AWS securityhub: Document business criticality in EC2 exposure impact traits
Summary
Adds a 'Business criticality' subsection and TOC entry, and updates the impact-traits description to state that Security Hub also considers the business criticality of downstream resources when assessing the blast radius of an exposed EC2 instance.
Security assessment
The change documents how Security Hub exposure findings factor in business criticality of reachable resources, supporting blast-radius/privilege-escalation triage. It is security-adjacent guidance rather than a fix for a specific vulnerability, so it is medium severity and not tied to a CVE.
Evidence
+The business criticality of the primary resource, set either by automation rules or by inference from the name and tags.
Diff
diff --git a/securityhub/latest/userguide/exposure-ec2-instance.md b/securityhub/latest/userguide/exposure-ec2-instance.md index c341be1..879c965 100644 --- a//securityhub/latest/userguide/exposure-ec2-instance.md +++ b//securityhub/latest/userguide/exposure-ec2-instance.md @@ -82,0 +83,2 @@ The remediation guidance provided in this topic might require additional consult + * [Business criticality](./exposure-ec2-instance.html#business-criticality) + @@ -237 +239 @@ To identify the specific Amazon Elastic Block Store (Amazon EBS) volume that has -Impact traits describe the potential blast radius of an exposure. Security Hub analyzes the effective permissions of the AWS Identity and Access Management principal associated with the EC2 instance to determine the downstream resources an attacker could reach if the instance is compromised. Each impact trait identifies a specific privilege escalation pattern. To reduce your blast radius, review the permission paths described in each trait and remove any unnecessary privileges. +Impact traits describe the potential blast radius of an exposure. Security Hub analyzes the effective permissions of the AWS Identity and Access Management principal associated with the EC2 instance to determine the downstream resources an attacker could reach if the instance is compromised, as well as the business criticality of those resources. Each impact trait identifies a specific privilege escalation pattern. To reduce your blast radius, review the permission paths described in each trait and remove any unnecessary privileges. @@ -304,0 +307,4 @@ The associated principal has a privilege escalation path that advances its overa +### Business criticality + +The business criticality of the primary resource, set either by automation rules or by inference from the name and tags. +