1. Security Hub for Organization
AWS Security Hub offers a comprehensive overview of your AWS infrastructure's security posture, helping you monitor and maintain compliance with industry standards and best practices.
2.2.1. Centrally managed
A target that only the delegated administrator can configure across Regions by using configuration policies.
The delegated administrator account specifies whether a target is centrally managed. The delegated administrator can also change a target's status from centrally managed to self-managed, or the other way around via Security Hub configuration.
centrally-managed implies the presence of a central team responsible for enforcing and managing the mandatory Security Hub standards and controls across the organization. This approach ensures that all accounts within the organization adhere to unified security standards.
2.2.2. Self-managed
A target that manages its own Security Hub configurations. A self-managed target uses account-specific operations to configure Security Hub for itself separately in each Region. This is in contrast to centrally managed targets, which are configurable only by the delegated administrator across Regions through configuration policies.
3. Enable Security Hub and Central Configuration using Terraform
In the following sections, we will explore how to enable Security Hub for AWS Organization, activate central configuration, and create configuration policies using Terraform.
i. Enable Security Hub and designate a Delegated Admin account for AWS Organization.
resource "aws_organizations_organization" "add_sh_service_principal" {
aws_service_access_principals = ["securityhub.amazonaws.com"]
feature_set = "ALL"
}
resource "aws_securityhub_organization_admin_account" "add_securityhub_admin" {
admin_account_id = "123456789012"
depends_on = [aws_organizations_organization.add_sh_service_principal]
}
Note: Above Terraform code must be executed in management account.
ii. Enable Security Hub configuration as central configuration
resource "aws_securityhub_organization_configuration" "enable_central_config" {
auto_enable = false
auto_enable_standards = "NONE"
organization_configuration {
configuration_type = "CENTRAL"
}
}
Once you enable the Security Hub configuration type to CENTRAL all the accounts in the member accounts will be updated as self-managed. you can see this by going to security hub service then under configuration.
iii. Example Terraform code to enable one security standard
resource "aws_securityhub_configuration_policy" "aws_foundational_standard" {
name = "AWS-Foundational-Standard"
description = "This is an example to enable single security standard"
configuration_policy {
service_enabled = true
enabled_standard_arns = [
"arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"
]
security_controls_configuration {
disabled_control_identifiers = []
}
}
depends_on = [aws_securityhub_organization_configuration.enable_central_config]
}
iv. Example Terraform code to enable single security control
resource "aws_securityhub_configuration_policy" "block_s3_public_access" {
name = "Block-S3-Public-Access"
description = "This is an example to enable single security control in the standard"
configuration_policy {
service_enabled = true
enabled_standard_arns = [
"arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"
]
security_controls_configuration {
enabled_control_identifiers = [
"S3.8"
]
}
}
depends_on = [aws_securityhub_organization_configuration.enable_central_config]
}
v. Example Terraform code to enable one standard and disable single security control
resource "aws_securityhub_configuration_policy" "block_s3_public_access" {
name = "Disable-Block-S3-Public-Access"
description = "This is an example to enable disable security control in the aws foundational standard"
configuration_policy {
service_enabled = true
enabled_standard_arns = [
"arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"
]
security_controls_configuration {
disabled_control_identifiers = [
"S3.8"
]
}
}
depends_on = [aws_securityhub_organization_configuration.enable_central_config]
}
vi. Example Terraform code to attach the configuration policy for specific OU
resource "aws_securityhub_configuration_policy_association" "associate_ou" {
target_id = "<OU_ID>"
policy_id = aws_securityhub_configuration_policy.aws_foundational_standard.id
}
Vii. Example Terraform code to attach the configuration policy with single account
resource "aws_securityhub_configuration_policy_association" "associate_account" {
target_id = "111122223333"
policy_id = aws_securityhub_configuration_policy.block_s3_public_access.id
}
4. Other Key Features of Security Hub
Automation Rules: You can use automation rules in AWS Security Hub to automatically update findings. When findings are received, Security Hub can take actions like hiding findings, changing their severity, or adding notes. These actions are applied to findings that meet the conditions you set.
Cross-Region aggregation: With AWS Security Hub, you can aggregate findings, updates, insights, compliance statuses, and security scores from multiple AWS Regions into a single home Region, allowing you to manage all the data centrally.
Centralize Dashboard: You can customize the Summary dashboard in the AWS Security Hub console to display only the security data that matters most to you.
Integrations: AWS Security Hub can ingest security findings from several AWS services and supported third-party AWS Partner Network security solutions.
I welcome your feedback and suggestions on alternative best practices. If you have any other methods or approaches that you believe are more effective than the one mentioned, please feel free to share your insights by leaving a comment. I value diverse perspectives and are open to exploring different approaches to achieve optimal results. Your suggestions are greatly appreciated!
SOCIAL SHARE CARD GENERATOR