aws-cloudformation / aws-cloudformation/cloudformation-coverage-roadmap

[AWS::SecurityHub::Standard] - [Enhancement] - increase DisabledStandardsControls max item count

Open
#2,217 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
No language data
Stars
1.1k
Forks
62
PR merge metrics
No merged PRs in 30d

Description

### Name of the resource

AWS::SecurityHub::Standard

### Resource name

_No response_

### Description

Since AWS has added a million and one VPC endpoints and shoved them all into the NIST standard in Security Hub, it would be nice if we could actually, programatically in a controlled way (that is, using IaC) control which of those endpoints actually make sense for our workloads. No sane person will create all 100+ endpoints for every possible service in every VPC they have.

Currently `DisabledStandardsControls` only allows for 100 items in the list. `NIST Special Publication 800-53 Revision 5` standard currently has almost 400 controls in it, making the limit of 100 items very low. This should be increased, so we can have an IaC way of controlling which of the controls we want to keep enabled.

### Other Details

_No response_

Contributor guide

Open the contributing guide

Research direction

The issue identifies AWS::SecurityHub::Standard and the DisabledStandardsControls property, but names no repository file, test, or entry point. Start by locating the resource schema and the constraint enforcing the 100-item maximum. Done means the property accepts more than 100 controls, with validation coverage updated if the repository provides it.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.