Security Hub Standards are not applied at the OU level

[jaristizabalc]

Describe the bug Using the following configuration on security-config.yaml

securityHub: enable: true regionAggregation: true excludeRegions: [] standards:

• name: AWS Foundational Security Best Practices v1.0.0

  https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-fsbp-controls.html

  deploymentTargets:
   organizationalUnits:
     - Staging
  enable: true

• name: CIS AWS Foundations Benchmark v1.4.0

  https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cis-controls.html

  deploymentTargets:
   organizationalUnits:
     - Staging        
  enable: true

• name: NIST Special Publication 800-53 Revision 5

  https://docs.aws.amazon.com/securityhub/latest/userguide/nist-standard.html

  enable: true

The intent is to apply Security Standards to a specific OU for onboarding brownfield accounts.

To Reproduce Release change to apply settings.

Expected behavior Standards are not enabled, only the AWS Foundational Security Best Practices v1.0.0, and it is applied at the root level. It looks like the deploymentTargets option does not have any effect.

After the LZA enabled Security Hub I noticed that it is still using the Local configuration setting:

If you enable Central configuration you can apply the Standards at the OU level. Can I configure the LZA to use this feature? would deploymentTargets then apply the Standards accordingly?

• [ ] Version: 1.6.2
• [ ] Region: us-east-1
• [ ] Was the solution modified from the version published on this repository? No
• [ ] If the answer to the previous question was yes, are the changes available on GitHub?
• [ ] Have you checked your service quotas for the services this solution uses? no limits
• [ ] Were there any errors in the CloudWatch Logs?

Thank you.

Juan.

[richardkeit]

Hi @jaristizabalc ,

Consolidated findings are a duplicate of this issue - please go give it a 👍 https://github.com/awslabs/landing-zone-accelerator-on-aws/issues/359

[mongrol]

I don't believe Consolidated findings are a duplicate of this. This issue is about whether LZA allows the enabling (and subsequent usage) of Central Configuration of Security Hub. Consolidated Findings are a General Setting. In my testing clickopsing Central Configuration is reverted back to Local on the next run of LZA.