search

hashicorp / terraform-provider-aws

The AWS Provider enables Terraform to manage AWS resources.
https://registry.terraform.io/providers/hashicorp/aws
Mozilla Public License 2.0
9.66k stars 9.04k forks source link

Feature Request: Security Hub #6674

Closed gazoakley closed 3 years ago

gazoakley commented 5 years ago

Community Note

Description

AWS has announced Security Hub: https://aws.amazon.com/security-hub/

New or Affected Resource(s)

Potential Terraform Configuration

# Used to enable AWS Security Hub
resource "aws_securityhub_account" "example" {}

# Subscribe to the CIS AWS Foundations Benchmark
resource "aws_securityhub_standards_subscription" "example" {
  depends_on    = ["aws_securityhub_account.example"]
  standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
}

# Subscribe to a third party provider
data "aws_region" "current" {}

resource "aws_securityhub_product_subscription" "example" {
  depends_on  = ["aws_securityhub_account.example"]
  product_arn = "arn:aws:securityhub:${data.aws_region.current.name}:679703615338:product/armordefense/armoranywhere"
}

# Add a member AWS account
resource "aws_securityhub_member" "example" {
  depends_on = ["aws_securityhub_account.example"]
  account_id = "123456789012"
  email      = "example@example.com"
  invite       = true
}

resource "aws_securityhub_account" "invitee" {
  provider = "aws.invitee"
}

resource "aws_securityhub_invite_accepter" "invitee" {
  provider   = "aws.invitee"
  depends_on = ["aws_securityhub_account.invitee"]
  master_id  = "${aws_securityhub_invitation.example.master_id}"
}

# Create an insight (group of findings)
resource "aws_securityhub_insight" "example" {
  depends_on         = ["aws_securityhub_account.example"]
  name               = "Example"
  group_by_attribute = "AwsAccountId"

  filters {
    generator_id {
      comparison = "EQUALS"
      value      = "123456"
    }
  }
}

Product ARNs

Remember to replace ${var.region} as appropriate (or define that variable)

References

aws_securityhub_account

aws_securityhub_member

aws_securityhub_invite_accepter

aws_securityhub_insight

aws_securityhub_standards_subscription

aws_securityhub_product_subscription

gazoakley commented 5 years ago

I'm planning to work on this.

jsamuel1 commented 5 years ago

Reference: https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_EnableSecurityHub.html To enable SecurityHub in the master account

https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_EnableImportFindingsForProduct.html To enable findings for an integrated product

https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchEnableStandards.html To turn on standards (eg. CIS benchmark)

gazoakley commented 5 years ago

@jsamuel1 @philsynek @tdmalone @brandonstevens: Any feedback on the design/examples above? I'm considering a few things:

gazoakley commented 5 years ago

Following in the same style as aws_guardduty_member I'll look at having a combined resource that creates a member and sends an invite. I'm also going to rename aws_securityhub_standard to aws_securityhub_standard_subscription

jsamuel1 commented 5 years ago

re: aws_securityhub_standard_subscription - @gazoakley, might be best to keep the plural from the aws API - ie. aws_securityhub_standards_subscription.

I think the separate aws_securityhub_account is needed, so that we can turn securityhub on/off - otherwise there is no reliable way to roll back to a previous state. Would the other API's return an error if securityhub isn't on?

For organization/multi-account usage, using the _member API, does this scenario negate the need to explicity enable in the child accounts?

gazoakley commented 5 years ago

re: aws_securityhub_standard_subscription - @gazoakley, might be best to keep the plural from the aws API - ie. aws_securityhub_standards_subscription.

It really bugs me that they named standards with a plural (when you're enabling an individual standard) but not product (which seems more natural). I guess I should rename to be consistent with the API though.

I think the separate aws_securityhub_account is needed, so that we can turn securityhub on/off - otherwise there is no reliable way to roll back to a previous state. Would the other API's return an error if securityhub isn't on?

They do return an error - I'm relying on that behaviour right now to detect if the aws_securityhub_account is present to manage state correctly. I think keeping that resource is probably the best course.

For organization/multi-account usage, using the _member API, does this scenario negate the need to explicity enable in the child accounts?

Doesn't look like it from testing through the console - you still need to send an invite and accept it in the other account even if both accounts are part of the same organization.

bflad commented 5 years ago

The aws_securityhub_account and aws_securityhub_standards_subscription resources have been released in version 1.52.0 and version 1.53.0 of the AWS provider respectively. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

digitalkaoz commented 5 years ago

any plans for aws_securityhub_insight and maybe aws_securityhub_action ?

conzy commented 4 years ago

Any current plans for aws_securityhub_member and aws_securityhub_invite_accepter resources to support multi account setups? I think they would operate in a similar way to the existing aws_guardduty_member and guardduty_invite_accepter resources

Thanks!

JonTheNiceGuy commented 4 years ago

Is there any chance of a aws_securityhub_action_target resource? This would enable things like this: https://aws.amazon.com/blogs/apn/how-to-integrate-aws-security-hub-custom-actions-with-pagerduty/

Edit D'oh. This is already in progress as #10493

bflad commented 4 years ago

The new aws_securityhub_member resource has been merged and will release with version 2.54.0 of the Terraform AWS Provider, later this week. 👍

doublefelix7 commented 4 years ago

I'm pretty new to Terraform development and I'm interested in taking a look at the aws_securityhub_insight resource. One question that I have is when defining the resource schema, is it necesssary to define all of the AwsSecurityFindingFilters listed here?

https://docs.aws.amazon.com/sdk-for-go/api/service/securityhub/#AwsSecurityFindingFilters

ghost commented 4 years ago

Any current plans for aws_securityhub_member and aws_securityhub_invite_accepter resources to support multi account setups? I think they would operate in a similar way to the existing aws_guardduty_member and guardduty_invite_accepter resources

Thanks!

Looking forward to the release of aws_securityhub_invite_accepter

dgershman commented 4 years ago

There is also aws_securityhub_custom_action tracking an open PR ready for code review. https://github.com/terraform-providers/terraform-provider-aws/pull/10493

bflad commented 3 years ago

Support for the aws_securityhub_action_target (custom action) resource has been merged and will release with version 3.4.0 of the Terraform AWS Provider, later this week. Thanks to @hhamalai for the implementation there. 👍

jasonhuling commented 3 years ago

Hello, any plans for an equivalent of aws_guardduty_organization_admin_account (aws_securityhub_organization_admin_account) for delegating an administrator account when working in AWS Organizations? Looks like this is pretty new, announced on Nov 23, 2020.

https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_EnableOrganizationAdminAccount.html

azman0101 commented 3 years ago

any plans for aws_securityhub_insight and maybe aws_securityhub_action ?

Any news on SH insight ?

anGie44 commented 3 years ago

Hi @jasonhuling et al. 👋 Support for the aws_securityhub_organization_admin_account resource has been merged and will release with version 3.28.0 of the Terraform AWS Provider.

anGie44 commented 3 years ago

Support for the aws_securityhub_invite_accepter resource has been merged and was released with v3.29.0 of the Terraform AWS Provider.

anGie44 commented 3 years ago

Support for the aws_securityhub_insight resource has been merged and will release with v3.37.0 of Terraform AWS Provider.

ghost commented 3 years ago

This has been released in version 3.37.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

ghost commented 3 years ago

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!