Class SecurityHubVerificationFactory

java.lang.Object
software.amazon.jsii.JsiiObject
software.constructs.Construct
com.cloudforgeci.api.core.annotation.BaseFactory
com.cloudforgeci.api.observability.SecurityHubVerificationFactory
All Implemented Interfaces:
software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable
public class SecurityHubVerificationFactory extends BaseFactory
Verifies Security Hub is already enabled in this account/Region, instead of enabling it from the application stack.

Security Hub (and its standards subscriptions) is an account/Region singleton, and the org consuming CFC may already own its enablement centrally -- via AWS Control Tower, an Organizations delegated administrator, Landing Zone Accelerator, or a hand-rolled baseline stack. An application deploy role enabling and configuring an account-wide security service is a real IAM-blast-radius concern for that setup, on top of the multi-stack collision risk SecurityHubFactory already solves with idempotent adoption. This factory instead makes the compliance claim honest without taking on either: it calls securityhub:DescribeHub, which throws (failing this stack's deploy) when the account/Region isn't subscribed, and succeeds silently otherwise. Nothing here enables Security Hub or manages standards subscriptions.

Scope: this only confirms the hub itself is enabled, not that a specific standard (e.g. PCI DSS v4.0.1) is subscribed -- DescribeHub's response doesn't include standards, and asserting a specific standard from GetEnabledStandards' response list isn't expressible with this SDK-call-only custom resource (no conditional-fail-on-value primitive without a Lambda-backed custom resource, which is a bigger lift than this check justifies on its own). Revisit if per-standard verification becomes a real requirement.

SecurityHubFactory is left in place, unused, for the case a future deployment model wants CFC to own provisioning again.

  • Nested Class Summary

    Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject

    software.amazon.jsii.JsiiObject.InitializationMode

    Nested classes/interfaces inherited from interface software.constructs.IConstruct

    software.constructs.IConstruct.Jsii$Default, software.constructs.IConstruct.Jsii$Proxy

  • Field Summary

    Fields inherited from class BaseFactory

    cfc, config, ctx

  • Constructor Summary

    Constructors
    Constructor
    Description
    SecurityHubVerificationFactory(software.constructs.Construct scope, String id)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    create()
    Resolves whether Security Hub is required, then fails this stack's deploy if the account/Region hub isn't already enabled centrally.

    Methods inherited from class BaseFactory

    getDeploymentContext, getSecurityProfileConfiguration, getSystemContext

    Methods inherited from class software.constructs.Construct

    getNode, isConstruct, toString

    Methods inherited from class software.amazon.jsii.JsiiObject

    jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

    Methods inherited from interface software.amazon.jsii.JsiiSerializable

    $jsii$toJson

  • Constructor Details

    • SecurityHubVerificationFactory

      public SecurityHubVerificationFactory(software.constructs.Construct scope, String id)
      Parameters:
      scope - parent construct
      id - construct ID

  • Method Details

    • create

      public void create()
      Resolves whether Security Hub is required, then fails this stack's deploy if the account/Region hub isn't already enabled centrally.
      Specified by:
      create in class BaseFactory