Repository: cloud-custodian/cloud-custodian

Issue:
Enable/Disable SecurityHub
**Is your feature request related to a problem? Please describe.**
I want to check if SecurityHub is enabled or not for all the accounts and take an action accordingly

**Describe the solution you'd like**
We can create a filter and action on `resource: aws.account`. Filter uses api `describe_hub`(https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/securityhub.html#SecurityHub.Client.describe_hub)
If we get a response back => sechub is enabled. If we get an exception, take action (https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/securityhub.html#SecurityHub.Client.enable_security_hub)

**Describe alternatives you've considered**
Create a new resource type

**Additional context**
NA



Discussion:

Resolving patch:
diff --git a/c7n/resources/account.py b/c7n/resources/account.py
--- a/c7n/resources/account.py
+++ b/c7n/resources/account.py
@@ -1731,3 +1731,34 @@ def process(self, resources):
         client.put_block_public_access_configuration(
             BlockPublicAccessConfiguration=updatedConfig
         )
+
+
+@filters.register('securityhub')
+class SecHubEnabled(Filter):
+    """Filter an account depending on whether security hub is enabled or not.
+
+    :example:
+
+    .. code-block:: yaml
+
+       policies:
+         - name: check-securityhub-status
+           resource: aws.account
+           filters:
+            - type: securityhub
+              enabled: true
+
+    """
+
+    permissions = ('securityhub:DescribeHub',)
+
+    schema = type_schema('securityhub', enabled={'type': 'boolean'})
+
+    def process(self, resources, event=None):
+        state = self.data.get('enabled', True)
+        client = local_session(self.manager.session_factory).client('securityhub')
+        sechub = self.manager.retry(client.describe_hub, ignore_err_codes=(
+            'InvalidAccessException',))
+        if state == bool(sechub):
+            return resources
+        return []


Test patch:
diff --git a/tests/data/placebo/test_enable_securityhub/iam.ListAccountAliases_1.json b/tests/data/placebo/test_enable_securityhub/iam.ListAccountAliases_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_enable_securityhub/iam.ListAccountAliases_1.json
@@ -0,0 +1,10 @@
+{
+    "status_code": 200,
+    "data": {
+        "AccountAliases": [
+            "custodian-skunk-works"
+        ],
+        "IsTruncated": false,
+        "ResponseMetadata": {}
+    }
+}
\ No newline at end of file
diff --git a/tests/data/placebo/test_enable_securityhub/securityhub.DescribeHub_1.json b/tests/data/placebo/test_enable_securityhub/securityhub.DescribeHub_1.json
new file mode 100644
--- /dev/null
+++ b/tests/data/placebo/test_enable_securityhub/securityhub.DescribeHub_1.json
@@ -0,0 +1,12 @@
+{
+    "status_code": 401,
+    "data": {
+        "Error": {
+            "Message": "AccountId: 644160558196 is not enabled for securityhub. Currentstate: false",
+            "Code": "InvalidAccessException"
+        },
+        "ResponseMetadata": {},
+        "Message": "AccountId: 644160558196 is not enabled for securityhub. Currentstate: false",
+        "Code": "InvalidAccessException"
+    }
+}
\ No newline at end of file
diff --git a/tests/test_account.py b/tests/test_account.py
--- a/tests/test_account.py
+++ b/tests/test_account.py
@@ -1166,3 +1166,18 @@ def test_data_events(self):
         )
         resources = p.run()
         self.assertEqual(len(resources), 1)
+
+    def test_enable_securityhub(self):
+        session_factory = self.replay_flight_data("test_enable_securityhub")
+        p = self.load_policy(
+            {
+                'name': 'enable-sechub',
+                'resource': 'account',
+                'filters': [{
+                    'type': 'securityhub',
+                    'enabled': False
+                }],
+            },
+            session_factory=session_factory)
+        resources = p.run()
+        self.assertEqual(len(resources), 1)