Amazon Resource Tagging standard in Security Hub

The Amazon Resource Tagging standard, developed by Amazon Security Hub, helps you determine whether your Amazon resources are missing tags. Tags are key‐value pairs that act as metadata for organizing Amazon resources. With most Amazon resources, you have the option of adding tags to a resource when you create the resource or after you create the resource. Examples of resources include Amazon CloudFront distributions, Amazon Elastic Compute Cloud (Amazon EC2) instances, and secrets in Amazon Secrets Manager. Tags can help you manage, identify, organize, search for, and filter Amazon resources.

Each tag has two parts:

You can use tags to categorize resources by purpose, owner, environment, or other criteria. For information about adding tags to Amazon resources, see the Tagging Amazon Resources and Tag Editor User Guide.

For each control that applies to the Amazon Resource Tagging standard in Security Hub, you can optionally use the supported parameter to specify tag keys that you want the control to check for. If you don't specify any tag keys, the control checks only for the existence of at least one tag key, and fails if a resource doesn't have any tag keys.

Before you enable the Amazon Resource Tagging standard, it's important to first enable and configure resource recording in Amazon Config. When you configure resource recording, also be sure to enable it for all the types of Amazon resources that are checked by controls that apply to the standard. Otherwise, Security Hub might not be able to evaluate the appropriate resources, and generate accurate findings for controls that apply to the standard. For more information, including a list of the types of resources to record, see Required Amazon Config resources for control findings.

After you enable the Amazon Resource Tagging standard, you begin receiving findings for controls that apply to the standard. Note that it can take up to 18 hours for Security Hub to generate findings for controls that use the same Amazon Config service-linked rule as controls that apply to other enabled standards. For more information, see Schedule for running security checks.

The Amazon Resource Tagging standard has the following Amazon Resource Name (ARN): arn:aws-cn:securityhub:region::standards/aws-resource-tagging-standard/v/1.0.0. You can also use the GetEnabledStandards operation of the Security Hub API to find the ARN of an enabled standard.

Controls that apply to the standard

The following list specifies which Amazon Security Hub controls apply to the Amazon Resource Tagging standard (v1.0.0). To review the details of a control, choose the control.