Control: 4.16 Ensure AWS Security Hub is enabled

Description

Security Hub collects security data from various AWS accounts, services, and supported third-party partner products, helping you analyze your security trends and identify the highest-priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from the AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.

AWS Security Hub provides you with a comprehensive view of your security state in AWS and helps you check your environment against security industry standards and best practices, enabling you to quickly assess the security posture across your AWS accounts.

Remediation

To grant the permissions required to enable Security Hub, attach the Security Hub managed policy AWSSecurityHubFullAccess to an IAM user, group, or role.

Enabling Security Hub:

From Console

Use the credentials of the IAM identity to sign in to the Security Hub console.
When you open the Security Hub console for the first time, choose Go to Security Hub.
The Security standards section on the welcome page lists supported security standards. Check the box for a standard to enable it.
Choose Enable Security Hub.

From Command Line

Run the enable-security-hub command, including --enable-default-standards to enable the default standards:

aws securityhub enable-security-hub --enable-default-standards

To enable Security Hub without the default standards, include --no-enable-default-standards:

aws securityhub enable-security-hub --no-enable-default-standards

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.cis_v400_4_16

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.cis_v400_4_16 --share

SQL

This control uses a named query:

select
  'arn:' || r.partition || '::' || r.region || ':' || r.account_id as resource,
  case
    when r.region = any(array['af-south-1', 'eu-south-1', 'cn-north-1', 'cn-northwest-1', 'ap-northeast-3']) then 'skip'
    -- Skip any regions that are disabled in the account.
    when r.opt_in_status = 'not-opted-in' then 'skip'
    when h.hub_arn is not null then 'ok'
    else 'alarm'
  end as status,
  case
    when r.region = any(array['af-south-1', 'eu-south-1', 'cn-north-1', 'cn-northwest-1', 'ap-northeast-3']) then r.region ||  ' region not supported.'
    when r.opt_in_status = 'not-opted-in' then r.region || ' region is disabled.'
    when h.hub_arn is not null then 'Security Hub enabled in ' || r.region || '.'
    else 'Security Hub disabled in ' || r.region || '.'
  end as reason
  , r.region, r.account_id
from
  aws_region as r
  left join aws_securityhub_hub as h on r.account_id = h.account_id and r.name = h.region;