Security Hub running across accounts and regions not showing score.

Question

I have security hub running from a central account in all the regions I use across all my accounts.  All the data is being pulled in to a single hub as I wanted.  However, I am not getting a Score nor am I seeing the Controls updated.  When I asked support they said I need to do:
To view cross-Region security scores and compliance statuses, add the following permissions to your IAM role that uses Security Hub [3]:
1. ListSecurityControlDefinitions
2. BatchGetStandardsControlAssociations
3. BatchUpdateStandardsControlAssociations

OK I get that.  But now the question is how do I update a Service Linked Role?  It does not let me edit it at all.  Nor can I create a new role and add it to Security Hub because it does not let you pick the role.

When I setup config I used the StackSet AWS provided.  Was I supposed to have changed the role it used in there?

I find it amazing that AWS provides the method to access the other regions and accounts but does not give you the option to enable the permissions for Cross Region scores.

Answer

Hello,

1. To @Gary Mclean's question - " My security Hub SLR only has the 1 policy.. Does that sound about right?"
- Yes, the Security Hub service-linked role (AWSServiceRoleForSecurityHub) should have 1 policy in it, [AWSSecurityHubServiceRolePolicy](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-awssecurityhubservicerolepolicy:~:text=AWS%20managed%20policy%3A%20AWSSecurityHubServiceRolePolicy)

2.  To @rePost-User-7973960 - "But now the question is how do I update a Service Linked Role? It does not let me edit it at all." 
- This is expected behavior as editing the service-linked role for Security Hub is not permitted. Only the description of the role can be edited. [Editing a service-linked role for Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/using-service-linked-roles.html#:~:text=Editing%20a%20service,User%20Guide.)

Support's recommendation to add ListSecurityControlDefinitions, BatchGetStandardsControlAssociations, and BatchUpdateStandardsControlAssociations comes from the following - [Cross-Region aggregation](https://docs.aws.amazon.com/securityhub/latest/userguide/finding-aggregation.html)

It's worth noting the above link states that those permissions should be added to your IAM role and not the service-linked role for Security Hub. Depending on what role you are assuming, add ListSecurityControlDefinitions, BatchGetStandardsControlAssociations, and BatchUpdateStandardsControlAssociations to an existing permission policy you have or create a custom inline policy, something like:

```
{
        "Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"securityhub:ListSecurityControlDefinitions",
				"securityhub:BatchGetStandardsControlAssociations",
				"securityhub:BatchUpdateStandardsControlAssociations"
			],
			"Resource": "*"
		}
	]
}
```

Depending on the outcome of the above, I would suggest coming back to @Pilar Pinto's re:Post reference for a sanity check on your setup - [How do I resolve an empty or “0%” security score or a “No data” compliance status in Security Hub?](https://repost.aws/knowledge-center/security-hub-empty-score-status)

Answer

I dont believe they are reffering to the SLR, more so the person trying to use Security Hub.

My security Hub SLR only has the 1 policy..

Does that sound about right?

Answer

Hi, you can try to config with control tower (it has AWS organizations) in order to manage various account in a centralized way.

Also, you have to use AWS config in order to use Security Hub enable https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-settingup.html#securityhub-enable-config

And the you can enble or disable the security standars (here is the service linked role involved) follow this document https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-enable-disable.html

Also, you can review this post https://repost.aws/knowledge-center/security-hub-empty-score-status

I expect this works!

Security Hub running across accounts and regions not showing score.

Relevant content