AWS imagebuilder: CIS Benchmarks guidance now points to CIS hardening components
Summary
Replaces the paragraph describing Amazon Inspector-based CIS Benchmark assessments with guidance to subscribe to a CIS hardening component in AWS Marketplace and add it to an image recipe whose parent OS the component supports, noting container recipes don't support CIS hardening components. Also minor wording fix for recipe version links.
Security assessment
The change updates compliance/hardening guidance for CIS Benchmarks, directing users to CIS hardening components and clarifying that container recipes are unsupported. It is security-adjacent hardening documentation rather than a fix for a specific vulnerability, and no CVE or incident is cited.
Evidence
+For Center for Internet Security (CIS) Benchmarks, subscribe to a CIS hardening component in AWS Marketplace, and add it to an image recipe whose parent image runs an operating system that the component supports. Container recipes don't support CIS hardening components. For more information, see [CIS hardening components](./toe-cis.html).
Diff
diff --git a/imagebuilder/latest/userguide/how-image-builder-works.md b/imagebuilder/latest/userguide/how-image-builder-works.md index 6eba38e..1450b49 100644 --- a//imagebuilder/latest/userguide/how-image-builder-works.md +++ b//imagebuilder/latest/userguide/how-image-builder-works.md @@ -143 +143 @@ You can also use your AWS Organizations account to enforce limitations on member -To update your distribution settings using the Image Builder console, follow the steps to [Create a new image recipe version from the console](./create-image-recipes.html#create-image-recipe-version-console), or [Create a new container recipe version with the console](./create-container-recipes.html#create-container-recipe-version). +To update your distribution settings using the Image Builder console, follow the steps to [Create a new image recipe version in the console](./create-image-recipes.html#create-image-recipe-version-console), or [Create a new container recipe version in the console](./create-container-recipes.html#create-container-recipe-version). @@ -151 +151 @@ To share components, recipes, or images with other accounts or within AWS Organi -For Center for Internet Security (CIS) Benchmarks, EC2 Image Builder uses Amazon Inspector to perform assessments for exposure, vulnerabilities, and deviations from best practices and compliance standards. For example, Image Builder assesses unintended network accessibility, unpatched CVEs, public internet connectivity, and remote root login activation. Amazon Inspector is offered as a test component that you can choose to add to your image recipe. For more information about Amazon Inspector, see the _[Amazon Inspector](https://docs.aws.amazon.com/inspector/v1/userguide/inspector_introduction.html) User Guide_. For more information, see [Center for Internet Security (CIS) Benchmarks](https://docs.aws.amazon.com/inspector/latest/userguide/inspector_cis.html). +For Center for Internet Security (CIS) Benchmarks, subscribe to a CIS hardening component in AWS Marketplace, and add it to an image recipe whose parent image runs an operating system that the component supports. Container recipes don't support CIS hardening components. For more information, see [CIS hardening components](./toe-cis.html).