search

awslabs / landing-zone-accelerator-on-aws

Deploy a multi-account cloud foundation to support highly-regulated workloads and complex compliance requirements.
https://aws.amazon.com/solutions/implementations/landing-zone-accelerator-on-aws/
Apache License 2.0
531 stars 420 forks source link

Support "excludeOus" parameter for Security Services #529

Open para0056 opened 1 month ago

para0056 commented 1 month ago

Is your feature request related to a problem? Please describe. For customers leveraging a single LZA environment for both sensitive/protected and innovation/exploratory workloads, it would be great to be able to exclude certain OUs from AWS Security Hub, Detective, GuardDuty, and Inspector in order to reduce cost and operational overhead.

Describe the feature you'd like Support excludeOus parameter in LZA security-service.yaml for AWS Security Hub, Detective, GuardDuty, and Inspector.

bfg-cloudsupport commented 1 month ago

Sandbox accounts are still valid targets to attackers and having no security services enabled seems folly to me. Instead I'd prefer support of selectively enabling/disabling controls/services/standards on an account/ou basis. The standards are good practise but it's clear many of the controls are overhanded for earlier dev accounts and it just causes noise. The current option is to disable and replace these controls with our own.