Skip to main content

· One min read

Changed​

The policy query fix for lacework-global-306. Non-running compute instances were improperly being marked as non-compliant for having public access.

· One min read

Changed​

Resolved an issue where AWS root accounts were incorrectly flagged as non-compliant due to changes in the AWS IAM get-credential-report API. Query logic has been updated in the following policies:

· One min read

Changed​

The following policy's title and description have been updated to clarify that a violation occurs when an AWS Elastic Load Balancer is associated with a security group that allows unrestricted egress or ingress:

· One min read

Changed​

A query improvement has been made for the following policy, fixing an issue where AWS accounts with CloudTrail trails configured to use advanced event selectors were being flagged as non-compliant:

· One min read

Updated​

The AWS Foundational Security Best Practices (FSBP) Standard compliance benchmark has been updated with new policies that are of high severity.

The following policies are newly added and are automated:

Click to expand

The following policies are newly added but are manual:

Click to expand

The following policies already exist and have been updated as part of this release

Click to expand

· One min read

Updated​

A query improvement has been made for the following policies, which simplifies the logic and also updates the severity:

The severity for lacework-global-52 has been increased from medium to high, and for lacework-global-171 it has been decreased from critical to medium, to reflect recent reviews of some Lacework policies.

· One min read

Updated​

The CIS Google Kubernetes Engine (GKE) 1.4.0 Benchmark compliance benchmark has been updated with newly automated policies.

The following policies that were manual have now been automated:

Click to expand

· One min read

Changed​

Some changes have been made to the following policies to fix an issue whereby the region was being incorrectly reported, causing unexpected non-compliant assessment results.

The queries that support these policies now correctly report the primary region, rather than the paired region.