# Understanding cross-Region aggregation in Security Hub CSPM **Note** The *aggregation Region* is now called the *home Region*. Some Security Hub CSPM API operations still use the older term aggregation Region. By using cross-Region aggregation in AWS Security Hub CSPM, you can aggregate findings, finding updates, insights, control compliance statuses, and security scores from multiple AWS Regions to a single home Region. You can then manage all of this data from the home Region. Suppose you set US East (N. Virginia) as the home Region, and US West (Oregon) and US West (N. California) as the linked Regions. When you view the **Findings** page in US East (N. Virginia), you see the findings from all three Regions. Updates to those findings are also reflected in all three Regions. **Note** In AWS GovCloud (US), cross-Region aggregation is supported only for findings, finding updates, and insights across AWS GovCloud (US). Specifically, you can only aggregate findings, finding updates, and insights between AWS GovCloud (US-East) and AWS GovCloud (US-West). In the China Regions, cross-Region aggregation is supported only for findings, finding updates, and insights across the China Regions. Specifically, you can only aggregate findings, finding updates, and insights between China (Beijing) and China (Ningxia). If a control is enabled in a linked Region but disabled in the home Region, you can see the compliance status of the control from the home Region, but you can't enable or disable that control from the home Region. The exception is if you use [central configuration](central-configuration-intro.md). If you use central configuration, the delegated Security Hub CSPM administrator can configure controls in the home Region and linked Regions from the home Region. If you have set an home Region, [security scores](standards-security-score.md) account for control statuses in all
 linked Regions. To view cross-Region security scores and compliance statuses, add the following permissions to your IAM role that uses Security Hub CSPM: + `[https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListSecurityControlDefinitions.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListSecurityControlDefinitions.html)` + `[https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchGetStandardsControlAssociations.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchGetStandardsControlAssociations.html)` + `[https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateStandardsControlAssociations.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateStandardsControlAssociations.html)` ## Types of data that are aggregated When cross-Region aggregation is enabled with one or more linked Regions, Security Hub CSPM replicates the following data from the linked Regions to the home Region. This occurs in every account that has cross-Region aggregation enabled. + Findings + Insights + Control compliance statuses + Security scores In addition to new data in the previous list, Security Hub CSPM also replicates updates to this data between the linked Regions and the home Region. Updates that occur in a linked Region are replicated to the home Region. Updates that occur in the home Region are replicated back to the linked Region. If there are conflicting updates in the home Region and the linked Region, then the most recent update is used. ![\[When cross-Region aggregation is enabled, Security Hub CSPM replicates new and updated findings between the linked Regions and home Region.\]](http://docs.aws.amazon.com/securityhub/latest/userguide/images/diagram-finding-aggregation.png) Cross-Region aggregation does not add to the cost of Security Hub CSPM. You are not charged when Security Hub CSPM replicates new data or updates. In the home Region, the **Summary** page provides a view of your active findings across linked Regions. For information, see [Viewing a cross-Region summary of findings by severity](https://docs.aws.amazon.com/securityhub/latest/userguide/findings-view-summary.html). Other **Summary** page panels that analyze findings also display information from across the linked Regions. Your security scores in the home Region are calculated by comparing the number of passed controls to the number of enabled controls in all linked Regions. In addition, if a control is enabled in at least one linked Region, it is visible on the **Security standards** details pages of the home Region. The compliance status of controls on the standards details pages reflects findings across linked Regions. If a security check associated with a control fails in one or more linked Regions, the compliance status of that control shows as **Failed** on the standards details pages of the home Region. The number of security checks includes findings from all linked Regions. Security Hub CSPM only aggregates data from Regions where an account has Security Hub CSPM enabled. Security Hub CSPM is not automatically enabled for an account based on the cross-Region aggregation configuration. It's possible to have cross-Region aggregation enabled without any linked Regions selected. In this case, no data replication occurs. ## Aggregation for administrator and member accounts Standalone accounts, member accounts, and administrator accounts can configure cross-Region aggregation. If configured by an administrator, the presence of the administrator account is essential for cross-Region aggregation to work in administered accounts. If the administrator account is removed or disassociated from a member account, cross-Region aggregation for the member account stops. This is true even if the account had cross-Region aggregation enabled before the administrator-member relationship begins. When an administrator account enables cross-Region aggregation, Security Hub CSPM replicates the data that the administrator account generates in all linked Regions to the home Region. In addition, Security Hub CSPM identifies the member accounts that are associated with that administrator, and each member account inherits the cross-Region aggregation settings of the administrator. Security Hub CSPM replicates the data that a member account generates in all linked Regions to the home Region. The administrator can access and manage security findings from all member accounts within the administered regions. However, as a Security Hub CSPM administrator, you must be signed in to the home Region to view aggregated data from all member accounts and linked Regions. As a Security Hub CSPM member account, you must be signed in to the home Region to view aggregated data from your account from all linked Regions. Member accounts don't have permissions to view data from other member accounts. An administrator account may manually invite member accounts or serve as the delegated administrator of an organization that is integrated with AWS Organizations. For a [manually-invited member account](account-management-manual.md), the administrator must invite the account from the home Region and all linked Regions in order for cross-Region aggregation to work. In addition, the member account must have Security Hub CSPM enabled in the home Region and all linked Regions to give the administrator the ability to view findings from the member account. If you don't use the home Region for other purposes, you can disable Security Hub CSPM standards and integrations in that Region to prevent charges. If you plan to use cross-Region aggregation, and have multiple administrator accounts, we recommend following these best practices: + Each administrator account has different member accounts. + Each administrator account has the same member accounts across Regions. + Each administrator account uses a different home Region. **Note** To understand how cross-Region aggregation impacts central configuration, see [Impact of central configuration on cross-Region aggregation](aggregation-central-configuration.md). # Impact of central configuration on cross-Region aggregation Central configuration is an opt-in feature in AWS Security Hub CSPM that you can use if you integrate with AWS Organizations. If you use central configuration, the delegated administrator account can configure the Security Hub CSPM service, standards, and controls for accounts and organizational units (OU) in the organization. To configure accounts and OUs, the delegated administrator creates Security Hub CSPM configuration policies. Configuration policies can be used to define whether Security Hub CSPM is enabled or disabled, and which standards and controls are enabled. The delegated administrator associates configuration policies with specific accounts, OUs, or the root (the entire organization). The delegated administrator can create and manage configuration policies for the organization only from the home Region. In addition, configuration policies take effect in the home Region and all linked Regions. You can't create a configuration policy that applies only in some linked Regions and not others. For information about cross-Region aggregation, see [Cross-Region aggregation](https://docs.aws.amazon.com/securityhub/latest/userguide/finding-aggregation.html). To use central configuration, you must designate a home Region. Optionally, you can choose one or more Regions as linked Regions. You can also choose to designate a home Region without any linked Regions. Changing your cross-Region aggregation settings can impact your configuration policies. When you add a linked Region, your configuration policies take effect in that Region. If the Region is an [opt-in Region](https://docs.aws.amazon.com/accounts/latest/reference/manage-acct-regions.html), the Region must be enabled in order for your configuration policies to take effect there. Conversely, when you remove a linked Region, configuration policies no longer take effect in that Region. In that Region, accounts maintain the settings they had when the linked Region was removed. You can change those settings, but must do so separately in each account and Region. If you remove or change the home Region, your configuration policies and policy associations are deleted. You can no longer use central configuration or create configuration policies in any Region. Accounts maintain the settings they had before the home Region was changed or removed. You can change those settings at any time, but since you no longer use central configuration, settings must be modified separately in each account and Region. You can use central configuration and create configuration policies again if you designate a new home Region. For more information about central configuration, see [Understanding central configuration in Security Hub CSPM](central-configuration-intro.md). # Enabling cross-Region aggregation **Note** The *aggregation Region* is now called the *home Region*. Some Security Hub CSPM API operations still use the older term aggregation Region. You must enable cross-Region aggregation from the AWS Region that you want to designate as the home Region. To enable cross-Region aggregation, you create a Security Hub CSPM resource called a finding aggregator. The finding aggregator resource specifies your home Region and linked Regions (if any). You can't use an AWS Region that is disabled by default as your home Region. For a list of Regions that are disabled by default, see [Enabling a Region](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable) in the *AWS General Reference*. When you enable cross-Region aggregation, you choose to specify one or more linked Regions if you wish. You can also choose whether to automatically link new Regions when Security Hub CSPM begins to support them and you have opted into them. ------ #### [ Security Hub CSPM console ] **To enable cross-Region aggregation** 1. Open the AWS Security Hub CSPM console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). 1. Using the AWS Region selector, sign in to the Region that you want to use as the aggregation Region. 1. In the Security Hub CSPM navigation menu, choose **Settings** and then **Regions**. 1. For **Finding aggregation**, choose **Configure finding aggregation**. By default, the home Region is set to **No aggregation Region**. 1. Under **Aggregation Region**, select the option to designate the current Region as the home Region. 1. Optionally, for **Linked Regions**, select the Regions to aggregate data from. 1. To automatically aggregate data from new Regions in the partition as Security Hub CSPM supports them and you opt into them, select **Link future Regions**. 1. Choose **Save**. ------ #### [ Security Hub CSPM API ] From the Region that you want to use as the home Region, use the [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_CreateFindingAggregator.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_CreateFindingAggregator.html) operation of the Security Hub CSPM API. If you use the AWS CLI, run the [create-finding-aggregator](https://docs.aws.amazon.com/cli/latest/reference/securityhub/create-finding-aggregator.html) command. For `RegionLinkingMode`, choose one of the following options: + `ALL_REGIONS` – Security Hub CSPM aggregates data from all Regions. Security Hub CSPM also aggregates data from new Regions as they are supported and you opt into them. + `ALL_REGIONS_EXCEPT_SPECIFIED` – Security Hub CSPM aggregates data from all Regions except for Regions that you want to exclude. Security Hub CSPM also aggregates data from new Regions as they are supported and you opt into them. Use `Regions` to provide the list of Regions to exclude from aggregation. + `SPECIFIED_REGIONS` – Security Hub CSPM aggregates data from a selected list of Regions. Security Hub CSPM does not aggregate data automatically from new Regions. Use `Regions` to provide the list of Regions to aggregate from. + `NO_REGIONS` – Security Hub CSPM doesn't aggregate data because you don't select any linked Regions. The following example configures cross-Region aggregation. The home Region is US East (N. Virginia). The linked Regions are US West (N. California) and US West (Oregon). This example is formatted for Linux, macOS, or Unix, and it uses the backslash (\$1) line-continuation character to improve readability. ``` $ aws securityhub create-finding-aggregator --region us-east-1 --region-linking-mode SPECIFIED_REGIONS --regions us-west-1 us-west-2 ``` ------ # Reviewing cross-Region aggregation settings **Note** The *aggregation Region* is now called the *home Region*. Some Security Hub CSPM API operations still use the older term aggregation Region. You can view the current cross-Region aggregation configuration in AWS Security Hub CSPM from any AWS Region. The configuration includes the home Region, the linked Regions (if any), and whether to automatically link new Regions as Security Hub CSPM supports them. Member accounts can view the cross-Region aggregation settings that the administrator account configured. Choose your preferred method, and follow the steps to view your current cross-Region aggregation settings. ------ #### [ Security Hub CSPM console ] **To view cross-Region aggregation settings (console)** 1. Open the AWS Security Hub CSPM console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). 1. On the navigation pane, choose **Settings** and then the **Regions** tab. If cross-Region aggregation is not enabled, then the **Regions** tab displays the option to enable cross-Region aggregation. Only administrator accounts and standalone accounts can enable cross-Region aggregation. If cross-Region aggregation is enabled, then the **Regions** tab displays the following information: + The home Region + Whether to automatically aggregate findings, insights, control statuses, and security scores from new Regions that Security Hub CSPM supports and that you opt into + The list of linked Regions (if any are selected) ------ #### [ Security Hub CSPM API ] **To review cross-Region aggregation settings (Security Hub CSPM API)** Use the [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindingAggregator.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindingAggregator.html) operation of the Security Hub CSPM API. If you use the AWS CLI, run the [get-finding-aggregator](https://docs.aws.amazon.com/cli/latest/reference/securityhub/get-finding-aggregator.html) command. When you make the request, provide the finding aggregator ARN. To obtain the finding aggregator ARN, use the [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListFindingAggregators.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListFindingAggregators.html) operation or [list-finding-aggregators](https://docs.aws.amazon.com/cli/latest/reference/securityhub/list-finding-aggregators.html) command. The following example shows the cross-Region aggregation settings for the specified finding aggregator ARN. This example is formatted for Linux, macOS, or Unix, and it uses the backslash (\$1) line-continuation character to improve readability ``` $aws securityhub get-finding-aggregator --finding-aggregator-arn arn:aws:securityhub:us-east-1:222222222222:finding-aggregator/123e4567-e89b-12d3-a456-426652340000 ``` ------ # Updating cross-Region aggregation settings **Note** The *aggregation Region* is now called the *home Region*. Some Security Hub CSPM API operations still use the older term aggregation Region. You can update your current cross-Region aggregation settings in AWS Security Hub CSPM by changing the linked Regions or the current home Region. You can also change whether to automatically aggregate data from new AWS Regions that Security Hub CSPM is supported in. Changes to cross-Region aggregation aren't implemented for an opt-in Region until you enable the Region in your AWS account. Regions that AWS introduced on or after to March 20, 2019 are opt-in Regions. When you stop aggregating data from a linked Region, AWS Security Hub CSPM doesn't remove any existing aggregated data from that Region that is accessible in the home Region. You can't use the update procedures in this section to change the home Region. To change the home Region, you must do the following: 1. Stop cross-Region aggregation. For instructions, see [Stopping cross-Region aggregation](finding-aggregation-stop.md). 1. Change to the Region that you want to be the new home Region. 1. Enable cross-Region aggregation. For instructions, see [Enabling cross-Region aggregation](finding-aggregation-enable.md). You must update the cross-Region aggregation configuration from the current home Region. ------ #### [ Security Hub CSPM console ] **To change the linked Regions** 1. Open the AWS Security Hub CSPM console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). Sign in to the current aggregation Region. 1. In the Security Hub CSPM navigation menu, choose **Settings**, then choose **Regions**. 1. For **Finding aggregation**, choose **Edit**. 1. For **Linked Regions**, update the selected linked Regions. 1. If needed, change whether **Link future Regions** is selected. This setting determines whether Security Hub CSPM automatically links new Regions as it adds support for them and you opt into them. 1. Choose **Save**. ------ #### [ Security Hub CSPM API ] Use the [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateFindingAggregator.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateFindingAggregator.html) operation. If you use the AWS CLI, run the [update-finding-aggregator](https://docs.aws.amazon.com/cli/latest/reference/securityhub/update-finding-aggregator.html) command. To identify the finding aggregator, you must provide the finding aggregator ARN. To obtain the finding aggregator ARN, use the [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListFindingAggregators.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListFindingAggregators.html) operation or [list-finding-aggregators](https://docs.aws.amazon.com/cli/latest/reference/securityhub/list-finding-aggregators.html) command.. If the linking mode is `ALL_REGIONS_EXCEPT_SPECIFIED` or `SPECIFIED_REGIONS`, you can change the list of excluded or included Regions. If you want to change the Region linking mode to `NO_REGIONS`, you shouldn't provide a Regions list. When you change the list of excluded or included Regions, you must provide the full list with the updates. For example, suppose you currently aggregate findings from US East (Ohio), and want to also aggregate findings from US West (Oregon). You must provide a `Regions` list that contains both US East (Ohio) and US West (Oregon). The following example updates cross-Region aggregation to selected Regions. The command is run from the current home Region, which is US East (N. Virginia). The linked Regions are US West (N. California) and US West (Oregon). This example is formatted for Linux, macOS, or Unix, and it uses the backslash (\$1) line-continuation character to improve readability. ``` aws securityhub update-finding-aggregator --region us-east-1 --finding-aggregator-arn arn:aws:securityhub:us-east-1:222222222222:finding-aggregator/123e4567-e89b-12d3-a456-426652340000 --region-linking-mode SPECIFIED_REGIONS --regions us-west-1 us-west-2 ``` ------ # Stopping cross-Region aggregation **Note** The *aggregation Region* is now called the *home Region*. Some Security Hub CSPM API operations still use the older term aggregation Region. If you don't want AWS Security Hub CSPM to aggregate data, you can delete your finding aggregator. Alternatively, you can keep your finding aggregator but not link any AWS Regions to the home Region by updating the existing aggregator to the `NO_REGIONS` linking mode. To change your home Region, you must delete your current finding aggregator and create a new one. When you delete your finding aggregator, Security Hub CSPM stops aggregating data. It doesn't remove any existing aggregated data from the home Region. ## Deleting the finding aggregator (console) You can delete your finding aggregator from the current home Region only. In Regions other than the home Region, the **Finding aggregation** panel on the Security Hub CSPM console displays a message that you must edit the configuration in the home Region. Choose this message to display a link to switch to the home Region. ------ #### [ Security Hub CSPM console ] **To stop cross-Region aggregation (console)** 1. Open the AWS Security Hub CSPM console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). 1. Ensure that you're signed in to your current home Region. 1. In the Security Hub CSPM navigation menu, choose **Settings**, then choose **Regions**. 1. Under **Finding aggregation**, choose **Edit**. 1. Under **Aggregation Region**, choose **No aggregation Region**. 1. Choose **Save**. 1. On the confirmation dialog, in the confirmation field, type **Confirm**. 1. Choose **Confirm**. ------ #### [ Security Hub CSPM API ] Use the [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DeleteFindingAggregator.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DeleteFindingAggregator.html) operation of the Security Hub CSPM API. If you're using the AWS CLI, run the [https://docs.aws.amazon.com/cli/latest/reference/securityhub/delete-finding-aggregator.html](https://docs.aws.amazon.com/cli/latest/reference/securityhub/delete-finding-aggregator.html) command. To identify the finding aggregator to delete, provide the finding aggregator ARN. To obtain the finding aggregator ARN, use the [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListFindingAggregators.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ListFindingAggregators.html) operation or [https://docs.aws.amazon.com/cli/latest/reference/securityhub/list-finding-aggregators.html](https://docs.aws.amazon.com/cli/latest/reference/securityhub/list-finding-aggregators.html) command. The following example deletes the finding aggregator. The command is run from the current home Region, which is US East (N. Virginia). This example is formatted for Linux, macOS, or Unix, and it uses the backslash (\$1) line-continuation character to improve readability. ``` $aws securityhub delete-finding-aggregator arn:aws:securityhub:us-east-1:222222222222:finding-aggregator/123e4567-e89b-12d3-a456-426652340000 --region us-east-1 ``` ------