AWS securityhub: Add business criticality to IAM user exposure impact traits
Summary
Adds a new 'Business criticality' subsection and TOC entry, and updates the impact traits description to note that Security Hub also considers the business criticality of downstream resources reachable from a compromised IAM user.
Security assessment
The change documents how Security Hub assesses blast radius and privilege-escalation paths for exposed IAM users, including business criticality of reachable resources. It is security guidance about exposure analysis rather than a fix for a specific vulnerability.
Evidence
+The business criticality of the primary resource, set either by automation rules or by inference from the name and tags.
Diff
diff --git a/securityhub/latest/userguide/exposure-iam-user.md b/securityhub/latest/userguide/exposure-iam-user.md index 89cbc81..417096e 100644 --- a//securityhub/latest/userguide/exposure-iam-user.md +++ b//securityhub/latest/userguide/exposure-iam-user.md @@ -72,0 +73,2 @@ IAM best practices recommend that you create IAM roles or use federation with an + * [Business criticality](./exposure-iam-user.html#business-criticality) + @@ -179 +181 @@ For unused permissions specifically, you can generate a least-privilege policy r -Impact traits describe the potential blast radius of an exposure. Security Hub analyzes the effective permissions of the AWS Identity and Access Management principal associated with the IAM user to determine the downstream resources an attacker could reach if the IAM user is compromised. Each impact trait identifies a specific privilege escalation pattern. To reduce your blast radius, review the permission paths described in each trait and remove any unnecessary privileges. +Impact traits describe the potential blast radius of an exposure. Security Hub analyzes the effective permissions of the AWS Identity and Access Management principal associated with the IAM user to determine the downstream resources an attacker could reach if the IAM user is compromised, as well as the business criticality of those resources. Each impact trait identifies a specific privilege escalation pattern. To reduce your blast radius, review the permission paths described in each trait and remove any unnecessary privileges. @@ -246,0 +249,4 @@ The associated principal has a privilege escalation path that advances its overa +### Business criticality + +The business criticality of the primary resource, set either by automation rules or by inference from the name and tags. +