Question

A financial services company aggregates Security Hub findings across 40 member accounts into a delegated administrator account. Compliance requires that any finding tagged with a specific approved-exception resource tag (indicating a documented risk acceptance) be automatically set to a SUPPRESSED workflow status and have its severity lowered, without an engineer manually editing each finding. The team wants this to apply consistently to all current and future matching findings across the organization using a native Security Hub feature. What should the DevOps engineer implement?

Accepted Answer

Create a Security Hub automation rule in the delegated administrator account that matches findings by the resource tag and automatically updates their workflow status to SUPPRESSED and adjusts severity.

Answer

Configure an EventBridge rule for each member account that triggers a Lambda function to call BatchUpdateFindings whenever a matching finding arrives.

Answer

Author an AWS Config conformance pack that evaluates the resource tag and marks noncompliant findings as suppressed in Security Hub.

Answer

Disable the relevant Security Hub controls in each member account so the findings tagged for exception are no longer generated.