Security Hub with Organisations

You do need to enable Security Hub in each account and in each region that your workloads are hosted in, individually.

You can of course achieve this easily by using CloudFormation.

To use Security Hub within an AWS Organization, do the following:

1. Choose one account (lets call it security-tooling account with id 123456789012) as your org wide security tooling account.

2. Delegate AWS Security Hub administration to this security-tooling account.

3. If are going to use other security services its best practice to make this security-tooling account the delegated administrator for those services as well (ex: Amazon GuardDuty, Amazon Inspector).

4. Enable AWS Config in every account and every region that you want to use AWS Security Hub in (This is because AWS Security Hub depends on AWS Config).

5. Enable AWS Security Hub in every account and every region that you want to.

6. In the Security-tooling (delegated administrator ) account; navigage to: Security Hub --> Settings --> Account Management.

7. Here you will see the list of accounts in your AWS Organization. You can enable these accounts. This enablement is so that those accounts send findings to the Security-tooling (delegated administrator) account.

8. Check the "auto enable accounts". When you do this, all subsequent accounts that get added to the organization will directly become members and start sending findings to the delegated administrator account. (IF AWS SECURITY HUB IS ENABLED IN THOSE ACCOUNTS)

9. Finally navigate to Security Hub --> Settings --> Regions. Select an aggregation region and add Linked regions, so as to aggregate findings in one region.

KEY POINT: An account may become a member but that would be of no use if AWS Security Hub is not enabled in it. An account may have AWS Security Hub enabled in it, but your findings will not be centralised if it is not made member account.

When you use both Security Hub and AWS Organizations together, you can automatically enable Security Hub for all of your accounts, including new accounts as they are added. This increases the coverage for Security Hub checks and findings, which provides a more comprehensive and accurate picture of your overall security posture.

The detail instruction is at here: https://docs.aws.amazon.com/securityhub/latest/userguide/accounts-transition-to-orgs.html