AWS Security Hub オートメーションルールで特定のコントロールを自動抑制してみた

{
  "AwsAccountId": "012345678901",
  "CompanyName": "AWS",
  "Compliance": {
    "Status": "FAILED",
    "SecurityControlId": "EC2.18",
    "AssociatedStandards": [
      {
        "StandardsId": "standards/aws-foundational-security-best-practices/v/1.0.0"
      }
    ],
    "SecurityControlParameters": [
      {
        "Value": [],
        "Name": "authorizedUdpPorts"
      },
      {
        "Value": ["80", "443"],
        "Name": "authorizedTcpPorts"
      }
    ]
  },
  "CreatedAt": "2024-08-14T02:14:50.595Z",
  "Description": "This control checks whether an Amazon EC2 security group permits unrestricted incoming traffic from unauthorized ports. The control status is determined as follows: If you use the default value for 'authorizedTcpPorts', the control fails if the security group permits unrestricted incoming traffic from any port other than ports 80 and 443; If you provide custom values for 'authorizedTcpPorts' or 'authorizedUdpPorts', the control fails if the security group permits unrestricted incoming traffic from any unlisted port; If no parameter is used, the control fails for any security group that has an unrestricted inbound traffic rule.",
  "FindingProviderFields": {
    "Types": [
      "Software and Configuration Checks/Industry and Regulatory Standards/AWS-Foundational-Security-Best-Practices"
    ],
    "Severity": {
      "Normalized": 70,
      "Label": "HIGH",
      "Product": 70,
      "Original": "HIGH"
    }
  },
  "FirstObservedAt": "2024-08-14T02:14:50.595Z",
  "GeneratorId": "aws-foundational-security-best-practices/v/1.0.0/EC2.18",
  "Id": "arn:aws:securityhub:ap-northeast-1:012345678901:subscription/aws-foundational-security-best-practices/v/1.0.0/EC2.18/finding/de2add97-455a-46b1-bb3e-37730ba38a25",
  "LastObservedAt": "2024-08-14T02:14:56.351Z",
  "Note": {
    "UpdatedBy": "sechub-automation",
    "Text": "オートメーションで自動的に抑制されました",
    "UpdatedAt": "2024-08-14T02:14:59.668Z"
  },
  "ProcessedAt": "2024-08-14T02:14:59.773Z",
  "ProductArn": "arn:aws:securityhub:ap-northeast-1::product/aws/securityhub",
  "ProductFields": {
    "StandardsArn": "arn:aws:securityhub:::standards/aws-foundational-security-best-practices/v/1.0.0",
    "StandardsSubscriptionArn": "arn:aws:securityhub:ap-northeast-1:012345678901:subscription/aws-foundational-security-best-practices/v/1.0.0",
    "ControlId": "EC2.18",
    "RecommendationUrl": "https://docs.aws.amazon.com/console/securityhub/EC2.18/remediation",
    "RelatedAWSResources:0/name": "securityhub-vpc-sg-open-only-to-authorized-ports-c7ec400d",
    "RelatedAWSResources:0/type": "AWS::Config::ConfigRule",
    "StandardsControlArn": "arn:aws:securityhub:ap-northeast-1:012345678901:control/aws-foundational-security-best-practices/v/1.0.0/EC2.18",
    "aws/securityhub/ProductName": "Security Hub",
    "aws/securityhub/CompanyName": "AWS",
    "aws/securityhub/annotation": "No tcp ['22'] port is authorized to be open, according to authorizedTcpPorts values ['80,443'] parameter.",
    "Resources:0/Id": "arn:aws:ec2:ap-northeast-1:012345678901:security-group/sg-0e209febfe1a9f83a",
    "aws/securityhub/FindingId": "arn:aws:securityhub:ap-northeast-1::product/aws/securityhub/arn:aws:securityhub:ap-northeast-1:012345678901:subscription/aws-foundational-security-best-practices/v/1.0.0/EC2.18/finding/de2add97-455a-46b1-bb3e-37730ba38a25"
  },
  "ProductName": "Security Hub",
  "RecordState": "ACTIVE",
  "Region": "ap-northeast-1",
  "Remediation": {
    "Recommendation": {
      "Text": "For information on how to correct this issue, consult the AWS Security Hub controls documentation.",
      "Url": "https://docs.aws.amazon.com/console/securityhub/EC2.18/remediation"
    }
  },
  "Resources": [
    {
      "Details": {
        "AwsEc2SecurityGroup": {
          "GroupName": "menber-account-ap-northeast-1",
          "OwnerId": "012345678901",
          "VpcId": "vpc-0e8a7ababbe73d146",
          "IpPermissions": [
            {
              "FromPort": 22,
              "ToPort": 22,
              "IpProtocol": "tcp",
              "IpRanges": [
                {
                  "CidrIp": "0.0.0.0/0"
                }
              ]
            }
          ],
          "IpPermissionsEgress": [
            {
              "IpProtocol": "-1",
              "IpRanges": [
                {
                  "CidrIp": "0.0.0.0/0"
                }
              ]
            }
          ],
          "GroupId": "sg-0e209febfe1a9f83a"
        }
      },
      "Id": "arn:aws:ec2:ap-northeast-1:012345678901:security-group/sg-0e209febfe1a9f83a",
      "Partition": "aws",
      "Region": "ap-northeast-1",
      "Type": "AwsEc2SecurityGroup"
    }
  ],
  "SchemaVersion": "2018-10-08",
  "Severity": {
    "Label": "HIGH",
    "Normalized": 70,
    "Original": "HIGH",
    "Product": 70
  },
  "Title": "EC2.18 Security groups should only allow unrestricted incoming traffic for authorized ports",
  "Types": [
    "Software and Configuration Checks/Industry and Regulatory Standards/AWS-Foundational-Security-Best-Practices"
  ],
  "UpdatedAt": "2024-08-14T02:14:50.595Z",
  "Workflow": {
    "Status": "SUPPRESSED"
  },
  "WorkflowState": "NEW"
}

aws securityhub create-automation-rule \
--rule-name "SH-特定のコントロールの検出結果を自動抑制-2" \
--description "SH-特定のコントロールの検出結果を自動抑制します" \
--rule-order 1 \
--rule-status "ENABLED" \
--criteria '{
  "ProductName": [{"Value": "Security Hub", "Comparison": "EQUALS"}],
  "ComplianceSecurityControlId": [
    {"Value": "EC2.17", "Comparison": "EQUALS"},
    {"Value": "EC2.18", "Comparison": "EQUALS"}
  ],  "RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}]
}' \
--actions '[{
  "Type": "FINDING_FIELDS_UPDATE",
  "FindingFieldsUpdate": {
    "Workflow": {"Status": "SUPPRESSED"},
    "Note": {
      "Text": "オートメーションで自動的に抑制されました",
      "UpdatedBy": "SecurityHub-AutomationRule"
    }
  }
}]'

{
    "RuleArn": "arn:aws:securityhub:ap-northeast-1:012345678901:automation-rule/d68bf547-cd21-4584-bb5b-c672e37c685d"
}