Class SecurityHubFactory

java.lang.Object
software.amazon.jsii.JsiiObject
software.constructs.Construct
com.cloudforgeci.api.core.annotation.BaseFactory
com.cloudforgeci.api.observability.SecurityHubFactory
All Implemented Interfaces:
software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable
public class SecurityHubFactory extends BaseFactory
Factory for AWS Security Hub and its standards subscriptions.

Security Hub is an account/Region singleton, and securityhub:EnableSecurityHub is not idempotent -- it throws ResourceConflictException when the account is already subscribed. The declarative AWS::SecurityHub::Hub CloudFormation resource has the same failure mode: a second CloudForgeCI stack in the same account/Region would fail its deploy trying to create a second hub. This enables the hub via an AwsCustomResource calling securityhub:EnableSecurityHub directly and ignores that specific conflict, so a second stack's deploy adopts the existing hub instead of failing. No onDelete: another stack may still depend on Security Hub, so deleting this stack must not disable it account-wide.

Standards subscriptions (CfnStandard) stay declarative CloudFormation resources -- each standard's ARN is stack-specific, so redundant subscriptions across stacks are a much narrower, lower-frequency risk than the hub itself, and CloudFormation's native resource lifecycle (proper update/delete, drift detection) is worth keeping here where it's available.

Standard versions are config, not hardcoded -- AWS periodically ships new standard versions (CIS has shipped 1.2.0, 1.4.0, 3.0.0, and 5.0.0; PCI DSS moved to 4.0.1 after the PCI Council retired the prior version), so a version bump here is a securityHub*Version config change, not a code change. Defaults are current as of this writing -- verify against securityhub:DescribeStandards if in doubt.

  • Nested Class Summary

    Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject

    software.amazon.jsii.JsiiObject.InitializationMode

    Nested classes/interfaces inherited from interface software.constructs.IConstruct

    software.constructs.IConstruct.Jsii$Default, software.constructs.IConstruct.Jsii$Proxy

  • Field Summary

    Fields inherited from class BaseFactory

    cfc, config, ctx

  • Constructor Summary

    Constructors
    Constructor
    Description
    SecurityHubFactory(software.constructs.Construct scope, String id)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    create()
    Resolves whether Security Hub is required, then enables the account/Region hub (adopting an existing one if another stack already created it) and subscribes it to each enabled standard.

    Methods inherited from class BaseFactory

    getDeploymentContext, getSecurityProfileConfiguration, getSystemContext

    Methods inherited from class software.constructs.Construct

    getNode, isConstruct, toString

    Methods inherited from class software.amazon.jsii.JsiiObject

    jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

    Methods inherited from interface software.amazon.jsii.JsiiSerializable

    $jsii$toJson

  • Constructor Details

    • SecurityHubFactory

      public SecurityHubFactory(software.constructs.Construct scope, String id)
      Parameters:
      scope - parent construct
      id - construct ID

  • Method Details

    • create

      public void create()
      Resolves whether Security Hub is required, then enables the account/Region hub (adopting an existing one if another stack already created it) and subscribes it to each enabled standard.
      Specified by:
      create in class BaseFactory