AWS systems-manager: Explorer Security Hub CSPM integration setup and trusted access steps revised
Summary
Rewrites the Explorer integration setup for Security Hub CSPM: clarifies that OpsItems are created for Critical severity findings by default (with other levels configurable), restructures prerequisites into labeled steps for management, member, and delegated administrator accounts, and adds instructions for enabling OpsData Sync trusted access in AWS Organizations (console Enable access button or CLI) plus a note for accounts not in an organization.
Security assessment
The only security-relevant content is the documented enabling of AWS Organizations trusted access for the opsdatasync.ssm.amazonaws.com service principal so Security Hub CSPM findings can be surfaced as OpsItems; this is operational guidance for a security-findings workflow, not a fix for a specific vulnerability, CVE, or incident, and it neither weakens nor strengthens a control beyond the documented trusted access grant. Severity is low because the change is procedural documentation/wording with no exploitable defect described.
Evidence
+ aws organizations enable-aws-service-access --service-principal opsdatasync.ssm.amazonaws.com
Diff
diff --git a/systems-manager/latest/userguide/explorer-securityhub-integration.md b/systems-manager/latest/userguide/explorer-securityhub-integration.md index 81c6890d1..5fdde7145 100644 --- a//systems-manager/latest/userguide/explorer-securityhub-integration.md +++ b//systems-manager/latest/userguide/explorer-securityhub-integration.md @@ -30 +30 @@ Before you continue, read about OpsCenter integration with Security Hub CSPM. Th -Explorer receives [all findings](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-integration-types.html#securityhub-cwe-integration-types-all-findings) from Security Hub CSPM. You can see all findings based on severity in the Explorer widget when you turn on the Security Hub CSPM default settings. By default, Explorer creates OpsItems for critical and high severity findings. You can manually configure Explorer to create OpsItems for medium and low severity findings. +Explorer receives [all findings](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-integration-types.html#securityhub-cwe-integration-types-all-findings) from Security Hub CSPM. You can see all findings based on severity in the Explorer widget when you turn on the Security Hub CSPM default settings. By default, Explorer creates OpsItems for Critical severity findings. You can manually configure Explorer to create OpsItems for other severity levels (High, Medium, and Low). @@ -44 +44 @@ Complete the following tasks before you configure Explorer to start receiving Se - * Log into the AWS Organizations management account. Systems Manager requires access to AWS Organizations to create OpsItems from Security Hub CSPM findings. After you log in to the management account, you're prompted to select the **Enable access** button on the Explorer **Configure dashboard** tab, as described in the following procedure. If you don't log in to the AWS Organizations management account, you can't allow access and Explorer can't create OpsItems from Security Hub CSPM findings. + * Log in to the AWS Organizations management account. Systems Manager requires access to AWS Organizations to create OpsItems from Security Hub CSPM findings. After you log in to the management account, you can enable this access from the Explorer **Configure dashboard** tab, as described in the following procedure. If the **Enable access** button is not shown, trusted access is already enabled. If you don't log in to the AWS Organizations management account, you can't allow access and Explorer can't create OpsItems from Security Hub CSPM findings. @@ -48,0 +49,4 @@ Complete the following tasks before you configure Explorer to start receiving Se +###### Note + +If your account isn't part of an organization in AWS Organizations, you don't need to enable OpsData Sync trusted access. The management account requirement described in this section doesn't apply. Enable AWS Security Hub CSPM in each AWS Region where you want to receive findings, and then, on the Explorer **Configure dashboard** tab, turn on the **OpsItems created by Security Hub CSPM findings** toggle. + @@ -51 +55 @@ Complete the following tasks before you configure Explorer to start receiving Se - 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). + 1. (management account) Enable AWS Security Hub CSPM in each AWS Region where you want to receive findings. For more information, see [Setting up Security Hub CSPM](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-settingup.html) in the _AWS Security Hub User Guide_. @@ -53 +57,11 @@ Complete the following tasks before you configure Explorer to start receiving Se - 2. In the navigation pane, choose **Explorer**. + 2. (management account) Enable OpsData Sync trusted access for AWS Organizations. You must enable trusted access before you can turn on the management account's own OpsData source in step 3. Steps 4 and 5, for member and delegated administrator accounts, don't depend on trusted access. Choose one of the following options: + + * In Explorer, on the **Configure dashboard** tab, under the **OpsItems created by Security Hub CSPM findings** section, choose the **Enable access** button. + + * Run the following command by using the AWS CLI. + + aws organizations enable-aws-service-access --service-principal opsdatasync.ssm.amazonaws.com + +###### Note + +If you are signed in to the management account and the **Enable access** button is not shown, trusted access is already enabled. To confirm, run the following command. @@ -55 +69 @@ Complete the following tasks before you configure Explorer to start receiving Se - 3. Select **Settings**. + aws organizations list-aws-service-access-for-organization @@ -57 +71 @@ Complete the following tasks before you configure Explorer to start receiving Se - 4. Select the **Configure dashboard** tab. +###### Note @@ -59 +73 @@ Complete the following tasks before you configure Explorer to start receiving Se - 5. Select **AWS Security Hub CSPM**. +The **Enable access** alert also appears in the **Create resource data sync** wizard, a common entry point from the management account. @@ -61 +75 @@ Complete the following tasks before you configure Explorer to start receiving Se - 6. Select the **Disabled** slider to turn on **AWS Security Hub CSPM**. + 3. (management account, optional) Complete this step only if you also want findings from the management account itself. Turn on the **OpsItems created by Security Hub CSPM findings** toggle. By default, Explorer creates OpsItems for Critical severity findings, and you can configure it to create OpsItems for additional severity levels. @@ -63 +77 @@ Complete the following tasks before you configure Explorer to start receiving Se -Critical and high severity findings are displayed by default. To display medium and low severity findings, select the **Disabled** slider next to **Medium,Low**. + 4. (Each member or delegated administrator account) Enable AWS Security Hub CSPM in the relevant AWS Region. @@ -65 +79 @@ Critical and high severity findings are displayed by default. To display medium - 7. In the **OpsItems created by Security Hub CSPM findings** section, choose **Enable access**. If you don't see this button, log in to the AWS Organizations management account and return to this page to select the button. + 5. (Each member or delegated administrator account) Turn on the **OpsItems created by Security Hub CSPM findings** toggle. These accounts can complete this step at any time, with no dependency on step 2\. If you create an organization-scoped resource data sync in Explorer from the management account (that is, a sync whose source is the entire organization or specific organizational units), this OpsData source is enabled automatically for all member accounts in the sync.