Security & Compliance Layer Spot check

[Juan A. (jaguer0)]

We deployed the full Security & Compliance layer following the docs. Right now we deployed it to one region but hit some snags, sharing in case others run into the same things & looking for spot check

1. Quickstart / reference stacks — region deployment recommendations. Found this workflow file but no corresponding components.yaml or stack files in my quickstart & wasn't sure if they're included or not. The workflow references stacks across many regions (core-aps1-security, core-euw1-security, etc.). Should we deploy to all of those? If so, what's the best approach — manually create stack files per region or is there a templating pattern? The docs and workflow point to all regions for certain services, but the FAQ suggests resources only deploy where resources are deployed.
2. CloudTrail — conflicting deployment guidance. Foundations deploys to core-gbl-root, but the Security layer docs say to deploy from core-gbl-audit. Deploying from audit fails with AccessDeniedException — delegation is needed but not documented. Which is the intended path?
3. Security Hub — account coverage not populating. Deployed Security Hub and can see all accounts listed under account coverage, but every account shows "No coverage data" even after 24+ hours. Had to manually enable Security Hub on the security account. Is there an additional enablement step per member account that's not in the docs?

[Juan A. (jaguer0)]

For security hub, It does seem like my accounts show up in Security Hub CSPM they don't show up as enabled in Security Hub

[Andriy Knysh (aknysh)]

Juan A. (@jaguer0) we just released new versions of all security and compliance components with a lot of improvements and updated docs:

https://github.com/cloudposse-terraform-components/aws-audit-manager
https://github.com/cloudposse-terraform-components/aws-security-hub
https://github.com/cloudposse-terraform-components/aws-access-analyzer
https://github.com/cloudposse-terraform-components/aws-config
https://github.com/cloudposse-terraform-components/aws-guardduty
https://github.com/cloudposse-terraform-components/aws-inspector2
https://github.com/cloudposse-terraform-components/aws-macie
https://github.com/cloudposse-terraform-components/aws-shield
https://github.com/cloudposse-terraform-components/aws-route53-resolver-dns-firewall

Please review the docs in each component, they are updated and might answer the questions that you raised.
The Security layer docs are outdated, we'll be working on improving them.

Ping me if you have any questions or need help.

[Juan A. (jaguer0)]

Andriy Knysh (@aknysh) Thanks for the guidance — I've updated my components to the versions mentioned. A couple of follow-up questions:

1. Security Hub naming: Is it expected that Security Hub maps to Security Hub CSPM, as noted in this comment? Just want to confirm that's the intended behavior. I don't see the accounts enabled on security hub but I do on Security Hub CSPM

2. Multi-region deployment: What's the recommended approach for deploying services like AWS Config, Security Hub, and GuardDuty across all regions? I currently only have us-east-2 configured. Looking at the this workflow file, it references all regions — do I need to manually create region-specific configuration files for each one, or is there a more streamlined approach? (example, do I create new directories for each region or can it be one file ? I get the workflow to deploy it but how do I set it up since currently Only have 1 region )

[Andriy Knysh (aknysh)]

Juan A. (@jaguer0)

Security Hub naming: Is it expected that Security Hub maps to Security Hub CSPM, as noted in this comment? Just want to confirm that's the intended behavior. I don't see the accounts enabled on security hub but I do on Security Hub CSPM

Yes, that's how the AWS Security Hub console works, you need to go to Security Hub CSPM to see the findings (not related to the terraform components).

Multi-region deployment: What's the recommended approach for deploying services like AWS Config, Security Hub, and GuardDuty across all regions? I currently only have us-east-2 configured. Looking at the this workflow file, it references all regions — do I need to manually create region-specific configuration files for each one, or is there a more streamlined approach? (example, do I create new directories for each region or can it be one file ? I get the workflow to deploy it but how do I set it up since currently Only have 1 region )

You need to import all the catalogs for all components that require multi-region deployment into the corresponding region stack manifests. Let me create a doc for you describing multi-region config. Can you contact me on Slack?