Skip to content

Latest commit

 

History

History
133 lines (106 loc) · 6.94 KB

README.md

File metadata and controls

133 lines (106 loc) · 6.94 KB
Raw

AWS Security Hub multi-account CIS 1.4 enable script

Note:
Security Hub now supports central configuration for security standards and controls across accounts.

Security Hub's central configration feature addresses many of the scenarios that are covered by the scripts in this repository, reducing or eliminating the need to run these scripts. Please refer to the Security Hub central configuration documentation first before going forward with using these scripts.

These scripts automate the process of enabling the CIS v1.4 security standard and disabling the CIS v1.2 security standard in AWS Security Hub simultaneously across a group of AWS accounts that are in your control. (Note, that you can have one administrator account and up to a 5000 member accounts).

The enablecis14.py script will do the following for each account and region provided to the script:

  • Enable CIS v1.4 standard.
  • Map disabled CIS v1.2 standard controls to the corresponding CIS v1.4 standard controls and disable the CIS v1.4 standard control if the map_cis12_disabled_controls parameter is set to Yes.
  • Disable CIS v1.2 standard if the disable_cis12 parameter is set to Yes.

License Summary

This sample code is made available under a modified MIT license. See the LICENSE file.

Prerequisites

  • The script depends on a pre-existing role in the admin account and all of the member accounts that will be accessed. The role name must be the same in all accounts and the role trust relationship needs to allow your instance or local credentials to assume the role. The policy document below contains the required permissions for the script to succeed:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "securityhub:BatchEnableStandards",
                "securityhub:BatchDisableStandards",
                "securityhub:GetEnabledStandards",
                "securityhub:DescribeStandardsControls",
                "securityhub:UpdateStandardsControl"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

If you do not have a common role that includes at least the above permissions you will need to create a role in each member account as well as the administrative account with at least the above permissions. When creating the role ensure you use the same role name in every account. You can use the enable-cis-14.yaml CloudFormation template to automate this process. This template creates a role named: ManageSecurityHubCIS. The template creates only global resources so it can be created in any region.

  • A text file that includes the list of accounts where the CIS 1.4 standard needs to be enabled. Each account should be listed on its own line in the file.

Steps

1. Setup execution environment:

Option 1: Launch EC2 instance:

Option 2: Locally:

2. Execute Scripts

2a. Enable CIS 1.4

  • Copy the required txt file to this directory
    • Should be a format where each account number is listed on a line.
usage: enablecis14.py [-h] --assume_role ASSUME_ROLE 
                            --enabled_regions ENABLED_REGIONS
                            --map_cis12_disabled_controls Yes/No 
                            --disable_cis12 Yes/No 
                            --input_file PATH_TO_ACCOUNTS_FILE

Enable CIS 1.4 in Security Hub accounts

                        
required arguments:
  -h, --help            show this help message and exit
  
  --assume_role ASSUME_ROLE
                        Role Name to assume in each account.
  --enabled_regions ENABLED_REGIONS
                        comma separated list of regions to the CIS v1.4 standard.
                        If not specified, all available regions are enabled.
  --map_cis12_disabled_controls MAP_CIS12_DISABLED_CONTROLS
                        Yes or No value indidating if any CIS 1.4 controls should be disabled if they map to a CIS 1.2 control that is currently disabled in the account and region.
  --disable_cis12 DISABLE_CIS12
                        Yes or No value indicating if the CIS 1.2 standard should be disabled after enabling CIS 1.4.

  --input_file INPUT_FILE
                        Path to the txt file containing the list of account IDs.
  
  

Example usage:
$ python3 enablecis14.py --assume_role ManageSecurityHubCIS --enabled_regions us-west-2,us-east-1 --map_cis12_disabled_controls Yes --disable_cis12 Yes --input_file /home/ec2-user/accounts.txt