Question

A CloudOps engineer manages Security Hub across an organization. The security team wants low-severity findings from a specific AWS Config rule that flags EC2 instances missing a non-critical 'CostCenter' tag to be automatically suppressed so they don't clutter the dashboard, while all other findings remain visible. The solution must require no custom code and apply going forward as new findings arrive. What should the engineer do?

Accepted Answer

Create a Security Hub automation rule with criteria matching the finding type and set the workflow status to SUPPRESSED as the action.

Answer

Disable the underlying AWS Config rule so it stops generating any findings for that check.

Answer

Create an EventBridge rule that triggers a Lambda function to call BatchUpdateFindings and archive each matching finding.

Answer

Lower the Security Hub finding severity threshold so low-severity findings are excluded from the default insights.