Comments (8)
fculpo
commented on June 12, 2024
1
@nozaq Hi, no I didn't use Security Hub before.
Actually your module seems to activate it with the first call, andd all subsequent enabled regions fail with the above error.
from terraform-aws-secure-baseline.
fculpo
commented on June 12, 2024
1
I applied region per region, deleting manually inthe AWS console until all regions were ok.
Seems fine now.
from terraform-aws-secure-baseline.
nozaq
commented on June 12, 2024
@fculpo Hi, have you already enabled SecurityHub outside of this module? If so, manually importing those subscription would resolve the error.
from terraform-aws-secure-baseline.
nozaq
commented on June 12, 2024
@fculpo Hmm, I see.
Could you check if each of the providers passed to the module(aws.ap-northeast-1, aws.us-east-1, etc.) has a region specified correctly? The module tries to enable SecurityHub for each provider, ResourceConflictException would happen when some of them point to the same region (also the default region would be used if no region was specified).
from terraform-aws-secure-baseline.
fculpo
commented on June 12, 2024
@nozaq Hi, here is the provider config:
I don't see any duplicates and each provider is mapped onto your required ones.
provider "aws" {
region = "eu-west-1"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "ap-southeast-1"
alias = "ap-southeast-1"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "ap-southeast-2"
alias = "ap-southeast-2"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "sa-east-1"
alias = "sa-east-1"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "ap-northeast-1"
alias = "ap-northeast-1"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "ap-northeast-2"
alias = "ap-northeast-2"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "ap-northeast-3"
alias = "ap-northeast-3"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "ap-south-1"
alias = "ap-south-1"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "us-east-1"
alias = "us-east-1"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "us-east-2"
alias = "us-east-2"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "ca-central-1"
alias = "ca-central-1"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "eu-north-1"
alias = "eu-north-1"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "eu-west-1"
alias = "eu-west-1"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "eu-west-2"
alias = "eu-west-2"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "eu-west-3"
alias = "eu-west-3"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "us-west-1"
alias = "us-west-1"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "us-west-2"
alias = "us-west-2"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}
provider "aws" {
region = "eu-central-1"
alias = "eu-central-1"
allowed_account_ids = local.allowed_account_ids
profile = local.profile
}from terraform-aws-secure-baseline.
fculpo
commented on June 12, 2024
Hi @nozaq, any news on this ?
from terraform-aws-secure-baseline.
jericoagustin
commented on June 12, 2024
@fculpo ,
How did you exactly resolved this?
I think I'm experiencing the same thing and encountering this error
Im using
hashicorp/aws version = "5.1.0"
│ Error: creating Security Hub Account: ResourceConflictException: Account is already subscribed to Security Hub
│ {
│ RespMetadata: {
│ StatusCode: 401,
│ RequestID: "d0100de1-5143-4ba0-bb8e-b64663838e83"
│ },
│ Code_: "ResourceConflictException",
│ Message_: "Account is already subscribed to Security Hub"
│ }
I tried to look at the aws console one by one on each region but Security Hub wasn't enabled in any of the regions.
I was able to create it at first then did the terraform destroy, but after running it the next day, it showing the error above.
from terraform-aws-secure-baseline.
fculpo
commented on June 12, 2024
I'm not sure we did resolve it, and not using this module anymore afaik
from terraform-aws-secure-baseline.
Related Issues (20)
- Upgrade to 1.0 guide should import access_log bucket resource, too HOT 1
- Policy errors during terraform apply of partially enabled baseline HOT 5
- S3 bucket - Terraform AWS Provider 4.0
- Make Audit Bucket Glacier Lifecycle Configuration Optional HOT 3
- GuardDuty: creation of invite accepter for master account? HOT 1
- data.aws_subnets.default.ids known only after apply HOT 3
- Example links on https://registry.terraform.io/modules/nozaq/secure-baseline/aws/2.0.0 are dead HOT 1
- Log delivery for notification messages sent to a topic
- Make audit log & content bucket name fully customizable
- Support for adding Security Hub member accounts via Organizations instead of the Manual process?
- Upgrade Security Hub CIS to v1.4.0 HOT 1
- Issue creating CloudTrail HOT 2
- Alarm baseline HOT 4
- AWS Control Tower Support
- Enable Object Lock for CloudTrail S3 Buckets
- Versioning and MFA Delete is not available for S3 buckets.
- Enable `NIST Special Publication 800-53 Revision 5`
- "The bucket does not allow ACLs" HOT 1
- Allow CloudTrail encryption with SSE-S3
- Setting '*_key_prefix' variables to empty string results in S3 paths containing pointless duplicit slash "/"
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from terraform-aws-secure-baseline.