# security-hub

Enables organization-level AWS Security Hub with standards, delegated admin, and cross-account aggregation.

Activates Security Hub in the current account, subscribes to CIS AWS Foundations, AWS Foundational Security Best Practices, and PCI DSS standards by default, designates a security account as delegated administrator, auto-enables member accounts, and optionally configures cross-region finding aggregation. Individual controls can be suppressed via the `disabled_controls` variable. Requires the `governance/organization` module to have trusted-access for `securityhub.amazonaws.com` enabled first.

## Usage

```hcl
module "security_hub" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/governance/security-hub/aws"
  version = "0.1.0"

  delegated_admin_account_id = "111122223333"
  finding_aggregation_region = "us-east-1"
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
## Requirements

| Name | Version |
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 6.50 |

## Providers

| Name | Version |
| ---- | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0 |

## Resources

| Name | Type |
| ---- | ---- |
| [aws_securityhub_account.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_account) | resource |
| [aws_securityhub_finding_aggregator.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_finding_aggregator) | resource |
| [aws_securityhub_member.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_member) | resource |
| [aws_securityhub_organization_admin_account.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_organization_admin_account) | resource |
| [aws_securityhub_organization_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_organization_configuration) | resource |
| [aws_securityhub_standards_control.disabled](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_standards_control) | resource |
| [aws_securityhub_standards_subscription.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_standards_subscription) | resource |

## Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_auto_enable_controls"></a> [auto_enable_controls](#input_auto_enable_controls) | Automatically enable new controls in enabled standards | `bool` | `true` | no |
| <a name="input_auto_enable_org_members"></a> [auto_enable_org_members](#input_auto_enable_org_members) | Auto-enable Security Hub for new organization member accounts | `bool` | `true` | no |
| <a name="input_control_finding_generator"></a> [control_finding_generator](#input_control_finding_generator) | Finding generator mode — SECURITY_CONTROL or STANDARD_CONTROL | `string` | `"SECURITY_CONTROL"` | no |
| <a name="input_delegated_admin_account_id"></a> [delegated_admin_account_id](#input_delegated_admin_account_id) | Account ID to designate as Security Hub delegated administrator | `string` | `null` | no |
| <a name="input_disabled_controls"></a> [disabled_controls](#input_disabled_controls) | Map of standard logical key to list of control IDs to disable | `map(list(string))` | `{}` | no |
| <a name="input_finding_aggregation_region"></a> [finding_aggregation_region](#input_finding_aggregation_region) | Region to aggregate findings from all linked regions (home region) | `string` | `null` | no |
| <a name="input_member_accounts"></a> [member_accounts](#input_member_accounts) | Map of member account logical keys to account IDs and email addresses | <pre>map(object({<br/>    account_id = string<br/>    email      = string<br/>  }))</pre> | `{}` | no |
| <a name="input_standards"></a> [standards](#input_standards) | Map of security standard ARN suffix to enable. Keys are logical names. | `map(string)` | <pre>{<br/>  "cis_aws_foundations": "ruleset/cis-aws-foundations-benchmark/v/1.4.0",<br/>  "fsbp": "standards/aws-foundational-security-best-practices/v/1.0.0",<br/>  "pci_dss": "standards/pci-dss/v/3.2.1"<br/>}</pre> | no |
| <a name="input_tags"></a> [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no |

## Outputs

| Name | Description |
| ---- | ----------- |
| <a name="output_id"></a> [id](#output_id) | Security Hub account ID (AWS account ID) |
| <a name="output_member_ids"></a> [member_ids](#output_member_ids) | Map of logical key to Security Hub member account ID |
| <a name="output_standards_subscription_arns"></a> [standards_subscription_arns](#output_standards_subscription_arns) | Map of logical standard key to subscription ARN |
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->