diff --git a/security_hub.tf b/security_hub.tf index bcd85e8..d75696d 100644 --- a/security_hub.tf +++ b/security_hub.tf @@ -1,3 +1,7 @@ +locals { + all_regions_except_home_region = [for region in var.allowed_regions : region if region != data.aws_region.current.name] +} + // AWS Security Hub - Management account configuration and enrollment resource "aws_securityhub_organization_admin_account" "default" { admin_account_id = data.aws_caller_identity.audit.account_id @@ -110,7 +114,7 @@ resource "aws_securityhub_finding_aggregator" "default" { provider = aws.audit linking_mode = var.aws_security_hub.aggregator_linking_mode - specified_regions = var.aws_security_hub.aggregator_linking_mode == "SPECIFIED_REGIONS" ? var.allowed_regions : null + specified_regions = var.aws_security_hub.aggregator_linking_mode == "SPECIFIED_REGIONS" ? local.all_regions_except_home_region : null depends_on = [aws_securityhub_account.default] }