Aws/securityhub Findings

Query and manage AWS Security Hub findings from a delegated administrator account. Leverages cross-region aggregation to cover the entire AWS Organization in a single API call.

Complements (does NOT duplicate) the upstream @swamp/aws/securityhub extension which manages Security Hub infrastructure (hubs, rules, policies, controls). This extension focuses on the findings operational lifecycle: query, triage, archive, resolve, and reopen.

Authentication

Uses the default AWS credential chain. Point at the delegated admin account (e.g. via AWS_PROFILE) to query findings across all member accounts.

Required IAM Permissions

• securityhub:GetFindings (read)
• securityhub:BatchUpdateFindings (write — for archive/resolve/reopen)

Usage

# Create model (pointed at delegated admin account)
AWS_PROFILE="my-account/ReadOnlyPlus" \
  swamp model create @webframp/aws/securityhub-findings sh-findings --global-arg region=us-east-1

# List all findings from last 24h
swamp model method run sh-findings list_findings --input startTime=24h

# List only HIGH severity GuardDuty findings
swamp model method run sh-findings list_findings --input productName=GuardDuty --input severityLabel=HIGH

# Get severity summary across org
swamp model method run sh-findings get_severity_summary --input startTime=7d

# Archive false positives
swamp model method run sh-findings archive_findings \
  --input 'findingArns=["arn:aws:securityhub:..."]' \
  --input 'note=Known EKS deployment pattern, suppressing'

# Resolve findings
swamp model method run sh-findings resolve_findings \
  --input 'findingArns=["arn:aws:securityhub:..."]' \
  --input 'note=Remediated by disabling public access'

Methods

• list_findings - Query findings with filters for product, severity, account, time
• get_finding_details - Get full ASFF details for specific finding ARNs
• get_severity_summary - Aggregate findings by severity across all accounts
• archive_findings - Suppress findings (false positive / expected behavior)
• resolve_findings - Mark findings as resolved
• reopen_findings - Reopen previously archived/resolved findings

2026.07.30.1

Added: Optional profile global argument for multi-account credential resolution. When set, credentials resolve via fromIni (supports SSO token cache and shared-config profiles). When omitted, the default credential chain applies as before. Fully backward compatible — no changes required for existing instances.