AWS Security Hub Summary
By: Giuseppe Borgese
Tags: AWS, Aws Security, Monitoring, Aws Config, DevOps

I try to summarise what I did and learned in my journey with AWS Security Hub.

Videos

From re-invent 2018

AWS re:Invent 2018: [NEW LAUNCH!] Introduction to AWS Security Hub (SEC397) 45 minutes video but without initial configuration. Nice to have an idea about the product, and listen to testimonials companies that have already used.

From AWS Online Tech Talks Introduction to AWS Security Hub 45 minutes more or less like the re-invent one but without testimonials. Slides of this Video here

Initial Configuration

AWS Security Hub at the end is “only” a way to generate and read AWS Config rules also gather information from GuardDuty, Inspector and Macie.

The first action is to enable AWS Config without any rules inside as it is written in the documentation

When you turn on AWS Config’s recorder, make sure to choose to record all resources supported in a given region, including global resources.

Time to have the first information

In the first page of the getting started you can read

When you enable Security Hub, it immediately begins consuming, aggregating, organizing, and prioritizing findings from AWS services, such as Amazon GuardDuty Amazon Inspector , and Amazon Macie , and from AWS partner security solutions.

This is not exactly true, it was not exactly immediately for me.

The AWS config rules will be created when you enable the kind of checks that you want to do.

In my opinion, we can think about AWS Config and AWS Security Hub like a single service, this is not completely true because you can use AWS Config from its own but it can help to think this. For this reason, both the services are region specific. You can have in multiple regions but you need to switch to see the findings of another region.

I enabled AWS Config and AWS Security Hub in the same moment with Terraform they were necessary around 3 hours to see some information in the web console for the Security Hub.

Very Important. When you turn on AWS Config’s recorder as part of enabling AWS Config, make sure to choose to record all resources supported in a given region, including global resources.

In my account, I have also already enabled GuardDuty and the information in this panel

were available only after 12/18 hours from the initial Config/SecurityHub activation.

Terraform Support

Security hub for Terraform was released just 20th December 2018 still few features to enable it and associate with a standard subscription and product_subscription.

What can be useful for me and it is not yet there it is to script also the invite/accept a subaccount (it seems like the VPC peering ) and Create an insight (a group of findings) but still we can do these things from the web console.

To enable using terraform is it enough this single line.

resource "aws_securityhub_account" "example" {}

This will automatically generate a role in IAM with the default policy nothing to care about

To enable the standard CIS checks

resource "aws_securityhub_standards_subscription" "example" {

depends_on = ["aws_securityhub_account.example"]

standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"

}

To enable external vendors take a look to the official terraform page

Standards Supported in AWS Security Hub — CIS AWS Foundations

As we already said this first set of checks creates AWS Config Rules to perform its job.

The limit for the AWS Config managed rules is 150 rules per account per region but the ones created by Security Hub will not be counted in the 150 limit.

The duration of a finding is 90 days but many checks are continuously repeated so they always stay there. I assume only a resource that it is deleted like an ec2 or a security group can lose the finding.

The list of check supported by the AWS Security Hub with a full description of each one is in this page

Insight

As it is possible to read from the documentation.

A Security Hub insight is a collection of related findings defined by an aggregation statement and optional filters. An insight identifies a security area that requires attention and intervention

It is possible to use the default one or create a custom

Finding

It is the smaller part of the Security Hub, we can describe a finding like “a piece of security information” this can comes from the AWS provider GuardDuty, Macie, Inspector but also from external provider that maybe we are already using and paying and we want to integrate. Full list of providers here

Managing AWS Accounts in AWS Security Hub

You can have a master account and send an invitation to sub-accounts to be a member of yours.

In a Sub-Account you need to enable Security Hub before accept an invitation

A master account can view the sub-account findings and archive them of course.

A master account can have up to 1000 sub-accounts.

Also GuardDuty has the same system of master and sub-account but you need to enable also in Security Hub and you cannot use the GuardDuty permission. This is obvious but the documentation wants to specify with a Note

A Sub-Account can accept only one invitation and a master account cannot accept an invitation. That has sense or you are a master or a Sub Account

Automating AWS Security Hub with CloudWatch Events

What it is interesting is trigger and action based on an event, I copied this image from the official presentation slides.

From an Security Hub Event==> CloudWatch ==> Lamda or EC2 Run Command or Kinesis Data Streams or Step Functions or SNS topic or an SMS queue

To do this you need to create a Custom Action in the settings panel.

Personally, I didn’t try yet.

Pricing

Security hub is in the preview so at the moment doesn’t cost anything, there isn’t yet any information for the future in the official pricing page.

Anyway, the security hub is “only” a way to generate and read AWS config rules. reading the AWS config pricing page it is almost impossible to calculate a value instead using the calculator from the web console it is.

If we use in the Security hub the standard “CIS AWS Foundations” this generates 27 rules and the cost using the calculator is 45,5 $ for each account.

Conclusion

I hope this article helps you to understand quickly the potential of this service without reading the boring getting started as I did.

Join our community Slack and read our weekly Faun topics ⬇