AWS Config recursos necessários para gerar resultados de controle - AWS Security Hub
AWS Config recursos necessários para todos os controlesRecursos necessários para o FSBP padrãoRecursos necessários para o CIS AWS Foundations BenchmarkRecursos necessários para NIST SP 800-53 Rev. 5Recursos necessários para a PCI DSS v3.2.1Recursos necessários para o AWS Resource Tagging StandardRecursos necessários para o Service-Managed Standard: AWS Control Tower

As traduções são geradas por tradução automática. Em caso de conflito entre o conteúdo da tradução e da versão original em inglês, a versão em inglês prevalecerá.

AWS Config recursos necessários para gerar resultados de controle

AWS Security Hub gera descobertas de controle executando verificações de segurança em relação aos controles do Security Hub. Alguns controles usam AWS Config regras que avaliam a conformidade com recursos específicos. Para que o Security Hub gere descobertas para controles que tenham um tipo de programação acionado por alteração, você deve ativar a gravação dos recursos necessários em AWS Config. Você não precisa registrar recursos para a maioria dos controles que têm um tipo de programação periódico. No entanto, alguns controles periódicos exigem o registro de recursos para detectar alterações na conformidade.

Esta página fornece uma lista dos recursos necessários em todos os padrões e uma lista dos recursos necessários divididos por padrão. A primeira tabela também lista quais controles do Security Hub usam cada recurso.

Se uma descoberta for gerada por uma verificação de segurança baseada em uma AWS Config regra, os detalhes da descoberta incluirão um link de Regras para a AWS Config regra associada. Para navegar até a AWS Config regra, sua conta deve ter AWS Identity and Access Management (IAM) permissões para visualizar AWS Config as regras.

nota

Regiões da AWS Quando um controle não está disponível, o recurso correspondente não está disponível em AWS Config. Para obter uma lista dos limites regionais nos controles do Security Hub, consulte Disponibilidade de controles por região.

AWS Config recursos necessários para todos os controles

Para que o Security Hub gere descobertas para controles ativados por alterações do Security Hub que usam uma AWS Config regra, você deve registrar esses recursos em AWS Config. Essa tabela também indica quais controles exigem um recurso específico. Um controle pode exigir mais do que um recurso.

Serviço Recurso necessário Controles relacionados
Amazon API Gateway AWS::ApiGateway::Stage

APIGateway.1

APIGateway.2

APIGateway.3

APIGateway.4

APIGateway5.
AWS::ApiGatewayV2::Stage

APIGateway.1

APIGateway9.
AWS AppSync AWS::AppSync::GraphQLApi

AppSync.2

AppSync.4

AppSync5.
AWS Backup (AWS Backup) AWS::Backup::BackupPlan

Backup.5
AWS::Backup::BackupVault

Backup.3
AWS::Backup::RecoveryPoint

Backup.1

Backup.2
AWS::Backup::ReportPlan

Backup.4
AWS Certificate Manager (ACM) AWS::ACM::Certificate

ACM.1

ACM.2

ACM.3
Amazon Athena AWS::Athena::DataCatalog Atena.2
AWS::Athena::WorkGroup

Atena.3
AWS CloudFormation AWS::CloudFormation::Stack

CloudFormation.2
Amazon CloudFront AWS::CloudFront::Distribution

CloudFront.1

CloudFront.3

CloudFront.4

CloudFront5.

CloudFront.6

CloudFront7.

CloudFront8.

CloudFront9.

CloudFront.10

CloudFront1.3

CloudFront1.4
AWS CloudTrail AWS::CloudTrail::Trail CloudTrail9.
Amazon CloudWatch AWS::CloudWatch::Alarm

CloudWatch1.5

CloudWatch1.7
AWS CodeArtifact AWS::CodeArtifact::Repository CodeArtifact.1
AWS CodeBuild AWS::CodeBuild::Project

CodeBuild.1

CodeBuild.2

CodeBuild.3

CodeBuild.4
Amazon Detective AWS::Detective::Graph Detetive.1
AWS Database Migration Service (AWS DMS) AWS::DMS::Certificate

DMS.2
AWS::DMS::Endpoint

DMS.9

DMS.10

DMS.11

DMS.12
AWS::DMS::EventSubscription DMS.3
AWS::DMS::ReplicationInstance

DMS.4

DMS.6
AWS::DMS::ReplicationSubnetGroup DMS5.
AWS::DMS::ReplicationTask

DMS7.

DMS8.
Amazon DynamoDB AWS::DynamoDB::Table

DynamoDB.1

DynamoDB.2

DynamoDB. 5

DynamoDB.6
Nuvem de computação elástica Amazon () EC2 AWS::EC2::ClientVpnEndpoint

EC25.1
AWS::EC2::CustomerGateway EC23.6
AWS::EC2::EIP

EC21.2

EC23.7
AWS::EC2::FlowLog EC24.8
AWS::EC2::Instance

EC2.4

EC28.

EC29.

EC21.7

EC22.4

EC23,8

EMR.1

SSM.1
AWS::EC2::InternetGateway

EC23.9
AWS::EC2::LaunchTemplate

EC22,5
AWS::EC2::NatGateway

EC24,0
AWS::EC2::NetworkAcl

EC21.6

EC22.1

EC24.1
AWS::EC2::NetworkInterface

EC22.2

EC23.5
AWS::EC2::RouteTable EC24.2
AWS::EC2::SecurityGroup

EC2.2

EC21.3

EC21.4

EC21.8

EC21.9

EC24.3
AWS::EC2::Subnet

EC21.5

EC24.4

ElastiCache7.
AWS::EC2::TransitGateway

EC22.3

EC25.2
AWS::EC2::TransitGatewayAttachment EC23.3
AWS::EC2::TransitGatewayRouteTable EC23.4
AWS::EC2::Volume

EC2.3

EC24,5
AWS::EC2::VPC

EC2.6

EC24.6
AWS::EC2::VPCEndpointService EC24.7
AWS::EC2::VPCPeeringConnection EC24.9
AWS::EC2::VPNConnection EC2.20
AWS::EC2::VPNGateway EC25,0
Amazon EC2 Auto Scaling AWS::AutoScaling::AutoScalingGroup

AutoScaling.1

AutoScaling.2

AutoScaling.6

AutoScaling9.

AutoScaling.10
AWS::AutoScaling::LaunchConfiguration

AutoScaling.3

Autoscaling.5
Amazon EC2 Systems Manager (SSM) AWS::SSM::AssociationCompliance

SSM.3
AWS::SSM::ManagedInstanceInventory

SSM.1
AWS::SSM::PatchCompliance

SSM.2
Amazon Elastic Container Registry (AmazonECR) AWS::ECR::PublicRepository ECR.4
AWS::ECR::Repository

ECR.2

ECR.3
Amazon Elastic Container Service (AmazonECS) AWS::ECS::Cluster

ECS1.2

ECS1.4
AWS::ECS::Service

ECS.2

ECS.10

ECS1.3
AWS::ECS::TaskDefinition

ECS.1

ECS.3

ECS.4

ECS5.

ECS8.

ECS9.

ECS1.5
Amazon Elastic File System (AmazonEFS) AWS::EFS::AccessPoint

EFS.3

EFS.4

EFS5.
Amazon Elastic Kubernetes Service (Amazon) EKS AWS::EKS::Cluster

EKS.2

EKS.6

EKS8.
AWS::EKS::IdentityProviderConfig EKS7.
AWS Elastic Beanstalk AWS::ElasticBeanstalk::Environment

ElasticBeanstalk.1

ElasticBeanstalk.2

ElasticBeanstalk.3
Elastic Load Balancing AWS::ElasticLoadBalancing::LoadBalancer

ELB.2

ELB.3

ELB5.

ELB7.

ELB8.

ELB9.

ELB.10

ELB1.4
AWS::ElasticLoadBalancingV2::LoadBalancer

ELB.1

ELB.4

ELB5.

ELB.6

ELB1.2

ELB1.3

ELB1.6
ElasticSearch AWS::Elasticsearch::Domain

ES.3

ES.4

ES.5

ES.6

ES.7

ES.8

ES.9
Amazon EventBridge AWS::Events::EventBus

EventBridge.2

EventBridge.3
AWS::Events::Endpoint

EventBridge.4
AWS Global Accelerator AWS::GlobalAccelerator::Accelerator

GlobalAccelerator.1
AWS Glue AWS::Glue::Job

Cola.1
Amazon GuardDuty AWS::GuardDuty::Detector

GuardDuty.4
AWS::GuardDuty::Filter

GuardDuty.2
AWS::GuardDuty::IPSet

GuardDuty.3
AWS Identity and Access Management (IAM) AWS::IAM::Group

IAM2.7

KMS.2
AWS::IAM::Policy

IAM.1

IAM2.1

KMS.1
AWS::IAM::Role

IAM2.4

IAM2.7

KMS.2
AWS::IAM::User

IAM.2

IAM.3

IAM5.

IAM8.

IAM1.9

IAM2.2

IAM2,5

IAM2.7

KMS.2
AWS Identity and Access Management Access Analyzer AWS::AccessAnalyzer::Analyzer

IAM2.3
AWS IoT AWS::IoT::Authorizer

IoT.4
AWS::IoT::Dimension

IoT.3
AWS::IoT::MitigationAction

IoT.2
AWS::IoT::Policy

IoT.6
AWS::IoT::RoleAlias

IoT.5
AWS::IoT::SecurityProfile

IoT.1
AWS Key Management Service (AWS KMS) AWS::KMS::Alias

S3.17
AWS::KMS::Key

KMS.3

S3.17
Amazon Kinesis AWS::Kinesis::Stream

Kinesis.1

Cinesia.2
AWS Lambda AWS::Lambda::Function

Lambda.1

Lambda.2

Lambda.3

Lambda.5

Lambda.6
Amazon MSK AWS::MSK::Cluster

MSK.1

MSK.2
Amazon MQ AWS::AmazonMQ::Broker

MQ.2

MQ.3

MQ.4

MQ.5

MQ.6
AWS Network Firewall AWS::NetworkFirewall::Firewall

NetworkFirewall.1

NetworkFirewall7.

NetworkFirewall9.
AWS::NetworkFirewall::FirewallPolicy

NetworkFirewall.3

NetworkFirewall.4

NetworkFirewall5.

NetworkFirewall8.
AWS::NetworkFirewall::RuleGroup

NetworkFirewall.6
OpenSearch Serviço Amazon AWS::OpenSearch::Domain

Opensearch.1

Opensearch.2

Opensearch.3

Opensearch.4

Opensearch.5

Opensearch.6

Opensearch.7

Opensearch.8

Pesquisa aberta. 9

Opensearch.10

Abrir pesquisa. 11
Amazon Relational Database Service (AmazonRDS) AWS::RDS::DBCluster

DocumentDB.1

DocumentDB.2

DocumentDB.4

DocumentDB.5

Neptune.1

Neptune.2

Neptune.4

Neptune.5

Neptune.7

Neptune.8

Neptune.9

RDS7.

RDS1.2

RDS1.4

RDS1.5

RDS1.6

RDS2.4

RDS2.7

RDS2.8

RDS3.4

RDS3.5
AWS::RDS::DBClusterSnapshot

DocumentDB.3

Neptune.3

Neptune.6

RDS.1

RDS.4

RDS2.9
AWS::RDS::DBInstance

RDS.2

RDS.3

RDS5.

RDS.6

RDS8.

RDS9.

RDS.10

RDS1.1

RDS1.3

RDS1.7

RDS1.8

RDS2.3

RDS2,5

RDS3.0
AWS::RDS::DBSecurityGroup

RDS3.1
AWS::RDS::DBSnapshot

RDS.1

RDS.4

RDS3.2
AWS::RDS::DBSubnetGroup

RDS3.3
AWS::RDS::EventSubscription

RDS1.9

RDS.20

RDS2.1

RDS2.2
Amazon Redshift AWS::Redshift::Cluster

Redshift.1

Redshift.2

Redshift.3

Redshift.4

Redshift.6

Redshift.7

Redshift.8

Redshift.9

Redshift.10

Desvio para o vermelho.11
AWS::Redshift::ClusterParameterGroup

Redshift.2
AWS::Redshift::ClusterSnapshot

Desvio para o vermelho.13
AWS::Redshift::ClusterSubnetGroup

Desvio para o vermelho.14
AWS::Redshift::EventSubscription

Desvio para o vermelho.12
Amazon Route 53 AWS::Route53::HostedZone

Route53.2
AWS::Route53::HealthCheck

Rota 53.1
Amazon Simple Storage Service (Amazon S3) AWS::S3::AccessPoint

S3.19
AWS::S3::AccountPublicAccessBlock

S3.2

S3.3
AWS::S3::Bucket

S3.2

S3.3

S3.5

S3.6

S3.7

S3.8

S3.9

S3.10

S3.11

S3.12

S3.13

S3.14

S3.15

S3.17

S3.20
AWS Secrets Manager AWS::SecretsManager::Secret

SecretsManager.1

SecretsManager.2

SecretsManager5.
AWS Service Catalog AWS::ServiceCatalog::Portfolio

ServiceCatalog.1
Amazon Simple Email Service (AmazonSES) AWS::SES::ConfigurationSet

SES.2
AWS::SES::ContactList

SES.1
Serviço de notificação simples da Amazon (AmazonSNS) AWS::SNS::Topic

SNS.1

SNS.3
Amazon Simple Queue Service (AmazonSQS) AWS::SQS::Queue

SQS.1

SQS.2
Amazon SageMaker AWS::SageMaker::NotebookInstance

SageMaker.2

SageMaker.3
AWS Step Functions AWS::StepFunctions::StateMachine

StepFunctions.1
AWS::StepFunctions::Activity

StepFunctions.2
AWS Transfer Family AWS::Transfer::Workflow

Transferência.1
AWS WAF AWS::WAF::Rule

WAF.6
AWS::WAF::RuleGroup

WAF7.
AWS::WAF::WebACL

WAF.1

WAF8.
AWS::WAFRegional::Rule

WAF.2
AWS::WAFRegional::RuleGroup

WAF.3
AWS::WAFRegional::WebACL

WAF.4
AWS::WAFv2::RuleGroup

WAF1.2
AWS::WAFv2::WebACL

WAF.10

WAF1.1

Recursos necessários para o FSBP padrão

Para que o Security Hub relate com precisão as descobertas dos controles ativados por alterações ativadas pelas Melhores Práticas AWS Fundamentais de Segurança (FSBP) que usam uma AWS Config regra, você deve registrar esses recursos em AWS Config. Para obter mais informações sobre esse padrão, consulte AWS Padrão de melhores práticas básicas de segurança (FSBP).

Serviço Recursos necessários do

Amazon API Gateway

AWS::ApiGateway::Stage

AWS::ApiGatewayV2::Stage

AWS AppSync

AWS::AppSync::GraphQLApi

AWS Backup

AWS::Backup::RecoveryPoint

AWS Certificate Manager (ACM)

AWS::ACM::Certificate

AWS CloudFormation

AWS::CloudFormation::Stack

Amazon CloudFront

AWS::CloudFront::Distribution

AWS CodeBuild

AWS::CodeBuild::Project

AWS Database Migration Service (AWS DMS)

AWS::DMS::Endpoint

AWS::DMS::ReplicationInstance

AWS::DMS::ReplicationTask

Amazon DynamoDB

AWS::DynamoDB::Table
Amazon EC2 Systems Manager (SSM)

AWS::SSM::AssociationCompliance

AWS::SSM::ManagedInstanceInventory

AWS::SSM::PatchCompliance

Nuvem de computação elástica Amazon () EC2

AWS::EC2::ClientVpnEndpoint

AWS::EC2::Instance

AWS::EC2::LaunchTemplate

AWS::EC2::NetworkAcl

AWS::EC2::NetworkInterface

AWS::EC2::SecurityGroup

AWS::EC2::Subnet

AWS::EC2::TransitGateway

AWS::EC2::VPNConnection

AWS::EC2::Volume

Amazon EC2 Auto Scaling

AWS::AutoScaling::AutoScalingGroup

AWS::AutoScaling::LaunchConfiguration

Amazon Elastic Container Registry (AmazonECR)

AWS::ECR::Repository

Amazon Elastic Container Service (AmazonECS)

AWS::ECS::Cluster

AWS::ECS::Service

AWS::ECS::TaskDefinition

Amazon Elastic File System (AmazonEFS)

AWS::EFS::AccessPoint

Amazon EKS

AWS::EKS::Cluster

ElasticBeanstalk

AWS::ElasticBeanstalk::Environment

Elastic Load Balancing

AWS::ElasticLoadBalancing::LoadBalancer

AWS::ElasticLoadBalancingV2::LoadBalancer

ElasticSearch

AWS::Elasticsearch::Domain

AWS Identity and Access Management (IAM)

AWS::IAM::Group

AWS::IAM::Policy

AWS::IAM::Role

AWS::IAM::User

AWS Key Management Service (AWS KMS)

AWS::KMS::Key

Amazon Kinesis

AWS::Kinesis::Stream

AWS Lambda

AWS::Lambda::Function

Amazon MSK

AWS::MSK::Cluster

AWS Network Firewall

AWS::NetworkFirewall::Firewall

AWS::NetworkFirewall::FirewallPolicy

AWS::NetworkFirewall::RuleGroup

OpenSearch Serviço Amazon

AWS::OpenSearch::Domain

Amazon Relational Database Service (AmazonRDS)

AWS::RDS::DBCluster

AWS::RDS::DBClusterSnapshot

AWS::RDS::DBInstance

AWS::RDS::DBSnapshot

AWS::RDS::EventSubscription

Amazon Redshift

AWS::Redshift::Cluster

Amazon Route 53

AWS::Route53::HostedZone

Amazon Simple Storage Service (Amazon S3)

AWS::S3::AccessPoint

AWS::S3::AccountPublicAccessBlock

AWS::S3::Bucket

Serviço de notificação simples da Amazon (AmazonSNS)

AWS::SNS::Topic

Amazon Simple Queue Service (AmazonSQS)

AWS::SQS::Queue

Amazon SageMaker

AWS::SageMaker::NotebookInstance

AWS Secrets Manager

AWS::SecretsManager::Secret

AWS Step Functions

AWS::StepFunctions::StateMachine

AWS WAF

AWS::WAF::Rule

AWS::WAF::RuleGroup

AWS::WAF::WebACL

AWS::WAFRegional::Rule

AWS::WAFRegional::RuleGroup

AWS::WAFRegional::WebACL

AWS::WAFv2::RuleGroup

AWS::WAFv2::WebACL

Recursos necessários para o CIS AWS Foundations Benchmark

Para executar verificações de segurança para controles habilitados que se aplicam ao Center for Internet Security (CIS) AWS Foundations Benchmark, o Security Hub executa as etapas de auditoria exatas prescritas para as verificações em Protegendo a Amazon Web Services ou usa regras AWS Config gerenciadas específicas.

Para obter mais informações sobre esse padrão, consulte CIS AWS Referência de fundações.

Recursos necessários para a CIS v3.0.0

Para que o Security Hub relate com precisão as descobertas dos controles ativados por alterações da CIS v3.0.0 ativados que usam uma AWS Config regra, você deve registrar esses recursos em. AWS Config

Serviço Recursos necessários do

Nuvem de computação elástica da Amazon (AmazonEC2)

AWS::EC2::Instance

AWS::EC2::NetworkAcl

AWS::EC2::SecurityGroup

AWS Identity and Access Management (IAM)

AWS::IAM::Group

AWS::IAM::User

AWS::IAM::Role

Amazon Relational Database Service (AmazonRDS)

AWS::RDS::DBInstance

Amazon Simple Storage Service (Amazon S3)

AWS::S3::Bucket

Recursos necessários para a CIS v1.4.0

Para que o Security Hub relate com precisão as descobertas dos controles ativados por alterações da CIS versão 1.4.0 ativados que usam uma AWS Config regra, você deve registrar esses recursos em. AWS Config

Serviço Recursos necessários do

Nuvem de computação elástica Amazon () EC2

AWS::EC2::NetworkAcl

AWS::EC2::SecurityGroup

AWS Identity and Access Management (IAM)

AWS::IAM::Policy

AWS::IAM::User

Amazon Relational Database Service (AmazonRDS)

AWS::RDS::DBInstance

Amazon Simple Storage Service (Amazon S3)

AWS::S3::Bucket

Recursos necessários para a CIS v1.2.0

Para que o Security Hub relate com precisão as descobertas dos controles ativados por alterações da CIS versão 1.2.0 ativados que usam uma AWS Config regra, você deve registrar esses recursos em. AWS Config

Serviço Recursos necessários do

Nuvem de computação elástica Amazon () EC2

AWS::EC2::SecurityGroup

AWS Identity and Access Management (IAM)

AWS::IAM::Policy

AWS::IAM::User

Recursos necessários para NIST SP 800-53 Rev. 5

Para que o Security Hub relate com precisão as descobertas dos controles acionados por alterações habilitados do National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 que usam uma AWS Config regra, você deve registrar esses recursos em. AWS Config Você só precisa registrar recursos para controles que tenham um tipo de programação acionado por alterações. Para obter mais informações sobre esse padrão, consulte Instituto Nacional de Padrões e Tecnologia (NIST) SP 800-53 Rev. 5.

Serviço Recursos necessários do

Amazon API Gateway

AWS::ApiGateway::Stage

AWS::ApiGatewayV2::Stage

AWS AppSync

AWS::AppSync::GraphQLApi

AWS Backup

AWS::Backup::RecoveryPoint

AWS Certificate Manager (ACM)

AWS::ACM::Certificate

AWS CloudFormation

AWS::CloudFormation::Stack

Amazon CloudFront

AWS::CloudFront::Distribution

Amazon CloudWatch

AWS::CloudWatch::Alarm

AWS CodeBuild

AWS::CodeBuild::Project

AWS Database Migration Service (AWS DMS)

AWS::DMS::Endpoint

AWS::DMS::ReplicationInstance

AWS::DMS::ReplicationTask

Amazon DynamoDB

AWS::DynamoDB::Table

Nuvem de computação elástica Amazon () EC2

AWS::EC2::ClientVpnEndpoint

AWS::EC2::EIP

AWS::EC2::Instance

AWS::EC2::LaunchTemplate

AWS::EC2::NetworkAcl

AWS::EC2::NetworkInterface

AWS::EC2::SecurityGroup

AWS::EC2::Subnet

AWS::EC2::TransitGateway

AWS::EC2::VPNConnection

AWS::EC2::Volume

Amazon EC2 Auto Scaling

AWS::AutoScaling::AutoScalingGroup

AWS::AutoScaling::LaunchConfiguration

Amazon Elastic Container Registry (AmazonECR)

AWS::ECR::Repository

Amazon Elastic Container Service (AmazonECS)

AWS::ECS::Cluster

AWS::ECS::Service

AWS::ECS::TaskDefinition

Amazon Elastic File System (AmazonEFS)

AWS::EFS::AccessPoint

Amazon EKS

AWS::EKS::Cluster

ElasticBeanstalk

AWS::ElasticBeanstalk::Environment

Elastic Load Balancing

AWS::ElasticLoadBalancing::LoadBalancer

AWS::ElasticLoadBalancingV2::LoadBalancer

ElasticSearch

AWS::Elasticsearch::Domain

Amazon EventBridge

AWS::Events::Endpoint

AWS::Events::EventBus

AWS Identity and Access Management (IAM)

AWS::IAM::Group

AWS::IAM::Policy

AWS::IAM::Role

AWS::IAM::User

AWS Key Management Service (AWS KMS)

AWS::KMS::Alias

AWS::KMS::Key

Amazon Kinesis

AWS::Kinesis::Stream

AWS Lambda

AWS::Lambda::Function

Amazon MSK

AWS::MSK::Cluster

Amazon MQ

AWS::AmazonMQ::Broker

AWS Network Firewall

AWS::NetworkFirewall::Firewall

AWS::NetworkFirewall::FirewallPolicy

AWS::NetworkFirewall::RuleGroup

OpenSearch Serviço Amazon

AWS::OpenSearch::Domain

Amazon Relational Database Service (AmazonRDS)

AWS::RDS::DBCluster

AWS::RDS::DBClusterSnapshot

AWS::RDS::DBInstance

AWS::RDS::DBSnapshot

AWS::RDS::EventSubscription

Amazon Redshift

AWS::Redshift::Cluster

Amazon Route 53

AWS::Route53::HostedZone

Amazon Simple Storage Service (Amazon S3)

AWS::S3::AccountPublicAccessBlock

AWS::S3::AccessPoint

AWS::S3::Bucket

AWS Service Catalog

AWS::ServiceCatalog::Portfolio

Serviço de notificação simples da Amazon (AmazonSNS)

AWS::SNS::Topic

Amazon Simple Queue Service (AmazonSQS)

AWS::SQS::Queue
Amazon EC2 Systems Manager (SSM)

AWS::SSM::AssociationCompliance

AWS::SSM::ManagedInstanceInventory

AWS::SSM::PatchCompliance

Amazon SageMaker

AWS::SageMaker::NotebookInstance

AWS Secrets Manager

AWS::SecretsManager::Secret

AWS WAF

AWS::WAF::Rule

AWS::WAF::RuleGroup

AWS::WAF::WebACL

AWS::WAFRegional::Rule

AWS::WAFRegional::RuleGroup

AWS::WAFRegional::WebACL

AWS::WAFv2::RuleGroup

AWS::WAFv2::WebACL

Recursos necessários para a PCI DSS v3.2.1

Para que o Security Hub relate com precisão as descobertas dos controles habilitados do Payment Card Industry Data Security Standard (PCIDSS) que usam uma AWS Config regra, você deve registrar esses recursos em AWS Config. Para obter mais informações sobre esse padrão, consulte Padrão de segurança de dados do setor de cartões de pagamento (PCIDSS).

Serviço Recursos necessários do

AWS CodeBuild

AWS::CodeBuild::Project

Nuvem de computação elástica Amazon () EC2

AWS::EC2::EIP

AWS::EC2::Instance

AWS::EC2::SecurityGroup

Amazon EC2 Auto Scaling

AWS::AutoScaling::AutoScalingGroup

AWS Identity and Access Management (IAM)

AWS::IAM::Policy

AWS::IAM::User

AWS Lambda

AWS::Lambda::Function

OpenSearch Serviço Amazon

AWS::OpenSearch::Domain

Amazon Relational Database Service (AmazonRDS)

AWS::RDS::DBClusterSnapshot

AWS::RDS::DBInstance

AWS::RDS::DBSnapshot

Amazon Redshift

AWS::Redshift::Cluster

Amazon Simple Storage Service (Amazon S3)

AWS::S3::AccountPublicAccessBlock

AWS::S3::Bucket
Amazon EC2 Systems Manager (SSM)

AWS::SSM::AssociationCompliance

AWS::SSM::ManagedInstanceInventory

AWS::SSM::PatchCompliance

Recursos necessários para o AWS Resource Tagging Standard

Todos os controles no Padrão AWS de Marcação de Recursos são acionados por alterações e usam uma AWS Config regra. Para que o Security Hub relate com precisão as descobertas desses controles, você deve registrar os seguintes recursos em AWS Config. Você só precisa registrar recursos para controles que tenham um tipo de programação acionado por alterações. Para obter mais informações sobre esse padrão, consulte AWS Padrão de marcação de recursos.

Serviço Recursos necessários do
AWS AppSync

AWS::AppSync::GraphQLApi
Amazon Athena

AWS::Athena::DataCatalog

AWS::Athena::WorkGroup
AWS Certificate Manager (ACM)

AWS::ACM::Certificate
AWS Backup (AWS Backup)

AWS::Backup::BackupPlan

AWS::Backup::BackupVault

AWS::Backup::RecoveryPlan

AWS::Backup::ReportPlan
AWS CloudFormation

AWS::CloudFormation::Stack
Amazon CloudFront

AWS::CloudFront::Distribution
AWS CloudTrail

AWS::CloudTrail::Trail
AWS CodeArtifact

AWS::CodeArtifact::Repository
Amazon Detective

AWS::Detective::Graph
AWS Database Migration Service (AWS DMS)

AWS::DMS::Certificate

AWS::DMS::EventSubscription

AWS::DMS::ReplicationInstance

AWS::DMS::ReplicationSubnetGroup
Amazon DynamoDB

AWS::DynamoDB::Trail
Nuvem de computação elástica Amazon () EC2

AWS::EC2::CustomerGateway

AWS::EC2::EIP

AWS::EC2::FlowLog

AWS::EC2::Instance

AWS::EC2::InternetGateway

AWS::EC2::NatGateway

AWS::EC2::NetworkAcl

AWS::EC2::NetworkInterface

AWS::EC2::RouteTable

AWS::EC2::SecurityGroup

AWS::EC2::Subnet

AWS::EC2::TransitGateway

AWS::EC2::TransitGatewayAttachment

AWS::EC2::TransitGatewayRouteTable

AWS::EC2::Volume

AWS::EC2::VPC

AWS::EC2::VPCEndpointService

AWS::EC2::VPCPeeringConnection

AWS::EC2::VPNGateway
Amazon EC2 Auto Scaling

AWS::AutoScaling::AutoScalingGroup
Amazon Elastic Container Registry (AmazonECR)

AWS::ECR::PublicRepository
Amazon Elastic Container Service (AmazonECS)

AWS::ECS::Cluster

AWS::ECS::Service

AWS::ECS::TaskDefinition
Amazon Elastic File System (AmazonEFS)

AWS::EFS::AccessPoint
Amazon Elastic Kubernetes Service (Amazon) EKS

AWS::EKS::Cluster

AWS::EKS::IdentityProviderConfig
AWS Elastic Beanstalk (Elastic Beanstalk)

AWS::ElasticBeanstalk::Environment
ElasticSearch

AWS::Elasticsearch::Domain
Amazon EventBridge

AWS::Events::EventBus
AWS Global Accelerator

AWS::GlobalAccelerator::Accelerator
AWS Glue

AWS::Glue::Job
Amazon GuardDuty

AWS::GuardDuty::Detector

AWS::GuardDuty::Filter

AWS::GuardDuty::IPSet
AWS Identity and Access Management (IAM)

AWS::IAM::Role

AWS::IAM::User
AWS Identity and Access Management Access Analyzer (Analisador de IAM acesso)

AWS::AccessAnalyzer::Analyzer
AWS IoT

AWS::IoT::Authorizer

AWS::IoT::Dimension

AWS::IoT::MitigationAction

AWS::IoT::Policy

AWS::IoT::RoleAlias

AWS::IoT::SecurityProfile
Amazon Kinesis

AWS::Kinesis::Stream
AWS Lambda

AWS::Lambda::Function
Amazon MQ

AWS::AmazonMQ::Broker
AWS Network Firewall

AWS::NetworkFirewall::Firewall

AWS::NetworkFirewall::FirewallPolicy
OpenSearch Serviço Amazon

AWS::OpenSearch::Domain
Amazon Relational Database Service

AWS::RDS::DBCluster

AWS::RDS::DBClusterSnapshot

AWS::RDS::DBInstance

AWS::RDS::DBSecurityGroup

AWS::RDS::DBSnapshot

AWS::RDS::DBSubnetGroup
Amazon Redshift

AWS::Redshift::Cluster

AWS::Redshift::ClusterSnapshot

AWS::Redshift::ClusterSubnetGroup

AWS::Redshift::EventSubscription
Amazon Route 53

AWS::Route53::HealthCheck
AWS Secrets Manager

AWS::SecretsManager::Secret
Amazon Simple Email Service (AmazonSES)

AWS::SES::ConfigurationSet

AWS::SES::ContactList
Serviço de notificação simples da Amazon (AmazonSNS)

AWS::SNS::Topic
Amazon Simple Queue Service (AmazonSQS)

AWS::SQS::Queue
AWS Step Functions

AWS::StepFunctions::Activity
AWS Transfer Family

AWS::Transfer::Workflow

Recursos necessários para o Service-Managed Standard: AWS Control Tower

Para que o Security Hub relate com precisão as descobertas do Padrão Gerenciado por Serviços habilitado: AWS Control Tower altere os controles acionados que usam uma AWS Config regra, você deve registrar os seguintes recursos em. AWS Config Para obter mais informações sobre esse padrão, consulte Padrão gerenciado por serviços: AWS Control Tower.

Serviço Recursos necessários do

Amazon API Gateway

AWS::ApiGateway::Stage

AWS::ApiGatewayV2::Stage

AWS Certificate Manager (ACM)

AWS::ACM::Certificate

AWS CodeBuild

AWS::CodeBuild::Project

Amazon DynamoDB

AWS::DynamoDB::Table

Nuvem de computação elástica Amazon () EC2

AWS::EC2::Instance

AWS::EC2::NetworkAcl

AWS::EC2::NetworkInterface

AWS::EC2::SecurityGroup

AWS::EC2::Subnet

AWS::EC2::VPNConnection

AWS::EC2::Volume

Amazon EC2 Auto Scaling

AWS::AutoScaling::AutoScalingGroup

AWS::AutoScaling::LaunchConfiguration

Amazon Elastic Container Registry (AmazonECR)

AWS::ECR::Repository

Amazon Elastic Container Service (AmazonECS)

AWS::ECS::Cluster

AWS::ECS::Service

AWS::ECS::TaskDefinition

Amazon Elastic File System (AmazonEFS)

AWS::EFS::AccessPoint

Amazon EKS

AWS::EKS::Cluster

ElasticBeanstalk

AWS::ElasticBeanstalk::Environment

Elastic Load Balancing

AWS::ElasticLoadBalancing::LoadBalancer

AWS::ElasticLoadBalancingV2::LoadBalancer

ElasticSearch

AWS::Elasticsearch::Domain

AWS Identity and Access Management (IAM)

AWS::IAM::Group

AWS::IAM::Policy

AWS::IAM::Role

AWS::IAM::User

AWS Key Management Service (AWS KMS)

AWS::KMS::Alias

AWS::KMS::Key

Amazon Kinesis

AWS::Kinesis::Stream

AWS Lambda

AWS::Lambda::Function

AWS Network Firewall

AWS::NetworkFirewall::FirewallPolicy

AWS::NetworkFirewall::RuleGroup

OpenSearch Serviço Amazon

AWS::OpenSearch::Domain

Amazon Relational Database Service (AmazonRDS)

AWS::RDS::DBCluster

AWS::RDS::DBClusterSnapshot

AWS::RDS::DBInstance

AWS::RDS::DBSnapshot

AWS::RDS::EventSubscription

Amazon Redshift

AWS::Redshift::Cluster

Amazon Simple Storage Service (Amazon S3)

AWS::S3::AccountPublicAccessBlock

AWS::S3::Bucket

Serviço de notificação simples da Amazon (AmazonSNS)

AWS::SNS::Topic

Amazon Simple Queue Service (AmazonSQS)

AWS::SQS::Queue
Amazon EC2 Systems Manager (SSM)

AWS::SSM::AssociationCompliance

AWS::SSM::ManagedInstanceInventory

AWS::SSM::PatchCompliance

AWS Secrets Manager

AWS::SecretsManager::Secret

AWS WAF

AWS::WAFRegional::Rule

AWS::WAFRegional::RuleGroup

AWS::WAFRegional::WebACL

AWS::WAFv2::WebACL