AWS securityhub: Remove retired SNS.2 delivery status logging control
Summary
Deleted the entire SNS.2 control definition (logging of delivery status for SNS notification messages), including its NIST AU-2/AU-12 mappings, severity, Config rule, rationale and remediation section, and removed SNS.2 from the control list at the top of the page.
Security assessment
The change removes documentation for a logging/audit-related detection control that the page itself states was retired in April 2024; it reduces documented logging guidance rather than fixing a discovered vulnerability, so it is security-adjacent (audit/logging coverage) but not evidence of a specific security issue.
Evidence
-## [SNS.2] Logging of delivery status should be enabled for notification messages sent to a topic
Diff
diff --git a/securityhub/latest/userguide/sns-controls.md b/securityhub/latest/userguide/sns-controls.md index 44d597c..5c9edb3 100644 --- a//securityhub/latest/userguide/sns-controls.md +++ b//securityhub/latest/userguide/sns-controls.md @@ -7 +7 @@ -[SNS.1] SNS topics should be encrypted at-rest using AWS KMS[SNS.2] Logging of delivery status should be enabled for notification messages sent to a topic[SNS.3] SNS topics should be tagged[SNS.4] SNS topic access policies should not allow public access +[SNS.1] SNS topics should be encrypted at-rest using AWS KMS[SNS.3] SNS topics should be tagged[SNS.4] SNS topic access policies should not allow public access @@ -37,43 +36,0 @@ To enable SSE for an SNS topic, see [Enabling server-side encryption (SSE) for a -## [SNS.2] Logging of delivery status should be enabled for notification messages sent to a topic - -###### Important - -Security Hub CSPM retired this control in April 2024. For more information, see [Change log for Security Hub CSPM controls](./controls-change-log.html). - -**Related requirements:** NIST.800-53.r5 AU-12, NIST.800-53.r5 AU-2 - -**Category:** Identify > Logging - -**Severity:** Medium - -**Resource type:** `AWS::SNS::Topic` - -**AWS Config rule:** [`sns-topic-message-delivery-notification-enabled`](https://docs.aws.amazon.com/config/latest/developerguide/sns-topic-message-delivery-notification-enabled.html) - -**Schedule type:** Change triggered - -**Parameters:** None - -This control checks whether logging is enabled for the delivery status of notification messages sent to an Amazon SNS topic for the endpoints. This control fails if the delivery status notification for messages is not enabled. - -Logging is an important part of maintaining the reliability, availability, and performance of services. Logging message delivery status helps provide operational insights, such as the following: - - * Knowing whether a message was delivered to the Amazon SNS endpoint. - - - - - * Identifying the response sent from the Amazon SNS endpoint to Amazon SNS. - - - - - * Determining the message dwell time (the time between the publish timestamp and the hand off to an Amazon SNS endpoint). - - - - -### Remediation - -To configure delivery status logging for a topic, see [Amazon SNS message delivery status](https://docs.aws.amazon.com/sns/latest/dg/sns-topic-attributes.html) in the _Amazon Simple Notification Service Developer Guide_. -