AWS securityhub: Add CRI Profile v2.2 mappings to KMS Security Hub controls
Summary
Multiple 'Related requirements' lines across the AWS KMS controls (IAM policy, key deletion, key rotation) were extended with CRI Profile v2.2 mappings covering access control, data protection, and key-management practices.
Security assessment
The diff only appends CRI Profile identifiers to existing KMS control requirement lists (including key rotation and key deletion controls); it does not alter the controls' security guidance, so impact is limited to compliance mapping metadata.
Evidence
+**Related requirements:** CRI Profile v2.2/PR.AA-01.02, CRI Profile v2.2/PR.AA-03.02, CRI Profile v2.2/PR.AA-05.01, CRI Profile v2.2/PR.PS-01.07
Diff
diff --git a/securityhub/latest/userguide/kms-controls.md b/securityhub/latest/userguide/kms-controls.md index 0974eb9..93e8e1a 100644 --- a//securityhub/latest/userguide/kms-controls.md +++ b//securityhub/latest/userguide/kms-controls.md @@ -15 +15 @@ These AWS Security Hub CSPM controls evaluate the AWS Key Management Service (AW -**Related requirements:** NIST.800-53.r5 AC-2, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(3) +**Related requirements:** NIST.800-53.r5 AC-2, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(3), CRI Profile v2.2/PR.AA-05.01, CRI Profile v2.2/PR.AA-05.02, CRI Profile v2.2/PR.PS-01.01, CRI Profile v2.2/PR.PS-01.03, CRI Profile v2.2/PR.PS-01.06 @@ -50 +50 @@ To modify an IAM customer managed policy, see [Editing customer managed policies -**Related requirements:** NIST.800-53.r5 AC-2, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(3) +**Related requirements:** NIST.800-53.r5 AC-2, NIST.800-53.r5 AC-2(1), NIST.800-53.r5 AC-3, NIST.800-53.r5 AC-3(15), NIST.800-53.r5 AC-3(7), NIST.800-53.r5 AC-5, NIST.800-53.r5 AC-6, NIST.800-53.r5 AC-6(3), CRI Profile v2.2/PR.AA-01.02, CRI Profile v2.2/PR.AA-03.02, CRI Profile v2.2/PR.AA-05.01, CRI Profile v2.2/PR.DS-01.01, CRI Profile v2.2/PR.PS-01.07 @@ -92 +92 @@ To modify an IAM inline policy, see [Editing inline policies](https://docs.aws.a -**Related requirements:** NIST.800-53.r5 SC-12, NIST.800-53.r5 SC-12(2) +**Related requirements:** NIST.800-53.r5 SC-12, NIST.800-53.r5 SC-12(2), CRI Profile v2.2/PR.DS-01.02, CRI Profile v2.2/PR.PS-01.07 @@ -120 +120 @@ To cancel a scheduled KMS key deletion, see **To cancel key deletion** under [Sc -**Related requirements:** CIS AWS Foundations Benchmark v5.0.0/3.6, CIS AWS Foundations Benchmark v3.0.0/3.6, CIS AWS Foundations Benchmark v1.4.0/3.8, CIS AWS Foundations Benchmark v1.2.0/2.8, NIST.800-53.r5 SC-12, NIST.800-53.r5 SC-12(2), NIST.800-53.r5 SC-28(3), PCI DSS v3.2.1/3.6.4, PCI DSS v4.0.1/3.7.4 +**Related requirements:** CIS AWS Foundations Benchmark v5.0.0/3.6, CIS AWS Foundations Benchmark v3.0.0/3.6, CIS AWS Foundations Benchmark v1.4.0/3.8, CIS AWS Foundations Benchmark v1.2.0/2.8, NIST.800-53.r5 SC-12, NIST.800-53.r5 SC-12(2), NIST.800-53.r5 SC-28(3), PCI DSS v3.2.1/3.6.4, PCI DSS v4.0.1/3.7.4, CRI Profile v2.2/PR.PS-01.06, CRI Profile v2.2/PR.PS-01.07 @@ -143,0 +144,2 @@ To enable KMS key rotation, see [How to enable and disable automatic key rotatio +**Related requirements:** CRI Profile v2.2/PR.AA-01.02, CRI Profile v2.2/PR.AA-03.02, CRI Profile v2.2/PR.AA-05.01, CRI Profile v2.2/PR.PS-01.07 +