Tutorial: Getting Started with Automated Security Response on AWS

This is a tutorial that will guide you through your first deployment. It will begin with the prerequisites for deploying the solution and it will end with you remediating example findings in a member account.

Prepare the accounts

In order to demonstrate the cross-account and cross-Region remediation capabilities of the solution, this tutorial will use two accounts. You can also deploy the solution to a single account.

The following examples use accounts 111111111111 and 222222222222 to demonstrate the solution. 111111111111 will be the admin account and 222222222222 will be the member account. We will set up the solution to remediate findings for resources in the Regions us-east-1 and us-west-2.

The table below is an example to illustrate the actions we will take for each step in each account and Region.

Account	Purpose	Action in us-east-1	Action in us-west-2
111111111111	Admin	None	None
222222222222	Member	None	None

The admin account performs the solution’s administration actions. These include initiating remediations manually and enabling fully automated remediation, as described in Enable fully automated remediations. This account must also be the Security Hub delegated administrator account for all accounts in which you wish to remediate findings, but it does not need to be nor should it be the AWS Organizations administrator account for the AWS Organization to which your accounts belong.

Enable AWS Config

Review the following documentation:

• AWS Config documentation

• AWS Config pricing

• Enabling AWS Config

Enable AWS Config in both accounts and both Regions. This will incur charges.

Important

Make sure you choose the option to "Include global resources (such as AWS IAM resources)." If you do not choose this option when enabling AWS Config, you do not see findings related to global resources (such as AWS IAM resources).

Account	Purpose	Action in us-east-1	Action in us-west-2
111111111111	Admin	Enable AWS Config	Enable AWS Config
222222222222	Member	Enable AWS Config	Enable AWS Config

Enable AWS Security Hub

Review the following documentation:

• AWS Security Hub documentation

• AWS Security Hub pricing

• Enabling AWS Security Hub

Enable AWS Security Hub in both accounts and both Regions. This will incur charges.

Account	Purpose	Action in us-east-1	Action in us-west-2
111111111111	Admin	Enable AWS Security Hub	Enable AWS Security Hub
222222222222	Member	Enable AWS Security Hub	Enable AWS Security Hub

Enable consolidated control findings

Review the following documentation:

• Generating and updating control findings

For the purposes of this tutorial, we will demonstrate the usage of the solution with the consolidated control findings feature of AWS Security Hub enabled, which is the recommended configuration. In partitions which do not support this feature as of the time of writing, you will need to deploy the standard-specific playbooks rather than SC (Security Control).

Enable consolidated control findings in both accounts and both Regions.

Account	Purpose	Action in us-east-1	Action in us-west-2
111111111111	Admin	Enable consolidated control findings	Enable consolidated control findings
222222222222	Member	Enable consolidated control findings	Enable consolidated control findings

It might take some time for findings to be generated with the new feature. You can proceed with the tutorial, but you are unable to remediate the findings generated without the new feature. Findings generated with the new feature can be identified by the GeneratorId field value security-control/<control_id>.

Configure cross-Region finding aggregation

Review the following documentation:

• Cross-Region aggregation

• Enabling cross-Region aggregation

Configure finding aggregation from us-west-2 to us-east-1 in both accounts.

Account	Purpose	Action in us-east-1	Action in us-west-2
111111111111	Admin	Configure aggregation from us-west-2	None
222222222222	Member	Configure aggregation from us-west-2	None

It may take some time for findings to propagate to the aggregation Region. You can proceed with the tutorial, but you will be unable to remediate findings from other Regions until they begin to appear in the aggregation Region.

Designate a Security Hub administrator account

Review the following documentation:

• Managing accounts in AWS Security Hub

• Managing organization member accounts

• Managing member accounts by invitation

In the preceding example, this tutorial uses the manual invitation method. For a set of production accounts, we recommend managing Security Hub delegated administration through AWS Organizations.

From the AWS Security Hub console in the admin account (111111111111), invite the member account (222222222222) to accept the admin account as a Security Hub delegated administrator. From the member account, accept the invitation.

Account	Purpose	Action in us-east-1	Action in us-west-2
111111111111	Admin	Invite the member account	None
222222222222	Member	Accept the invitation	None

It may take some time for findings to propagate to the admin account. You can proceed with the tutorial, but you will be unable to remediate findings from member accounts until they begin to appear in the admin account.

Create the roles for self-managed StackSets permissions

Review the following documentation:

• AWS CloudFormation StackSets

• Grant self-managed permissions

We will be deploying CloudFormation stacks to multiple accounts, so we will use StackSets. We cannot use service-managed permissions because the admin stack and the member stack have nested stacks, which aren’t supported by the service, so we must use self-managed permissions.

Deploy the stacks for basic permissions for StackSet operations. For production accounts, you may wish to narrow the permissions according to the "advanced permissions options" documentation.

Account	Purpose	Action in us-east-1	Action in us-west-2
111111111111	Admin	Deploy the StackSet administrator role stack Deploy the StackSet Execution role stack	None
222222222222	Member	Deploy the StackSet execution role stack	None

Create the insecure resources that will generate example findings

Review the following documentation:

• Security Hub controls reference

• AWS Lambda controls

The following creates an example resource with an insecure configuration to demonstrate a remediation. The example control is Lambda.1: Lambda function policies should prohibit public access.

Important

You will intentionally create a resource with an insecure configuration. Review the nature of the control and evaluate the risk of creating such a resource in your environment. Be aware of any tooling your organization might have for detecting and reporting such resources and request an exception if appropriate. If the example control is inappropriate for your environment, select another control that the solution supports.

In the second Region of the member account, navigate to the AWS Lambda console and create a function in the latest Python runtime. Under Configuration → Permissions, add a policy statement to allow invoking the function from the URL with no authentication.

Confirm on the console page that the function allows public access. After the solution remediates this issue, compare the permissions to confirm that the public access has been revoked.

Account	Purpose	Action in us-east-1	Action in us-west-2
111111111111	Admin	None	None
222222222222	Member	None	Create a Lambda function with an insecure configuration

It may take some time for AWS Config to detect the insecure configuration. You can proceed with the tutorial, but you will be unable to remediate the finding until Config detects it.

Create CloudWatch log groups for related controls

Review the following documentation:

• Monitoring CloudTrail Log Files with Amazon CloudWatch Logs

• CloudTrail controls

Various CloudTrail controls supported by the solution require there to be a CloudWatch Log group that is the destination of a multi-Region CloudTrail. In the following example, we will create a placeholder log group. For production accounts, you should properly configure CloudTrail integration with CloudWatch Logs.

Create a log group in each account and Region with the same name, for example: asr-log-group.

Account	Purpose	Action in us-east-1	Action in us-west-2
111111111111	Admin	Create a log group	Create a log group
222222222222	Member	Create a log group	Create a log group