In reviewing the aws_securityhub_organization_configuration resource docs, there are several notes. The third note is as follows:
This is an advanced Terraform resource. Terraform will automatically assume management of the Security Hub Organization Configuration without import and perform no actions on removal from the Terraform configuration.
My colleague and I have reviewed this note, but we aren’t completely sure what is meant here. Our environment is using Security Hub central coniguration, and that was previously setup manually via AWS console previously (not using Terraform).
We don’t intend on creating a aws_securityhub_organization_configuration, but came upon it while creating an aws_securityhub_configuration_policy resource. While reviewing those docs, there is a note which highlights that the aws_securityhub_organization_configuration is required to be set to CENTRAL. The note highlighted above made us question if Terraform would somehow automatically assume management of the Security Hub organization configuration. The Terraform state file doesn’t show any aws_securityhub_organization_configuration after creating the aws_securityhub_configuration_policy resource, but that hasn’t been associated with an organization yet either.
Any idea if Terraform will track the Security Hub organization configuration while defining aws_securityhub_configuration_policy resources and associating via aws_securityhub_configuration_policy_association? Thanks