# Architecture details
<a name="architecture-details"></a>

This section describes the components and AWS services that make up this solution and the architecture details on how these components work together.

## AWS services in this solution
<a name="aws-services-in-this-solution"></a>

The solution uses the following services. Core services are required to use the solution, and supporting services connect the core services.


| AWS service | Description | 
| --- | --- | 
|  [Amazon EventBridge](https://aws.amazon.com/eventbridge/)  |  **Core**. EventBridge rules are used to listen and trigger on events emitted by AWS Security Hub and AWS Security Hub CSPM. | 
|  [AWS IAM](https://aws.amazon.com/iam/)  |  **Core**. Deploys many roles to allow remediations on different resources. | 
|  [AWS Lambda](https://aws.amazon.com/lambda/)  |  **Core.** Deploys multiple lambda functions that will be used by the step function orchestator to remediate issues.<br />Serves as the backend for the solution’s Web UI integrated with API Gateway. | 
|  [AWS Security Hub](https://aws.amazon.com/security-hub/)  |  **Core**. Provides customers with a comprehensive view of their AWS security state. | 
|  [AWS Step Functions](https://aws.amazon.com/step-functions/)  |  **Core**. Deploys an orchestrator that will invoke the remediation documents with AWS Systems Manager API calls. | 
|  [AWS Systems Manager](https://aws.amazon.com/systems-manager/)  |  **Core**. Deploys System Manager Automation Documents that contain the remediation logic to be executed by the solution.<br />Uses Parameter Store to maintain solution metadata and configuration settings. | 
|  [AWS DynamoDB](https://aws.amazon.com/dynamodb/)  |  **Core**. Stores the last run remediation in each account and Region to optimize scheduling of remediations.<br />Stores findings generated by AWS Security Hub & AWS Security Hub CSPM.<br />Stores remediation and solution configuration metadata.<br />Stores data for users accessing the solution’s Web UI. | 
|  [AWS CloudTrail](https://aws.amazon.com/cloudtrail)  |  **Supporting.** Records changes that the solution makes to your AWS resources and displays them on a CloudWatch dashboard. | 
|  [Amazon CloudWatch](https://aws.amazon.com/cloudwatch/)  |  **Supporting**. Deploys log groups that the different playbooks will use to log results. Collects metrics to display on a custom dashboard with alarms. | 
|  [Amazon Simple Notification Service](https://aws.amazon.com/sns/)  |  **Supporting**. Deploys SNS topics that receive a notification once a remediation has been completed. | 
|  [AWS SQS](https://aws.amazon.com/sqs/)  |  **Supporting**. Assists with scheduling remediations so that the solution can run remediations in parallel.<br />Buffers Lambda executions using Lambda EventSource Mappings. | 
|  [AWS Key Management Service](https://aws.amazon.com/kms)  |  **Supporting**. Used to encrypt data for remediations. | 
|  [AWS Config](https://aws.amazon.com/config)  |  **Supporting**. Records all resources for use with AWS Security Hub. | 
|  [Amazon S3](https://aws.amazon.com/s3)  |  **Supporting**. Stores exported remediation history and log data.<br />Hosts the solution’s Web UI as a Single-page Application (SPA). | 
|  [Amazon CloudFront](https://aws.amazon.com/cloudfront)  |  **Supporting**. Delivers the solution’s Web UI | 
|  [Amazon API Gateway](https://aws.amazon.com/apigateway)  |  **Supporting**. Creates the solution’s REST API to support the user interface. | 
|  [AWS WAF](https://aws.amazon.com/waf)  |  **Supporting**. Protects the solution’s Web UI. | 
|  [Amazon Cognito](https://aws.amazon.com/cognito)  |  **Supporting**. Used to authenticate and authorize access to the solution’s Web UI. |