Importing an AWS Config rules evaluation as a finding in Security Hub

In this section, we will implement a solution that imports a non-compliant AWS Config rules evaluation as a finding in Security Hub. This solution helps in showing the non-compliant resources in a single pane of the dashboard of Security Hub, which makes it easier to investigate. Once we receive the finding in Security Hub, we can also automate the taking of actions using Lambda. The following figure shows a flow diagram of the solution:

Figure 7.14 – Flow diagram of the solution

The preceding solution consists of the following steps:

1. When we deploy or provision any non-compliant resources, the AWS Config rule will detect the changes and change the state from compliant to non-compliant.
2. The moment the Config rule changes the resource state from compliant to non-compliant, the CloudWatch event rule will trigger the Lambda function.
3. The Lambda function will gather the...