As part of our ongoing maintenance and improvement of rules and rule bundles, we are updating rules related to AWS CloudTrail log metric filters. This change will offer a shift towards organization-level CloudTrail configurations, enabling enhanced security and manageability for your resources.

Please be aware that the existing rules will be deprecated in the following bundles:

• AWS FTR version 1.0.0
• CIS Benchmark from version 1.1.0 to 1.5.0
• Organization Rules
• S3 Best Practice version 1.0 and version 1.1
• Stax Foundation Compliance version 1.0

The deprecated rules are as follows:

• Ensure a log metric filter and alarm exist for AWS Config configuration changes, 
• Ensure a log metric filter and alarm exist for AWS Management Console authentication failures, 
• Ensure a log metric filter and alarm exist for Management Console sign-in without MFA, 
• Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL), 
• Ensure a log metric filter and alarm exist for changes to network gateways,
• Ensure a log metric filter and alarm exist for CloudTrail configuration changes,
• Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer-created CMKs, 
• Ensure a log metric filter and alarm exist for IAM policy changes, 
• Ensure a log metric filter and alarm exist for route table changes, 
• Ensure a log metric filter and alarm exist for S3 bucket policy changes, 
• Ensure a log metric filter and alarm exist for security group changes, 
• Ensure a log metric filter and alarm exist for unauthorized API calls, 
• Ensure a log metric filter and alarm exist for usage of root user credentials, 
• Ensure a log metric filter and alarm exist for VPC changes

The newly introduced rules will take their place with the following rule names respectively:

• CloudTrail should have a log metric filter for AWS Config changes,
• CloudTrail should have a log metric filter for Console authentication failures,
• CloudTrail should have a log metric filter for Console sign-in without MFA,
• CloudTrail should have a log metric filter for NACL changes,
• CloudTrail should have a log metric filter for Network Gateway changes,
• CloudTrail should have a log metric filter for CloudTrail configuration changes,
• CloudTrail should have a log metric filter for scheduled deletion of customer-created CMKs,
• CloudTrail should have a log metric filter for IAM policy changes,
• CloudTrail should have a log metric filter for route table changes,
• CloudTrail should have a log metric filter for s3 bucket policy changes,
• CloudTrail should have a log metric filter for security group changes,
• CloudTrail should have a log metric filter for unauthorized API calls,
• CloudTrail should have a log metric filter for root user credentials,
• CloudTrail should have a log metric filter for VPC changes

Please note that the check history for the deprecated rules will not be kept.

If you have any questions about this change and what it means for you, please contact support.

The rule “Lambdas have a unique role” will be deprecated in a rules update in 7 days. This rule has been a part of the Stax compliance module for many years, and after careful consideration, we have decided that it no longer serves its intended purpose.

This rule was originally intended to ensure that AWS Lambdas — cloud computing functions — had a unique role within the environment. As cloud computing and serverless functions have evolved, we have determined that this rule does not provide additional security and is no longer necessary.

This rule is only part of the Stax rule catalog, and is not used as part of any compliance or best practice rule bundles.

The stax-audit-bus EventBridge rule has been deprecated and will be removed from all Stax-managed AWS accounts on 31 March 2023. To understand the impact, read more.

The Explore the cost of your services feature will be deprecated on 1 December 2022.  No customer action is required as part of this change. Read more. 

The Tag Policy feature in the Cost & Compliance module will be deprecated on 1 December 2022. To ensure you are not impacted, follow this guide to prepare for the change. 

The PhoneNumber and Tags attributes have been deprecated from the User APIs.

These attributes will be removed from the API on 1 December 2022 and from this date will be ignored on Create and Update requests, and not returned in GET requests.

Stax API endpoint Fetch All Tasks by Status has been deprecated and will be removed from stax-au1, stax-us1 and stax-eu1 on Sunday 14th August at 0200 UTC (Monday 15th August at 1200 AEST).

In addition, a change is being made to the API endpoint Fetch Status of task in stax-au1, stax-us1 and stax-eu1 such that any tasks created on or after Sunday 14th August at 0200 UTC (Monday 15th August at 1200 AEST) will have a 30 day expiry. Any tasks older than 30 days will be removed from the system, responding with a 404 NOT FOUND status.

These changes are being made to improve the way Stax manages tasks.

If you have any concerns, please raise a support case.

Stax has released a new Config Aggregator named stax-assurance-<stax_organization_id> in your security foundation account. It is an organizational aggregator with the intention of deprecating the current multi-account aggregator juma-assurance-<security_aws_account_id>, to simplify the configuration and management. You will find the aggregator in the AWS region according to your Stax Installation region.

For organizations where the security foundation account is not set up as the organization's delegated administrator account for AWS Config (with service principal config.amazonaws.com), this aggregator will not be created.

During the week beginning 29 November 2021, Stax will start the process of removing the aggregator juma-assurance-<security_aws_account_id> from your security foundation account.

Update: The juma-assurance-<security_aws_account_id> aggregator removal work has been completed for all Stax tenancies.

Stax has deprecated its automatic CloudFormation template validation for Workload Catalog items.

When deploying a Workload Manifest file, Stax will validate the structure of the Manifest, ensure that all CloudFormation templates are reachable, and that the CloudFormation templates themselves are valid JSON or YAML. It will no longer query AWS's Validate Template API to validate the CloudFormation template(s) when a manifest is uploaded.

This feature has been deprecated as, in some instances, it prevented deployment of sophisticated Workloads and templates that relied on specific AWS account and region combinations.

The API endpoints affected are:

• Create Workload Catalog Item: stax-au1 stax-us1 stax-eu1
• Update Workload Catalog Item: stax-au1 stax-us1 stax-eu1

Consider leveraging the AWS CLI/API directly when developing CloudFormation templates to ensure their validity.

These changes have been applied automatically by Stax. Should you experience any issues, please raise a support case.

Stax will update its account bootstrap process from July 1, 2021. After this time, the AWS account alias will no longer be generated or modified.

For existing accounts that already have an alias, the alias will remain unchanged.

This does not prevent you from creating an account alias at a later stage.