AWS prescriptive-guidance documentation change
Summary
Enhanced control descriptions with specific implementation guidance (e.g., 'Block public access to Lambda functions', 'Restrict default security group').
Security assessment
Adds detailed security documentation for infrastructure hardening but does not indicate remediation of a specific security issue.
Diff
diff --git a/prescriptive-guidance/latest/security-controls-by-caf-capability/infrastructure-controls.md b/prescriptive-guidance/latest/security-controls-by-caf-capability/infrastructure-controls.md index 43932db38..2541139cf 100644 --- a//prescriptive-guidance/latest/security-controls-by-caf-capability/infrastructure-controls.md +++ b//prescriptive-guidance/latest/security-controls-by-caf-capability/infrastructure-controls.md @@ -7 +7 @@ -CloudFront default root objectsScan application codeCreate network layersUse only authorized portsPublic access to Systems Manager documentsPublic access to Lambda functionsUpdate default security groupScan for vulnerabilities and network exposureSet up AWS WAFAdvanced protections against DDoS attacksControl network traffic +Specify default root objects for CloudFront distributionsScan application code to identify common security issuesCreate network layers by using dedicated VPCs and subnetsRestrict incoming traffic to only authorized portsBlock public access to Systems Manager documentsBlock public access to Lambda functionsRestrict inbound and outbound traffic in the default security groupScan for software vulnerabilities and unintended network exposureSet up AWS WAFConfigure advanced protections against DDoS attacksUse a defense-in-depth approach to control network traffic @@ -13 +13 @@ Infrastructure protection is a key part of any security program. It includes con -###### Controls in this section: +Controls in this section: