Security Hub throws ResourceConflictException for "master" accounts

[gws]

Hi there,

Upgrading to 0.18.0, I had an issue with my account set up in the following way (some variables redacted, let me know if they are important):

module "secure_baseline" {
  source  = "nozaq/secure-baseline/aws"
  version = "0.18.0"

  aws_account_id                         = "..."
  region                                 = "..."
  account_type                           = "master"
  audit_log_bucket_name                  = "..."
  config_sns_topic_name                  = "..."
  cloudwatch_logs_retention_in_days      = "7"
  cloudtrail_name                        = "multi-region"
  cloudtrail_iam_role_name               = "..."
  cloudtrail_iam_role_policy_name        = "..."
  cloudtrail_key_deletion_window_in_days = "7"
  support_iam_role_principal_arns        = [...]

  target_regions = ["us-west-2"]
}

I received an exception like the following for each region even though I only had a single region in target_regions:

Error: Error enabling Security Hub for account: ResourceConflictException: Account is already subscribed to Security Hub
{
  Code_: "ResourceConflictException",
  Message_: "Account is already subscribed to Security Hub"
}

  on .terraform/modules/secure_baseline/terraform-aws-secure-baseline-0.18.0/modules/securityhub-baseline/main.tf line 4, in resource "aws_securityhub_account" "main":
   4: resource "aws_securityhub_account" "main" {



Error: Error enabling Security Hub for account: ResourceConflictException: Account is already subscribed to Security Hub
{
  Code_: "ResourceConflictException",
  Message_: "Account is already subscribed to Security Hub"
}

  on .terraform/modules/secure_baseline/terraform-aws-secure-baseline-0.18.0/modules/securityhub-baseline/main.tf line 4, in resource "aws_securityhub_account" "main":
   4: resource "aws_securityhub_account" "main" {

...

It appears to be related to #105.

[nozaq]

Hi @gws, thank you for reporting this issue.
It seems the problem is that the module tried to enable SecurityHub in regions not in target_regions.
The ResourceConflictException happened because the AWS providers for excluded regions all fall back to the default one, so multiple SecurityHub activation calls went to the same default region.

I'm trying to fix it in #111, and hopefully will publish 0.18.1 soon!

[nozaq]

Just published a fix.

@gws Could you try check if 0.18.1 does not produce errors on your side? 🙏

[gws]

@nozaq Works great with 0.18.1, thank you!

[nozaq]

@gws You're welcome, thanks for your report 👍