AWS imagebuilder: Clarify CIS hardening component subscription and usage requirements
Summary
Rewrites the CIS hardening component description to explain that components enforce CIS Benchmarks Level 1, must be subscribed to in AWS Marketplace, added to an image recipe with a supported parent OS, and are not supported in container recipes, with a link to the subscription procedure.
Security assessment
The added text documents how to obtain and apply CIS Benchmark Level 1 hardening components, which is security best-practice/hardening guidance. It is not tied to a specific vulnerability or incident, so it is security documentation rather than a fix.
Evidence
+CIS hardening components run a script to enforce CIS Benchmarks Level 1 guidelines for your configuration. To use a CIS hardening component, subscribe to it in AWS Marketplace, and add it to an image recipe whose parent image runs an operating system that the component supports. Container recipes don't support CIS hardening components. To subscribe, see [Subscribe to AWS Marketplace components](./use-marketplace-components.html#use-marketplace-components-subscribe). The CIS organization owns and maintains CIS hardening components to ensure that they reflect the latest guidelines.
Diff
diff --git a/imagebuilder/latest/userguide/toe-cis.md b/imagebuilder/latest/userguide/toe-cis.md index cc30715..524e4d6 100644 --- a//imagebuilder/latest/userguide/toe-cis.md +++ b//imagebuilder/latest/userguide/toe-cis.md @@ -17 +17 @@ CIS creates and maintains a set of configuration guidelines, known as the CIS Be -When you subscribe to a CIS Hardened Image in AWS Marketplace, you also get access to the associated hardening component that runs a script to enforce CIS Benchmarks Level 1 guidelines for your configuration. The CIS organization owns and maintains CIS hardening components to ensure that they reflect the latest guidelines. +CIS hardening components run a script to enforce CIS Benchmarks Level 1 guidelines for your configuration. To use a CIS hardening component, subscribe to it in AWS Marketplace, and add it to an image recipe whose parent image runs an operating system that the component supports. Container recipes don't support CIS hardening components. To subscribe, see [Subscribe to AWS Marketplace components](./use-marketplace-components.html#use-marketplace-components-subscribe). The CIS organization owns and maintains CIS hardening components to ensure that they reflect the latest guidelines.