Aws/セキュリティ管理/10.適用手順-共通項目①

# 設定
## 全てのリージョンでSecurityHubからAWSベストプラクティスを有効化する
ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text)
aws ec2 describe-regions --query "Regions[].[RegionName]" --output text \
| while read region; do
  echo "## enable SecurityHub in ${region}"
  aws --region ${region} securityhub batch-enable-standards --standards-subscription-requests '{"StandardsArn":"arn:aws:securityhub:'${region}'::standards/aws-foundational-security-best-practices/v/1.0.0"}'
  aws --region ${region} securityhub update-standards-control --standards-control-arn "arn:aws:securityhub:${region}:${ACCOUNT_ID}:control/aws-foundational-security-best-practices/v/1.0.0/IAM.6" --control-status DISABLED --disabled-reason "仮想MFAで対応"
  aws --region ${region} securityhub update-standards-control --standards-control-arn "arn:aws:securityhub:${region}:${ACCOUNT_ID}:control/aws-foundational-security-best-practices/v/1.0.0/CloudTrail.5" --control-status DISABLED --disabled-reason "EventBridgeで対応"
done

確認/削除(戻し)

# 確認
aws ec2 describe-regions --query "Regions[].[RegionName]" --output text \
| while read region; do
  echo "## enable SecurityHub in ${region}"
  aws --region ${region} securityhub get-enabled-standards
done

# 削除(戻し)
# 全てのリージョンでSecurityHubを無効化する
aws ec2 describe-regions --query "Regions[].[RegionName]" --output text \
| while read region; do
  echo "## disable SecurityHub in ${region}"
  aws --region ${region} securityhub disable-security-hub
done