How to debug Security Hub checks failing in the CIS Reference Architecture?

[zackproser]

A customer asked:

How do I debug Security Hub check that is failing for my CIS Reference Architecture?

[zackproser]

The Gruntwork CIS Reference Architecture implements a configuration that is compliant with the CIS AWS Foundations Benchmark.

If you need to debug why a particular Security Hub check is failing for your CIS Reference Architecture, start by opening the official AWS whitepaper on the CIS Foundations Benchmark and looking for the section that maps to the failing check.

For example, let's say your Ensure a log metric filter and alarm exist for unauthorized API calls securityhub check is failing with CLOUDTRAIL_METRIC_FILTER_NOT_VALID.

Ensure a log metric filter and alarm exist for unauthorized API calls is the relevant section in the whitepaper to review. Within that section is an Audit subheader, which lays out exactly how to perform the check manually, with a combination of AWS console tasks and AWS CLI calls.

Perform the steps outlined in the Audit and take note of the exact command or step that fails or can't be completed successfully. This provides clues as to which of the CIS service catalog modules might have an issue.

Please provide this information as feedback to Gruntwork when opening tickets or sending inquiries to support, as it will greatly assist us in narrowing down the problem.

Additional resources

• AWS Security Hub Core Concepts - Gruntwork guide detailing how the checks run, how they behave with cross-account architectures, etc.
• Official AWS Whitepaper on CIS Foundations Benchmark

[zackproser]

Credit for this solution goes to @yorinasub17