AWS securityhub: Add business criticality to Lambda function exposure impact traits
Summary
Adds a 'Business criticality' subsection and TOC entry, and updates the impact traits text to include business criticality of downstream resources reachable from a compromised Lambda function.
Security assessment
Documents that exposure findings for Lambda functions factor in the business criticality of resources reachable via the function's IAM principal, supporting blast-radius reduction. General security guidance, not a specific vulnerability fix.
Evidence
+The business criticality of the primary resource, set either by automation rules or by inference from the name and tags.
Diff
diff --git a/securityhub/latest/userguide/exposure-lambda-function.md b/securityhub/latest/userguide/exposure-lambda-function.md index c30855f..b26278f 100644 --- a//securityhub/latest/userguide/exposure-lambda-function.md +++ b//securityhub/latest/userguide/exposure-lambda-function.md @@ -82,0 +83,2 @@ The remediation guidance provided in this topic might require additional consult + * [Business criticality](./exposure-lambda-function.html#business-criticality) + @@ -190 +192 @@ Afterwards, deploy the updated version. For instructions, see [Deploying Lambda -Impact traits describe the potential blast radius of an exposure. Security Hub analyzes the effective permissions of the AWS Identity and Access Management principal associated with the Lambda function to determine the downstream resources an attacker could reach if the function is compromised. Each impact trait identifies a specific privilege escalation pattern. To reduce your blast radius, review the permission paths described in each trait and remove any unnecessary privileges. +Impact traits describe the potential blast radius of an exposure. Security Hub analyzes the effective permissions of the AWS Identity and Access Management principal associated with the Lambda function to determine the downstream resources an attacker could reach if the function is compromised, as well as the business criticality of those resources. Each impact trait identifies a specific privilege escalation pattern. To reduce your blast radius, review the permission paths described in each trait and remove any unnecessary privileges. @@ -257,0 +260,4 @@ The associated principal has a privilege escalation path that advances its overa +### Business criticality + +The business criticality of the primary resource, set either by automation rules or by inference from the name and tags. +