Combine AWS Control Tower and AWS Security Hu

[JunaidGH]

Hi,

Thanks for uploading the script.

I am trying to implement you scripts into our AWS Control Tower setup, which has the following accounts - Master, Audit and Log. I was wondering if it is possible to get the script to work with having the Audit account as being the primary account, rather than Master Account.
I am trying to combine AWS Control Tower & AWS Security Hub and use the Audit account as the Security account for AWS Cloutrail, Config, GuardDuty etc...

Thanks

[ryanholland]

The Security Hub Master can be any account within the organization and does not have to be the Organization Master, the Security Hub Master/Member only pertains to the Security Hub service. So in the command line provide the account number of your Audit account as the master to have it be your Security Hub Master.

[JunaidGH]

Thanks Ryan, i tried that, but originally this was not working and i assumed i was doing something wrong in the script/CLI. It transpired, it was ControlTower GuardRails which was blocking the permission to create the resources.

Thanks

[phancox]

@JunaidGH would you mind sharing which of the guard rails was causing the problem.