data.yaml

metadata:
  id: 3851b212-b300-545d-8d6b-54ef71c86661
  name: Ensure AWS Security Hub is enabled
  profile_applicability: '* Level 2'
  description: |-
    Security Hub collects security data from across AWS accounts, services, and supported third-party partner products and helps you analyze your security trends and identify the highest priority security issues.
    When you enable Security Hub, it begins to consume, aggregate, organize, and prioritize findings from AWS services that you have enabled, such as Amazon GuardDuty, Amazon Inspector, and Amazon Macie.
    You can also enable integrations with AWS partner security products.
  rationale: |-
    AWS Security Hub provides you with a comprehensive view of your security state in AWS and helps you check your environment against security industry standards and best practices - enabling you to quickly assess the security posture across your AWS accounts.
  audit: |-
    The process to evaluate AWS Security Hub configuration per region 

    **From Console:**

    1. Sign in to the AWS Management Console and open the AWS Security Hub console at https://console.aws.amazon.com/securityhub/.
    2. On the top right of the console, select the target Region.
    3. If presented with the Security Hub > Summary page then Security Hub is set-up for the selected region.
    4. If presented with Setup Security Hub or Get Started With Security Hub - follow the online instructions.
    5. Repeat steps 2 to 4 for each region.
  remediation: |-
    To grant the permissions required to enable Security Hub, attach the Security Hub managed policy AWSSecurityHubFullAccess to an IAM user, group, or role.

    Enabling Security Hub

    **From Console:**

    1. Use the credentials of the IAM identity to sign in to the Security Hub console.
    2. When you open the Security Hub console for the first time, choose Enable AWS Security Hub.
    3. On the welcome page, Security standards list the security standards that Security Hub supports.
    4. Choose Enable Security Hub.

    **From Command Line:**

    5. Run the enable-security-hub command. To enable the default standards, include `--enable-default-standards`.
    ```
    aws securityhub enable-security-hub --enable-default-standards
    ```

    6. To enable the security hub without the default standards, include `--no-enable-default-standards`.
    ```
    aws securityhub enable-security-hub --no-enable-default-standards
    ```
  impact: |-
    It is recommended AWS Security Hub be enabled in all regions. AWS Security Hub requires AWS Config to be enabled.
  default_value: ''
  references: |-
    1. https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-get-started.html
    2. https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-enable.html#securityhub-enable-api
    3. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/securityhub/enable-security-hub.html
  section: Monitoring
  version: '1.0'
  tags:
  - CIS
  - AWS
  - CIS 4.16
  - Monitoring
  benchmark:
    name: CIS Amazon Web Services Foundations
    version: v1.5.0
    id: cis_aws
    rule_number: '4.16'
    posture_type: cspm