terraform-aws-security-hub-report

Security Hub Auto Reports

A Terraform module plus three Python Lambdas that pull AWS Security Hub findings from every account in an AWS Organization (or an explicit list) in parallel, merge them into one Excel workbook in S3, and announce it on Slack, Microsoft Teams and/or SNS. It runs on an EventBridge schedule, monthly by default, and is deployed once per customer from a tfvars file.

What a run produces

• s3://<out_bucket>/SecurityHubReports/YYYY/MM/DD/<cust_name>-Security-Hub-Findings.xlsx with a Summary sheet (status and severity counts per account) and a Findings sheet (every active, unresolved finding, sorted by severity).
• One notification per configured channel with account success/failure counts, the finding total, the S3 path and the list of failed accounts.
• Per-account JSON part files under parts/ next to the report, kept for troubleshooting.

See the sample report for what the workbook looks like.

Where to go next

• Architecture: the state machine, the three Lambdas, and the contracts between them.
• Deployment: prerequisites, tfvars, the cross-account role rollout, notifications.
• Operations: running on demand, reading the notification, troubleshooting failed accounts, limits.
• Development: tests, lint, regenerating the diagram and sample report.