AI CloudAdvisor (Beta)

My Presets

You must be logged in to save or view your saved configuration templates

Security Controls

Service Control PoliciesConfig RulesCloudWatch Alarms and Event RulesCloudFormation Guard RulesLogging & Monitoring ConfigurationsBackups & DRAuto Remediation RulesConformance PacksBilling and Cost ManagementS3 Bucket PoliciesSecurity Groups & NACLsIAM PoliciesVPC Endpoint Policies

AWS Services

Guided Walkthroughs

Configuration Packages

Reference Guides

Other

AI CloudAdvisor (Beta)

Configuration Stack
0

My Presets

Security Controls

AWS Services

Guided Walkthroughs

Configuration Packages

Reference Guides

Other

Guided Walkthroughs

Delegated Security Account

Overview

  • This guide configures delegation for the main AWS security services to create a dedicated security account. The security account aggregates all findings and alerts from the various services to allow for centralized monitoring and response.
  • The guide creates two CLI scripts to be applied in the organization Management Account and the member account designated as the central Security Account. The following services are included in this guide: 
    • GuardDuty: Signature and anomaly-based security detection in the account to alert on suspicious activity
    • Security Hub: Aggregates findings from various security services and enables compliance monitoring according to standards such as CIS, PCI DSS, and AWS best practices
    • Access Analyzer: Identifies resources in the organization that are shared with external entities
    • Inspector: Software vulnerability scanning for EC2 instances and ECR repositories
    • Macie: Automates the discovery of sensitive data on Amazon S3 buckets
  • Important: This guide requires a recent scan of your organization management AWS account to ensure an up-to-date view of the AWS environment, configuration, and resources

A premium subscription is required for this content


Configuration

AWS Account
GuardDuty
Security Hub
Access Analyzer
Inspector
Macie

Account Summary

Select AWS account and region to display account summary
Hide Info

AWS Account/Regions

Management AWS Account

Select the organization management account which is used to delegate management of security services to the dedicated security account.

Security Account

Enter the account id for the AWS account that will be designated as the central security account. This account will be delegated the permissions to manage security services on behalf of the organization and aggregate findings across all member accounts.

AWS Regions

AWS services operate independently in each region, and so it is required that you select each region you want to enable delegation for (It is recommended to enable this in all active regions in your organization).

Deploy

Organization Management Account AWS Shell
Run the following commands in the organization management account to delegate the management of the selected security services


#!/bin/bash 

aws --region "us-east-1" guardduty enable-organization-admin-account --admin-account-id "" 

aws --region "us-east-1" securityhub enable-organization-admin-account --admin-account-id "" 


aws --region "us-east-1" organizations register-delegated-administrator --account-id "" --service-principal "access-analyzer.amazonaws.com"

aws --region "us-east-1" inspector2 enable-delegated-admin-account --delegated-admin-account-id ""

Dedicated Security Account AWS Shell
Run the following commands in the organization designated security account to update the settings for the delegated security services


#!/bin/bash 

gdDetectorId=$(aws --region "us-east-1" guardduty list-detectors --query "DetectorIds[0]" --output=text)
aws --region "us-east-1" guardduty update-organization-configuration --detector-id $gdDetectorId --auto-enable 
aws --region "us-east-1" guardduty create-members --detector-id $gdDetectorId --account-details AccountId=,Email=

aws --region "us-east-1" securityhub update-organization-configuration --auto-enable
aws --region "us-east-1" securityhub create-members --account-details AccountId=,Email=

aws --region "us-east-1" inspector2 enable --resource-types EC2 ECR
aws --region "us-east-1" inspector2 associate-member --account-id 
aws --region "us-east-1" inspector2 update-organization-configuration --auto-enable ec2=true,ecr=true
aws --region "us-east-1" inspector2 enable --account-ids  --resource-types EC2 ECR