On 12 February 2024, Stax will implement changes to the configuration of Stax-managed Security Hub. This update will align the Stax-managed Security Hub service with the new AWS Security Hub central configuration capability announced by AWS.

If you have already enabled Stax-managed Security Hub, you will be impacted by this change.

Ensure you review our guide to understand the change, impacts, and actions you need to take before 12 February 2024.

If you have questions or concerns regarding the changes, please reach out by raising a support case.

On 02 April 2024, Stax will deprecate stax2aws versions 1.4.3 and older. These versions of the Stax Command Line Interface (CLI) utilize a device authorization grant solution which is being deprecated.

All users will be required to upgrade to version 1.5.0 of stax2aws on or before 02 ** April 2024 **to continue using the Stax CLI.

In addition, on 02 April 2024, Stax will remove the obsolete device flow resources from Stax-managed security accounts. No customer action is required for this part of the change and we will inform you when this change has been applied.

If you have questions or concerns regarding the changes, please reach out by raising a support case.

Version 1.5.0 of stax2aws has been released. See how to upgrade stax2aws.

Changes:

• simplified the OAuth 2.0 device authorization implementation

  • support added for native OAuth 2.0 device authorization grant
  • support for custom Stax device flow authorization grant removed

• updated dependencies and security patches

As announced on 17 January 2024, Stax has implemented a change in Stax-managed AWS Config to restrict the recording of global resources, such as IAM users, groups, roles, and customer-managed policies, to your Stax Installation Region only.

This change aligns with AWS Config best practices recommending the recording of global resources in a single region to prevent redundant copies of IAM configuration items across all regions.

Importantly, this change will not affect customer compliance with the CIS AWS Foundations Benchmark v1.2.0 and later control - “Ensure AWS Config is enabled in all regions”. The CIS AWS Benchmark’s Audit procedure specifies that recording of global resources is only required in one region. For more details, refer to the CIS AWS Benchmark.

Impact of change

• Customers can expect a reduction in the number of redundant copies of IAM configuration items stored in every region.

• Customers using the CIS AWS Foundations Benchmark v1.2.0 and v1.4.0 in AWS Security Hub may observe a change in the compliance status of control: [Config.1] AWS Config should be enabled. This adjustment is attributed to the rule mandating the recording of global resources in all regions. For more information and guidance on suppressing findings for this control manually or through an automation rule, please visit the following AWS guides:

- AWS Config Rules and Global Resource Types

- Security Hub controls that you might want to disable

Stax has released a new compliance rule called EC2 instances should not be too old, allowing customers to continuously monitor their EC2 instances’ age based on their organizations requirements. This rule helps align with best practices to ensure the regularly updating, patching and restarting of EC2 instances.

This rule evaluates whether an EC2 instance’s launch time exceeds the specified number of days (Instance Age parameter). The default Instance Age parameter is set to 60 days if no value is specified.

To add any of this new rules to your Organization Rule Bundle, head to the Rules Catalog page.

On 23 January 2024, Stax will implement a change to restrict the recording of global resources, such as IAM users, groups, roles, and customer-managed policies, to your Stax Installation Region.

This change aligns with AWS Config best practices recommending the recording of global resources in a single region to prevent redundant copies of IAM configuration items across all regions. Additionally, this change may help customers in reducing their AWS Config costs.

Importantly, this change does not affect customer compliance with the CIS AWS Foundations Benchmark v1.2.0 and later control - “Ensure AWS Config is enabled in all regions”. The CIS AWS Benchmark’s Audit procedure specifies that including global resources related to IAM resources is required in only one region. For more details, refer to the CIS AWS Benchmark.

Impact of change

• After the change, customers can expect a reduction in the number of redundant copies of IAM configuration items stored in every region.
• Customers using the CIS AWS Foundations Benchmark v1.2.0 and v1.4.0 in AWS Security Hub may observe a change in the compliance status of control: [Config.1] AWS Config should be enabled. This adjustment is attributed to the rule mandating the recording of global resources in all regions. For more information and guidance on suppressing findings for this control manually or through an automation rule, please visit the following AWS guides: - AWS Config Rules and Global Resource Types - Security Hub controls that you might want to disable

Stax Tag Compliance Rules now include support for additional resource types, allowing users to track the tag compliance across a wider range of AWS products and services. For a complete list of supported AWS resource types, visit our guide.

Updated Rules

• Resource tag keys should have specified values

• Resource tag keys should not have specified values

• Resource should have specified tag keys

• Resource should not have specified tag keys

New supported resources

• dynamodb-table

• dynamodb-backup

• rds-cluster

• rds-cluster-param-group

• rds-cluster-snapshot

• rds-param-group

• rds-proxy

• rds-reserved

• sns-topic

• sns-subscription

For more information and to get started, see Monitoring Tag Compliance.

On 12 February 2024, changes will be made to how Stax-managed Security Hub is configured. This update will align the Stax-managed Security Hub service with the new AWS Security Hub capability announced by AWS.

After the change, Stax will only enable and configure cross-region aggregation for Security Hub in regions that are explicitly enabled in Stax-managed Security Hub.

Previously, Stax enabled Security Hub and configured cross-region aggregation for every available region in every account. While supported Security Hub standards and controls were only enabled in the regions explicitly enabled in Stax-managed Security Hub.

If you have already enabled Stax-managed Security Hub and would like the service to continue to be enabled with cross-region aggregation in everyavailable region, ensure that you update your current Stax-managed Security Hub configuration by toggling on the "All Regions" option or selecting individual AWS regions from the list.

To avoid interruption to service,  update your Stax-managed Security Hub configuration before 12 February 2024. If no action is taken, Stax will only enable and aggregate Security Hub in regions enabled in the Stax-managed Security Hub service.

For more information, see Using Stax-managed Security Hub.

On Sunday 11 February at 0200 UTC (Monday 12 February at 1300 AEDT), the following deprecated Stax API endpoints will be removed from stax-au1, stax-us1, and stax-eu1 and will no longer be supported by Stax API/SDK:

**- Fetch IDAM Users **GET /20190206/idam/user

**- Fetch IDAM User ** GET /20190206/idam/user/{org_id}

The following endpoints should be used instead which now includes the user's MFA status.

-** Fetch Stax Users and Federated Users** GET /20190206/users

• Fetch Stax User and Federated User GET /20190206/users/{user_id}

To avoid interruption to service switch to these replacement API endpoints before 11 February 2024. Refer to the Stax API documentation for up-to-date API schema details.

If you have any concerns, please raise a support case.

Stax has introduced changes to the Fetch ** Stax Users and Federated User(s) API endpoints in **stax-au1, stax-eu1, and stax-us1. This change helps identify Stax users with multi-factor authentication (MFA) enabled.

Update Endpoints:

-** Fetch Stax Users and Federated Users** GET /20190206/users

• **Fetch Stax User and Federated User **GET /20190206/users/{user_id}

The endpoint's response schema (teams) now includes the MFAEnabled parameter. For more information, refer to our Stax API documentation.

Viewing a user's MFA status in the Stax Console will be released in early 2024.