AWS securityhub documentation change

Service: securityhub · 2026-02-19 · Documentation low

File: securityhub/latest/userguide/fsbp-standard.md

Summary

Added new AWS Foundational Security Best Practices controls: APIGateway.10 (HTTPS for private API integrations), ELB.21/22 (encrypted health checks/transport), RDS.50 (backup retention), and SageMaker.9-15 (traffic encryption and network isolation)

Security assessment

The changes document new security controls for encryption, network isolation, and backup retention. While these are security enhancements, there's no evidence they address specific vulnerabilities or incidents. They appear to be proactive best practice additions.

Diff

diff --git a/securityhub/latest/userguide/fsbp-standard.md b/securityhub/latest/userguide/fsbp-standard.md
index 4c9f4e988..ff02ad888 100644
--- a//securityhub/latest/userguide/fsbp-standard.md
+++ b//securityhub/latest/userguide/fsbp-standard.md
@@ -36,0 +37,2 @@ The following list specifies which AWS Security Hub CSPM controls apply to the A
+[[APIGateway.10] API Gateway V2 integrations should use HTTPS for private connections ](./apigateway-controls.html#apigateway-10)
+
@@ -338,0 +341,4 @@ The following list specifies which AWS Security Hub CSPM controls apply to the A
+[[ELB.21] Application and Network Load Balancer target groups should use encrypted health check protocols](./elb-controls.html#elb-21)
+
+[[ELB.22] ELB target groups should use encrypted transport protocols](./elb-controls.html#elb-22)
+
@@ -588,0 +595,2 @@ The following list specifies which AWS Security Hub CSPM controls apply to the A
+[[RDS.50] RDS for MySQL RDS DB clusters should have enough backup retention period set](./rds-controls.html#rds-50)
+
@@ -654,0 +663,14 @@ The following list specifies which AWS Security Hub CSPM controls apply to the A
+[[SageMaker.9] SageMaker data quality job definitions should have inter-container traffic encryption enabled](./sagemaker-controls.html#sagemaker-9)
+
+[[SageMaker.10] SageMaker model explainability job definitions should have inter-container traffic encryption enabled](./sagemaker-controls.html#sagemaker-10)
+
+[[SageMaker.11] SageMaker data quality job definitions should have network isolation enabled](./sagemaker-controls.html#sagemaker-11)
+
+[[SageMaker.12] SageMaker model bias job definitions should have network isolation enabled](./sagemaker-controls.html#sagemaker-12)
+
+[[SageMaker.13] SageMaker model quality job definitions should have inter-container traffic encryption enabled](./sagemaker-controls.html#sagemaker-13)
+
+[[SageMaker.14] SageMaker monitoring schedules should have network isolation enabled](./sagemaker-controls.html#sagemaker-14)
+
+[[SageMaker.15] SageMaker model bias job definitions should have inter-container traffic encryption enabled](./sagemaker-controls.html#sagemaker-15)
+