Architecture details
This section describes the components and AWS services that make up this solution and the architecture details on how these components work together.
AWS services in this solution
The solution uses the following services. Core services are required to use the solution, and supporting services connect the core services.
| AWS service | Description |
|---|---|
|
Core. EventBridge rules are used to listen and trigger on events emitted by AWS Security Hub and AWS Security Hub CSPM. |
|
|
Core. Deploys many roles to allow remediations on different resources. |
|
|
Core. Deploys multiple lambda functions that will be used by the step function orchestator to remediate issues. Serves as the backend for the solution’s Web UI integrated with API Gateway. |
|
|
Core. Provides customers with a comprehensive view of their AWS security state. |
|
|
Core. Deploys an orchestrator that will invoke the remediation documents with AWS Systems Manager API calls. |
|
|
Core. Deploys System Manager Automation Documents that contain the remediation logic to be executed by the solution. Uses Parameter Store to maintain solution metadata and configuration settings. |
|
|
Core. Stores the last run remediation in each account and Region to optimize scheduling of remediations. Stores findings generated by AWS Security Hub & AWS Security Hub CSPM. Stores remediation and solution configuration metadata. Stores data for users accessing the solution’s Web UI. |
|
|
Supporting. Records changes that the solution makes to your AWS resources and displays them on a CloudWatch dashboard. |
|
|
Supporting. Deploys log groups that the different playbooks will use to log results. Collects metrics to display on a custom dashboard with alarms. |
|
|
Supporting. Deploys SNS topics that receive a notification once a remediation has been completed. |
|
|
Supporting. Assists with scheduling remediations so that the solution can run remediations in parallel. Buffers Lambda executions using Lambda EventSource Mappings. |
|
|
Supporting. Used to encrypt data for remediations. |
|
|
Supporting. Records all resources for use with AWS Security Hub. |
|
|
Supporting. Stores exported remediation history and log data. Hosts the solution’s Web UI as a Single-page Application (SPA). |
|
|
Supporting. Delivers the solution’s Web UI |
|
|
Supporting. Creates the solution’s REST API to support the user interface. |
|
|
Supporting. Protects the solution’s Web UI. |
|
|
Supporting. Used to authenticate and authorize access to the solution’s Web UI. |
