Open stefano-franco opened 1 year ago
Voting for Prioritization
Volunteering to Work on This Issue
Great! This would allow for a very elegant Security Hub 'control panel'.
At the moment it's only possible to easily define which controls are suppressed. It would be great to also keep track of all controls you want to keep active, so Terraform can keep track if someone secretly disabled a control to do bad stuff unnoticed.
You would be able to do this then like so:
locals {
our_standard = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
our_exeptions = {
"id1.1" : "We manage this some other way.",
"id3.2" : "We manage this some other way too.",
}
extended_exeptions = { for id, reason in local.our_exeptions : "${local.our_standard}/${id}" => reason }
}
resource "aws_securityhub_standards_control" "our_exeptions" {
for_each = local.extended_exeptions
standards_control_arn = each.key
control_status = "DISABLED"
disabled_reason = each.value
depends_on = [aws_securityhub_standards_subscription.not_present_in_this_example]
}
data "aws_securityhub_standards_control_definitions" "our_standard" {
standards_control_arn = local.our_standard
}
resource "aws_securityhub_standards_control" "our_controls" {
for_each = setsubtract(
[for control in aws_securityhub_standards_control_definitions.our_standard : control.arn],
keys(local.extended_exeptions)
)
standards_control_arn = each.key
control_status = "ENABLED"
depends_on = [aws_securityhub_standards_subscription.not_present_in_this_example]
}
I'd like to try this one!
New centralized management features are now available and appear to be easier to apply to multiple regions. https://aws.amazon.com/jp/blogs/security/introducing-new-central-configuration-capabilities-in-aws-security-hub/
Description
Corresponding data source for boto3 method list_security_control_definitions and API call ListSecurityControlDefinitions.
This would allow to list all available controls for a specific Security Hub standard, including the CurrentRegionAvailability. Security Hub has regional limitation that makes it really difficult to disable controls in different regions without adding manual exceptions.
A data source that could provide contextual information about all available controls could be used to conditionally disable only the available controls in each region.
Requested Resource(s) and/or Data Source(s)
Potential Terraform Configuration
References
Would you like to implement a fix?
None