AWS guidance documentation change
Summary
Added documentation for granular control over data collection scope
Security assessment
Enables security/compliance controls through exclusion lists but does not address an active vulnerability.
Diff
diff --git a/guidance/latest/cloud-intelligence-dashboards/data-collection-deployment.md b/guidance/latest/cloud-intelligence-dashboards/data-collection-deployment.md index c3fdbc7ec..42e5ca5c9 100644 --- a//guidance/latest/cloud-intelligence-dashboards/data-collection-deployment.md +++ b//guidance/latest/cloud-intelligence-dashboards/data-collection-deployment.md @@ -3 +3 @@ -Prerequisites for deploymentStep 1. [In Management Accounts] Deploy the Read Permissions stackStep 2. [In Data Collection Account] Deploy the Data Collection Stack +Prerequisites for deploymentStep 1. [In Management Accounts] Deploy the Read Permissions stackStep 2. [In Data Collection Account] Deploy the Data Collection StackStep 3. (Optional) [In Data Collection Account] Apply granular control over accounts, regions, and modules @@ -78,0 +79,6 @@ After deployment you can [check the execution state](./data-collection-utilize-d +## Step 3. (Optional) [In Data Collection Account] Apply granular control over accounts, regions, and modules + +In most cases, the Data Collection framework can be run as deployed, collecting data from all accounts in your Organization for all enabled modules and the regions defined during installation. However, in some scenarios you may need to limit certain modules to a subset of accounts, OUs, and/or regions — for example, excluding sandbox accounts from specific modules or restricting regional data collection for compliance reasons. + +For detailed instructions on configuring inclusion lists, exclusion lists, and per-module allow/deny rules, see [Granular Account and Region Control over Data Collection](./granular-data-collection-control.html). + @@ -87 +93 @@ Data Collection -Utilize Data +Granular Data Collection Control