{"id":20475893,"url":"https://github.com/aws-ia/terraform-aws-security-hub","last_synced_at":"2025-04-13T12:34:38.201Z","repository":{"id":184548090,"uuid":"633606744","full_name":"aws-ia/terraform-aws-security-hub","owner":"aws-ia","description":"Configure and deploy AWS Security Hub.","archived":false,"fork":false,"pushed_at":"2023-07-28T22:24:06.000Z","size":683,"stargazers_count":16,"open_issues_count":2,"forks_count":6,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-03-27T03:35:16.441Z","etag":null,"topics":["aws","aws-security","aws-security-hub","security","security-hub","securityhub"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/aws-ia/security-hub/aws/latest","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aws-ia.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-04-27T22:08:04.000Z","updated_at":"2025-02-18T21:25:12.000Z","dependencies_parsed_at":"2023-07-28T23:35:27.520Z","dependency_job_id":null,"html_url":"https://github.com/aws-ia/terraform-aws-security-hub","commit_stats":null,"previous_names":["aws-ia/terraform-aws-security-hub"],"tags_count":1,"template":false,"template_full_name":"aws-ia/terraform-repo-template","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-ia%2Fterraform-aws-security-hub","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-ia%2Fterraform-aws-security-hub/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-ia%2Fterraform-aws-security-hub/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-ia%2Fterraform-aws-security-hub/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aws-ia","download_url":"https://codeload.github.com/aws-ia/terraform-aws-security-hub/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248714728,"owners_count":21149955,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","aws-security","aws-security-hub","security","security-hub","securityhub"],"created_at":"2024-11-15T15:17:32.454Z","updated_at":"2025-04-13T12:34:38.151Z","avatar_url":"https://github.com/aws-ia.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Terraform Module for AWS Security Hub\n\nTerraform module that creates AWS Security Hub resources.\n\n- [Terraform Module for AWS Security Hub](#terraform-module-for-aws-security-hub)\n  - [Usage](#usage)\n    - [Standalone](#standalone)\n    - [Organizations](#organizations)\n  - [Overview Diagrams](#overview-diagrams)\n    - [Standalone](#standalone-1)\n    - [Organizations](#organizations-1)\n  - [Terraform Module](#terraform-module)\n\n## Usage\n\n### Standalone\n\n```hcl\nmodule \"security_hub\" {\n  source = \"../../../\"\n\n  enable_default_standards  = false\n  control_finding_generator = \"STANDARD_CONTROL\"\n  auto_enable_controls      = true\n\n  product_config = [{\n    enable = true\n    arn    = \"arn:aws:securityhub:${data.aws_region.current.name}::product/aws/guardduty\"\n  }]\n\n  standards_config = {\n    aws_foundational_security_best_practices = {\n      enable = true\n      status = \"ENABLED\"\n    }\n    cis_aws_foundations_benchmark_v120 = {\n      enable = false\n    }\n    cis_aws_foundations_benchmark_v140 = {\n      enable = true\n      status = \"ENABLED\"\n    }\n    nist_sp_800_53_rev5 = {\n      enable = false\n    }\n    pci_dss = {\n      enable = false\n    }\n  }\n\n  action_target = [{\n    name        = \"Send to Amazon SNS\"\n    identifier  = \"SendToSNS\"\n    description = \"This is a custom action to send findings to SNS Topic\"\n  }]\n\n}\n\nresource \"aws_securityhub_standards_control\" \"ensure_iam_password_policy_prevents_password_reuse\" {\n  standards_control_arn = \"arn:aws:securityhub:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:control/cis-aws-foundations-benchmark/v/1.4.0/1.10\"\n  control_status        = \"DISABLED\"\n  disabled_reason       = \"Password policies are managed by external resource\"\n\n  depends_on = [module.security_hub]\n}\n\nresource \"aws_securityhub_insight\" \"this\" {\n  filters {\n    created_at {\n      date_range {\n        unit  = \"DAYS\"\n        value = 7\n      }\n    }\n    network_source_ipv4 {\n      cidr = \"10.0.0.0/16\"\n    }\n    criticality {\n      gte = \"80\"\n    }\n    resource_tags {\n      comparison = \"EQUALS\"\n      key        = \"Environment\"\n      value      = \"Development\"\n    }\n  }\n\n  group_by_attribute = \"AwsAccountId\"\n\n  name = \"insight\"\n\n  depends_on = [module.standalone_security_hub]\n}\n```\n\n### Organizations\n\n```hcl\nmodule \"delegated_admin\" {\n  source = \"aws-ia/terraform-aws-security-hub/aws//modules/organizations_admin/\"\n\n  admin_account_id      = data.aws_caller_identity.current.account_id\n  auto_enable_standards = \"DEFAULT\"\n\n  depends_on = [module.security_hub]\n}\n\nmodule \"member_account\" {\n  source = \"aws-ia/terraform-aws-security-hub/aws//modules/organizations_member/\"\n\n  providers = {\n    aws        = aws\n    aws.member = aws.member\n  }\n\n  member_config = [{\n    account_id = \"281190191734\"\n    email      = \"required@example.com\"\n    invite     = false\n  }]\n\n  depends_on = [module.security_hub]\n}\n\nmodule \"security_hub\" {\n  source = \"aws-ia/terraform-aws-security-hub\"\n\n  enable_default_standards  = false\n  control_finding_generator = \"STANDARD_CONTROL\"\n  auto_enable_controls      = true\n\n  product_config = [{\n    enable = true\n    arn    = \"arn:aws:securityhub:${data.aws_region.current.name}::product/aws/guardduty\"\n  }]\n\n  standards_config = {\n    aws_foundational_security_best_practices = {\n      enable = true\n      status = \"ENABLED\"\n    }\n    cis_aws_foundations_benchmark_v120 = {\n      enable = false\n    }\n    cis_aws_foundations_benchmark_v140 = {\n      enable = true\n      status = \"ENABLED\"\n    }\n    nist_sp_800_53_rev5 = {\n      enable = false\n    }\n    pci_dss = {\n      enable = false\n    }\n  }\n\n  action_target = [{\n    name        = \"Send to Amazon SNS\"\n    identifier  = \"SendToSNS\"\n    description = \"This is a custom action to send findings to SNS Topic\"\n  }]\n}\n\nresource \"aws_securityhub_insight\" \"this\" {\n  filters {\n    aws_account_id {\n      comparison = \"EQUALS\"\n      value      = \"123456789012\"\n    }\n    aws_account_id {\n      comparison = \"EQUALS\"\n      value      = \"098765432109\"\n    }\n    created_at {\n      date_range {\n        unit  = \"DAYS\"\n        value = 7\n      }\n    }\n    network_source_ipv4 {\n      cidr = \"10.0.0.0/16\"\n    }\n    criticality {\n      gte = \"80\"\n    }\n    resource_tags {\n      comparison = \"EQUALS\"\n      key        = \"Environment\"\n      value      = \"Development\"\n    }\n  }\n\n  group_by_attribute = \"AwsAccountId\"\n\n  name = \"insight-per-account-id\"\n\n  depends_on = [module.security_hub]\n}\n```\n\n## Overview Diagrams\n\n### Standalone\n\n![standalone-diagram](./docs/Architectures-SecurityHub\\_Standalone.png)\n\n### Organizations\n\n![organizations-diagram](./docs/Architectures-SecurityHub\\_Org.png)\n\n## Terraform Module\n\n### Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_terraform\"\u003e\u003c/a\u003e [terraform](#requirement\\_terraform) | \u003e= 1.0.0 |\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | \u003e= 4.47 |\n| \u003ca name=\"requirement_time\"\u003e\u003c/a\u003e [time](#requirement\\_time) | \u003e= 0.9 |\n\n### Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | \u003e= 4.47 |\n| \u003ca name=\"provider_time\"\u003e\u003c/a\u003e [time](#provider\\_time) | \u003e= 0.9 |\n\n### Modules\n\nNo modules.\n\n### Resources\n\n| Name | Type |\n|------|------|\n| [aws_securityhub_account.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_account) | resource |\n| [aws_securityhub_action_target.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_action_target) | resource |\n| [aws_securityhub_finding_aggregator.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_finding_aggregator) | resource |\n| [aws_securityhub_product_subscription.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_product_subscription) | resource |\n| [aws_securityhub_standards_subscription.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/securityhub_standards_subscription) | resource |\n| [time_sleep.wait_securityhub_enable](https://registry.terraform.io/providers/hashicorp/time/latest/docs/resources/sleep) | resource |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n\n### Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_action_target\"\u003e\u003c/a\u003e [action\\_target](#input\\_action\\_target) | Creates Security Hub custom action.\u003cbr\u003e  `name`        - The description for the custom action target.\u003cbr\u003e  `identifier`  - The ID for the custom action target.\u003cbr\u003e  `description` - The name of the custom action target. | \u003cpre\u003elist(object({\u003cbr\u003e    name        = string\u003cbr\u003e    identifier  = string\u003cbr\u003e    description = string\u003cbr\u003e  }))\u003c/pre\u003e | `[]` | no |\n| \u003ca name=\"input_auto_enable_controls\"\u003e\u003c/a\u003e [auto\\_enable\\_controls](#input\\_auto\\_enable\\_controls) | Whether to automatically enable new controls when they are added to standards that are enabled. By default, this is set to true, and new controls are enabled automatically. To not automatically enable new controls, set this to false. | `bool` | `true` | no |\n| \u003ca name=\"input_control_finding_generator\"\u003e\u003c/a\u003e [control\\_finding\\_generator](#input\\_control\\_finding\\_generator) | Updates whether the calling account has consolidated control findings turned on. If the value for this field is set to SECURITY\\_CONTROL, Security Hub generates a single finding for a control check even when the check applies to multiple enabled standards. If the value for this field is set to STANDARD\\_CONTROL, Security Hub generates separate findings for a control check when the check applies to multiple enabled standards. For accounts that are part of an organization, this value can only be updated in the administrator account. | `string` | `\"STANDARD_CONTROL\"` | no |\n| \u003ca name=\"input_enable_default_standards\"\u003e\u003c/a\u003e [enable\\_default\\_standards](#input\\_enable\\_default\\_standards) | Whether to enable the security standards that Security Hub has designated as automatically enabled including: AWS Foundational Security Best Practices v1.0.0 and CIS AWS Foundations Benchmark v1.2.0. Defaults to `true`. | `bool` | `true` | no |\n| \u003ca name=\"input_linking_mode\"\u003e\u003c/a\u003e [linking\\_mode](#input\\_linking\\_mode) | Indicates whether to aggregate findings from all of the available Regions or from a specified list. The options are ALL\\_REGIONS, ALL\\_REGIONS\\_EXCEPT\\_SPECIFIED or SPECIFIED\\_REGIONS. When ALL\\_REGIONS or ALL\\_REGIONS\\_EXCEPT\\_SPECIFIED are used, Security Hub will automatically aggregate findings from new Regions as Security Hub supports them and you opt into them. | `string` | `\"ALL_REGIONS\"` | no |\n| \u003ca name=\"input_product_config\"\u003e\u003c/a\u003e [product\\_config](#input\\_product\\_config) | The ARN of the product that generates findings that you want to import into Security Hub. | \u003cpre\u003elist(object({\u003cbr\u003e    enable = bool\u003cbr\u003e    arn    = string\u003cbr\u003e  }))\u003c/pre\u003e | `null` | no |\n| \u003ca name=\"input_specified_regions\"\u003e\u003c/a\u003e [specified\\_regions](#input\\_specified\\_regions) | List of regions to include or exclude (required if linking\\_mode is set to ALL\\_REGIONS\\_EXCEPT\\_SPECIFIED or SPECIFIED\\_REGIONS) | `list(string)` | `null` | no |\n| \u003ca name=\"input_standards_config\"\u003e\u003c/a\u003e [standards\\_config](#input\\_standards\\_config) | `aws_foundational_security_best_practices` - AWS Foundational Security Best Practices\u003cbr\u003e  `cis_aws_foundations_benchmark_v120` - CIS AWS Foundations Benchmark v1.2.0\u003cbr\u003e  `cis_aws_foundations_benchmark_v140` - CIS AWS Foundations Benchmark v1.4.0\u003cbr\u003e  `nist_sp_800_53_rev5` - NIST SP 800-53 Rev. 5\u003cbr\u003e  `pci_dss` - PCI DSS | \u003cpre\u003eobject({\u003cbr\u003e    aws_foundational_security_best_practices = object({\u003cbr\u003e      enable          = bool\u003cbr\u003e      status          = optional(string)\u003cbr\u003e      disabled_reason = optional(string)\u003cbr\u003e    })\u003cbr\u003e    cis_aws_foundations_benchmark_v120 = object({\u003cbr\u003e      enable          = bool\u003cbr\u003e      status          = optional(string)\u003cbr\u003e      disabled_reason = optional(string)\u003cbr\u003e    })\u003cbr\u003e    cis_aws_foundations_benchmark_v140 = object({\u003cbr\u003e      enable          = bool\u003cbr\u003e      status          = optional(string)\u003cbr\u003e      disabled_reason = optional(string)\u003cbr\u003e    })\u003cbr\u003e    nist_sp_800_53_rev5 = object({\u003cbr\u003e      enable          = bool\u003cbr\u003e      status          = optional(string)\u003cbr\u003e      disabled_reason = optional(string)\u003cbr\u003e    })\u003cbr\u003e    pci_dss = object({\u003cbr\u003e      enable          = bool\u003cbr\u003e      status          = optional(string)\u003cbr\u003e      disabled_reason = optional(string)\u003cbr\u003e    })\u003cbr\u003e  })\u003c/pre\u003e | \u003cpre\u003e{\u003cbr\u003e  \"aws_foundational_security_best_practices\": {\u003cbr\u003e    \"enable\": true,\u003cbr\u003e    \"status\": \"ENABLED\"\u003cbr\u003e  },\u003cbr\u003e  \"cis_aws_foundations_benchmark_v120\": {\u003cbr\u003e    \"enable\": true,\u003cbr\u003e    \"status\": \"ENABLED\"\u003cbr\u003e  },\u003cbr\u003e  \"cis_aws_foundations_benchmark_v140\": {\u003cbr\u003e    \"enable\": false\u003cbr\u003e  },\u003cbr\u003e  \"nist_sp_800_53_rev5\": {\u003cbr\u003e    \"enable\": false\u003cbr\u003e  },\u003cbr\u003e  \"pci_dss\": {\u003cbr\u003e    \"enable\": false\u003cbr\u003e  }\u003cbr\u003e}\u003c/pre\u003e | no |\n\n### Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_action_target\"\u003e\u003c/a\u003e [action\\_target](#output\\_action\\_target) | Security Hub custome action targets. |\n| \u003ca name=\"output_finding_aggregator\"\u003e\u003c/a\u003e [finding\\_aggregator](#output\\_finding\\_aggregator) | Security Hub finding aggregator configuration. |\n| \u003ca name=\"output_product_subscription\"\u003e\u003c/a\u003e [product\\_subscription](#output\\_product\\_subscription) | Security Hub products subscriptions. |\n| \u003ca name=\"output_securityhub_account\"\u003e\u003c/a\u003e [securityhub\\_account](#output\\_securityhub\\_account) | Security Hub AWS account configuration. |\n| \u003ca name=\"output_standards_subscription\"\u003e\u003c/a\u003e [standards\\_subscription](#output\\_standards\\_subscription) | Security Hub compliance standards subscriptions. |\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faws-ia%2Fterraform-aws-security-hub","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faws-ia%2Fterraform-aws-security-hub","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faws-ia%2Fterraform-aws-security-hub/lists"}