AWS awssupport documentation change
Summary
Updated exclusion process documentation for Security Hub controls integrated with Trusted Advisor. Clarified that exclusions can be managed via Trusted Advisor console and API, replacing previous instructions about mandatory Security Hub CSPM usage.
Security assessment
The change documents improved resource exclusion capabilities for security checks. While it enhances security management by providing more exclusion options (console + API), there's no evidence of addressing a specific vulnerability. It adds security documentation about operational processes.
Diff
diff --git a/awssupport/latest/user/security-hub-controls-with-trusted-advisor.md b/awssupport/latest/user/security-hub-controls-with-trusted-advisor.md index c6ed377a5..56f3ad2c7 100644 --- a//awssupport/latest/user/security-hub-controls-with-trusted-advisor.md +++ b//awssupport/latest/user/security-hub-controls-with-trusted-advisor.md @@ -91 +91 @@ For **Source** , you can choose **AWS Security Hub CSPM** to filter for Security - * You must use Security Hub CSPM to exclude resources from your findings. Currently, you can't use the Trusted Advisor console to exclude items from Security Hub CSPM controls. For more information, see [Setting the workflow status for findings](https://docs.aws.amazon.com/securityhub/latest/userguide/finding-workflow-status.html). + * Results for these checks are automatically refreshed at least once daily, and refresh requests are not allowed. It might take a few hours for changes to appear. You can use the Trusted Advisor console to exclude resources from checks that automatically refresh. You can use the [BatchUpdateRecommendationResourceExclusion](https://docs.aws.amazon.com/trustedadvisor/latest/APIReference/API_BatchUpdateRecommendationResourceExclusion.html) API to exclude resources from any check except Trusted Advisor Priority recommendation resources. @@ -112 +112 @@ After you enable a security standard, it can take up to two hours for Security H - * You must use Security Hub CSPM if you want to exclude resources from your findings. Currently, you can't use the Trusted Advisor console to exclude items from Security Hub CSPM controls. For more information, see [Setting the workflow status for findings](https://docs.aws.amazon.com/securityhub/latest/userguide/finding-workflow-status.html). + * Results for these checks are automatically refreshed at least once daily, and refresh requests are not allowed. It might take a few hours for changes to appear. You can use the Trusted Advisor console to exclude resources from checks that automatically refresh. You can use the [BatchUpdateRecommendationResourceExclusion](https://docs.aws.amazon.com/trustedadvisor/latest/APIReference/API_BatchUpdateRecommendationResourceExclusion.html) API to exclude resources from any check except Trusted Advisor Priority recommendation resources.