AWS AWSEC2 documentation change
Summary
Removed IAM prerequisites section for STIG downloads and added new STIG version information for 2026 Q1 release (Linux and Windows)
Security assessment
The change removes IAM policy documentation for accessing STIG downloads, which could impact security configuration guidance, but doesn't address a specific vulnerability. It adds documentation for new STIG versions (RHEL 10, Windows Server 2025) and updated security benchmarks, which are security compliance features. No evidence of addressing a specific security incident.
Diff
diff --git a/AWSEC2/latest/UserGuide/ec2-stig-downloads.md b/AWSEC2/latest/UserGuide/ec2-stig-downloads.md index 417f2aa02..4e937a2e4 100644 --- a//AWSEC2/latest/UserGuide/ec2-stig-downloads.md +++ b//AWSEC2/latest/UserGuide/ec2-stig-downloads.md @@ -5 +5 @@ -IAM prerequisites for STIG downloadsSTIG download bundle detailsLinux STIG version historyWindows STIG version history +STIG download bundle detailsLinux STIG version historyWindows STIG version history @@ -15,2 +14,0 @@ Amazon stores the script bundles in the EC2 Windows S3 `STIG` bucket in each AWS - * IAM prerequisites for STIG downloads - @@ -26,24 +23,0 @@ Amazon stores the script bundles in the EC2 Windows S3 `STIG` bucket in each AWS -## IAM prerequisites for STIG downloads - -The IAM role that you associate with your instance profile must have `s3:GetObject` permissions to download the script bundles from Amazon S3. You can add the following example policy to your instance profile role. - - - { - "Version": "2012-10-17", - "Statement": [ - { - "Sid": "DownloadSTIGScriptBundles", - "Effect": "Allow", - "Action": [ - "s3:GetObject" - ], - "Resource": [ - "arn:aws:s3:::aws-windows-downloads*/STIG/*.zip", - "arn:aws:s3:::aws-windows-downloads*/STIG/*.tgz" - ] - } - ] - } - -To add the STIG download policy example to your instance profile role as an inline policy, follow the [Update the permissions policy for a role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_update-role-permissions.html#id_roles_update-role-permissions-policy) process in the _AWS Identity and Access Management User Guide_. For more information about instance profile roles, see [Use instance profiles](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html). - @@ -113,0 +88,25 @@ This section logs version history for Linux script bundles that are updated quar +Added support for the RHEL 10 operating system and updated the following STIG versions and applied STIGS for the 2026 first quarter release for all compliance levels (low/medium/high): + +###### STIG-Build-Linux version 1.0.x + + * RHEL 8 STIG Version 2 Release 6 + + * RHEL 9 STIG Version 2 Release 7 + + * RHEL 10 STIG Version 1 Release 1 + + * Amazon Linux 2023 STIG Version 1 Release 2 + + * SLES 12 STIG Version 3 Release 4 + + * SLES 15 STIG Version 2 Release 6 + + * Ubuntu 20.04 STIG Version 2 Release 4 + + * Ubuntu 22.04 STIG Version 2 Release 7 + + * Ubuntu 24.04 STIG Version 1 Release 4 + + + + @@ -747 +746,22 @@ This section logs version history for Windows script bundles that are updated qu -### 2025 Q3 changes - 9/04/2025 (no changes): +Adding support for the Windows Server 2025 operating system and updated the following STIG versions and applied STIGS for the 2026 first quarter release for all compliance levels (low/medium/high): + +###### STIG-Build-Windows version 1.0.x + + * Windows Server 2025 STIG Version 1 Release 1 + + * Windows Server 2022 STIG Version 2 Release 7 + + * Windows Server 2019 STIG Version 3 Release 7 + + * Microsoft .NET Framework 4.0 STIG Version 2 Release 7 + + * Windows Firewall STIG Version 2 Release 2 + + * Internet Explorer 11 STIG Version 2 Release 6 + + * Microsoft Edge STIG Version 2 Release 4 (Windows Server 2022 and 2025 only) + + + + +There were no changes for Windows component STIGS for the 2025 fourth quarter release.