Skip to main content

AWS Security Hub Configuration Guide

1. Introduction​

  • A valid Role (Role ARN) is required in order to access AWS Security Hub

2. Prerequisites​

  • AWS Console access with required service access.

3. AWS Security Hub Setup Guide​

  • Enable the Security Hub service in your AWS account.
  • Enable the security standards that you need to check. If a standard is not enabled, you will see an Enable Standard button. If it is already enabled, you will see a View Results button.
  • Create a role (eg. ASCERA_Security_Hub_Readonly) in the user's AWS account that has access to AWS Security Hub (all read access). You can use the AWS managed policy AWSSecurityHubReadOnlyAccess for this.
  • Add a trust policy that allows the ascera-connector user from the ASCERA AWS account to assume the role you created (ASCERA_Security_Hub_Readonly) in the user's account.
  • Copy the ARN of the role you created. You will need it to create the connector.

Once the role and trust policy are in place, ASCERA can assume the role and use the AWS Security Hub APIs to fetch findings and compliance data.