We are excited to highlight AWS Partner software solutions with AWS built-in, including new infrastructure as code (IaC) that integrates automatically with AWS foundational services to help customers achieve their long-term goals in the cloud. AWS built-in software uses a well-architected Modular Code Repository (MCR) designed to add value to partner software solutions. AWS built-in partner solutions leverage key building blocks called Cloud Foundational Services across multiple domains such as identity, security, and operations. 

Amazon Detective has expanded finding groups to include Amazon Inspector network reachability and software vulnerability findings alongside Amazon GuardDuty findings. The combined threats and vulnerabilities help security analysts prioritize where they should focus their time by answering questions like “was this EC2 instance compromised because of a software vulnerability?” or “did this GuardDuty finding occur because of unintended network exposure?”

Customers can now apply two independent layers of server-side encryption to objects in Amazon S3. Dual-layer server-side encryption with keys stored in AWS Key Management Service (DSSE-KMS) is designed to meet National Security Agency CNSSP 15 for FIPS compliance and Data-at-Rest Capability Package (DAR CP) Version 5.0 guidance for two layers of CNSA encryption. Amazon S3 is the only cloud object storage service where customers can apply two layers of encryption at the object level and control the data keys used for both layers. S3 features such as DSSE-KMS are vetted and accepted for use on top-secret workloads, which benefits all customers globally. 

AWS Security Hub, a cloud security posture management service that performs security best practice checks, aggregates alerts, and facilitates automated remediation, now features a capability to automatically update or suppress findings in near-real time. You can now use automation rules to automatically update various fields in findings, suppress findings, update finding severity and workflow status, add notes, and more. 

AWS Elastic Disaster Recovery (AWS DRS) now allows you to replicate and recover your AWS network components and configurations to maintain the readiness and security of your AWS recovery site. These components includes subnet CIDR, security groups, route tables, Internet gateways, and network ACLs. 

AWS Well-Architected introduces Profiles, which allows customers to tailor their Well-Architected reviews based on their business goals. This feature creates a mechanism for continuous improvement by encouraging customers to review their workloads with certain goals in mind first, and then complete the remaining Well-Architected review questions.

AWS CloudTrail Lake, a managed data lake that lets organizations aggregate, immutably store, and query their audit and security logs for auditing, security investigations and operational troubleshooting, announces the general availability of CloudTrail Lake dashboards. CloudTrail Lake dashboards provide out-of-the-box visibility for top trends from your CloudTrail data directly within the CloudTrail Lake console. It also offers the flexibility to drill down into additional details such as specific user activity for further investigation needs using CloudTrail Lake SQL queries. Auditing and compliance engineers can use the CloudTrail Lake dashboards to track progress of compliance mandates such as migration to TLS 1.2 and beyond. CloudTrail Lake dashboards will help security engineers closely track sensitive user activities such as deletion of trails or repeated access denied errors. Cloud operation engineers can get visibility to issues such as top service throttling errors from the curated dashboard.

AWS WAF Fraud Control announces Account Creation Fraud Prevention, a managed protection for AWS WAF that is designed to prevent creation of fake or fraudulent accounts. Fraudsters use fake accounts to initiate activities, such as abusing promotional and sign-up bonuses, impersonating legitimate users, and carrying out phishing attacks. These activities can lead to several direct or indirect costs such as damaged customer relationships, reputational loss, and exposure to financial fraud. Account Creation Fraud Prevention protects your account sign-up or registration pages by allowing you to continuously monitor requests for anomalous digital activity and automatically block suspicious requests based on request identifiers and behavioral analysis. 

Today, AWS announces the preview release of Amazon CodeGuru Security, a static application security testing (SAST) tool that uses Machine Learning to help you identify code vulnerabilities and provide guidance you can use as part of remediation. CodeGuru Security also provides in-context code patches for certain classes of vulnerabilities, helping you reduce the effort required to fix code vulnerabilities.

Today, AWS announces a new summary page in the Amazon GuardDuty console to help you more quickly identify and take action on the highest-priority findings across your AWS environment. The summary page presents trends of findings over time, a breakdown of findings by severity and finding type, and top finding volume resources such as Amazon Elastic Compute Cloud (Amazon EC2) instances, Amazon Simple Storage Service (Amazon S3) buckets, Amazon Relational Database Service (Amazon RDS) databases, AWS Lambda functions, or Amazon Elastic Kubernetes Service (Amazon EKS) clusters. If you are operating in a multi-account environment, the new summary page consolidates findings from across the organization, and helps you to more quickly identify top-impacted accounts.