AWS securityhub documentation change

Service: securityhub · 2026-02-28 · Documentation high

File: securityhub/latest/userguide/fsbp-standard.md

Summary

Added new AWS Security Hub CSPM controls: APIGateway.10 (HTTPS for API Gateway V2 private connections), ELB.21/ELB.22 (encrypted health checks and transport for ELB), RDS.50 (MySQL backup retention), and multiple SageMaker controls (inter-container encryption and network isolation for jobs).

Security assessment

The changes document new security best practices for encryption in transit, network isolation, and backup retention. These are preventive measures rather than fixes for disclosed vulnerabilities. No explicit mention of CVEs, incidents, or patched weaknesses in the diff.

Diff

diff --git a/securityhub/latest/userguide/fsbp-standard.md b/securityhub/latest/userguide/fsbp-standard.md
index 4c9f4e988..5db97236b 100644
--- a//securityhub/latest/userguide/fsbp-standard.md
+++ b//securityhub/latest/userguide/fsbp-standard.md
@@ -36,0 +37,2 @@ The following list specifies which AWS Security Hub CSPM controls apply to the A
+[[APIGateway.10] API Gateway V2 integrations should use HTTPS for private connections](./apigateway-controls.html#apigateway-10)
+
@@ -338,0 +341,4 @@ The following list specifies which AWS Security Hub CSPM controls apply to the A
+[[ELB.21] Application and Network Load Balancer target groups should use encrypted health check protocols](./elb-controls.html#elb-21)
+
+[[ELB.22] ELB target groups should use encrypted transport protocols](./elb-controls.html#elb-22)
+
@@ -588,0 +595,2 @@ The following list specifies which AWS Security Hub CSPM controls apply to the A
+[[RDS.50] RDS for MySQL RDS DB clusters should have enough backup retention period set](./rds-controls.html#rds-50)
+
@@ -654,0 +663,14 @@ The following list specifies which AWS Security Hub CSPM controls apply to the A
+[[SageMaker.9] SageMaker data quality job definitions should have inter-container traffic encryption enabled](./sagemaker-controls.html#sagemaker-9)
+
+[[SageMaker.10] SageMaker model explainability job definitions should have inter-container traffic encryption enabled](./sagemaker-controls.html#sagemaker-10)
+
+[[SageMaker.11] SageMaker data quality job definitions should have network isolation enabled](./sagemaker-controls.html#sagemaker-11)
+
+[[SageMaker.12] SageMaker model bias job definitions should have network isolation enabled](./sagemaker-controls.html#sagemaker-12)
+
+[[SageMaker.13] SageMaker model quality job definitions should have inter-container traffic encryption enabled](./sagemaker-controls.html#sagemaker-13)
+
+[[SageMaker.14] SageMaker monitoring schedules should have network isolation enabled](./sagemaker-controls.html#sagemaker-14)
+
+[[SageMaker.15] SageMaker model bias job definitions should have inter-container traffic encryption enabled](./sagemaker-controls.html#sagemaker-15)
+