Specify a central security-hub aws account when sending findings about prowler

[jfagoagas]

Hello @jmello-pagseguro, thanks for creating the issue here.

To continue the conversation we had in Slack, as far as I can tell the above feature is not supported by AWS Security Hub right? At least it wasn't, so you have to send each finding to their correspondent AWS Security Hub region and then aggregate all the account’s region findings in one region to view all at once.

Regarding accounts you can delegate administrators in Security Hub to manage your organisation but I’m not sure if all the findings can be sent to single account since they are theoretically restricted by their ARN.

The AWS CLI documentation about the call batch-import-findings states the following:

• The Amazon Web Services account that is associated with a finding if you are using the default product ARN or are a partner sending findings from within a customer's Amazon Web Services account. In these cases, the identifier of the account that you are calling BatchImportFindings from needs to be the same as the AwsAccountId attribute for the finding.
• An AWS account that Security Hub has allow-listed for an official partner integration. In this case, you can call BatchImportFindings from the allow-listed account and send findings from different customer accounts in the same batch.

Maybe your use case can fit into the second but I'm not sure how it works internally in AWS.

[jfagoagas]

We are closing this issue since the behaviour described above is not supported by AWS Security Hub, as discussed with the issue owner in the Prowler Community Slack at https://prowler-workspace.slack.com/archives/C0451NDLC4X/p1720027104962509.