Member-only story
Setup AWS SecurityHub with Terraform in Less than a Minute
A simple example of setting up SecurityHub at the Organization level with Terraform.
I’m gonna show you how to create a SecurityHub multi-account setup using terraform.
AWS Organizations
If you are using AWS Organizations, you have something similar to the setup below. For configuring SecurityHub at the Organization level, you need to add securityhub.amazonaws.com to service access principals. In this way, you’re telling Organizations that you want to use SecurityHub.
A best practice recommended by AWS is to delegate all security-related systems to a separate account, like a security or audit account. It’s a bad practice to mix Organization service with security services. If you do that, you will end up granting account access to users that not necessarily are Security Staff, like Finance people that need access to the Organization service account to see the bills.
At the last part of the code you can see the delegation resource, and the admin_account_id, which in this case is the id of the security account.
Cheers! you have configured Organizations and delegated administration of SecurityHub to security account, well done.
SecurityHub
It’s time to go to the security account.
Depending on the setup you have for terraform projects, you will have both accounts in the same terraform project, or maybe you have them in different projects separated by directories, so you need to figure out where it’s the best place to put your code, depending on your setup.
The first section of the code enables SecurityHub automatically for all new accounts in the Organization. This lets us keep our environment fully compliant, and centralize all findings in security account.
The second resource enables the CIS benchmark. This is very useful since it’ll give…
