You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: CHANGELOG.md
+34-6Lines changed: 34 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,19 +1,22 @@
1
1
# Change Log
2
+
2
3
All notable changes to this project will be documented in this file.
3
4
4
5
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
5
6
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
6
7
7
-
## [2.0.0] - 2023-01-17
8
+
## [2.0.0] - 2023-03-23
8
9
9
10
### Added
11
+
10
12
- New remediations contributed by 6Pillars: CIS v1.2.0 1.20
11
13
- New AFSBP remediations for CloudFormation.1, EC2.15, SNS.1, SNS.2, SQS.1
12
14
- Service Catalog AppRegistry integration
13
15
- New support for Security Controls, finding deduplication
14
16
- New support for CIS v1.4.0 standard
15
17
16
18
### Changed
19
+
17
20
- Added protections to avoid deployment failure due to SSM document throttling
18
21
19
22
## [1.5.1] - 2022-12-22
@@ -31,40 +34,48 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
31
34
## [1.5.0] - 2022-05-31
32
35
33
36
### Added
37
+
34
38
- New remediations - see Implementation Guide
35
39
36
40
### Changed
41
+
37
42
- Improved cross-region remediation using resource region from Resources[0].Id
38
43
- Added custom resource provider for SSM documents to allow in-place stack upgrades
39
44
40
45
## [1.4.2] - 2022-01-14
41
46
42
47
### Changed
48
+
43
49
- Fix to correct the generator id pattern for CIS 1.2.0 Ruleset.
44
50
45
51
## [1.4.1] - 2022-01-05
46
52
47
53
### Changed
54
+
48
55
- Bug Fix for issue [47](https://github.com/aws-solutions/aws-security-hub-automated-response-and-remediation/issues/47)
49
56
- Bug Fix for issue [48](https://github.com/aws-solutions/aws-security-hub-automated-response-and-remediation/issues/48)
50
57
51
-
52
58
## [1.4.0] - 2021-12-13
53
59
54
60
### Changed
61
+
55
62
- Bug fixes for AFSBP EC2.1, CIS 3.x
56
63
- Separated Member roles from the remediations so that roles can be deployed once per account
57
64
- Roles are now global
58
65
- Cross-region remediation is now supported
59
66
- Deployment using stacksets is documented in the IG and supported by the templates
60
-
- Member account roles for remediation runbooks are now retained when the stack is deleted so that remediations that use these roles continue to function if the solution is removed
67
+
- Member account roles for remediation runbooks are now retained when the stack is deleted so that remediations that use
68
+
these roles continue to function if the solution is removed
61
69
62
70
### Added
71
+
63
72
- Added a get_approval_requirement lambda that customers can use to implement custom business logic
64
-
- Added the ability for customers to route findings to an alterate runbook when the finding meets criteria. For example, potentially destructive remediations can be sent to a runbook that sends the finding data to Incident Manager.
73
+
- Added the ability for customers to route findings to an alterate runbook when the finding meets criteria. For example,
74
+
potentially destructive remediations can be sent to a runbook that sends the finding data to Incident Manager.
65
75
- New remediation for AFSBP & PCI S3.5
66
76
67
77
## [1.3.2] - 2021-11-09
78
+
68
79
- Corrected CIS 3.1 filter pattern
69
80
- Corrected SNS Access Policy for SO0111-SHARR-LocalAlarmNotification
70
81
- Corrected KMS CMK Access Policy used by the SNS topic to allow CloudWatch use
@@ -73,34 +84,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
73
84
## [1.3.1] - 2021-09-10
74
85
75
86
### Changed
76
-
- CreateLogMetricFilterAndAlarm.py changed to make Actions active, add SNS notification to SO0111-SHARR-LocalAlarmNotification
87
+
88
+
- CreateLogMetricFilterAndAlarm.py changed to make Actions active, add SNS notification to
89
+
SO0111-SHARR-LocalAlarmNotification
77
90
- Change CIS 2.8 remediation to match new finding data format
78
91
79
92
## [1.3.0] - 2021-08-30
80
93
81
94
### Added
95
+
82
96
- New AWS Foundational Best Practices (AFSBP) support: EC2.6, IAM.7-8, S3.1-3
83
97
- New CIS v1.2.0 support: 2.1, 2.7, 3.1-14
84
98
- New PCI-DSS v3.2.1 Playbook support for 17 controls (see IG for details)
85
99
- Library of remediation SSM Automation runbooks
86
100
- NEWPLAYBOOK as a template for custom playbook creation
87
101
88
102
### Changed
103
+
89
104
- Updated to CDK v1.117.0
90
105
- Reduced duplicate code
91
106
- Updated CIS playbook to Orchestrator architecture
92
107
- Single Orchestrator deployment to enable multi-standard remediation with a single click
93
108
- Custom Actions now consolidated to one: "Remediate with SHARR"
94
109
95
110
### Removed
111
+
96
112
- AWS Service Catalog for Playbook deployment
97
113
98
114
## [1.2.1] - 2021-05-14
115
+
99
116
### Changed
117
+
100
118
- Corrected SSM permissions that were preventing execution of AWS-owned SSM remediation documents
101
119
102
120
## [1.2.0] - 2021-03-22
121
+
103
122
### Added
123
+
104
124
- New AFSBP playbook with 12 new remediations
105
125
- New Lambda Layer for use by solution lambdas
106
126
- New Playbook architecture: Step Function, microservice Lambdas, Systems Manager runbooks
@@ -110,25 +130,33 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
110
130
- Encrypted CloudWatch logs for AFSBP state machine
111
131
112
132
### Changed
133
+
113
134
- Consolidated CDK to a single installation
114
135
- Moved common/core CDK modules to source/lib
115
136
- Update CDK to 1.80.0
116
137
117
138
## [1.1.0] - 2020-11-15
139
+
118
140
### Changed
141
+
119
142
- Added support for AWS partitions other than 'aws' (aws-us-gov, aws-cn)
120
143
- Updated CDK support to 1.68.0
121
144
122
145
## [1.0.1] - 2020-09-18
146
+
123
147
### Changed
148
+
124
149
- Added info-level messages indicating action (CREATE/UPDATE) from the CreateCustomAction lambda
125
-
- Added more stringent matching on Workflow Status and Compliance Status to CloudWatch Event Rules for Custom Actions and CloudWatch finding events (automatic trigger)
150
+
- Added more stringent matching on Workflow Status and Compliance Status to CloudWatch Event Rules for Custom Actions
151
+
and CloudWatch finding events (automatic trigger)
126
152
- Added logging of the finding id to the lambda log for each remediation
127
153
- Added region name to all IAM roles
128
154
- Added region name to IAM Groups - permissions can now be granted per region
129
155
- Removed statically-defined policy names for IAM Groups
130
156
- Removed snapshot test from CDK unit tests
131
157
132
158
## [1.0.0] - 2020-08-12
159
+
133
160
### Added
161
+
134
162
- New add-on solution for AWS Security Hub with CIS v1.2.0 remediations
0 commit comments