Skip to content

Lab 06 — AWS Config + Security Hub

📝 Guide written, not run yet 🧭 Management and Security Governance 💲 ≈ $0.10–0.30
Services: AWS Config, SSM Automation, Security Hub, IAM, S3, EC2

In one sentence

Record resource configuration with AWS Config, flag non-compliant resources with managed rules, fix them with SSM Automation (one automatic, one manual remediation), then aggregate everything in Security Hub — control findings, a custom finding in ASFF, and an automation rule that rewrites findings.

The idea

 sec6-ssh-open (SG, tag sec6=lab)  ── 22 from 0.0.0.0/0 ──┐
 sec6-test-… (bucket, tag sec6=lab) ── versioning off ─────┤
                                                           ▼
 Config recorder (only SG + S3 types) ──► config items ──► rules (scoped to tag sec6=lab)
       │ history + snapshots → s3://sec6-config-…            │ NON_COMPLIANT
       │                                                     ├─► AUTOMATIC remediation
       │                                                     │     AWS-DisablePublicAccessForSecurityGroup
       │                                                     └─► MANUAL remediation (you run it)
       │                                                           AWS-ConfigureS3BucketVersioning
       ▼
 Security Hub (FSBP standard) ── its controls run as Config rules ──► findings (ASFF)
       ▲  batch-import-findings: your own scanner's finding
       └─ automation rule: Title starts "sec6:" → severity LOW + SUPPRESSED

Both rules are scoped to the tag sec6=lab, and the remediation role can only touch tagged resources — real resources are only recorded and evaluated, never changed.

What to expect when you run it

AWS Config

Step Expected
Recorder (SG + S3 types only) started ✅ recording: true, lastStatus: SUCCESS after a minute
Open-SSH SG + unversioned bucket, both tagged ❌ both rules NON_COMPLIANT, only the two lab resources listed
Resource timeline for the SG ✅ configuration items show each change (created, rule added…)
Automatic remediation on the SSH rule ✅ SSM Automation runs, port 22 rule removed, rule → COMPLIANT
Re-open port 22 ✅ heals itself within minutes (change → evaluation → remediation)
Manual remediation on versioning ⚠️ nothing happens until you start the remediation, then versioning = Enabled

Security Hub

Step Expected
Enable with FSBP only ✅ Security Hub creates its own securityhub-… Config rules
Control findings (15–30 min later) ❌ FAILED S3.x / EC2.x controls — for lab and real resources (report only)
Import a custom HIGH finding in ASFF ✅ imported…
…with an automation rule on Title sec6: ✅ …and immediately rewritten to LOW + SUPPRESSED with a note
select-resource-config advanced query ✅ SQL-like answers over current configuration (by tag, counts by type)

Key lessons

  1. Config = what it looks like and how it changed; CloudTrail = who called the API. Together they answer "who opened port 22, and what did it look like before".
  2. Config rules detect, they don't prevent. Prevention is SCPs/IAM/RCPs; remediation is an after-the-fact SSM Automation run with its own role.
  3. Security Hub depends on Config. Its controls are Config rules, so they only see what the recorder records.
  4. Automation rules change findings; EventBridge responds to them. Different tools for "relabel" vs "act".

Exam notes

  • One recorder per region per account. Record all types or a list; continuous or daily. Global types (IAM) recorded in one region only. Delivery channel → S3 (history, snapshots), optional SNS.
  • Rule triggers: configuration change (scoped by type/tag/ID) or periodic (1/3/6/12/24 h). Rule kinds: AWS managed, custom Lambda, custom Guard. Proactive mode checks CloudFormation resources before deployment.
  • Compliance changes → EventBridge "Config Rules Compliance Change" → SNS/Lambda.
  • Remediation = SSM Automation document + AutomationAssumeRole; automatic (with retries) or manual. Pairs: open SSH → AWS-DisablePublicAccessForSecurityGroup; public bucket → AWS-DisableS3BucketPublicReadWrite; unencrypted bucket → AWS-EnableS3BucketEncryption; unused keys → AWSConfigRemediation-RevokeUnusedIAMUserCredentials.
  • Aggregator = read-only multi-account, multi-region Config view. Conformance pack = rules + remediations as one unit, deployable org-wide. Org-wide needs trusted access + delegated admin.
  • Security Hub = aggregation + posture: GuardDuty, Inspector, Macie, Config, Access Analyzer, Firewall Manager and partners, all in ASFF; standards (FSBP, CIS, PCI DSS, NIST 800-53) made of controls.
  • Responses: EventBridge "Security Hub Findings - Imported" → Lambda/Step Functions, or custom actions (a console button that sends findings to EventBridge).
  • Org view: delegated admin + cross-region aggregation; central configuration pushes standards/controls to all accounts.
  • 2025 naming: the original service is now "Security Hub CSPM" under the new unified Security Hub; the exam's standards/controls/ASFF content is the CSPM part.
  • Control Tower guardrails: SCPs = preventive, Config rules = detective, CFN hooks = proactive.

Review questions

Question 1

An auditor asks "who opened port 22 on sg-0example last Tuesday, and what did the SG look like before?" Which two services answer which half?

Show answer

CloudTrail answers who — the AuthorizeSecurityGroupIngress event with the principal, source IP and time. AWS Config answers what it looked like before — the configuration item history / resource timeline shows the SG's rules before and after the change (and Config links to the CloudTrail event for each change).

Question 2

Your Config rule flags an open SSH group, but nothing fixes it automatically, and the remediation shows FAILED. Name two likely causes.

Show answer

(1) The AutomationAssumeRole is wrong: its trust policy doesn't trust ssm.amazonaws.com, or it lacks permission (e.g. ec2:RevokeSecurityGroupIngress, or a tag condition that doesn't match the resource). (2) The parameters are wrong — the resource ID isn't mapped to the document's input, or the role ARN parameter isn't passed. Also check retries were exhausted and the SSM execution's step error. (If it never even runs, it's set to manual, not automatic.)

Question 3

Security Hub shows no findings for EC2 controls in a new account, though Security Hub and FSBP are enabled. What's missing?

Show answer

AWS Config recording — or recording that excludes the EC2 resource types. Security Hub's controls are evaluated by service-linked Config rules, which need configuration items to evaluate. Enable the Config recorder (with the relevant types) in that account and region.

Question 4

You want every new member account in the org to get the same Config rules automatically. What do you use?

Show answer

Organization Config rules or, better, an organization conformance pack, deployed from the management account or a Config delegated admin (with trusted access enabled). New accounts joining the org get them automatically. (Control Tower detective controls achieve the same in a landing zone.)

Question 5

Your SOC wants HIGH Security Hub findings from a known test account downgraded to INFORMATIONAL automatically, and CRITICAL ones to page the on-call engineer. Which two features?

Show answer

A Security Hub automation rule (criteria: AwsAccountId = test account, severity HIGH → action: set severity INFORMATIONAL) for the relabelling, and an EventBridge rule on Security Hub Findings - Imported with Severity.Label = CRITICAL → SNS / Incident Manager to page. Automation rules modify findings; they can't notify.