Improve AWS Security Hub Documentation

[ncvicchi]

Description

While working on Release 4.9.0 - Alpha 3 - E2E UX tests - Amazon Security Hub #24869, provided documentation for 4.9.0-alpha3 on configuring and setting AWS Security Hub presented a great deal of troubles, inhibiting from successfully implementing the configuration and thus allowing to pass the test successfully.

The document seems to be focused on experienced AWS users, where many concepts are assumed to be known, and many links to AWS documentation are provided, generating a lot of effort to accomplish a simple task that would be easier to configure if examples were provided.

It would be a lot easier for any user if the documentation provided examples and eventually references other documentation to learn more on the subject, but not to implement the feature itself.

Discarding regex option was not even possible to be tested since no event generation procedure was available (this might be a documentation or E2E design issue).

More details are provided in the Feedback section of the E2E issue, as well as in the comments.

[nico-stefani]

Update

I've been reviewing the documentation section and I noted some items that we could improve.

These are the suggestions:

• Add a diagram showing the AWS architecture, for this use case, and how are the interactions with Wazuh
• Highlight the pre-requisites section

  wazuh-documentation/source/cloud-security/amazon/services/supported-services/security-hub.rst

  Line 35 in 3166327

  AWS Security Hub uses service-linked AWS Config rules to perform security checks for most controls. We advise to `configure AWS Config <https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-setup-prereqs.html#securityhub-prereq-config>`_ as a prerequisite.

• Include the IAM policies as a code block

  wazuh-documentation/source/cloud-security/amazon/services/supported-services/security-hub.rst

  Lines 49 to 50 in 3166327

  	- `AWSSecurityHubFullAccess <https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-awssecurityhubfullaccess>`__ to access the Security Hub console and API operations.
  	- `AWSSecurityHubOrganizationsAccess <https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html#security-iam-awsmanpol-awssecurityhuborganizationsaccess>`__ to enable and manage the Security Hub through the Organizations integration.

• Give more relevance to the EventBridge configuration section

  wazuh-documentation/source/cloud-security/amazon/services/supported-services/security-hub.rst

  Lines 73 to 82 in 3166327

  	To integrate Security Hub with EventBridge, you need to create the following:
  	- A Firehose stream in Amazon Data Firehose
  	- An event rule in EventBridge
  	EventBridge needs a target such as the Firehose stream. It triggers the target when it receives an event matching an event pattern. The event pattern is defined in the rule.
  	The AWS documentation provides steps on how to configure the rule.
  	- `Creating an event rule for automatically sent findings <https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-all-findings.html#securityhub-cwe-all-findings-predefined-pattern>`__
  	- `Defining a rule for using custom actions to send findings and insight results <https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-cwe-custom-actions.html#securityhub-cwe-define-rule>`__

• Include the configurations examples directly instead of pointing to WAF

  wazuh-documentation/source/cloud-security/amazon/services/supported-services/security-hub.rst

  Line 84 in 3166327

  Check the :doc:`Amazon WAF integration <waf>` for a configuration example.

• Include a link to the SQS creation page and maybe add some images of the procedure

  wazuh-documentation/source/cloud-security/amazon/services/supported-services/security-hub.rst

  Lines 86 to 117 in 3166327

  	Amazon Simple Queue Service
  	^^^^^^^^^^^^^^^^^^^^^^^^^^^
  	#. Set up a *Standard* type SQS Queue with the default configurations. You can apply an Access Policy similar to the following example, where ``<region>``, ``<account-id>``, and ``<s3-bucket>`` are the region, account ID, and the name you are going to provide to the S3 bucket.
  	.. code-block:: json
  	{
  	"Version": "2012-10-17",
  	"Id": "example-ID",
  	"Statement": [
  	{
  	"Sid": "example-access-policy",
  	"Effect": "Allow",
  	"Principal": {
  	"Service": "s3.amazonaws.com"
  	},
  	"Action": "SQS:SendMessage",
  	"Resource": "arn:aws:sqs:<region>:<account-id>:<s3-bucket>",
  	"Condition": {
  	"StringEquals": {
  	"aws:SourceAccount": "<account-id>"
  	},
  	"ArnLike": {
  	"aws:SourceArn": "arn:aws:s3:*:*:<s3-bucket>"
  	}
  	}
  	}
  	]
  	}
  	You can make your access policy to accept S3 notifications from different account IDs and to apply different conditions. More information in `Managing access in Amazon SQS <https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-overview-of-managing-access.html>`_.

• Include images for the S3 and Event Notifications section

  wazuh-documentation/source/cloud-security/amazon/services/supported-services/security-hub.rst

  Lines 119 to 128 in 3166327

  	Amazon S3 and Event Notifications
  	^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  	To configure an S3 bucket that reports creation events, do the following.
  	#. Configure an S3 bucket as defined in the :doc:`Configuring an S3 Bucket <../prerequisites/S3-bucket>` section. Provide the name you decided in the previous section.
  	#. Once created, go to **Event notifications** inside the **Properties** tab. Select **Create event notification**.
  	#. In **Event Types**, select **All object create events**. This generates notifications for any type of event that results in the creation of an object in the bucket.
  	#. In the **Destination** section, select **SQS queue**.
  	#. Select **Choose from your SQS queues**. Then, choose the queue you created previously.

Before implementing these items I'll put them in common with the documentation team to get feedback from them.

[nico-stefani]

Update

After discussing the proposed items we decide to continue with:

• Include the IAM policies as a code block
• Move the EventBridge explanation to the introduction section
• Explain what to find in the WAF link
• Add screenshots for the SQS procedure
• Add screenshots for the S3 procedure