Question

A security team enables Security Hub with the AWS Foundational Security Best Practices standard across an organization. One control flags several EC2 instances that intentionally run without detailed monitoring, and this configuration is an approved architectural exception documented in a risk register. The team wants to stop these specific findings from cluttering the dashboard and skewing the compliance score, but they must keep the same control active so that any NEW non-compliant resources are still detected and scored. What should they do?

Accepted Answer

Set the workflow status of the existing findings to Suppressed, leaving the control enabled to evaluate future resources

Answer

Disable the specific control in the standard so the approved instances no longer generate findings

Answer

Create a Security Hub insight that filters out the findings for the approved instances

Answer

Add the instance IDs to a GuardDuty suppression rule so the findings are automatically archived