Security Services

src/config/security-services.ts controls the security capabilities that the Organization Security StackSet manages from the security account: Security Hub CSPM, GuardDuty, Inspector, and Macie. The starter enables all four. Choose which services to keep before deploying; the unified Security Hub V2 hub in the delegated administrator account stays enabled and managed either way. Edits take effect on the next landing-zone deployment.

Options

The exported securityServices object uses SecurityServicesConfiguration. All four service objects are required, and each requires an explicit boolean enabled. Optional feature settings take effect when that service is enabled.

CSPM

disabledControlIdentifiers adds to the controls already disabled by the landing zone. The starter supplies ['S3.20', 'S3.22', 'S3.23', 'EC2.172']. Use enabledStandardIdentifiers to choose different standards by their standard ARN strings.

Automation rules

automationRules keeps Security Hub automation rules in every enabled Region. A rule matches findings by criteria such as the control ID, resource ID, or resource tags, and then updates them. The common use is suppressing the findings of a control on resources that can't meet it. A suppressed finding no longer counts toward its control's status or the security score.

criteria and actions use the aws-cdk-lib Security Hub types for automation rules (CfnAutomationRule). Synthesis rejects an operator, action type, workflow status, severity label, or verification state that the Security Hub API doesn't accept.

The landing zone creates the rules in each enabled Region. It manages only the rules it created, so rules you create in the console stay as they are. AWS allows 100 rules per account and Region. The rules exist only while CSPM is enabled.

The starter ships three rules:

To suppress a control on your own resources, add a rule next to these. Match the control with complianceSecurityControlId and narrow the match with resourceId or resourceTags. Filters on the same field are OR-ed, and filters on different fields must all match.

GuardDuty

Each optional field below is a boolean and defaults to true when omitted. Setting enabled: false turns GuardDuty off regardless of these protection-plan choices. GuardDuty is enforced through AWS Organizations policies, so accounts cannot change the protection plans it manages themselves. Accounts in the close-account OU always have GuardDuty off.

Inspector

Each optional field is a boolean and defaults to true when omitted: ec2Scanning, ecrScanning, lambdaStandardScanning, lambdaCodeScanning, and codeRepositoryScanning. Set an individual field to false to exclude that scan type while Inspector is enabled.

Macie

The optional boolean automatedSensitiveDataDiscovery defaults to true. Set it to false to retain bucket monitoring without automated sensitive data discovery. It has no effect when enabled is false.

Starter configuration

export const securityServices: SecurityServicesConfiguration = {
  cspmOptions: {
    enabled: true,
    disabledControlIdentifiers: ['S3.20', 'S3.22', 'S3.23', 'EC2.172'],
    automationRules: [
      {
        ruleName: 'landing-zone-stackset-instances',
        description: 'Suppress CloudFormation.3 and CloudFormation.4 on landing-zone StackSet stack instances',
        criteria: {
          complianceSecurityControlId: [
            { comparison: 'EQUALS', value: 'CloudFormation.3' },
            { comparison: 'EQUALS', value: 'CloudFormation.4' },
          ],
          resourceTags: [
            { comparison: 'EQUALS', key: LandingZoneTags.MANAGED_KEY, value: LandingZoneTags.MANAGED_VALUE },
          ],
          resourceId: [{ comparison: 'CONTAINS', value: ':stack/StackSet-' }],
        },
        actions: [
          {
            type: 'FINDING_FIELDS_UPDATE',
            findingFieldsUpdate: {
              workflow: { status: 'SUPPRESSED' },
              note: { text: 'Suppressed by the landing zone', updatedBy: 'cdk-landing-zone' },
            },
          },
        ],
      },
      {
        ruleName: 'landing-zone-access-log-buckets',
        description: 'Suppress S3.9 on the landing-zone buckets that receive server access logs',
        criteria: {
          complianceSecurityControlId: [{ comparison: 'EQUALS', value: 'S3.9' }],
          resourceTags: [{ comparison: 'EQUALS', key: ACCESS_LOGS_BUCKET_TAG_KEY, value: 'true' }],
        },
        actions: [
          {
            type: 'FINDING_FIELDS_UPDATE',
            findingFieldsUpdate: {
              workflow: { status: 'SUPPRESSED' },
              note: { text: 'Suppressed by the landing zone', updatedBy: 'cdk-landing-zone' },
            },
          },
        ],
      },
      {
        ruleName: 'landing-zone-cdk-staging-buckets',
        description: 'Suppress S3.9 on the CDK bootstrap staging buckets the landing zone deploys',
        criteria: {
          complianceSecurityControlId: [{ comparison: 'EQUALS', value: 'S3.9' }],
          resourceId: [{ comparison: 'CONTAINS', value: ':::cdk-hnb659fds-assets-' }],
          resourceTags: [
            { comparison: 'EQUALS', key: LandingZoneTags.MANAGED_KEY, value: LandingZoneTags.MANAGED_VALUE },
          ],
        },
        actions: [
          {
            type: 'FINDING_FIELDS_UPDATE',
            findingFieldsUpdate: {
              workflow: { status: 'SUPPRESSED' },
              note: { text: 'Suppressed by the landing zone', updatedBy: 'cdk-landing-zone' },
            },
          },
        ],
      },
    ],
  },
  guardDutyOptions: { enabled: true },
  inspectorOptions: { enabled: true },
  macieOptions: { enabled: true },
};

All four services are enabled in the starter. For example, change GuardDuty to guardDutyOptions: { enabled: true, s3DataEvents: false } to keep it with S3 protection excluded, or set macieOptions: { enabled: false } to turn Macie off if you don't need it. Keep every service's explicit enabled choice when editing its feature flags.

Apply changes

Review and deploy the landing-zone phase after editing this file:

pnpm landingzone:diff:all
pnpm landingzone:deploy:all

The delegated administrator registrations and trusted access these services need come from the organization phase. Keep the delegated administrator and trusted access entries in place when you disable a capability, so you can enable it again. For the construct behind each service, see the construct reference.

Things to know

• Disabling is a setting, not a removal. Set enabled: false and deploy. The landing zone keeps the configuration it needs to enable the service again and actively turns the service off across the organization, so accounts are not left to manage it themselves. Do not remove the Organization Security StackSet to disable a service. The table below shows what each service leaves behind.
• The Security Hub V2 hub stays enabled in the delegated administrator account when all four services are disabled.
• Check the result. After a change, confirm the state in each service's console in the administrator account.
• Close-account OU. Accounts in the close-account OU have Security Hub CSPM, GuardDuty, and Inspector turned off regardless of this file, and Macie does not manage them. Accounts in the Suspended OU keep the services you enabled.
• Region limit. GuardDuty supports at most 15 enabled Regions in total (the primary Region plus secondaryRegions), even while it is disabled. Synthesis fails with more.
• Removing a Region. Remove it from secondaryRegions in landing-zone-settings.ts, run pnpm exec projen, review pnpm organization:diff and pnpm landingzone:diff:all, then deploy the organization phase followed by the landing-zone phase. The services are turned off in the removed Region first, and retained Regions keep their settings. Afterwards, confirm that CSPM, GuardDuty, and Inspector are off in the removed Region.
• Deploy order. Deploy the organization phase before the landing-zone phase when you change Regions or enable a service for the first time, so delegation is registered before the services are configured.

What disabling leaves behind