Security Hub Overview

# Get the security score for FSBP
aws securityhub get-enabled-standards \
  --query 'StandardsSubscriptions[*].{Standard: StandardsArn, Status: StandardsStatus}' \
  --output table

# Get control status summary
aws securityhub describe-standards-controls \
  --standards-subscription-arn \
    "arn:aws:securityhub:us-east-1:123456789012:subscription/aws-foundational-security-best-practices/v/1.0.0" \
  --query 'Controls[?ControlStatus==`FAILED`].{Id: ControlId, Title: Title, Severity: SeverityRating}' \
  --output table

# Count findings by severity
aws securityhub get-findings \
  --filters '{
    "ComplianceStatus": [{"Value": "FAILED", "Comparison": "EQUALS"}],
    "RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}]
  }' \
  --query 'length(Findings)' \
  --output text

# Enable consolidated control findings
aws securityhub update-security-hub-configuration \
  --control-finding-generator SECURITY_CONTROL

# This changes the GeneratorId format from standard-specific
# (e.g., aws-foundational-security-best-practices/v/1.0.0/IAM.1)
# to a unified format (e.g., security-control/IAM.1)

# Verify the setting
aws securityhub describe-hub \
  --query 'ControlFindingGenerator'

# Enable Security Hub with default standards
aws securityhub enable-security-hub \
  --enable-default-standards

# Enable GuardDuty integration
aws securityhub enable-import-findings-for-product \
  --product-arn "arn:aws:securityhub:us-east-1::product/aws/guardduty"

# Enable Inspector integration
aws securityhub enable-import-findings-for-product \
  --product-arn "arn:aws:securityhub:us-east-1::product/aws/inspector"

# Enable Macie integration
aws securityhub enable-import-findings-for-product \
  --product-arn "arn:aws:securityhub:us-east-1::product/aws/macie"

# Enable IAM Access Analyzer integration
aws securityhub enable-import-findings-for-product \
  --product-arn "arn:aws:securityhub:us-east-1::product/aws/access-analyzer"

# List all available integrations
aws securityhub describe-products \
  --query 'Products[*].{Name: ProductName, Arn: ProductArn, Categories: Categories}' \
  --output table

import boto3
from datetime import datetime

securityhub = boto3.client('securityhub')

def import_finding(account_id, region, resource_arn, title, description, severity):
    """Import a custom security finding into Security Hub."""
    finding = {
        'SchemaVersion': '2018-10-08',
        'Id': f'{resource_arn}/custom-finding-{datetime.utcnow().isoformat()}',
        'ProductArn': f'arn:aws:securityhub:{region}:{account_id}:product/{account_id}/default',
        'GeneratorId': 'custom-security-scanner',
        'AwsAccountId': account_id,
        'Types': ['Software and Configuration Checks/Custom'],
        'CreatedAt': datetime.utcnow().isoformat() + 'Z',
        'UpdatedAt': datetime.utcnow().isoformat() + 'Z',
        'Severity': {
            'Label': severity  # CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL
        },
        'Title': title,
        'Description': description,
        'Resources': [{
            'Type': 'Other',
            'Id': resource_arn,
            'Region': region
        }],
        'Compliance': {
            'Status': 'FAILED'
        },
        'Workflow': {
            'Status': 'NEW'
        },
        'RecordState': 'ACTIVE'
    }

    response = securityhub.batch_import_findings(Findings=[finding])
    print(f"Imported: {response['SuccessCount']} success, {response['FailedCount']} failed")
    return response

# Example: Flag a container image running as root
import_finding(
    account_id='123456789012',
    region='us-east-1',
    resource_arn='arn:aws:ecs:us-east-1:123456789012:task-definition/web-app:42',
    title='Container running as root user',
    description='The task definition web-app:42 runs the container as root. '
                'Configure a non-root USER in the Dockerfile to reduce blast radius.',
    severity='HIGH'
)

# Step 1: From the MANAGEMENT account, designate a delegated admin
aws securityhub enable-organization-admin-account \
  --admin-account-id 111111111111

# Step 2: From the DELEGATED ADMIN account, auto-enable for all members
aws securityhub update-organization-configuration \
  --auto-enable \
  --auto-enable-standards DEFAULT

# Step 3: Enable cross-region aggregation to your primary region
aws securityhub create-finding-aggregator \
  --region us-east-1 \
  --region-linking-mode ALL_REGIONS

# Step 4: Verify all member accounts are enabled
aws securityhub list-members \
  --query 'Members[*].{AccountId: AccountId, Status: MemberStatus}' \
  --output table

# Step 5: Check aggregation status
aws securityhub get-finding-aggregator \
  --finding-aggregator-arn arn:aws:securityhub:us-east-1:111111111111:finding-aggregator/abc123

AWSTemplateFormatVersion: '2010-09-09'
Description: Enable Security Hub with FSBP and CIS standards in every account

Resources:
  SecurityHub:
    Type: AWS::SecurityHub::Hub
    Properties:
      EnableDefaultStandards: true
      ControlFindingGenerator: SECURITY_CONTROL
      Tags:
        ManagedBy: CloudFormation
        Purpose: SecurityBaseline

  # Enable additional standards
  CISStandard:
    Type: AWS::SecurityHub::Standard
    DependsOn: SecurityHub
    Properties:
      StandardsArn: !Sub 'arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.4.0'

  # Disable noisy or irrelevant controls
  # Example: Disable the hardware MFA control for non-root accounts
  DisableIAM6:
    Type: AWS::SecurityHub::Standard
    DependsOn: SecurityHub
    Properties:
      StandardsArn: !Sub 'arn:aws:securityhub:${AWS::Region}::standards/aws-foundational-security-best-practices/v/1.0.0'
      DisabledSecurityControlIdentifiers:
        - IAM.6  # Hardware MFA (not practical for most organizations)

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "PreventDisablingSecurityHub",
      "Effect": "Deny",
      "Action": [
        "securityhub:DisableSecurityHub",
        "securityhub:DeleteMembers",
        "securityhub:DisassociateMembers",
        "securityhub:BatchDisableStandards"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotLike": {
          "aws:PrincipalArn": [
            "arn:aws:iam::*:role/SecurityAdminRole",
            "arn:aws:iam::*:role/OrganizationSetupRole"
          ]
        }
      }
    },
    {
      "Sid": "PreventDisablingGuardDuty",
      "Effect": "Deny",
      "Action": [
        "guardduty:DeleteDetector",
        "guardduty:DisassociateFromMasterAccount",
        "guardduty:UpdateDetector"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotLike": {
          "aws:PrincipalArn": [
            "arn:aws:iam::*:role/SecurityAdminRole"
          ]
        }
      }
    }
  ]
}

# Suppress findings for known acceptable configurations
aws securityhub create-automation-rule \
  --rule-name "Suppress public website buckets" \
  --rule-order 1 \
  --description "Suppress S3 public access findings for approved static website buckets" \
  --criteria '{
    "GeneratorId": [
      {"Value": "security-control/S3.2", "Comparison": "EQUALS"},
      {"Value": "security-control/S3.3", "Comparison": "EQUALS"}
    ],
    "ResourceId": [
      {"Value": "arn:aws:s3:::company-website-prod", "Comparison": "EQUALS"},
      {"Value": "arn:aws:s3:::company-docs-public", "Comparison": "EQUALS"}
    ]
  }' \
  --actions '[{
    "Type": "FINDING_FIELDS_UPDATE",
    "FindingFieldsUpdate": {
      "Workflow": {"Status": "SUPPRESSED"},
      "Note": {
        "Text": "Auto-suppressed: approved public website bucket",
        "UpdatedBy": "automation-rule"
      }
    }
  }]'

# Auto-escalate critical findings
aws securityhub create-automation-rule \
  --rule-name "Escalate critical findings" \
  --rule-order 2 \
  --description "Mark critical findings as NOTIFIED to ensure rapid response" \
  --criteria '{
    "SeverityLabel": [{"Value": "CRITICAL", "Comparison": "EQUALS"}],
    "WorkflowStatus": [{"Value": "NEW", "Comparison": "EQUALS"}]
  }' \
  --actions '[{
    "Type": "FINDING_FIELDS_UPDATE",
    "FindingFieldsUpdate": {
      "Workflow": {"Status": "NOTIFIED"},
      "Note": {
        "Text": "Auto-escalated: critical severity finding",
        "UpdatedBy": "automation-rule"
      }
    }
  }]'

{
  "Source": ["aws.securityhub"],
  "DetailType": ["Security Hub Findings - Imported"],
  "Detail": {
    "findings": {
      "Compliance": {
        "Status": ["FAILED"]
      },
      "GeneratorId": [{
        "prefix": "security-control/S3"
      }],
      "Severity": {
        "Label": ["CRITICAL", "HIGH"]
      },
      "Workflow": {
        "Status": ["NEW"]
      },
      "RecordState": ["ACTIVE"]
    }
  }
}

import json
import boto3
import logging

logger = logging.getLogger()
logger.setLevel(logging.INFO)

s3 = boto3.client('s3')
securityhub = boto3.client('securityhub')

REMEDIATION_MAP = {
    'security-control/S3.4': remediate_encryption,
    'security-control/S3.5': remediate_ssl_only,
    'security-control/S3.9': remediate_access_logging,
}

def handler(event, context):
    """Route Security Hub S3 findings to appropriate remediation functions."""
    for finding in event['detail']['findings']:
        generator_id = finding['GeneratorId']
        bucket_arn = finding['Resources'][0]['Id']
        bucket_name = bucket_arn.split(':::')[-1]

        logger.info(f"Processing {generator_id} for bucket {bucket_name}")

        if generator_id in REMEDIATION_MAP:
            try:
                REMEDIATION_MAP[generator_id](bucket_name)
                update_finding(finding, 'RESOLVED',
                    f'Auto-remediated by {generator_id} handler')
                logger.info(f"Successfully remediated {bucket_name}")
            except Exception as e:
                logger.error(f"Failed to remediate {bucket_name}: {e}")
                update_finding(finding, 'NOTIFIED',
                    f'Auto-remediation failed: {str(e)}')
        else:
            logger.warning(f"No remediation handler for {generator_id}")

def remediate_encryption(bucket_name):
    """Enable default AES-256 encryption on the bucket."""
    s3.put_bucket_encryption(
        Bucket=bucket_name,
        ServerSideEncryptionConfiguration={
            'Rules': [{
                'ApplyServerSideEncryptionByDefault': {
                    'SSEAlgorithm': 'AES256'
                },
                'BucketKeyEnabled': True
            }]
        }
    )

def remediate_ssl_only(bucket_name):
    """Apply a bucket policy denying non-SSL requests."""
    policy = {
        "Version": "2012-10-17",
        "Statement": [{
            "Sid": "EnforceSSLOnly",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                f"arn:aws:s3:::{bucket_name}",
                f"arn:aws:s3:::{bucket_name}/*"
            ],
            "Condition": {
                "Bool": {"aws:SecureTransport": "false"}
            }
        }]
    }
    s3.put_bucket_policy(Bucket=bucket_name, Policy=json.dumps(policy))

def remediate_access_logging(bucket_name):
    """Enable server access logging to a central logging bucket."""
    s3.put_bucket_logging(
        Bucket=bucket_name,
        BucketLoggingStatus={
            'LoggingEnabled': {
                'TargetBucket': 'central-s3-access-logs',
                'TargetPrefix': f'{bucket_name}/'
            }
        }
    )

def update_finding(finding, status, note_text):
    """Update the finding workflow status in Security Hub."""
    securityhub.batch_update_findings(
        FindingIdentifiers=[{
            'Id': finding['Id'],
            'ProductArn': finding['ProductArn']
        }],
        Workflow={'Status': status},
        Note={
            'Text': note_text,
            'UpdatedBy': 'auto-remediation-lambda'
        }
    )

import json
import urllib3
import os

http = urllib3.PoolManager()
SLACK_WEBHOOK = os.environ['SLACK_WEBHOOK_URL']

SEVERITY_COLORS = {
    'CRITICAL': '#FF0000',
    'HIGH': '#FF6600',
    'MEDIUM': '#FFCC00',
    'LOW': '#00CC00',
}

def handler(event, context):
    """Send Security Hub critical findings to Slack."""
    for finding in event['detail']['findings']:
        severity = finding['Severity']['Label']
        title = finding['Title']
        description = finding.get('Description', 'No description')
        account = finding['AwsAccountId']
        region = finding['Region']
        resource = finding['Resources'][0]['Id']
        generator = finding['GeneratorId']

        # Truncate description for Slack readability
        if len(description) > 300:
            description = description[:297] + '...'

        slack_message = {
            'attachments': [{
                'color': SEVERITY_COLORS.get(severity, '#808080'),
                'blocks': [
                    {
                        'type': 'header',
                        'text': {
                            'type': 'plain_text',
                            'text': f':rotating_light: {severity} Security Finding'
                        }
                    },
                    {
                        'type': 'section',
                        'fields': [
                            {'type': 'mrkdwn', 'text': f'*Title:*\n{title}'},
                            {'type': 'mrkdwn', 'text': f'*Account:*\n{account}'},
                            {'type': 'mrkdwn', 'text': f'*Region:*\n{region}'},
                            {'type': 'mrkdwn', 'text': f'*Control:*\n{generator}'},
                        ]
                    },
                    {
                        'type': 'section',
                        'text': {
                            'type': 'mrkdwn',
                            'text': f'*Resource:*\n`{resource}`'
                        }
                    },
                    {
                        'type': 'section',
                        'text': {
                            'type': 'mrkdwn',
                            'text': f'*Description:*\n{description}'
                        }
                    }
                ]
            }]
        }

        http.request(
            'POST', SLACK_WEBHOOK,
            body=json.dumps(slack_message),
            headers={'Content-Type': 'application/json'}
        )

# Create EventBridge rule for critical findings -> Jira
aws events put-rule \
  --name security-hub-critical-to-jira \
  --event-pattern '{
    "source": ["aws.securityhub"],
    "detail-type": ["Security Hub Findings - Imported"],
    "detail": {
      "findings": {
        "Severity": {"Label": ["CRITICAL"]},
        "Workflow": {"Status": ["NEW"]},
        "RecordState": ["ACTIVE"]
      }
    }
  }'

# Target: Step Functions state machine that creates Jira tickets
aws events put-targets \
  --rule security-hub-critical-to-jira \
  --targets '[{
    "Id": "JiraCreator",
    "Arn": "arn:aws:states:us-east-1:123456789012:stateMachine:CreateJiraTicket",
    "RoleArn": "arn:aws:iam::123456789012:role/EventBridgeToStepFunctionsRole"
  }]'

# Create an insight showing unresolved critical findings by account
aws securityhub create-insight \
  --name "Critical Findings by Account" \
  --filters '{
    "SeverityLabel": [{"Value": "CRITICAL", "Comparison": "EQUALS"}],
    "WorkflowStatus": [{"Value": "NEW", "Comparison": "EQUALS"}],
    "RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}]
  }' \
  --group-by-attribute AwsAccountId

# Create an insight showing findings by service
aws securityhub create-insight \
  --name "Findings by AWS Service" \
  --filters '{
    "ComplianceStatus": [{"Value": "FAILED", "Comparison": "EQUALS"}],
    "RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}]
  }' \
  --group-by-attribute ResourceType

# Create an insight tracking remediation SLA compliance
# (findings older than 7 days that are still NEW)
aws securityhub create-insight \
  --name "SLA Breached - Findings Older Than 7 Days" \
  --filters '{
    "SeverityLabel": [
      {"Value": "CRITICAL", "Comparison": "EQUALS"},
      {"Value": "HIGH", "Comparison": "EQUALS"}
    ],
    "WorkflowStatus": [{"Value": "NEW", "Comparison": "EQUALS"}],
    "RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}],
    "CreatedAt": [{"DateRange": {"Value": 7, "Unit": "DAYS"}}]
  }' \
  --group-by-attribute AwsAccountId

# Disable a specific control across all standards
aws securityhub update-standards-control \
  --standards-control-arn \
    "arn:aws:securityhub:us-east-1:123456789012:control/aws-foundational-security-best-practices/v/1.0.0/IAM.6" \
  --control-status DISABLED \
  --disabled-reason "Organization uses virtual MFA for root accounts as accepted risk"

# Bulk disable controls using a list
CONTROLS_TO_DISABLE=(
  "IAM.6"
  "CloudTrail.5"
)

SUBSCRIPTION_ARN="arn:aws:securityhub:us-east-1:123456789012:subscription/aws-foundational-security-best-practices/v/1.0.0"

for control in "${CONTROLS_TO_DISABLE[@]}"; do
  aws securityhub update-standards-control \
    --standards-control-arn "${SUBSCRIPTION_ARN}/${control}" \
    --control-status DISABLED \
    --disabled-reason "Disabled per security team review - $(date +%Y-%m-%d)"
done

# Create a custom action for "Send to Security Team"
aws securityhub create-action-target \
  --name "Send to Security Team" \
  --description "Escalate this finding to the security team Slack channel" \
  --id "SendToSecurityTeam"

# Create a custom action for "Create Jira Ticket"
aws securityhub create-action-target \
  --name "Create Jira Ticket" \
  --description "Create a Jira ticket for remediation tracking" \
  --id "CreateJiraTicket"

# Create EventBridge rule matching custom action events
aws events put-rule \
  --name security-hub-custom-action-escalate \
  --event-pattern '{
    "source": ["aws.securityhub"],
    "detail-type": ["Security Hub Findings - Custom Action"],
    "detail": {
      "actionName": ["SendToSecurityTeam"]
    }
  }'

# Enable enhanced scanning on ECR (uses Amazon Inspector)
aws ecr put-registry-scanning-configuration \
  --scan-type ENHANCED \
  --rules '[
    {
      "scanFrequency": "CONTINUOUS_SCAN",
      "repositoryFilters": [
        {"filter": "*", "filterType": "WILDCARD"}
      ]
    }
  ]'

# Query Security Hub for container vulnerability findings
aws securityhub get-findings \
  --filters '{
    "ProductName": [{"Value": "Inspector", "Comparison": "EQUALS"}],
    "ResourceType": [{"Value": "AwsEcrContainerImage", "Comparison": "EQUALS"}],
    "SeverityLabel": [
      {"Value": "CRITICAL", "Comparison": "EQUALS"},
      {"Value": "HIGH", "Comparison": "EQUALS"}
    ],
    "RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}]
  }' \
  --query 'Findings[*].{Title: Title, Image: Resources[0].Id, Severity: Severity.Label}' \
  --output table

# Export all CIS findings for audit
aws securityhub get-findings \
  --filters '{
    "GeneratorId": [
      {"Value": "cis-aws-foundations-benchmark", "Comparison": "PREFIX"}
    ],
    "RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}]
  }' \
  --max-items 1000 \
  --query 'Findings[*].{
    Control: GeneratorId,
    Title: Title,
    Status: Compliance.Status,
    Resource: Resources[0].Id,
    Account: AwsAccountId,
    Region: Region,
    FirstSeen: CreatedAt,
    LastSeen: UpdatedAt,
    WorkflowStatus: Workflow.Status
  }' \
  --output json > cis-audit-report.json

# Generate a summary of compliance by standard
aws securityhub get-enabled-standards \
  --query 'StandardsSubscriptions[*].{
    Standard: StandardsArn,
    Status: StandardsStatus
  }' --output table

# Count passed vs failed controls
echo "=== FSBP Compliance Summary ==="
echo -n "PASSED: "
aws securityhub get-findings --filters '{
  "GeneratorId": [{"Value": "security-control/", "Comparison": "PREFIX"}],
  "ComplianceStatus": [{"Value": "PASSED", "Comparison": "EQUALS"}],
  "RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}]
}' --query 'length(Findings)' --output text

echo -n "FAILED: "
aws securityhub get-findings --filters '{
  "GeneratorId": [{"Value": "security-control/", "Comparison": "PREFIX"}],
  "ComplianceStatus": [{"Value": "FAILED", "Comparison": "EQUALS"}],
  "RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}]
}' --query 'length(Findings)' --output text

# Publish security score as a CloudWatch custom metric
# Run this as a scheduled Lambda function (every 6 hours)
import boto3

securityhub = boto3.client('securityhub')
cloudwatch = boto3.client('cloudwatch')

def publish_security_metrics():
    """Publish Security Hub metrics to CloudWatch for dashboarding."""

    # Count findings by severity
    for severity in ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW']:
        findings = securityhub.get_findings(
            Filters={
                'SeverityLabel': [{'Value': severity, 'Comparison': 'EQUALS'}],
                'ComplianceStatus': [{'Value': 'FAILED', 'Comparison': 'EQUALS'}],
                'WorkflowStatus': [{'Value': 'NEW', 'Comparison': 'EQUALS'}],
                'RecordState': [{'Value': 'ACTIVE', 'Comparison': 'EQUALS'}]
            },
            MaxResults=1
        )

        cloudwatch.put_metric_data(
            Namespace='SecurityHub',
            MetricData=[{
                'MetricName': 'ActiveFindings',
                'Dimensions': [
                    {'Name': 'Severity', 'Value': severity}
                ],
                'Value': len(findings.get('Findings', [])),
                'Unit': 'Count'
            }]
        )

# Create CloudWatch alarm for critical finding spike
aws cloudwatch put-metric-alarm \
  --alarm-name security-hub-critical-spike \
  --metric-name ActiveFindings \
  --namespace SecurityHub \
  --dimensions Name=Severity,Value=CRITICAL \
  --statistic Maximum \
  --period 3600 \
  --threshold 5 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 1 \
  --alarm-actions arn:aws:sns:us-east-1:123456789012:security-alerts

# Enable Security Hub
resource "aws_securityhub_account" "main" {}

# Enable FSBP standard
resource "aws_securityhub_standards_subscription" "fsbp" {
  standards_arn = "arn:aws:securityhub:${data.aws_region.current.name}::standards/aws-foundational-security-best-practices/v/1.0.0"
  depends_on    = [aws_securityhub_account.main]
}

# Enable CIS standard
resource "aws_securityhub_standards_subscription" "cis" {
  standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.4.0"
  depends_on    = [aws_securityhub_account.main]
}

# Disable specific controls that are not applicable
resource "aws_securityhub_standards_control" "iam6_disable" {
  standards_control_arn = "${aws_securityhub_standards_subscription.fsbp.id}/IAM.6"
  control_status        = "DISABLED"
  disabled_reason       = "Organization uses virtual MFA for root accounts"
  depends_on            = [aws_securityhub_standards_subscription.fsbp]
}

# Enable product integrations
resource "aws_securityhub_product_subscription" "guardduty" {
  product_arn = "arn:aws:securityhub:${data.aws_region.current.name}::product/aws/guardduty"
  depends_on  = [aws_securityhub_account.main]
}

resource "aws_securityhub_product_subscription" "inspector" {
  product_arn = "arn:aws:securityhub:${data.aws_region.current.name}::product/aws/inspector"
  depends_on  = [aws_securityhub_account.main]
}

resource "aws_securityhub_product_subscription" "access_analyzer" {
  product_arn = "arn:aws:securityhub:${data.aws_region.current.name}::product/aws/access-analyzer"
  depends_on  = [aws_securityhub_account.main]
}

resource "aws_securityhub_product_subscription" "macie" {
  product_arn = "arn:aws:securityhub:${data.aws_region.current.name}::product/aws/macie"
  depends_on  = [aws_securityhub_account.main]
}

# Cross-region finding aggregation
resource "aws_securityhub_finding_aggregator" "main" {
  linking_mode = "ALL_REGIONS"
  depends_on   = [aws_securityhub_account.main]
}

# EventBridge rule for critical findings
resource "aws_cloudwatch_event_rule" "critical_findings" {
  name        = "security-hub-critical-findings"
  description = "Capture critical Security Hub findings"

  event_pattern = jsonencode({
    source      = ["aws.securityhub"]
    detail-type = ["Security Hub Findings - Imported"]
    detail = {
      findings = {
        Severity    = { Label = ["CRITICAL"] }
        Workflow    = { Status = ["NEW"] }
        RecordState = ["ACTIVE"]
      }
    }
  })
}

resource "aws_cloudwatch_event_target" "critical_to_sns" {
  rule      = aws_cloudwatch_event_rule.critical_findings.name
  target_id = "SendToSNS"
  arn       = aws_sns_topic.security_alerts.arn
}

# SNS topic for security alerts
resource "aws_sns_topic" "security_alerts" {
  name              = "security-hub-alerts"
  kms_master_key_id = aws_kms_key.security.id
}

data "aws_region" "current" {}