AWS securityhub documentation change
Summary
Removed the [MQ.3] control entirely from documentation, including its description, requirements, and remediation guidance.
Security assessment
This removes documentation for a retired control. The change note indicates the control was retired earlier (January 2026) with no security justification provided in the diff. The removal is part of documentation maintenance.
Diff
diff --git a/securityhub/latest/userguide/mq-controls.md b/securityhub/latest/userguide/mq-controls.md index 41c1a4f70..356b27388 100644 --- a//securityhub/latest/userguide/mq-controls.md +++ b//securityhub/latest/userguide/mq-controls.md @@ -7 +7 @@ -[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch[MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled[MQ.4] Amazon MQ brokers should be tagged[MQ.5] ActiveMQ brokers should use active/standby deployment mode[MQ.6] RabbitMQ brokers should use cluster deployment mode +[MQ.2] ActiveMQ brokers should stream audit logs to CloudWatch[MQ.4] Amazon MQ brokers should be tagged[MQ.5] ActiveMQ brokers should use active/standby deployment mode[MQ.6] RabbitMQ brokers should use cluster deployment mode @@ -37,32 +36,0 @@ To stream ActiveMQ broker logs to CloudWatch Logs, see [ Configuring Amazon MQ f -## [MQ.3] Amazon MQ brokers should have automatic minor version upgrade enabled - -###### Important - -Security Hub CSPM retired this control in January 2026. For more information, see [Change log for Security Hub CSPM controls](./controls-change-log.html). - -**Related requirements:** NIST.800-53.r5 CM-3, NIST.800-53.r5 SI-2, PCI DSS v4.0.1/6.3.3 - -**Category:** Identify > Vulnerability, patch, and version management - -**Severity:** Medium - -**Resource type:** `AWS::AmazonMQ::Broker` - -**AWS Config rule:** [`mq-auto-minor-version-upgrade-enabled`](https://docs.aws.amazon.com/config/latest/developerguide/mq-auto-minor-version-upgrade-enabled.html) - -**Schedule type:** Change triggered - -**Parameters:** None - -This control checks whether an Amazon MQ broker has automatic minor version upgrade enabled. The control fails if the broker doesn't have automatic minor version upgrade enabled. - -As Amazon MQ releases and supports new broker engine versions, the changes are backward-compatible with an existing application and don't deprecate existing functionality. Automatic broker engine version updates protect you against security risks, help fix bugs, and improve functionality. - -###### Note - -When the broker associated with automatic minor version upgrade is on its latest patch and becomes unsupported, you must take manual action to upgrade. - -### Remediation - -To enable automatic minor version upgrade for an MQ broker, see [ Automatically upgrading the minor engine version](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/upgrading-brokers.html#upgrading-brokers-automatic-upgrades.html) in the _Amazon MQ Developer Guide_. -