source/repositories/compliant-framework-central-core/templates/security/security-hub.yml [163:249]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Type: Custom::ConfigureIamPolicy
    Properties:
      ServiceToken: !GetAtt rConfigureIamPolicyFunction.Arn

  rSecurityHubAlarmNotificationTopicCmk:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F76
    Type: AWS::KMS::Key
    Properties:
      Description: Logging - S3 CMK
      EnableKeyRotation: true
      KeyPolicy:
        Version: 2012-10-17
        Id: key-policy-1
        Statement:
          - Sid: Allow administration of the key
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:ListGrants
              - kms:GenerateRandom
              - kms:TagResource
              - kms:CreateAlias
              - kms:ListKeyPolicies
              - kms:ListResourceTags
              - kms:CreateGrant
              - kms:RevokeGrant
              - kms:GetKeyPolicy
              - kms:ListKeys
              - kms:ListRetirableGrants
              - kms:PutKeyPolicy
              - kms:ListAliases
              - kms:CancelKeyDeletion
              - kms:DisableKey
              - kms:DeleteAlias
              - kms:DescribeKey
              - kms:ImportKeyMaterial
              - kms:UpdateKeyDescription
              - kms:GetKeyRotationStatus
              - kms:DeleteImportedKeyMaterial
              - kms:DisableKeyRotation
              - kms:UpdateAlias
              - kms:UntagResource
              - kms:RetireGrant
              - kms:EnableKey
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:EnableKeyRotation
              - kms:ScheduleKeyDeletion
              - kms:GetParametersForImport
              - kms:CreateKey
            Resource: "*"
          - Sid: Allow Cloudtrail use of the key
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:DescribeKey
              - kms:GenerateDataKey
              - kms:GenerateDataKeyPair
              - kms:GenerateDataKeyPairWithoutPlaintext
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
  rSecurityHubAlarmNotificationTopicCmkAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: alias/compliant-framework/security-hub/sns
      TargetKeyId: !Ref rSecurityHubAlarmNotificationTopicCmk

  # CIS AWS Foundation Benchmark Topics
  rSecurityHubAlarmNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: SecurityHub-CIS-Alarms
      KmsMasterKeyId: !Ref rSecurityHubAlarmNotificationTopicCmkAlias
      Subscription:
        - Endpoint: !Ref pNotificationsEmail
          Protocol: email
  # 1.1 – Avoid the use of the "root" account
  rSecurityHubRootAccountMetricFilter:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



source/repositories/compliant-framework-security-baseline/templates/security-baseline.yml [254:340]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    Type: Custom::ConfigureIamPolicy
    Properties:
      ServiceToken: !GetAtt rConfigureIamPolicyFunction.Arn

  rSecurityHubAlarmNotificationTopicCmk:
    Metadata:
      cfn_nag:
        rules_to_suppress:
          - id: F76
    Type: AWS::KMS::Key
    Properties:
      Description: Logging - S3 CMK
      EnableKeyRotation: true
      KeyPolicy:
        Version: 2012-10-17
        Id: key-policy-1
        Statement:
          - Sid: Allow administration of the key
            Effect: Allow
            Principal:
              AWS:
                - !Sub arn:${AWS::Partition}:iam::${AWS::AccountId}:root
            Action:
              - kms:ListGrants
              - kms:GenerateRandom
              - kms:TagResource
              - kms:CreateAlias
              - kms:ListKeyPolicies
              - kms:ListResourceTags
              - kms:CreateGrant
              - kms:RevokeGrant
              - kms:GetKeyPolicy
              - kms:ListKeys
              - kms:ListRetirableGrants
              - kms:PutKeyPolicy
              - kms:ListAliases
              - kms:CancelKeyDeletion
              - kms:DisableKey
              - kms:DeleteAlias
              - kms:DescribeKey
              - kms:ImportKeyMaterial
              - kms:UpdateKeyDescription
              - kms:GetKeyRotationStatus
              - kms:DeleteImportedKeyMaterial
              - kms:DisableKeyRotation
              - kms:UpdateAlias
              - kms:UntagResource
              - kms:RetireGrant
              - kms:EnableKey
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:EnableKeyRotation
              - kms:ScheduleKeyDeletion
              - kms:GetParametersForImport
              - kms:CreateKey
            Resource: "*"
          - Sid: Allow Cloudtrail use of the key
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action:
              - kms:Encrypt
              - kms:Decrypt
              - kms:DescribeKey
              - kms:GenerateDataKey
              - kms:GenerateDataKeyPair
              - kms:GenerateDataKeyPairWithoutPlaintext
              - kms:GenerateDataKeyWithoutPlaintext
              - kms:ReEncryptFrom
              - kms:ReEncryptTo
            Resource: "*"
  rSecurityHubAlarmNotificationTopicCmkAlias:
    Type: AWS::KMS::Alias
    Properties:
      AliasName: alias/compliant-framework/security-hub/sns
      TargetKeyId: !Ref rSecurityHubAlarmNotificationTopicCmk

  # CIS AWS Foundation Benchmark Topics
  rSecurityHubAlarmNotificationTopic:
    Type: AWS::SNS::Topic
    Properties:
      TopicName: SecurityHub-CIS-Alarms
      KmsMasterKeyId: !Ref rSecurityHubAlarmNotificationTopicCmkAlias
      Subscription:
        - Endpoint: !Ref pNotificationsEmail
          Protocol: email
  # 1.1 – Avoid the use of the "root" account
  rSecurityHubRootAccountMetricFilter:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



