Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for SecurityHub automations #450

Open
Thomas-McKanna opened this issue May 13, 2024 · 0 comments
Open

Add support for SecurityHub automations #450

Thomas-McKanna opened this issue May 13, 2024 · 0 comments
Labels
enhancement New feature or request

Comments

@Thomas-McKanna
Copy link

LZA provides support for enabling SecurityHub standards and suppressing certain controls. It would be very nice if LZA could also be used to define SecurityHub Automation rules as well, especially since these rules are region specific and its tedious to try to manually keep rules for multiple regions consistent. According to official docs:

An automation rule applies only in the AWS Region in which it's created. To apply a rule in multiple Regions, the delegated administrator must create the rule in each Region. This can be done through the Security Hub console, Security Hub API, or AWS CloudFormation. You can also use a multi-Region deployment script.

Automation rules could be defined like:

centralSecurityServices:
  securityHub:
    automationRules:
      - name: DoXYZ
         description: xyz
         enabled: true
         criteria:
           - key: aaa
             operator: Equals
             values:
               - val1
               - val2
         automatedAction:
           workflowStatus: SUPPRESSED
           note: xyz

The order of the rules list would determine rule order in SecurityHub, and the rules would be replicated to all regions enabled in the LZA config.

@Thomas-McKanna Thomas-McKanna added the enhancement New feature or request label May 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant