SecurityHub: Ability to disable specific compliance controls

[jgeurts]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Description

Provide a way to disable specific compliance controls from terraform.

New or Affected Resource(s)

• aws_securityhub_standards_control

Potential Terraform Configuration

resource "aws_securityhub_account" "example" {}

resource "aws_securityhub_standards_subscription" "cis_aws_foundations_benchmark" {
  standards_arn = "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"
  depends_on    = [aws_securityhub_account.example]
}

resource "aws_securityhub_standards_control" "ensure_iam_password_policy_prevents_password_reuse" {
  arn             = "arn:aws:securityhub:us-east-1:078884324539:control/cis-aws-foundations-benchmark/v/1.2.0/1.10"
  control_status  = "DISABLED"
  disabled_reason = "We handle password policies within Okta" 
  depends_on      = [aws_securityhub_standards_subscription.cis_aws_foundations_benchmark]
}

References

• https://aws.amazon.com/about-aws/whats-new/2020/01/aws-security-hub-releases-ability-disable-specific-compliance-controls/
• New resource: aws_securityhub_standards_control #14714

[jgeurts]

Closing as #14714 was merged!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.