Security Services

src/config/security-services.ts controls the security capabilities that the Organization Security StackSet manages from the security account: Security Hub CSPM, GuardDuty, Inspector, and Macie. The starter explicitly disables all four. Choose which services to enable before deploying; the unified Security Hub V2 hub in the delegated administrator account stays enabled and managed either way. Edits take effect on the next landing-zone deployment.

Options

The exported securityServices object uses SecurityServicesConfiguration. All four service objects are required, and each requires an explicit boolean enabled. Optional feature settings take effect when that service is enabled.

CSPM

disabledControlIdentifiers adds to the controls already disabled by the landing zone. The starter supplies ['S3.22', 'S3.23']. Use enabledStandardIdentifiers to choose different standards by their standard ARN strings.

GuardDuty

Each optional field below is a boolean and defaults to true when omitted. Setting enabled: false turns GuardDuty off regardless of these protection-plan choices. GuardDuty is enforced through AWS Organizations policies, so accounts cannot change the protection plans it manages themselves. Accounts in the close-account OU always have GuardDuty off.

Inspector

Each optional field is a boolean and defaults to true when omitted: ec2Scanning, ecrScanning, lambdaStandardScanning, lambdaCodeScanning, and codeRepositoryScanning. Set an individual field to false to exclude that scan type while Inspector is enabled.

Macie

The optional boolean automatedSensitiveDataDiscovery defaults to true. Set it to false to retain bucket monitoring without automated sensitive data discovery. It has no effect when enabled is false.

Starter configuration

export const securityServices: SecurityServicesConfiguration = {
  cspmOptions: {
    enabled: true,
    disabledControlIdentifiers: ['S3.22', 'S3.23'],
  },
  guardDutyOptions: { enabled: true },
  inspectorOptions: { enabled: true },
  macieOptions: { enabled: true },
};

All four services are enabled in the starter. For example, change GuardDuty to guardDutyOptions: { enabled: true, s3DataEvents: false } to keep it with S3 protection excluded, or set macieOptions: { enabled: false } to turn Macie off if you don't need it. Keep every service's explicit enabled choice when editing its feature flags.

Apply changes

Review and deploy the landing-zone phase after editing this file:

pnpm landingzone:diff:all
pnpm landingzone:deploy:all

The delegated administrator registrations and trusted access these services need come from the organization phase. Keep the delegated administrator and trusted access entries in place when you disable a capability, so you can enable it again. For the construct behind each service, see the construct reference.

Things to know

• Disabling is a setting, not a removal. Set enabled: false and deploy. The landing zone keeps the configuration it needs to enable the service again and actively turns the service off across the organization, so accounts are not left to manage it themselves. Do not remove the Organization Security StackSet to disable a service. The table below shows what each service leaves behind.
• The Security Hub V2 hub stays enabled in the delegated administrator account when all four services are disabled.
• Check the result. After a change, confirm the state in each service's console in the administrator account.
• Close-account OU. Accounts in the close-account OU have Security Hub CSPM, GuardDuty, and Inspector turned off regardless of this file, and Macie does not manage them. Accounts in the Suspended OU keep the services you enabled.
• Region limit. GuardDuty supports at most 15 enabled Regions in total (the primary Region plus secondaryRegions), even while it is disabled. Synthesis fails with more.
• Removing a Region. Remove it from secondaryRegions in landing-zone-settings.ts, run pnpm exec projen, review pnpm organization:diff and pnpm landingzone:diff:all, then deploy the organization phase followed by the landing-zone phase. The services are turned off in the removed Region first, and retained Regions keep their settings. Afterwards, confirm that CSPM, GuardDuty, and Inspector are off in the removed Region.
• Deploy order. Deploy the organization phase before the landing-zone phase when you change Regions or enable a service for the first time, so delegation is registered before the services are configured.

What disabling leaves behind