Skip to content

Latest commit

 

History

History

nist800-53-enable

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
README.md
README.md
 
 
disableNIST800-53.py
disableNIST800-53.py
 
 
enable-NIST800-53.yaml
enable-NIST800-53.yaml
 
 
enableNIST800-53.py
enableNIST800-53.py
 
 

README.md

AWS Security Hub multi-account NIST 800-53 enable script

Note:
Security Hub now supports central configuration for security standards and controls across accounts.

Security Hub's central configration feature addresses many of the scenarios that are covered by the scripts in this repository, reducing or eliminating the need to run these scripts. Please refer to the Security Hub central configuration documentation first before going forward with using these scripts.

These scripts automate the process of enabling the NIST 800-53 security standard across a group of AWS accounts that are in your control. (Note, that you can have one administrator account and up to a 5000 member accounts).

The enableNIST800-53.py script will do the following for each account and region provided to the script:

  • Enable NIST 800-53 security standard.

License Summary

This sample code is made available under a modified MIT license. See the LICENSE file.

Prerequisites

  • The script depends on a pre-existing role in the admin account and all of the member accounts that will be accessed. The role name must be the same in all accounts and the role trust relationship needs to allow your instance or local credentials to assume the role. The policy document below contains the required permissions for the script to succeed:
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "securityhub:BatchEnableStandards",
                "securityhub:BatchDisableStandards",
                "securityhub:GetEnabledStandards",
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

If you do not have a common role that includes at least the above permissions you will need to create a role in each member account as well as the administrative account with at least the above permissions. When creating the role ensure you use the same role name in every account. You can use the enable-NIST800-53.yaml CloudFormation template to automate this process. This template creates a role named: ManageSecurityHubNIST. The template creates only global resources so it can be created in any region.

  • A text file that includes the list of accounts where the NIST 800-53 standard needs to be enabled. Each account should be listed on its own line in the file.

Steps

1. Setup execution environment:

Option 1: Launch EC2 instance:

Option 2: Locally:

2. Execute Scripts

2a. Enable NIST800-53

  • Copy the required txt file to this directory
    • Should be a format where each account number is listed on a line.
usage: enableNIST800-53.py [-h] --assume_role ASSUME_ROLE 
                                --enabled_regions ENABLED_REGIONS
                                --input_file PATH_TO_ACCOUNTS_FILE

Enable NIST 800-53 in Security Hub accounts

                        
required arguments:
  -h, --help            show this help message and exit
  
  --assume_role ASSUME_ROLE
                        Role Name to assume in each account.
  --enabled_regions ENABLED_REGIONS
                        comma separated list of regions to enable the NIST 800-53 standard in.
                        If not specified, all available regions are enabled.

  --input_file INPUT_FILE
                        Path to the txt file containing the list of account IDs.
  
  

Example usage:
$ python3 enableNIST800-53.py --assume_role ManageSecurityHubNIST --enabled_regions us-west-2,us-east-1 --input_file /home/ec2-user/accounts.txt

2b. Disable NIST800-53

  • Copy the required txt file to this directory
    • Should be a format where each account number is listed on a line.
usage: disableNIST800-53.py [-h] --assume_role ASSUME_ROLE 
                                 --enabled_regions ENABLED_REGIONS
                                 --input_file PATH_TO_ACCOUNTS_FILE

Disable NIST 800-53 in Security Hub accounts

                        
required arguments:
  -h, --help            show this help message and exit
  
  --assume_role ASSUME_ROLE
                        Role Name to assume in each account.
  --enabled_regions ENABLED_REGIONS
                        comma separated list of regions to disable the NIST 800-53 standard in.
                        If not specified, all available regions are enabled.

  --input_file INPUT_FILE
                        Path to the txt file containing the list of account IDs.
  
  

Example usage:
$ python3 disableNIST800-53.py --assume_role ManageSecurityHubNIST --enabled_regions us-west-2,us-east-1 --input_file /home/ec2-user/accounts.txt