AWS security hub findings

[saurabh3460]

No description provided.

[saurabh3460]

This is ready for review @stewartshea

[stewartshea]

I'm not quite sure on the implementation of this yet - first I think we need to figure out which regions have security hub enabled, and then which products are enabled, see the example simple script for this type of thing (not yet at all integrated for our codebundles).

#!/bin/bash

echo "Fetching AWS Security Hub status across regions..."
for region in $(aws ec2 describe-regions --query "Regions[].RegionName" --output text); do
  echo -e "\nChecking $region..."
  hub_status=$(aws securityhub describe-hub --region $region --query "HubArn" --output text 2>/dev/null)
  
  if [ -n "$hub_status" ]; then
    echo "✅ Security Hub is enabled in $region"
    echo "🔍 Enabled Products:"
    aws securityhub list-enabled-products-for-import --region $region --query "ProductSubscriptions" --output text 2>/dev/null
  else
    echo "❌ Security Hub is NOT enabled in $region"
  fi
done

I also think we need to address two other things:

1. are we matching on the right resource (there is a cloudquery resource, but we have to fix/investigate the ARN issue - I will look into this)
2. What other tasks should we add - this one is collecting findings, but what about cost control or improper configuration, we could also have a task that just lists the enabled products and regions, etc.

We can chat more live.

[stewartshea]

Converted to draft until it is ready for review again.