[Issue #6986] Set up alerts from AWS Security Hub

[sean-navapbc]

Summary

• Created SNS topic for Security Hub findings with email subscription to [email protected]
• Added EventBridge rules to capture CRITICAL and HIGH severity findings automatically
• Configured formatted alerts with finding details, affected resources, and remediation steps
• Added optional Slack integration configuration (commented out, ready to enable)
• Included comprehensive documentation for setup, testing, and customization

Changes

New file: infra/accounts/security_hub_alerts.tf

• SNS topic: security-hub-findings
• EventBridge rules for CRITICAL and HIGH severity findings
• SNS topic policy allowing EventBridge to publish
• Formatted alert messages with direct links to AWS console

New file: infra/accounts/SECURITY_HUB_ALERTS.md

• Setup documentation
• Testing instructions
• Slack integration guide
• Customization examples
• Troubleshooting tips

Modified: infra/project-config/system_notifications.tf

• Added security-alerts channel configuration for optional Slack integration

Alert Format

Each alert includes:

• Finding title and severity (🚨 CRITICAL or ⚠️ HIGH)
• Compliance status
• Description of the issue
• Affected resource details
• AWS account and region
• Remediation recommendations
• Direct link to Security Hub console

How It Works

1. Security Hub detects a CRITICAL or HIGH severity finding
2. EventBridge rule matches the finding based on severity and status (NEW)
3. Finding details are formatted and sent to SNS topic
4. Email notification is delivered to [email protected]
5. (Optional) Can be extended to Slack by enabling the configuration

Test Plan

• Run terraform init and terraform plan in infra/accounts/
• Review the planned resources (SNS topic, EventBridge rules, subscriptions)
• Apply with terraform apply
• Confirm the SNS subscription email sent to [email protected]
• (Optional) Test with a sample finding using the AWS CLI command in the documentation
• Verify alert is received via email
• Archive test finding in Security Hub console

Notes

• Email subscription requires confirmation (check spam folder)
• Alerts only trigger for NEW findings (not existing ones)
• Slack integration is configured but commented out - requires GitHub secrets setup
• See SECURITY_HUB_ALERTS.md for full documentation