Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- Resource criticality expresses business importance; it is not an exposure severity rating or exploit likelihood.
- Automation rules can set criticality for existing inventory and newly discovered resources.
- Security Hub also infers criticality from resource tags and names and records the determining source.
- The Resources column supports sorting, filtering and grouping; exposure details show criticality on the Impact assessment tab.
- AWS states no incremental Essentials feature fee or new enablement. Availability in a specific target Region still needs verification.
What AWS added on October 14
The feature gives central security teams business context when deciding which exposures to address first. Similar security issues can affect resources with different importance to the organization. Resource criticality adds that importance to exposure prioritization.
AWS announced that Security Hub now supports the capability without a Preview label. The announcement describes rules, automatic inference and display locations, but does not provide a step-by-step configuration tutorial.
Separate business importance, severity and exploit likelihood
Resource criticality expresses business importance. Exposure severity is a security risk rating. The current severity guide describes a combination of likelihood and impact: likelihood concerns how readily an exposure can be discovered and exploited, while impact concerns the harm from exploitation.
A Very High criticality value therefore does not directly mean CRITICAL exposure severity. The current guide also says impact alone does not generate an exposure finding. The announcement supplies no one-to-one mapping between criticality and severity, and promises no automatic resource remediation from a criticality label.
Rules and inference: check what determined the value
AWS gives an automation-rule example that marks compute resources in a particular account as Very High. Hypothetically, an account hosting critical business workloads could illustrate why a team would use that classification; its actual rating should follow the team’s business assessment. A rule applies both to resources already in inventory and to new resources as Security Hub discovers them.
Security Hub also infers criticality from resource tags and names without additional inference configuration and records which source determined the value. Review the value together with its recorded source. The verified announcement and current guides do not specify tag keys, rule fields, IAM permissions or precedence when sources conflict.
Start with a read-only review in Resources and Impact assessment
In an existing Security Hub console, choose Resources and review criticality for relevant resources. Use the column to sort, filter or group important resources. The current Resources guide explains resource details, associated findings and traits; delegated administrators can view member-account resources.
Then open the Impact assessment tab of a relevant exposure and review criticality alongside the impact context. The current exposure guide describes network reachability, resource relationships and permission-related potential impact as security evidence. Reading that context helps distinguish business importance from the specific exposure risk without changing resource settings or performing remediation.
No incremental feature fee; check the plan and Region separately
AWS says resource criticality is included in Security Hub Essentials at no additional cost and requires no new enablement. The current pricing page describes Essentials as a paid, per-resource-unit monthly plan. This announcement does not make the whole Security Hub service free.
For availability, the announcement links the official AWS Region table without listing regional coverage in its text. Availability of this capability in a specific target Region has not been verified here. Check official availability for your Region before relying on it. The verified material also does not support a new rule API, IAM setup or source-precedence tutorial.
Sources
Frequently Asked Questions
Does resource criticality need separate enablement?
AWS says it is included with Security Hub Essentials and requires no new enablement. Accounts that do not use Security Hub still need the service’s own setup and configuration.
How quickly does criticality update after a tag changes?
The announcement confirms inference from tags and names, but gives no refresh deadline, tag-key specification or precedence between conflicting sources. Do not build automation around guessed rules; check current official documentation and the resource’s recorded determining source.
Can high criticality be treated as an automatic remediation instruction?
It should not be. Criticality adds business importance and prioritization context; the announcement does not promise that setting it will modify resources automatically. Choose remediation based on the specific exposure, impact and your team’s change process.
Which accounts and Regions can I view?
The current Resources guide says delegated administrators can view member-account resources. A configured home Region can display resources from linked Regions. This describes viewing scope and does not establish that every AWS Region supports the new feature.