AWS CDK で Security Hub のコントロールを個別に無効化してみた

$ aws securityhub get-enabled-standards
{
    "StandardsSubscriptions": [
        {
            "StandardsSubscriptionArn": "arn:aws:securityhub:ap-northeast-1:XXXXXXXXXXXX:subscription/aws-foundational-security-best-practices/v/1.0.0",
            "StandardsArn": "arn:aws:securityhub:ap-northeast-1::standards/aws-foundational-security-best-practices/v/1.0.0",
            "StandardsInput": {},
            "StandardsStatus": "READY"
        },
        {
            "StandardsSubscriptionArn": "arn:aws:securityhub:ap-northeast-1:XXXXXXXXXXXX:subscription/cis-aws-foundations-benchmark/v/1.4.0",
            "StandardsArn": "arn:aws:securityhub:ap-northeast-1::standards/cis-aws-foundations-benchmark/v/1.4.0",
            "StandardsInput": {},
            "StandardsStatus": "READY"
        }
    ]
}

standardsSubscriptionArn=arn:aws:securityhub:${region}:${accountId}:subscription/cis-aws-foundations-benchmark/v/1.4.0
aws securityhub describe-standards-controls \
    --standards-subscription-arn ${standardsSubscriptionArn} > cntrols.json

{
    "Controls": [
        // 中略
        {
            "StandardsControlArn": "arn:aws:securityhub:ap-northeast-1:XXXXXXXXXXXX:control/cis-aws-foundations-benchmark/v/1.4.0/3.5",
            "ControlStatus": "ENABLED",
            "ControlStatusUpdatedAt": "2025-01-21T05:20:50.357000+00:00",
            "ControlId": "3.5",
            "Title": "AWS Config should be enabled and use the service-linked role for resource recording",
            "Description": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), any configuration changes between resources. It is recommended AWS Config be enabled in all regions.",
            "RemediationUrl": "https://docs.aws.amazon.com/console/securityhub/Config.1/remediation",
            "SeverityRating": "CRITICAL",
            "RelatedRequirements": [
                "CIS AWS Foundations Benchmark v1.4.0/3.5"
            ]
        },
        {
            "StandardsControlArn": "arn:aws:securityhub:ap-northeast-1:XXXXXXXXXXXX:control/cis-aws-foundations-benchmark/v/1.4.0/1.6",
            "ControlStatus": "ENABLED",
            "ControlStatusUpdatedAt": "2025-01-21T05:20:50.290000+00:00",
            "ControlId": "1.6",
            "Title": "Ensure hardware MFA is enabled for the 'root' user account",
            "Description": "The root user account is the most privileged user in an AWS account. MFA adds an extra layer of protection on top of a user name and password. With MFA enabled, when a user signs in to an AWS website, they will be prompted for their user name and password as well as for an authentication code from their AWS MFA device. For Level 2, it is recommended that the root user account be protected with a hardware MFA.",
            "RemediationUrl": "https://docs.aws.amazon.com/console/securityhub/IAM.6/remediation",
            "SeverityRating": "CRITICAL",
            "RelatedRequirements": [
                "CIS AWS Foundations Benchmark v1.4.0/1.6"
            ]
        },
    ]
}

import { Construct } from 'constructs';
import * as cdk from 'aws-cdk-lib';
import * as securityhub from 'aws-cdk-lib/aws-securityhub';

export class SecurityHubConstruct extends Construct {
  constructor(scope: Construct, id: string, props: SecurityHubConstructProps) {
    super(scope, id);

    const region = cdk.Stack.of(this).region;
    const accountId = cdk.Stack.of(this).account;

    // CIS AWS Foundations Benchmark v1.4.0 標準を有効化する
    new securityhub.CfnStandard(this, 'CisAwsFoundationsBenchmarkv1_4_0', {
      standardsArn: `arn:aws:securityhub:${region}::standards/cis-aws-foundations-benchmark/v/1.4.0`,
      disabledStandardsControls: [
        // Config.1
        {
          standardsControlArn: `arn:aws:securityhub:${region}:${accountId}:control/cis-aws-foundations-benchmark/v/1.4.0/3.5`,
          reason: 'AWS Congig は管理アカウントにより設定されているため。',
        },
        // IAM.6
        {
          standardsControlArn: `arn:aws:securityhub:${region}:${accountId}:control/cis-aws-foundations-benchmark/v/1.4.0/1.6`,
          reason:
            'メンバーアカウントではルートユーザーの設定にアクセスできないため。',
        },
      ],
    });
  }
}