Change log for Security Hub controls - Amazon Security Hub
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Change log for Security Hub controls

The following change log tracks material changes to existing Amazon Security Hub security controls, which may result in changes to the overall status of a control and the compliance status of its findings. For information about how Security Hub evaluates control status, see Compliance status and control status. Changes may take a few days after their entry in this log to affect all Amazon Web Services Regions in which the control is available.

This log tracks changes occurring since April 2023.

Select a control to view more details about it. Title changes are noted on each control's detailed description for 90 days.

Date of change Control ID and title Description of change
June 25, 2024 [Config.1] Amazon Config should be enabled and use the service-linked role for resource recording This control checks whether Amazon Config is enabled, uses the service-linked role, and records resources for enabled controls. Security Hub updated the control title to reflect what the control evaluates.
June 14, 2024 [RDS.34] Aurora MySQL DB clusters should publish audit logs to CloudWatch Logs This control checks whether an Amazon Aurora MySQL DB cluster is configured to publish audit logs to Amazon CloudWatch Logs. Security Hub updated the control so that it doesn't generate findings for Aurora Serverless v1 DB clusters.
June 10, 2024 [Config.1] Amazon Config should be enabled and use the service-linked role for resource recording This control checks whether Amazon Config is enabled and Amazon Config resource recording is turned on. Previously, the control produced a PASSED finding only if you configured recording for all resources. Security Hub updated the control to produce a PASSED finding when recording is turned on for resources that are required for enabled controls. The control has also been updated to check whether the Amazon Config service-linked role is used, which provides permissions to record necessary resources.
May 8, 2024 [S3.20] S3 general purpose buckets should have MFA delete enabled This control checks whether an Amazon S3 general purpose versioned bucket has multi-factor authentication (MFA) delete enabled. Previously, the control produced a FAILED finding for buckets that have a Lifecycle configuration. However, MFA delete with versioning can't be enabled on a bucket that has a Lifecycle configuration. Security Hub updated the control to produce no findings for buckets that have a Lifecycle configuration. The control description has been updated to reflect the current behavior.
May 2, 2024 [EKS.2] EKS clusters should run on a supported Kubernetes version Security Hub updated the oldest supported version of Kubernetes that the Amazon EKS cluster can run on to produce a passed finding. The current oldest supported version is Kubernetes 1.26.
April 30, 2024 [CloudTrail.3] At least one CloudTrail trail should be enabled Changed control title from CloudTrail should be enabled to At least one CloudTrail trail should be enabled. This control currently produces a PASSED finding if an Amazon Web Services account has at least one CloudTrail trail enabled. The title and description have been changed to accurately reflect the current behavior.
April 29, 2024 [AutoScaling.1] Auto Scaling groups associated with a load balancer should use ELB health checks Changed control title from Auto Scaling groups associated with a Classic Load Balancer should use load balancer health checks to Auto Scaling groups associated with a load balancer should use ELB health checks. This control currently evaluates Application, Gateway, Network, and Classic Load Balancers. The title and description have been changed to accurately reflect the current behavior.
April 19, 2024 [CloudTrail.1] CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events The control checks whether Amazon CloudTrail is enabled and configured with at least one multi-Region trail that includes read and write management events. Previously, the control incorrectly generated PASSED findings when an account had CloudTrail enabled and configured with at least one multi-Region trail, even if no trail captured read and write management events. The control now generates a PASSED finding only when CloudTrail is enabled and configured with at least one multi-Region trail that captures read and write management events.
April 10, 2024 [Athena.1] Athena workgroups should be encrypted at rest Security Hub retired this control and removed it from all standards. Athena workgroups send logs to Amazon Simple Storage Service (Amazon S3) buckets. Amazon S3 now provides default encryption with S3 managed keys (SS3-S3) on new and existing S3 buckets.
April 10, 2024 [AutoScaling.4] Auto Scaling group launch configuration should not have a metadata response hop limit greater than 1 Security Hub retired this control and removed it from all standards. Metadata response hop limits for Amazon Elastic Compute Cloud (Amazon EC2) instances are workload dependent.
April 10, 2024 [CloudFormation.1] CloudFormation stacks should be integrated with Simple Notification Service (SNS) Security Hub retired this control and removed it from all standards. Integrating Amazon CloudFormation stacks with Amazon SNS topics is no longer a security best practice. Though integrating important CloudFormation stacks with SNS topics can be useful, it is not required for all stacks.
April 10, 2024 [CodeBuild.5] CodeBuild project environments should not have privileged mode enabled Security Hub retired this control and removed it from all standards. Enabling privileged mode in a CodeBuild project does not impose an additional risk to the customer environment.
April 10, 2024 [IAM.20] Avoid the use of the root user Security Hub retired this control and removed it from all standards. The purpose of this control is covered by another control, [CloudWatch.1] A log metric filter and alarm should exist for usage of the "root" user.
April 10, 2024 [SNS.2] Logging of delivery status should be enabled for notification messages sent to a topic Security Hub retired this control and removed it from all standards. Logging delivery status for SNS topics is no longer a security best practice. Though logging delivery status for important SNS topics can be useful, it is not required for all topics.
April 10, 2024 [S3.10] S3 general purpose buckets with versioning enabled should have Lifecycle configurations Security Hub removed this control from Amazon Foundational Security Best Practices and Service-Managed Standard: Amazon Control Tower. The purpose of this control is covered by two other controls: [S3.13] S3 general purpose buckets should have Lifecycle configurations and [S3.14] S3 general purpose buckets should have versioning enabled. This control is still part of NIST SP 800-53 Rev. 5.
April 10, 2024 [S3.11] S3 general purpose buckets should have event notifications enabled Security Hub removed this control from Amazon Foundational Security Best Practices and Service-Managed Standard: Amazon Control Tower. Though there are some cases where event notifications for S3 buckets are useful, this not a universal security best practice. This control is still part of NIST SP 800-53 Rev. 5.
April 10, 2024 [SNS.1] SNS topics should be encrypted at-rest using Amazon KMS Security Hub removed this control from Amazon Foundational Security Best Practices and Service-Managed Standard: Amazon Control Tower. Since SNS already encrypts topics by default, using Amazon KMS to encrypt topics is no longer recommended as a security best practice. This control is still part of NIST SP 800-53 Rev. 5.
April 8, 2024 [ELB.6] Application, Gateway, and Network Load Balancers should have deletion protection enabled Changed control title from Application Load Balancer deletion protection should be enabled to Application, Gateway, and Network Load Balancers should have deletion protection enabled. This control currently evaluates Application, Gateway, and Network Load Balancers. The title and description have been changed to accurately reflect the current behavior.
March 22, 2024 [Opensearch.8] Connections to OpenSearch domains should be encrypted using the latest TLS security policy Changed control title from Connections to OpenSearch domains should be encrypted using TLS 1.2 to Connections to OpenSearch domains should be encrypted using the latest TLS security policy. Previously, the control only checked whether connections to OpenSearch domains used TLS 1.2. The control now produces a PASSED finding if OpenSearch domains are encrypted using the latest TLS security policy. The control title and description have been updated to reflect the current behavior.
March 22, 2024 [ES.8] Connections to Elasticsearch domains should be encrypted using the latest TLS security policy Changed control title from Connections to Elasticsearch domains should be encrypted using TLS 1.2 to Connections to Elasticsearch domains should be encrypted using the latest TLS security policy. Previously, the control only checked whether connections to Elasticsearch domains used TLS 1.2. The control now produces a PASSED finding if Elasticsearch domains are encrypted using the latest TLS security policy. The control title and description have been updated to reflect the current behavior.
March 12, 2024 [S3.1] S3 general purpose buckets should have block public access settings enabled Changed title from S3 Block Public Access setting should be enabled to S3 general purpose buckets should have block public access settings enabled. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.2] S3 general purpose buckets should block public read access Changed title from S3 buckets should prohibit public read access to S3 general purpose buckets should block public read access. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.3] S3 general purpose buckets should block public write access Changed title from S3 buckets should prohibit public write access to S3 general purpose buckets should block public write access. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.5] S3 general purpose buckets should require requests to use SSL Changed title from S3 buckets should require requests to use Secure Socket Layer to S3 general purpose buckets should require requests to use SSL. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.6] S3 general purpose bucket policies should restrict access to other Amazon Web Services accounts Changed title from S3 permissions granted to other Amazon Web Services accounts in bucket policies should be restricted to S3 general purpose bucket policies should restrict access to other Amazon Web Services accounts. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.7] S3 general purpose buckets should use cross-Region replication Changed title from S3 buckets should have cross-Region replication enabled to S3 general purpose buckets should use cross-Region replication. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.7] S3 general purpose buckets should use cross-Region replication Changed title from S3 buckets should have cross-Region replication enabled to S3 general purpose buckets should use cross-Region replication. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.8] S3 general purpose buckets should block public access Changed title from S3 Block Public Access setting should be enabled at the bucket-level to S3 general purpose buckets should block public access. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.9] S3 general purpose buckets should have server access logging enabled Changed title from S3 bucket server access logging should be enabled to Server access logging should be enabled for S3 general purpose buckets. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.10] S3 general purpose buckets with versioning enabled should have Lifecycle configurations Changed title from S3 buckets with versioning enabled should have lifecycle policies configured to S3 general purpose buckets with versioning enabled should have Lifecycle configurations. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.11] S3 general purpose buckets should have event notifications enabled Changed title from S3 buckets should have event notifications enabled to S3 general purpose buckets should have event notifications enabled. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.12] ACLs should not be used to manage user access to S3 general purpose buckets Changed title from S3 access control lists (ACLs) should not be used to manage user access to buckets to ACLs should not be used to manage user access to S3 general purpose buckets. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.13] S3 general purpose buckets should have Lifecycle configurations Changed title from S3 buckets should have lifecycle policies configured to S3 general purpose buckets should have Lifecycle configurations. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.14] S3 general purpose buckets should have versioning enabled Changed title from S3 buckets should use versioning to S3 general purpose buckets should have versioning enabled. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.15] S3 general purpose buckets should have Object Lock enabled Changed title from S3 buckets should be configured to use Object Lock to S3 general purpose buckets should have Object Lock enabled. Security Hub changed the title to account for a new S3 bucket type.
March 12, 2024 [S3.17] S3 general purpose buckets should be encrypted at rest with Amazon KMS keys Changed title from S3 buckets should be encrypted at rest with Amazon KMS keys to S3 general purpose buckets should be encrypted at rest with Amazon KMS keys. Security Hub changed the title to account for a new S3 bucket type.
March 7, 2024 [Lambda.2] Lambda functions should use supported runtimes Lambda.2 checks whether the Amazon Lambda function settings for runtimes match the expected values set for the supported runtimes in each language. Security Hub now supports nodejs20.x and ruby3.3 as a parameter.
February 22, 2024 [Lambda.2] Lambda functions should use supported runtimes Lambda.2 checks whether the Amazon Lambda function settings for runtimes match the expected values set for the supported runtimes in each language. Security Hub now supports dotnet8 as a parameter.
February 5, 2024 [EKS.2] EKS clusters should run on a supported Kubernetes version Security Hub updated the oldest supported version of Kubernetes that the Amazon EKS cluster can run on to produce a passed finding. The current oldest supported version is Kubernetes 1.25.
January 10, 2024 [CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials Changed title from CodeBuild GitHub or Bitbucket source repository URLs should use OAuth to CodeBuild Bitbucket source repository URLs should not contain sensitive credentials. Security Hub removed mention of OAuth because other connection methods can also be secure. Security Hub removed mention of GitHub because it's no longer possible to have a personal access token or username and password in GitHub source repository URLs.
January 8, 2024 [Lambda.2] Lambda functions should use supported runtimes Lambda.2 checks whether the Amazon Lambda function settings for runtimes match the expected values set for the supported runtimes in each language. Security Hub no longer supports go1.x and java8 as parameters because these are retired runtimes.
December 29, 2023 [RDS.8] RDS DB instances should have deletion protection enabled RDS.8 checks whether an Amazon RDS DB instance that uses one of the supported database engines has deletion protection enabled. Security Hub now supports custom-oracle-ee, oracle-ee-cdb, and oracle-se2-cdb as database engines.
December 22, 2023 [Lambda.2] Lambda functions should use supported runtimes Lambda.2 checks whether the Amazon Lambda function settings for runtimes match the expected values set for the supported runtimes in each language. Security Hub now supports java21 and python3.12 as parameters. Security Hub no longer supports ruby2.7 as a parameter.
December 15, 2023 [CloudFront.1] CloudFront distributions should have a default root object configured CloudFront.1 checks whether an Amazon CloudFront distribution has a default root object configured. Security Hub lowered the severity of this control from CRITICAL to HIGH because adding the default root object is a recommendation that depends on a user's application and specific requirements.
December 5, 2023 [EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22 Changed control title from Security groups should not allow ingress from 0.0.0.0/0 to port 22 to Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22.
December 5, 2023 [EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389 Changed control title from Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389 to Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389.
December 5, 2023 [RDS.9] RDS DB instances should publish logs to CloudWatch Logs Changed control title from Database logging should be enabled to RDS DB instances should publish logs to CloudWatch Logs. Security Hub identified that this control only checks whether logs are published to Amazon CloudWatch Logs and doesn't check whether RDS logs are enabled. The control produces a PASSED finding if RDS DB instances are configured to publish logs to CloudWatch Logs. The control title has been updated to reflect the current behavior.
November 17, 2023 [EC2.19] Security groups should not allow unrestricted access to ports with high risk EC2.19 checks whether unrestricted incoming traffic for a security group is accessible to the specified ports that are considered to be high risk. Security Hub updated this control to account for managed prefix lists when they are supplied as the source for a security group rule. The control produces a FAILED finding if the prefix lists contain the strings '0.0.0.0/0' or '::/0'.
November 16, 2023 [CloudWatch.15] CloudWatch alarms should have specified actions configured Changed control title from CloudWatch alarms should have an action configured for the ALARM state to CloudWatch alarms should have specified actions configured.
November 16, 2023 [CloudWatch.16] CloudWatch log groups should be retained for a specified time period Changed control title from CloudWatch log groups should be retained for at least 1 year to CloudWatch log groups should be retained for a specified time period.
November 16, 2023 [Lambda.5] VPC Lambda functions should operate in multiple Availability Zones Changed control title from VPC Lambda functions should operate in more than one Availability Zone to VPC Lambda functions should operate in multiple Availability Zones.
November 16, 2023 [AppSync.2] Amazon AppSync should have field-level logging enabled Changed control title from Amazon AppSync should have request-level and field-level logging turned on to Amazon AppSync should have field-level logging enabled.
November 16, 2023 [EMR.1] Amazon EMR cluster primary nodes should not have public IP addresses Changed control title from Amazon Elastic MapReduce cluster master nodes should not have public IP addresses to Amazon EMR cluster primary nodes should not have public IP addresses.
November 16, 2023 [Opensearch.2] OpenSearch domains should not be publicly accessible Changed control title from OpenSearch domains should be in a VPC to OpenSearch domains should not be publicly accessible.
November 16, 2023 [ES.2] Elasticsearch domains should not be publicly accessible Changed control title from Elasticsearch domains should be in a VPC to Elasticsearch domains should not be publicly accessible.
October 31, 2023 [ES.4] Elasticsearch domain error logging to CloudWatch Logs should be enabled ES.4 checks whether Elasticsearch domains are configured to send error logs to Amazon CloudWatch Logs. The control previously produced a PASSED finding for an Elasticsearch domain that has any logs configured to send to CloudWatch Logs. Security Hub updated the control to produce a PASSED finding only for an Elasticsearch domain that is configured to send error logs to CloudWatch Logs. The control was also updated to exclude Elasticsearch versions that don’t support error logs from evaluation.
October 16, 2023 [EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22 EC2.13 checks whether security groups allow unrestricted ingress access to port 22. Security Hub updated this control to account for managed prefix lists when they are supplied as the source for a security group rule. The control produces a FAILED finding if the prefix lists contain the strings '0.0.0.0/0' or '::/0'.
October 16, 2023 [EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389 EC2.14 checks whether security groups allow unrestricted ingress access to port 3389. Security Hub updated this control to account for managed prefix lists when they are supplied as the source for a security group rule. The control produces a FAILED finding if the prefix lists contain the strings '0.0.0.0/0' or '::/0'.
October 16, 2023 [EC2.18] Security groups should only allow unrestricted incoming traffic for authorized ports EC2.18 checks whether the security groups that are in use allow unrestricted incoming traffic. Security Hub updated this control to account for managed prefix lists when they are supplied as the source for a security group rule. The control produces a FAILED finding if the prefix lists contain the strings '0.0.0.0/0' or '::/0'.
October 16, 2023 [Lambda.2] Lambda functions should use supported runtimes Lambda.2 checks whether the Amazon Lambda function settings for runtimes match the expected values set for the supported runtimes in each language. Security Hub now supports python3.11 as a parameter.
October 4, 2023 [S3.7] S3 general purpose buckets should use cross-Region replication Security Hub added the parameter ReplicationType with a value of CROSS-REGION to ensure that S3 buckets have cross-Region replication enabled rather than same-Region replication.
September 27, 2023 [EKS.2] EKS clusters should run on a supported Kubernetes version Security Hub updated the oldest supported version of Kubernetes that the Amazon EKS cluster can run on to produce a passed finding. The current oldest supported version is Kubernetes 1.24.
September 20, 2023 CloudFront.2 – CloudFront distributions should have origin access identity enabled Security Hub retired this control and removed it from all standards. Instead, see [CloudFront.13] CloudFront distributions should use origin access control. Origin access control is the current security best practice. This control will be removed from documentation in 90 days.
September 20, 2023 [EC2.22] Unused Amazon EC2 security groups should be removed Security Hub removed this control from Amazon Foundational Security Best Practices (FSBP) and National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5. It is still part of Service-Managed Standard: Amazon Control Tower. This control produces a passed finding if security groups are attached to EC2 instances or to an elastic network interface. However, for certain use cases, unattached security groups don't pose a security risk. You can use other EC2 controls—such as EC2.2, EC2.13, EC2.14, EC2.18, and EC2.19—to monitor your security groups.
September 20, 2023 EC2.29 – EC2 instances should be launched in a VPC Security Hub retired this control and removed it from all standards. Amazon EC2 has migrated EC2-Classic instances to a VPC. This control will be removed from documentation in 90 days.
September 20, 2023 S3.4 – S3 buckets should have server-side encryption enabled Security Hub retired this control and removed it from all standards. Amazon S3 now provides default encryption with S3 managed keys (SS3-S3) on new and existing S3 buckets. The encryption settings are unchanged for existing buckets that are encrypted with SS3-S3 or SS3-KMS server-side encryption. This control will be removed from documentation in 90 days.
September 14, 2023 [EC2.2] VPC default security groups should not allow inbound or outbound traffic Changed control title from The VPC default security group should not allow inbound and outbound traffic to VPC default security groups should not allow inbound or outbound traffic.
September 14, 2023 [IAM.9] MFA should be enabled for the root user Changed control title from Virtual MFA should be enabled for the root user to MFA should be enabled for the root user.

September 14, 2023

 [RDS.19] Existing RDS event notification subscriptions should be configured for critical cluster events Changed control title from An RDS event notifications subscription should be configured for critical cluster events to Existing RDS event notification subscriptions should be configured for critical cluster events.
September 14, 2023 [RDS.20] Existing RDS event notification subscriptions should be configured for critical database instance events Changed control title from An RDS event notifications subscription should be configured for critical database instance events to Existing RDS event notification subscriptions should be configured for critical database instance events.
September 14, 2023 [WAF.2] Amazon WAF Classic Regional rules should have at least one condition Changed control title from A WAF Regional rule should have at least one condition to Amazon WAF Classic Regional rules should have at least one condition.
September 14, 2023 [WAF.3] Amazon WAF Classic Regional rule groups should have at least one rule Changed control title from A WAF Regional rule group should have at least one rule to Amazon WAF Classic Regional rule groups should have at least one rule.
September 14, 2023 [WAF.4] Amazon WAF Classic Regional web ACLs should have at least one rule or rule group Changed control title from A WAF Regional web ACL should have at least one rule or rule group to Amazon WAF Classic Regional web ACLs should have at least one rule or rule group.
September 14, 2023 [WAF.6] Amazon WAF Classic global rules should have at least one condition Changed control title from A WAF global rule should have at least one condition to Amazon WAF Classic global rules should have at least one condition.
September 14, 2023 [WAF.7] Amazon WAF Classic global rule groups should have at least one rule Changed control title from A WAF global rule group should have at least one rule to Amazon WAF Classic global rule groups should have at least one rule.
September 14, 2023 [WAF.8] Amazon WAF Classic global web ACLs should have at least one rule or rule group Changed control title from A WAF global web ACL should have at least one rule or rule group to Amazon WAF Classic global web ACLs should have at least one rule or rule group.
September 14, 2023 [WAF.10] Amazon WAF web ACLs should have at least one rule or rule group Changed control title from A WAFv2 web ACL should have at least one rule or rule group to Amazon WAF web ACLs should have at least one rule or rule group.
September 14, 2023 [WAF.11] Amazon WAF web ACL logging should be enabled Changed control title from Amazon WAFv2 web ACL logging should be activated to Amazon WAF web ACL logging should be enabled.

July 20, 2023

 S3.4 – S3 buckets should have server-side encryption enabled S3.4 checks whether an Amazon S3 bucket either has server-side encryption enabled or that the S3 bucket policy explicitly denies PutObject requests without server-side encryption. Security Hub updated this control to include dual-layer server side encryption with KMS keys (DSSE-KMS). The control produces a passed finding when an S3 bucket is encrypted with SSE-S3, SSE-KMS, or DSSE-KMS.
July 17, 2023 [S3.17] S3 general purpose buckets should be encrypted at rest with Amazon KMS keys S3.17 checks whether an Amazon S3 bucket is encrypted with an Amazon KMS key. Security Hub updated this control to include dual-layer server side encryption with KMS keys (DSSE-KMS). The control produces a passed finding when an S3 bucket is encrypted with SSE-KMS or DSSE-KMS.
June 9, 2023 [EKS.2] EKS clusters should run on a supported Kubernetes version EKS.2 checks whether an Amazon EKS cluster is running on a supported Kubernetes version.The oldest supported version is now 1.23.
June 9, 2023 [Lambda.2] Lambda functions should use supported runtimes Lambda.2 checks whether the Amazon Lambda function settings for runtimes match the expected values set for the supported runtimes in each language. Security Hub now supports ruby3.2 as a parameter.
June 5, 2023 [APIGateway.5] API Gateway REST API cache data should be encrypted at rest APIGateway.5.checks whether all methods in Amazon API Gateway REST API stages are encrypted at rest. Security Hub updated the control to evaluate the encryption of a particular method only when caching is enabled for that method.
May 18, 2023 [Lambda.2] Lambda functions should use supported runtimes Lambda.2 checks whether the Amazon Lambda function settings for runtimes match the expected values set for the supported runtimes in each language. Security Hub now supports java17 as a parameter.
May 18, 2023 [Lambda.2] Lambda functions should use supported runtimes Lambda.2 checks whether the Amazon Lambda function settings for runtimes match the expected values set for the supported runtimes in each language. Security Hub no longer supports nodejs12.x as a parameter.
April 23, 2023 [ECS.10] ECS Fargate services should run on the latest Fargate platform version ECS.10 checks whether Amazon ECS Fargate services are running the latest Fargate platform version. Customers can deploy Amazon ECS through ECS directly, or by using CodeDeploy. Security Hub updated this control to produce Passed findings when you use CodeDeploy to deploy ECS Fargate services.
April 20, 2023 [S3.6] S3 general purpose bucket policies should restrict access to other Amazon Web Services accounts S3.6 checks whether an Amazon Simple Storage Service (Amazon S3) bucket policy prevents principals from other Amazon Web Services accounts from performing denied actions on resources in the S3 bucket. Security Hub updated the control to account for conditionals in a bucket policy.
April 18, 2023 [Lambda.2] Lambda functions should use supported runtimes Lambda.2 checks whether the Amazon Lambda function settings for runtimes match the expected values set for the supported runtimes in each language. Security Hub now supports python3.10 as a parameter.
April 18, 2023 [Lambda.2] Lambda functions should use supported runtimes Lambda.2 checks whether the Amazon Lambda function settings for runtimes match the expected values set for the supported runtimes in each language. Security Hub no longer supports dotnetcore3.1 as a parameter.
April 17, 2023 [RDS.11] RDS instances should have automatic backups enabled RDS.11 checks whether Amazon RDS instances have automated backups enabled, with a backup retention period that's greater than or equal to seven days. Security Hub updated this control to exclude read replicas from evaluation, as not all engines support automated backups on read replicas. Additionally, RDS doesn’t provide the option to specify a backup retention period when creating read replicas. Read replicas are created with a backup retention period of 0 by default.