AWS security-ir documentation change
Summary
Clarified regional setup and organization-wide coverage of delegated administrator account for AWS Security Incident Response, including best practice recommendations about not using the management account.
Security assessment
The changes provide clarifications about how the delegated administrator account works across regions and emphasize security best practices (principle of least privilege) regarding account selection. No evidence of a specific security vulnerability being addressed.
Diff
diff --git a/security-ir/latest/userguide/considerations_important.md b/security-ir/latest/userguide/considerations_important.md index 447ebb17f..3ba666669 100644 --- a//security-ir/latest/userguide/considerations_important.md +++ b//security-ir/latest/userguide/considerations_important.md @@ -9 +9 @@ The following considerations and recommendations can help you understand how a d -**A delegated Security Incident Response administrator account is regional.** +**Delegated administrator account for AWS Security Incident Response.** @@ -12 +12 @@ The following considerations and recommendations can help you understand how a d -The delegated Security Incident Response administrator account and member accounts must be added through AWS Organizations. +You can designate one member account as the delegated Security Incident Response administrator account. For example, if you designate a member account `111122223333` in `Europe (Ireland)`, you can't designate another member account `555555555555` in `Canada (Central)`. It is required that you use the same account as delegated Security Incident Response administrator account in all other Regions. @@ -14 +14 @@ The delegated Security Incident Response administrator account and member accoun -**Delegated administrator account for AWS Security Incident Response.** +**You set up your delegated Security Incident Response administrator account in a specific AWS Region.** @@ -17 +17 @@ The delegated Security Incident Response administrator account and member accoun -You may designate one member account as the delegated Security Incident Response administrator account. For example, if you designate a member account `111122223333` in `Europe (Ireland)`, you can't designate another member account `555555555555` in `Canada (Central)`. It is required that you use the same account as delegated Security Incident Response administrator account in all other Regions. +You designate a delegated Security Incident Response administrator account in one AWS Region during the initial setup. Although the setup is regional, AWS Security Incident Response provides organization-wide coverage across all supported AWS Regions. Security findings from Amazon GuardDuty and AWS Security Hub CSPM are ingested from all supported AWS Regions, and cases are centrally managed in the Region where you activated your subscription. The delegated Security Incident Response administrator account and member accounts must be added through AWS Organizations. @@ -19 +19 @@ You may designate one member account as the delegated Security Incident Response -**It is not recommended to set your organization's management as the delegated Security Incident Response administrator account.** +**It's not recommended to set your organization's management account as the delegated Security Incident Response administrator account.** @@ -22 +22 @@ You may designate one member account as the delegated Security Incident Response -Your organization's management can be the delegated Security Incident Response administrator account. However, the AWS security best practices follow the principle of least privilege and doesn't recommend this configuration. +Your organization's management account can be the delegated Security Incident Response administrator account. However, the AWS security best practices follow the principle of least privilege and does't recommend this configuration. @@ -27 +27 @@ Your organization's management can be the delegated Security Incident Response a -If you remove a delegated Security Incident Response administrator account, AWS Security Incident Response removes all the member accounts associated with this delegated Security Incident Response administrator account. AWS Security Incident Response will not longer be enabled for all these member accounts. +If you remove a delegated Security Incident Response administrator account, AWS Security Incident Response removes all the member accounts associated with this delegated Security Incident Response administrator account. AWS Security Incident Response will no longer be enabled for all the member accounts.