AWS securityhub documentation change

Service: securityhub · 2026-01-13 · Documentation low

File: securityhub/latest/userguide/controls-change-log.md

Summary

Added three entries to the change log: updated Redshift.4 control parameters, retired MQ.3 control, and added dotnet10 support to Lambda.2 control.

Security assessment

Changes reflect routine updates to security controls (parameter removal, control retirement, runtime support addition) without evidence of addressing vulnerabilities. Retirement of MQ.3 is due to service requirements, not security flaws.

Diff

diff --git a/securityhub/latest/userguide/controls-change-log.md b/securityhub/latest/userguide/controls-change-log.md
index 9e4d2c346..18c8d5786 100644
--- a//securityhub/latest/userguide/controls-change-log.md
+++ b//securityhub/latest/userguide/controls-change-log.md
@@ -12,0 +13,3 @@ Date of change | Control ID and title | Description of change
+January 12, 2026 | [[Redshift.4] Amazon Redshift clusters should have audit logging enabled](./redshift-controls.html#redshift-4) | Security Hub CSPM updated this control to remove the `loggingEnabled` parameter.  
+January 12, 2026 | [MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled | Security Hub CSPM retired the control and removed the control from all applicable standards. Security Hub CSPM retired the control due to Amazon MQ requirements for automatic minor version upgrades. Previously, the control applied to the [AWS Foundational Security Best Practices (FSBP) standard](https://docs.aws.amazon.com/securityhub/latest/userguide/fsbp-standard.html), the [NIST SP 800-53 Rev. 5 standard](https://docs.aws.amazon.com/securityhub/latest/userguide/nist-standard.html) and the [PCI DSS v4.0.1 standard](https://docs.aws.amazon.com/securityhub/latest/userguide/pci-standard.html).  
+January 12, 2026 | [[Lambda.2] Lambda functions should use supported runtimes](./lambda-controls.html#lambda-2) | This control checks whether the runtime settings for an AWS Lambda function match expected values for supported runtimes in each language. Security Hub CSPM now supports `dotnet10` as a parameter value for this control. AWS Lambda added support for this runtime.