Security Services

src/config/security-services.ts controls the security capabilities deployed by the Security Hub V2 StackSet. The starter explicitly disables CSPM, GuardDuty, Inspector, and Macie. Choose which services to enable before deploying; the unified Security Hub V2 hub in the delegated administrator account remains enabled and managed.

Options

The exported securityServices object uses SecurityServicesConfiguration. All four service objects are required, and each requires an explicit boolean enabled. Optional feature settings take effect when that service is enabled.

CSPM

disabledControlIdentifiers adds to the controls already disabled by the landing zone. The starter supplies ['S3.22', 'S3.23']. Use enabledStandardIdentifiers to choose different standards by their standard ARN strings.

GuardDuty

Each optional field below is a boolean and defaults to true when omitted. Setting enabled: false keeps GuardDuty disabled regardless of these protection-plan choices.

Inspector

Each optional field is a boolean and defaults to true when omitted: ec2Scanning, ecrScanning, lambdaStandardScanning, lambdaCodeScanning, and codeRepositoryScanning. Set an individual field to false to exclude that scan type while Inspector is enabled.

Macie

The optional boolean automatedSensitiveDataDiscovery defaults to true. Set it to false to retain bucket monitoring without automated sensitive data discovery. It has no effect when enabled is false.

Starter configuration

export const securityServices: SecurityServicesConfiguration = {
  cspmOptions: {
    enabled: false,
    disabledControlIdentifiers: ['S3.22', 'S3.23'],
  },
  guardDutyOptions: { enabled: false },
  inspectorOptions: { enabled: false },
  macieOptions: { enabled: false },
};

For example, change GuardDuty to guardDutyOptions: { enabled: true, s3DataEvents: false } to enable it with S3 protection excluded. Keep every service's explicit enabled choice when editing its feature flags.

Apply changes

Review and deploy the landing-zone phase after editing this file:

pnpm landingzone:diff:all
pnpm landingzone:deploy:all

Changing enabled to false actively disables that capability on deployment while retaining prerequisites for re-enablement. Inspector scanning is disabled across enabled Regions; GuardDuty and Macie monitoring are suspended for the administrator and managed members. Check the service status in the administrator and member accounts after deployment.

Keep the delegated administrator and trusted access entries in place when disabling a capability. Removing the Security Hub V2 StackSet is a separate teardown operation; use these settings for routine enablement changes. See the construct reference for the security services' lifecycle behavior.

Upgrading before region removal

1. Adopt the current starter changes and package pins, preserving your existing regions and security-service choices.
2. Run pnpm exec projen, then deploy the organization phase with pnpm organization:deploy and the landing-zone phase with pnpm landingzone:deploy:all. Confirm both finish successfully before disabling services or removing regions.
3. Before removing a secondary region, centrally manage or disable any self-managed Security Hub CSPM member hubs in that region.
4. Remove the region from secondaryRegions in landing-zone-settings.ts, run pnpm exec projen, and review pnpm organization:diff and pnpm landingzone:diff:all. Deploy the organization phase followed by the landing-zone phase again.
5. Verify that managed CSPM coverage and Inspector scanning are disabled in the removed region and that retained regions still have their intended settings.