This article is for teams who want to connect their AWS environment to Tenacy to automate the collection of cloud security indicators, without manual re-entry.
AWS Security Hub is a service provided by Amazon Web Services (AWS) to help organizations control the security of their AWS environments. It can aggregate results from several AWS services and security standards, to identify vulnerabilities, bad practices, and security features that are not implemented, presented as findings.
This connector queries the AWS Security Hub API to collect indicators (values tracked over time on a perimeter) based on the findings detected.
This connector allows the following information to be collected:
On findings: Count, Severity, Confidence, Compliance Status
On assets: number of assets with high or critical severity findings
Add and configure the connector
To add this connector, go to Catalog > Connectors > AWS Security Hub > Add a connector
After adding it, you must configure:
Operator perimeter: the perimeter that operates and dictates the cloud compliance rules, to which indicators will be linked by default.
Frequency: how often the AWS API is queried and the periodicity of the associated indicators. This frequency can be daily, weekly, monthly, half-yearly, or yearly.
Then:
AWS Region: one of the regions of your AWS subscription, used to instantiate the AWS client.
💡 The selected AWS region has no impact on the findings retrieved or on the associated perimeters: it is only used to technically instantiate the AWS client.
AWS API key ID: an API key whose minimum permissions are: all necessary resources (
*in the related field, for no filter) and the actionsGetFindingAggregator,GetFindingHistory, andGetFindings.AWS API key secret: the secret generated together with the API key above.
⚠️ This secret is only visible at the time the key is generated. Keep it safe, as it cannot be displayed again afterward.
Findings history: filters findings over a certain number of days. By default, findings from the last 90 days are retrieved.
Perimeter mapping table: map at least one AWS region or account ID to the operator perimeter.
💡 If several regions or account IDs correspond to a single Tenacy perimeter, separate them with commas, with no spaces.
⚠️ You cannot mix AWS account IDs and regions within the same Tenacy perimeter.
💡 To generate an API key with the right resources and permissions, refer to the dedicated AWS documentation: https://docs.aws.amazon.com/fr_fr/service-authorization/latest/reference/list_awssecurityhub.html
Run your first test
Once the connector is properly configured, test the integration by running an initial execution.
Go to ⚙️ > Connectors > click on the AWS Security Hub connector > Run now:
💡 Feel free to contact Tenacy support if you have any questions about this.
Expected result
Once the test runs successfully, the connector automatically queries the AWS Security Hub API according to the chosen frequency. The associated indicators start updating on the operator perimeter and on the perimeters mapped in the mapping table.
Metrics fed
Built-in Metrics
Findings: total number of findings retrieved
Resources at risk: resources with at least one active severe or critical finding
Average severity: average severity of findings
Average confidence: average confidence of findings
Active findings: number of unarchived findings
Configurable metrics
Findings by severity: findings for each severity level
Findings by status: findings for each status
Frequently asked questions
Does this connector also create gaps?
No, this connector only retrieves indicators from AWS Security Hub findings, it does not create gaps in a register.
Does the selected AWS region impact the findings retrieved?
No, it is only used to technically instantiate the AWS client and has no impact on the findings or the associated perimeters.
Can I map several AWS accounts or regions to a single Tenacy perimeter?
Yes, by separating the identifiers with a comma and no spaces. However, you cannot mix AWS account IDs and regions within the same perimeter.
What happens if I don't set a findings history value?
By default, only findings from the last 90 days are retrieved.