AWS securityhub: Clarify multi-account failure logic for Inspector scanning controls
Summary
Reworded the failure conditions for the Amazon Inspector EC2, ECR, Lambda code, and Lambda standard scanning controls so that in multi-account environments the control fails if the delegated administrator account OR any associated member account lacks scanning enabled (previously stated as the administrator and all member accounts).
Security assessment
The change corrects the boolean logic describing when a Security Hub vulnerability-scanning control fails, making clear that a single member account without Inspector scanning triggers a finding. This affects how operators interpret detection/vulnerability-management coverage, but it documents existing control behavior rather than fixing a specific vulnerability.
Evidence
+This control checks whether Amazon Inspector EC2 scanning is enabled. For a standalone account, the control fails if Amazon Inspector EC2 scanning is disabled in the account. In a multi-account environment, the control fails if the delegated Amazon Inspector administrator account or any associated member account doesn't have EC2 scanning enabled.
Diff
diff --git a/securityhub/latest/userguide/inspector-controls.md b/securityhub/latest/userguide/inspector-controls.md index 7b5ba39..126f8e7 100644 --- a//securityhub/latest/userguide/inspector-controls.md +++ b//securityhub/latest/userguide/inspector-controls.md @@ -31 +31 @@ These controls may not be available in all AWS Regions. For more information, se -This control checks whether Amazon Inspector EC2 scanning is enabled. For a standalone account, the control fails if Amazon Inspector EC2 scanning is disabled in the account. In a multi-account environment, the control fails if the delegated Amazon Inspector administrator account and all member accounts don't have EC2 scanning enabled. +This control checks whether Amazon Inspector EC2 scanning is enabled. For a standalone account, the control fails if Amazon Inspector EC2 scanning is disabled in the account. In a multi-account environment, the control fails if the delegated Amazon Inspector administrator account or any associated member account doesn't have EC2 scanning enabled. @@ -57 +57 @@ To enable Amazon Inspector EC2 scanning, see [Activating scans](https://docs.aws -This control checks whether Amazon Inspector ECR scanning is enabled. For a standalone account, the control fails if Amazon Inspector ECR scanning is disabled in the account. In a multi-account environment, the control fails if the delegated Amazon Inspector administrator account and all member accounts don't have ECR scanning enabled. +This control checks whether Amazon Inspector ECR scanning is enabled. For a standalone account, the control fails if Amazon Inspector ECR scanning is disabled in the account. In a multi-account environment, the control fails if the delegated Amazon Inspector administrator account or any associated member account doesn't have ECR scanning enabled. @@ -83 +83 @@ To enable Amazon Inspector ECR scanning, see [Activating scans](https://docs.aws -This control checks whether Amazon Inspector Lambda code scanning is enabled. For a standalone account, the control fails if Amazon Inspector Lambda code scanning is disabled in the account. In a multi-account environment, the control fails if the delegated Amazon Inspector administrator account and all member accounts don't have Lambda code scanning enabled. +This control checks whether Amazon Inspector Lambda code scanning is enabled. For a standalone account, the control fails if Amazon Inspector Lambda code scanning is disabled in the account. In a multi-account environment, the control fails if the delegated Amazon Inspector administrator account or any associated member account doesn't have Lambda code scanning enabled. @@ -109 +109 @@ To enable Amazon Inspector Lambda code scanning, see [Activating scans](https:// -This control checks whether Amazon Inspector Lambda standard scanning is enabled. For a standalone account, the control fails if Amazon Inspector Lambda standard scanning is disabled in the account. In a multi-account environment, the control fails if the delegated Amazon Inspector administrator account and all member accounts don't have Lambda standard scanning enabled. +This control checks whether Amazon Inspector Lambda standard scanning is enabled. For a standalone account, the control fails if Amazon Inspector Lambda standard scanning is disabled in the account. In a multi-account environment, the control fails if the delegated Amazon Inspector administrator account or any associated member account doesn't have Lambda standard scanning enabled.