Using AWS Config rules to run security checks
To run security checks on your environment's resources, AWS Security Hub either uses steps specified by the standard or specific AWS Config rules. Some rules are developed and managed by AWS Config. Other rules are custom rules that Security Hub develops.
AWS Config rules that Security Hub uses for controls are referred to as service-linked rules, because they are enabled and controlled by the Security Hub service.
To enable checks against these AWS Config rules, you must first enable AWS Config for your account and turn on resource recording for required resources. For instructions on enabling AWS Config, see Configuring AWS Config for Security Hub. For information about required resources to record, see Required AWS Config resources for Security Hub control findings.
Generating the service-linked rules
For every control that uses an AWS Config service-linked rule, Security Hub creates instances of the required rules in your AWS environment.
These service-linked rules are specific to Security Hub. It creates these service-linked rules even
if other instances of the same rules already exist. The service-linked rule adds
securityhubbefore the original rule name, and a unique identifier after the rule
name. For example, for the original AWS Config managed rule vpc-flow-logs-enabled, the
service-linked rule name would be something like
securityhub-vpc-flow-logs-enabled-12345.
There are limits on the number of AWS Config rules that can be used to evaluate controls. Custom AWS Config rules that Security Hub creates don't count towards that limit. You can enable a security standard even if you've already reached the AWS Config limit for managed rules in your account. To learn more about AWS Config rule limits, see Service Limits in the AWS Config Developer Guide.
Viewing details about the AWS Config rules for controls
The finding details on the Findings page, Insights page, and Integrations page of the Security Hub console include a Rules link to the associated AWS Config rule details. For more information, see Instructions for reviewing finding details and history.
On the control details page, the Investigate column of the finding list contains a link to the AWS Config rule details. For more information, see Viewing the AWS Config rule for a finding resource.
To navigate to the AWS Config rule from finding or control details, you must have the relevant IAM permission in the selected account.
Custom rules aren't linked on the console. For custom rule descriptions, see Security Hub controls reference. Select a control from the list to see its description, including the AWS Config rule.
