AWS securityhub high security documentation change
Summary
Added multiple new controls to the list of unsupported controls across various AWS regions. New controls include BedrockAgentCore (1-6), SageMaker (16-19), EC2.183, RDS.51, EKS.9, and APIGateway.11.
Security assessment
The added controls explicitly address security configurations: encryption requirements (KMS keys), network isolation (VPC configurations), authentication requirements, and protocol security (IKEv2). These directly mitigate risks like data exposure, unauthorized access, and insecure network communications.
Diff
diff --git a/securityhub/latest/userguide/regions-controls.md b/securityhub/latest/userguide/regions-controls.md index 477335945..25d7000c0 100644 --- a//securityhub/latest/userguide/regions-controls.md +++ b//securityhub/latest/userguide/regions-controls.md @@ -221,0 +222,12 @@ The following controls are not supported in the US West (N. California) Region. + * [[BedrockAgentCore.1] Bedrock AgentCore runtimes should be configured with VPC network mode](./bedrockagentcore-controls.html#bedrockagentcore-1) + + * [[BedrockAgentCore.2] Bedrock AgentCore Gateways should require authorization for inbound requests](./bedrockagentcore-controls.html#bedrockagentcore-2) + + * [[BedrockAgentCore.3] Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-3) + + * [[BedrockAgentCore.4] Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-4) + + * [[BedrockAgentCore.5] Bedrock AgentCore custom browsers should not use public network mode](./bedrockagentcore-controls.html#bedrockagentcore-5) + + * [[BedrockAgentCore.6] Bedrock AgentCore custom browsers should have session recording enabled](./bedrockagentcore-controls.html#bedrockagentcore-6) + @@ -366,0 +379,2 @@ The following controls are not supported in the US West (Oregon) Region. + * [[BedrockAgentCore.3] Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-3) + @@ -433,0 +448,12 @@ The following controls are not supported in the Africa (Cape Town) Region. + * [[BedrockAgentCore.1] Bedrock AgentCore runtimes should be configured with VPC network mode](./bedrockagentcore-controls.html#bedrockagentcore-1) + + * [[BedrockAgentCore.2] Bedrock AgentCore Gateways should require authorization for inbound requests](./bedrockagentcore-controls.html#bedrockagentcore-2) + + * [[BedrockAgentCore.3] Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-3) + + * [[BedrockAgentCore.4] Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-4) + + * [[BedrockAgentCore.5] Bedrock AgentCore custom browsers should not use public network mode](./bedrockagentcore-controls.html#bedrockagentcore-5) + + * [[BedrockAgentCore.6] Bedrock AgentCore custom browsers should have session recording enabled](./bedrockagentcore-controls.html#bedrockagentcore-6) + @@ -648,0 +675,12 @@ The following controls are not supported in the Asia Pacific (Hong Kong) Region. + * [[BedrockAgentCore.1] Bedrock AgentCore runtimes should be configured with VPC network mode](./bedrockagentcore-controls.html#bedrockagentcore-1) + + * [[BedrockAgentCore.2] Bedrock AgentCore Gateways should require authorization for inbound requests](./bedrockagentcore-controls.html#bedrockagentcore-2) + + * [[BedrockAgentCore.3] Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-3) + + * [[BedrockAgentCore.4] Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-4) + + * [[BedrockAgentCore.5] Bedrock AgentCore custom browsers should not use public network mode](./bedrockagentcore-controls.html#bedrockagentcore-5) + + * [[BedrockAgentCore.6] Bedrock AgentCore custom browsers should have session recording enabled](./bedrockagentcore-controls.html#bedrockagentcore-6) + @@ -829,0 +868,12 @@ The following controls are not supported in the Asia Pacific (Hyderabad) Region. + * [[BedrockAgentCore.1] Bedrock AgentCore runtimes should be configured with VPC network mode](./bedrockagentcore-controls.html#bedrockagentcore-1) + + * [[BedrockAgentCore.2] Bedrock AgentCore Gateways should require authorization for inbound requests](./bedrockagentcore-controls.html#bedrockagentcore-2) + + * [[BedrockAgentCore.3] Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-3) + + * [[BedrockAgentCore.4] Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-4) + + * [[BedrockAgentCore.5] Bedrock AgentCore custom browsers should not use public network mode](./bedrockagentcore-controls.html#bedrockagentcore-5) + + * [[BedrockAgentCore.6] Bedrock AgentCore custom browsers should have session recording enabled](./bedrockagentcore-controls.html#bedrockagentcore-6) + @@ -1195,0 +1246,8 @@ The following controls are not supported in the Asia Pacific (Hyderabad) Region. + * [[SageMaker.16] SageMaker models should use private registry in VPC for primary containers](./sagemaker-controls.html#sagemaker-16) + + * [[SageMaker.17] SageMaker feature group offline stores should be encrypted with AWS KMS keys](./sagemaker-controls.html#sagemaker-17) + + * [[SageMaker.18] SageMaker feature group online stores with standard storage should be encrypted with AWS KMS keys](./sagemaker-controls.html#sagemaker-18) + + * [[SageMaker.19] SageMaker models should use private registry in VPC for multi-container inference pipelines](./sagemaker-controls.html#sagemaker-19) + @@ -1256,0 +1315,12 @@ The following controls are not supported in the Asia Pacific (Jakarta) Region. + * [[BedrockAgentCore.1] Bedrock AgentCore runtimes should be configured with VPC network mode](./bedrockagentcore-controls.html#bedrockagentcore-1) + + * [[BedrockAgentCore.2] Bedrock AgentCore Gateways should require authorization for inbound requests](./bedrockagentcore-controls.html#bedrockagentcore-2) + + * [[BedrockAgentCore.3] Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-3) + + * [[BedrockAgentCore.4] Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-4) + + * [[BedrockAgentCore.5] Bedrock AgentCore custom browsers should not use public network mode](./bedrockagentcore-controls.html#bedrockagentcore-5) + + * [[BedrockAgentCore.6] Bedrock AgentCore custom browsers should have session recording enabled](./bedrockagentcore-controls.html#bedrockagentcore-6) + @@ -1520,0 +1591,4 @@ The following controls are not supported in the Asia Pacific (Jakarta) Region. + * [[SageMaker.16] SageMaker models should use private registry in VPC for primary containers](./sagemaker-controls.html#sagemaker-16) + + * [[SageMaker.19] SageMaker models should use private registry in VPC for multi-container inference pipelines](./sagemaker-controls.html#sagemaker-19) + @@ -1613,0 +1688,12 @@ The following controls are not supported in the Asia Pacific (Malaysia) Region. + * [[BedrockAgentCore.1] Bedrock AgentCore runtimes should be configured with VPC network mode](./bedrockagentcore-controls.html#bedrockagentcore-1) + + * [[BedrockAgentCore.2] Bedrock AgentCore Gateways should require authorization for inbound requests](./bedrockagentcore-controls.html#bedrockagentcore-2) + + * [[BedrockAgentCore.3] Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-3) + + * [[BedrockAgentCore.4] Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-4) + + * [[BedrockAgentCore.5] Bedrock AgentCore custom browsers should not use public network mode](./bedrockagentcore-controls.html#bedrockagentcore-5) + + * [[BedrockAgentCore.6] Bedrock AgentCore custom browsers should have session recording enabled](./bedrockagentcore-controls.html#bedrockagentcore-6) + @@ -1795,0 +1882,2 @@ The following controls are not supported in the Asia Pacific (Malaysia) Region. + * [[EC2.183] EC2 VPN connections should use IKEv2 protocol](./ec2-controls.html#ec2-183) + @@ -2177,0 +2266,2 @@ The following controls are not supported in the Asia Pacific (Malaysia) Region. + * [[RDS.51] RDS global clusters should run on a supported Aurora MySQL version](./rds-controls.html#rds-51) + @@ -2257,0 +2348,8 @@ The following controls are not supported in the Asia Pacific (Malaysia) Region. + * [[SageMaker.16] SageMaker models should use private registry in VPC for primary containers](./sagemaker-controls.html#sagemaker-16) + + * [[SageMaker.17] SageMaker feature group offline stores should be encrypted with AWS KMS keys](./sagemaker-controls.html#sagemaker-17) + + * [[SageMaker.18] SageMaker feature group online stores with standard storage should be encrypted with AWS KMS keys](./sagemaker-controls.html#sagemaker-18) + + * [[SageMaker.19] SageMaker models should use private registry in VPC for multi-container inference pipelines](./sagemaker-controls.html#sagemaker-19) + @@ -2350,0 +2449,12 @@ The following controls are not supported in the Asia Pacific (Melbourne) Region. + * [[BedrockAgentCore.1] Bedrock AgentCore runtimes should be configured with VPC network mode](./bedrockagentcore-controls.html#bedrockagentcore-1) + + * [[BedrockAgentCore.2] Bedrock AgentCore Gateways should require authorization for inbound requests](./bedrockagentcore-controls.html#bedrockagentcore-2) + + * [[BedrockAgentCore.3] Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-3) + + * [[BedrockAgentCore.4] Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-4) + + * [[BedrockAgentCore.5] Bedrock AgentCore custom browsers should not use public network mode](./bedrockagentcore-controls.html#bedrockagentcore-5) + + * [[BedrockAgentCore.6] Bedrock AgentCore custom browsers should have session recording enabled](./bedrockagentcore-controls.html#bedrockagentcore-6) + @@ -2738,0 +2849,8 @@ The following controls are not supported in the Asia Pacific (Melbourne) Region. + * [[SageMaker.16] SageMaker models should use private registry in VPC for primary containers](./sagemaker-controls.html#sagemaker-16) + + * [[SageMaker.17] SageMaker feature group offline stores should be encrypted with AWS KMS keys](./sagemaker-controls.html#sagemaker-17) + + * [[SageMaker.18] SageMaker feature group online stores with standard storage should be encrypted with AWS KMS keys](./sagemaker-controls.html#sagemaker-18) + + * [[SageMaker.19] SageMaker models should use private registry in VPC for multi-container inference pipelines](./sagemaker-controls.html#sagemaker-19) + @@ -2896,0 +3015,2 @@ The following controls are not supported in the Asia Pacific (New Zealand) Regio + * [[APIGateway.11] API Gateway domain names should use recommended security policies](./apigateway-controls.html#apigateway-11) + @@ -2952,0 +3073,12 @@ The following controls are not supported in the Asia Pacific (New Zealand) Regio + * [[BedrockAgentCore.1] Bedrock AgentCore runtimes should be configured with VPC network mode](./bedrockagentcore-controls.html#bedrockagentcore-1) + + * [[BedrockAgentCore.2] Bedrock AgentCore Gateways should require authorization for inbound requests](./bedrockagentcore-controls.html#bedrockagentcore-2) + + * [[BedrockAgentCore.3] Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-3) + + * [[BedrockAgentCore.4] Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-4) + + * [[BedrockAgentCore.5] Bedrock AgentCore custom browsers should not use public network mode](./bedrockagentcore-controls.html#bedrockagentcore-5) + + * [[BedrockAgentCore.6] Bedrock AgentCore custom browsers should have session recording enabled](./bedrockagentcore-controls.html#bedrockagentcore-6) + @@ -3138,0 +3271,2 @@ The following controls are not supported in the Asia Pacific (New Zealand) Regio + * [[EC2.183] EC2 VPN connections should use IKEv2 protocol](./ec2-controls.html#ec2-183) + @@ -3196,0 +3331,2 @@ The following controls are not supported in the Asia Pacific (New Zealand) Regio + * [[EKS.9] EKS node groups should run on a supported Kubernetes version](./eks-controls.html#eks-9) + @@ -3560,0 +3697,2 @@ The following controls are not supported in the Asia Pacific (New Zealand) Regio + * [[RDS.51] RDS global clusters should run on a supported Aurora MySQL version](./rds-controls.html#rds-51) + @@ -3654,0 +3793,8 @@ The following controls are not supported in the Asia Pacific (New Zealand) Regio + * [[SageMaker.16] SageMaker models should use private registry in VPC for primary containers](./sagemaker-controls.html#sagemaker-16) + + * [[SageMaker.17] SageMaker feature group offline stores should be encrypted with AWS KMS keys](./sagemaker-controls.html#sagemaker-17) + + * [[SageMaker.18] SageMaker feature group online stores with standard storage should be encrypted with AWS KMS keys](./sagemaker-controls.html#sagemaker-18) + + * [[SageMaker.19] SageMaker models should use private registry in VPC for multi-container inference pipelines](./sagemaker-controls.html#sagemaker-19) + @@ -3743,0 +3890,12 @@ The following controls are not supported in the Asia Pacific (Osaka) Region. + * [[BedrockAgentCore.1] Bedrock AgentCore runtimes should be configured with VPC network mode](./bedrockagentcore-controls.html#bedrockagentcore-1) + + * [[BedrockAgentCore.2] Bedrock AgentCore Gateways should require authorization for inbound requests](./bedrockagentcore-controls.html#bedrockagentcore-2) + + * [[BedrockAgentCore.3] Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-3) + + * [[BedrockAgentCore.4] Bedrock AgentCore Gateway should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-4) + + * [[BedrockAgentCore.5] Bedrock AgentCore custom browsers should not use public network mode](./bedrockagentcore-controls.html#bedrockagentcore-5) + + * [[BedrockAgentCore.6] Bedrock AgentCore custom browsers should have session recording enabled](./bedrockagentcore-controls.html#bedrockagentcore-6) + @@ -3929,0 +4088,4 @@ The following controls are not supported in the Asia Pacific (Osaka) Region. + * [[SageMaker.16] SageMaker models should use private registry in VPC for primary containers](./sagemaker-controls.html#sagemaker-16) + + * [[SageMaker.19] SageMaker models should use private registry in VPC for multi-container inference pipelines](./sagemaker-controls.html#sagemaker-19) + @@ -3964,0 +4127,2 @@ The following controls are not supported in the Asia Pacific (Seoul) Region. + * [[BedrockAgentCore.3] Bedrock AgentCore Memory should be encrypted with customer managed AWS KMS keys](./bedrockagentcore-controls.html#bedrockagentcore-3) + @@ -4054,0 +4219,2 @@ The following controls are not supported in the Asia Pacific (Seoul) Region. + * [[SageMaker.19] SageMaker models should use private registry in VPC for multi-container inference pipelines](./sagemaker-controls.html#sagemaker-19) + @@ -4247,0 +4414,2 @@ The following controls are not supported in the Asia Pacific (Taipei) Region. + * [[APIGateway.11] API Gateway domain names should use recommended security policies](./apigateway-controls.html#apigateway-11) + @@ -4313,0 +4482,12 @@ The following controls are not supported in the Asia Pacific (Taipei) Region. + * [[BedrockAgentCore.1] Bedrock AgentCore runtimes should be configured with VPC network mode](./bedrockagentcore-controls.html#bedrockagentcore-1) +