Skip to main content

Member Enrollment

The Enrollment page shows every AWS account that has been added to Security Hub CSPM, its current enrollment phase, and any errors. From here you can add unenrolled accounts, retry accounts that failed enrollment, and remove enrolled accounts.

Accessing Enrollment​

Select Enrollment under Security Hub CSPM in the sidebar. The page header reads Enrollment, subtitled "Manage which member accounts are enrolled in Security Hub", and the page loads the current enrollment state for all accounts. If Security Hub is not yet set up, the page shows an information banner instead — "Security Hub is not set up yet for this customer. Complete the setup wizard first to enroll member accounts." — with a Go to setup button that opens the setup wizard.

Header Card​

A read-only summary card at the top of the page shows:

  • Admin account: the account ID of the Security Hub delegated administrator
  • Home region: the primary aggregation region
  • Linking regions: all regions where Security Hub is active

These values are set during setup and can be changed on the Settings page (regions only; the admin account is permanent).

AWS Config Warning Banner​

If AWS Config recording is missing in one or more enrolled account/region pairs, a warning banner appears:

AWS Config isn't recording in N enrolled account/region pair(s). The standards can't evaluate those accounts until it's set up.

Click Set up AWS Config in the banner to open the AWS Config needed for full evaluation dialog, which lists the affected 123456789012 — us-east-1 pairs. Its Enable AWS Config button starts minimal recording without leaving the Enrollment page; Open AWS Config page navigates to Config Recorders instead, and Later closes the dialog. See AWS Config for more information.

Progress Bar​

While any account is in an active enrollment phase — or while the CSPM configuration itself is mid-operation, such as during a region repair — a progress bar with a live label appears below the header card. It advances automatically as the orchestration job works through the enrolled accounts. A percentage is shown beside the label only when the job reports one; a job that cannot estimate its progress runs the bar indeterminate with no number. If the job reports no label at all, the bar reads Working….

Enrolled Accounts​

The Enrolled accounts table lists every account currently in or transitioning through the enrollment process. Each row is one account, rolled up across every linking region: the row shows the worst phase among that account's per-region cells — failed first, then pending, then any in-flight phase — so an account that is enabled in one region and still enrolling in another reads as the in-flight phase.

ColumnDescription
AccountThe account name and ID; the admin account is marked with an admin chip
StatusThe current enrollment phase chip (see Phase Reference below) with a spinner for active phases; per-region error messages appear below the chip when present, each prefixed with its region and joined by •
ActionsRetry (for failed non-admin accounts) and Remove (for non-admin accounts not in a removing phase)

Accounts in an active phase display a spinner next to their status chip. The page polls automatically while any account is in an active phase, updating statuses in real time.

If nothing is enrolled yet, the table shows an empty state headed No accounts enrolled yet, reading "Pick accounts from the Not enrolled list below and add them to Security Hub."

Phase Reference​

Phase names are shown in the chip as Title Case (the associating_standards phase, for example, reads Associating Standards).

PhaseColorDescription
pendingGrayQueued for processing; the orchestrator has not started this account yet
enablingBluePrism is enabling Security Hub in the account
invitingBlueThe admin account is sending a Security Hub membership invitation to this account
acceptingBluePrism is accepting the invitation on behalf of the member account
associating_standardsBluePrism is associating the chosen compliance standards with this account
enabledGreenThe account is fully enrolled and standards are active
failedRedOne or more steps failed for this account; error details appear below the status chip
removingAmberPrism is removing this account from Security Hub

Accounts that are fully removed (disabled phase) drop out of the Enrolled accounts table and reappear in the Not enrolled table, ready to be re-enrolled.

info

The page polls automatically whenever any account is in an active phase (pending, enabling, inviting, accepting, associating_standards, removing) or the configuration itself is in progress. Polling stops when all accounts reach a terminal state (enabled, failed, or disabled) and the configuration has settled.

Repairing Region Associations​

A Repair region associations button sits in the Enrolled accounts header. Its tooltip reads "Associate members with the admin in every linking region — fixes accounts whose findings only show in the home region".

Use it when an account is enrolled and healthy but its findings only appear for the home region — the symptom of a member that was associated with the administrator in some regions but not others. Prism asks AWS which (account, region) pairs are genuinely associated, corrects any rows it finds already associated, and associates the rest. The operation is idempotent, so running it when nothing is wrong costs one read and changes nothing.

While it runs, the configuration moves to an in-progress state and the progress bar shows "Reconciling associations…". The button is unavailable while another operation is in flight.

note

Repair only works while CSPM is settled (enabled or partial_failure). It does nothing when the only enrolled account is the administrator, since there are no member associations to repair.

Adding Accounts​

Accounts not yet enrolled appear in the Not enrolled table at the bottom of the page.

To add one or more accounts:

  1. In the Not enrolled table, select the checkbox next to each account you want to enroll. To select all unenrolled accounts at once, select the checkbox in the table header row.
  2. Click Add N to Security Hub (the button label shows the count of selected accounts).
  3. Prism sends an enrollment request for all selected accounts. Their rows move to the Enrolled accounts table with a pending status and begin advancing through the enrollment phases.

The Add N to Security Hub button is disabled when no accounts are selected or while an operation is in progress.

tip

If every linked account is already enrolled, the table shows an empty state headed Everything is enrolled, reading "All linked accounts are already enrolled in Security Hub."

Retrying a Failed Account​

If an account reaches the failed phase, a Retry button appears in its Actions cell.

To retry a failed account:

  1. Click Retry in the row for the failed account.
  2. Prism resubmits the enrollment request for that account only.
  3. The account re-enters the active enrollment phases (pending → enabling → … → enabled).
note

The admin account cannot be retried. If the admin account fails during initial setup, disable Security Hub and run the setup wizard again.

Removing an Account​

To remove an enrolled account from Security Hub CSPM:

  1. Click Remove in the Actions cell for the account you want to remove.
  2. The Remove account from Security Hub dialog appears: "Remove {account ID}? Its Security Hub data in that account will be disabled." Click Remove to confirm or Cancel to abort.
  3. The account enters the removing phase. Prism asynchronously disables Security Hub in that account.
  4. Once removal completes, the account moves from the Enrolled accounts table to the Not enrolled table.
warning

The admin account cannot be removed — its row carries no Remove button. To change the admin account, disable Security Hub on the Settings Danger zone tab and run the setup wizard again.