Skip to main content

🛡️ AWS Security Hub is not enabled🟢

Logic​

Similar Policies​

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-z-bc139af81

Description​

Open File

Description​

Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues. When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie. You can also enable integrations with AWS partner security products.

Rationale​

AWS Security Hub provides you with a comprehensive view of your security state in AWS and helps you check your environment against security industry standards and best practices - enabling you to quickly assess the security posture across your AWS accounts.

Impact​

It is recommended AWS Security Hub be enabled in all regions. AWS Security Hub requires AWS Config to be enabled.

Audit​

The process to evaluate AWS Security Hub configuration per region

From Console​
  1. Sign in to the AWS Management Console and open the AWS Security Hub console at https://console.aws.amazon.com/securityhub/.

... see more

Remediation​

Open File

Remediation​

To grant the permissions required to enable Security Hub, attach the Security Hub managed policy AWSSecurityHubFullAccess to an IAM user, group, or role. Enabling Security Hub

From Console​

  1. Use the credentials of the IAM identity to sign in to the Security Hub console.
  2. When you open the Security Hub console for the first time, choose Go to Security Hub.
  3. The Security standards section on the welcome page lists supported security standards. Check the box for a standard to enable it.
  4. Choose Enable Security Hub.

From Command Line​

  1. Run the enable-security-hub command. To enable the default standards, include --enable-default-standards:
aws securityhub enable-security-hub --enable-default-standards
  1. To enable the security hub without the default standards, include --no-enable-default-standards:
aws securityhub enable-security-hub --no-enable-default-standards

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Well-Architected → 💼 SEC04-BP03 Correlate and enrich security alerts2no data
💼 AWS Well-Architected → 💼 SEC04-BP04 Initiate remediation for non-compliant resources2no data
💼 CIS AWS v1.5.0 → 💼 4.16 Ensure AWS Security Hub is enabled - Level 2 (Automated)11no data
💼 CIS AWS v2.0.0 → 💼 4.16 Ensure AWS Security Hub is enabled - Level 2 (Automated)11no data
💼 CIS AWS v3.0.0 → 💼 4.16 Ensure AWS Security Hub is enabled - Level 2 (Automated)11no data
💼 CIS AWS v4.0.0 → 💼 4.16 Ensure AWS Security Hub is enabled (Automated)1no data
💼 CIS AWS v4.0.1 → 💼 4.16 Ensure AWS Security Hub is enabled (Automated)1no data
💼 CIS AWS v5.0.0 → 💼 4.16 Ensure AWS Security Hub is enabled (Automated)1no data
💼 CIS AWS v6.0.0 → 💼 5.16 Ensure AWS Security Hub is enabled (Automated)1no data
💼 Cloudaware Framework → 💼 Threat Protection31no data
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)265no data
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)4851no data
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)65no data
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)65no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events145no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events85no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events142no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation44765no data