Security Hub has delegated admin configured and is enabled in all regions with organization auto-enable
securityhub_delegated_admin_enabled_all_regions
AWS Security Hub has a delegated administrator configured at the organization level, hubs are active in all opted-in regions, and organization auto-enable is active so that new member accounts are automatically enrolled.
Risk
Without org-wide AWS Security Hub configuration, findings can be aggregated inconsistently, delegated admin may be missing in some regions, and new accounts will not be auto-enrolled. This fragments security posture visibility, delays incident response, and lets misconfigurations and compliance drift go undetected across the organization.
prowler aws --checks securityhub_delegated_admin_enabled_all_regions
Recommendation
Configure a delegated administrator for AWS Security Hub via AWS Organizations. Enable Security Hub in all opted-in regions and turn on auto-enable so new member accounts are automatically enrolled. This ensures uniform security posture monitoring across the entire organization.
Remediation
aws securityhub enable-organization-admin-account --admin-account-id <ADMIN_ACCOUNT_ID> && aws securityhub update-organization-configuration --auto-enable --auto-enable-standards DEFAULT
- Sign in to the AWS Organizations management account
- Open the AWS Organizations console
- Navigate to Services > AWS Security Hub
- Click Register delegated administrator and enter the security account ID
- Switch to the delegated admin account
- In Security Hub console, go to Settings > Accounts
- Enable auto-enable for new organization accounts
- Repeat hub enablement for all opted-in regions
Source Code
Resource Type
AwsSecurityHubHub
References
Related To
- securityhub_enabled
- guardduty_delegated_admin_enabled_all_regions