Why can't you enable SecurityHub Controls using CloudFormation?

Question

I'm trying to disable a specific SecurityHub standard control (IAM.6 from Best Practices) using CloudFormation and I'm getting a permission error.  The CFN template seems to be correct and applies correctly:
```
    "BestPractices": {
      "Type": "AWS::SecurityHub::Standard",
      "Properties": {
        "DisabledStandardsControls": [
          {
            "StandardsControlArn": "arn:aws:securityhub:us-east-1:11111222223333:control/aws-foundational-security-best-practices/v/1.0.0/IAM.6",
            "Reason": "We don't utilize hardware MFA"
          }
        ],
        "StandardsArn": "arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"
      }
    },
```

However, it's generating the following error.  We do have centralized SecurityHub management configured but I'm trying to apply the CFN template in the management account.  In fact, when this CFN template failed to apply I manually enabled the standard in the AWS Console.

> AccessDeniedException: This account is currently associated with a central configuration policy, so only the administrator can access this operation.

Ideally, I just want the ability to disable certain controls using CFN but you can't do that unless you enable the whole standard and then disable certain controls.

re:Post Agent · Accepted Answer

The error you're encountering is due to the centralized Security Hub management configuration in your AWS environment. When Security Hub is centrally managed, certain operations, including enabling or disabling standards and controls, are restricted to the delegated administrator account.

CloudFormation cannot directly enable or disable Security Hub controls when central configuration is in place. This is because the central configuration policy takes precedence over individual account settings, including those attempted through CloudFormation.

In your case, even though you're trying to apply the CloudFormation template in the management account, the centralized Security Hub configuration prevents you from making these changes directly. The error message "AccessDeniedException: This account is currently associated with a central configuration policy, so only the administrator can access this operation" confirms this restriction.

To disable specific controls like IAM.6 from the AWS Foundational Security Best Practices standard in a centrally managed Security Hub environment, you need to:

1. Use the delegated administrator account to create and manage configuration policies.
2. Use these configuration policies to disable the specific controls you want across your organization.

Unfortunately, this process cannot be directly managed through CloudFormation templates in individual accounts when central configuration is in use. The centralized management approach is designed to ensure consistent security standards across your organization, which is why it restricts individual accounts from making these changes.

If you absolutely need to use CloudFormation to manage these settings, you might need to reconsider your Security Hub centralized management setup. However, this would impact your ability to maintain consistent security standards across your organization, so it's generally not recommended.  
**Sources**  
[Disabling a control in a specific standard - AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/disable-controls-standard.html)  
[Disabling a security standard in Security Hub - AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/disable-standards.html)  
[Enabling a control in a specific standard - AWS Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/controls-configure.html)

Why can't you enable SecurityHub Controls using CloudFormation?

Add your answer

Relevant content