Options
All
  • Public
  • Public/Protected
  • All
Menu

Class CentralSecurityServicesConfig

AWS Accelerator central security services configuration

Hierarchy

  • CentralSecurityServicesConfig

Implements

Index

Constructors

Properties

Constructors

constructor

Properties

Readonly auditManager

auditManager: undefined | AuditManagerConfig = undefined

Amazon Audit Manager Configuration

Readonly delegatedAdminAccount

delegatedAdminAccount: "Audit" = 'Audit'

Designated administrator account name for accelerator security services. AWS organizations designate a member account as a delegated administrator for the organization users and roles from that account can perform administrative actions for security services like Macie, GuardDuty, Detective and SecurityHub. Without designated administrator account administrative tasks for security services are performed only by users or roles in the organization's management account. This helps you to separate management of the organization from management of these security services. Accelerator use Audit account as designated administrator account.

default

Audit

To make Audit account as designated administrator account for every security services configured by accelerator, you need to provide below value for this parameter

example
delegatedAdminAccount: Audit

Readonly detective

detective: undefined | DetectiveConfig = undefined

Amazon Detective Configuration

Readonly ebsDefaultVolumeEncryption

ebsDefaultVolumeEncryption: EbsDefaultVolumeEncryptionConfig = ...

AWS Elastic Block Store default encryption configuration

Accelerator use this parameter to configure EBS default encryption. Accelerator will create KMS key for every AWS environment (account and region), which will be used as default EBS encryption key.

To enable EBS default encryption in every region accelerator implemented, you need to provide below value for this parameter.

example
ebsDefaultVolumeEncryption:
    enable: true
    excludeRegions: []

Readonly guardduty

guardduty: GuardDutyConfig = ...

Amazon GuardDuty Configuration

Readonly macie

macie: MacieConfig = ...

Amazon Macie Configuration

Accelerator use this parameter to define AWS Macie configuration.

To enable Macie in every region accelerator implemented and set fifteen minutes of frequency to publish updates to policy findings for the account with publishing sensitive data findings to Security Hub. you need to provide below value for this parameter.

example
macie:
    enable: true
    excludeRegions: []
    policyFindingsPublishingFrequency: FIFTEEN_MINUTES
    publishSensitiveDataFindings: true

Readonly s3PublicAccessBlock

s3PublicAccessBlock: S3PublicAccessBlockConfig = ...

AWS S3 public access block configuration

Accelerator use this parameter to block AWS S3 public access

To enable S3 public access blocking in every region accelerator implemented, you need to provide below value for this parameter.

example
s3PublicAccessBlock:
    enable: true
    excludeAccounts: []

Readonly securityHub

securityHub: SecurityHubConfig = ...

AWS SecurityHub configuration

Accelerator use this parameter to define AWS SecurityHub configuration.

To enable AWS SecurityHub for all regions and enable "AWS Foundational Security Best Practices v1.0.0" security standard for IAM.1 & EC2.10 controls you need provide below value for this parameter.

example
securityHub:
    enable: true
    regionAggregation: true
    excludeRegions: []
    standards:
      - name: AWS Foundational Security Best Practices v1.0.0
        enable: true
        controlsToDisable:
          - IAM.1
          - EC2.10

Readonly snsSubscriptions

snsSubscriptions: SnsSubscriptionConfig[] = []

AWS SNS subscription configuration

Accelerator use this parameter to define AWS SNS notification configuration.

To enable high, medium and low SNS notifications, you need to provide below value for this parameter.

example
snsSubscriptions:
    - level: High
      email: <notify-high>@example.com
    - level: Medium
      email: <notify-medium>@example.com
    - level: Low
      email: <notify-low>@example.com

Readonly ssmAutomation

ssmAutomation: SsmAutomationConfig = ...

AWS Systems Manager Document configuration

Accelerator use this parameter to define AWS Systems Manager documents configuration. SSM documents are created in designated administrator account for security services, i.e. Audit account.

To create a SSM document named as "SSM-ELB-Enable-Logging" in every region accelerator implemented and share this document with Root organizational unit(OU), you need to provide below value for this parameter. To share document to specific account uncomment accounts list. A valid SSM document template file ssm-documents/ssm-elb-enable-logging.yaml must be present in Accelerator config repository. Accelerator will use this template file to create the document.

example
ssmAutomation:
    excludeRegions: []
    documentSets:
      - shareTargets:
          organizationalUnits:
            - Root
          # accounts:
          #   - Network
        documents:
          - name: SSM-ELB-Enable-Logging
            template: ssm-documents/ssm-elb-enable-logging.yaml

Generated using TypeDoc