I’m going to show you how to create a SecurityHub multi-account setup using terraform. AWS Organizations If you are using AWS Organizations, you have something similar to the setup below. For configuring SecurityHub at the Organization level, you need to add to service access principals. In this way, you’re telling Organizations that you want to use SecurityHub. securityhub.amazonaws.com A best practice recommended by AWS is to delegate all security-related systems to a separate account, like a or account. It’s a bad practice to mix Organization service with security services. If you do that, you will end up granting account access to users that not necessarily are Security Staff, like Finance people that need access to the Organization service account to see the bills. security audit At the last part of the code you can see the delegation resource, and the , which in this case is the id of the security account. admin_account_id Cheers! You have configured Organizations and delegated administration of SecurityHub to security account, well done. SecurityHub It’s time to go to the security account. Depending on the setup you have for terraform projects, you will have both accounts in the same terraform project, or maybe you have them in different projects separated by directories, so you need to figure out where it’s the best place to put your code, depending on your setup. The first section of the code enables SecurityHub automatically for all new accounts in the Organization. This lets us keep our environment fully compliant and centralize all findings in the security account. The second resource enables the CIS benchmark. This is very useful since it’ll give you a lot of checks that you can use to size the level of compliance resources in your accounts. Finally, we add two existing accounts to SecurityHub as members. The first time you enable it, you need to add existing accounts in this way. For new accounts, you are covered with flag. auto_enable That’s Not All, Folks! I hope that you’ve learned something new with my post, and if this is your case, I encourage you to become one of my followers. You’ll be notified when I upload more useful content like this one. Also Published Here

Different

Keep

DevSecOps Deep Dive: CI/CD Pipeline Security

Using AWS Macie To Classify Databases

Connect with Me on LinkedIn!

Read My Stories

Newsletter

Hire Me

Nominated for 2022 - HackerNoon Contributor of the Year - Devops

Too Long; Didn't Read

Get Free Unlimited IP Geo Data With IPinfo Lite

Setting Up AWS SecurityHub With Terraform in a Minute

Setting Up AWS SecurityHub With Terraform in a Minute

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Untitled Story

10 Things I Did To Increase CloudTrail Logs Security

101 Stories To Learn About Cloud Infrastructure

10 Things in Engineering We Don't Spend Enough Time On

10 Things I Did To Increase CloudTrail Logs Security

10 reasons to give cloud computing a go

10 Things I Did To Increase CloudTrail Logs Security

101 Stories To Learn About Cloud Infrastructure

10 Things in Engineering We Don't Spend Enough Time On

10 Things I Did To Increase CloudTrail Logs Security

10 reasons to give cloud computing a go

Light-Mode

Classic

Newspaper

Dark-Mode

Neon Noir

Minty

HN StartUps