security-hub

Enables organization-level AWS Security Hub with standards, delegated admin, and cross-account aggregation.

Activates Security Hub in the current account, subscribes to CIS AWS Foundations, AWS Foundational Security Best Practices, and PCI DSS standards by default, designates a security account as delegated administrator, auto-enables member accounts, and optionally configures cross-region finding aggregation. Individual controls can be suppressed via the disabled_controls variable. Requires the governance/organization module to have trusted-access for securityhub.amazonaws.com enabled first.

Usage

module "security_hub" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/governance/security-hub/aws"
  version = "0.1.0"

  delegated_admin_account_id = "111122223333"
  finding_aggregation_region = "us-east-1"
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_securityhub_account.this	resource
aws_securityhub_finding_aggregator.this	resource
aws_securityhub_member.this	resource
aws_securityhub_organization_admin_account.this	resource
aws_securityhub_organization_configuration.this	resource
aws_securityhub_standards_control.disabled	resource
aws_securityhub_standards_subscription.this	resource

Inputs

Name	Description	Type	Default	Required
auto_enable_controls	Automatically enable new controls in enabled standards	`bool`	`true`	no
auto_enable_org_members	Auto-enable Security Hub for new organization member accounts	`bool`	`true`	no
control_finding_generator	Finding generator mode — SECURITY_CONTROL or STANDARD_CONTROL	`string`	`"SECURITY_CONTROL"`	no
delegated_admin_account_id	Account ID to designate as Security Hub delegated administrator	`string`	`null`	no
disabled_controls	Map of standard logical key to list of control IDs to disable	`map(list(string))`	`{}`	no
finding_aggregation_region	Region to aggregate findings from all linked regions (home region)	`string`	`null`	no
member_accounts	Map of member account logical keys to account IDs and email addresses	map(object({ account_id = string email = string }))	`{}`	no
standards	Map of security standard ARN suffix to enable. Keys are logical names.	`map(string)`	{ "cis_aws_foundations": "ruleset/cis-aws-foundations-benchmark/v/1.4.0", "fsbp": "standards/aws-foundational-security-best-practices/v/1.0.0", "pci_dss": "standards/pci-dss/v/3.2.1"}	no
tags	Resource tags to apply to all resources	`map(string)`	`{}`	no

Outputs

Name	Description
id	Security Hub account ID (AWS account ID)
member_ids	Map of logical key to Security Hub member account ID
standards_subscription_arns	Map of logical standard key to subscription ARN