Assume about aws-securityhub-multiaccount-scripts

[mrxpl0it]

I wanted to provide an update on this. I believe there are issues with the instructions for this.

#1 you need to change the assume role the ec2 instance it supposed to use. I used the EnableSecurityHub.yaml, and as written, it doesn't work. The ec2 needs to assume the role "ManageSecurityHub" not the role "EnableSecurityHub". The way the CFT is built, you need to call the role you are assuming not the role the instance profile has.

#2 If you intend on using this for multiple accounts across regions, you have to modify the s3 bucket profile to allow the new accounts to write to it if you want to use a centralized s3 bucket.

[ryanholland]

The CloudFormation template creates an execution role (ManageSecurityHub) and an instance profile and role. You cannot attach the ManageSecurityHub to the instance because you cannot attach a role directly to an instance but rather can only attach an instance profile. The instance profile, EnableSecurityHub, should only be used in the master account and allows the instance with that profile to assume the execution role. The issue you had is that you attempted to use the role used in the instance profile (EnableSecurityHub) rather than the execution role (ManageSecurityHub) in the command.