Skip to main content

Settings

The Settings page lets you change the compliance standards evaluated across your organization, add or remove linking regions, check and repair the IAM permissions CSPM needs in each enrolled account, and disable Security Hub CSPM entirely. Changes to standards or regions trigger an asynchronous update job; disabling CSPM triggers a teardown job.

Accessing Settings​

Select Settings under Security Hub CSPM in the sidebar. The page header reads Settings, subtitled "Manage standards, linking regions, and Security Hub status". Below it the page shows four tabs, in this order: Standards, Regions, Permissions, and Danger zone.

If Security Hub is not yet set up, the page shows an information banner instead — "Security Hub is not set up yet for this customer. Complete the setup wizard first to manage standards, regions, or disable the service." — with a Go to setup button that opens the setup wizard.

Standards Tab​

The Standards tab, headed Compliance standards, lists all compliance standards available for your organization, each with a checkbox indicating whether it is currently enabled. A line beneath the heading reads "Selected standards are enabled uniformly across every enrolled account and region."

To update the enabled standards:

  1. Check or uncheck standards to reflect the desired set. At least one standard must remain enabled.
  2. Click Save standards.
  3. A brief "Standards saved" confirmation appears.
  4. Prism navigates back to the Compliance Dashboard. If AWS Config recording is missing in any enrolled account/region pair, an in-page warning banner appears instead (see below).

The Save standards button is disabled when no standards are selected, or while a save is in progress.

AWS Config Warning Banner​

After saving standards, if AWS Config is not recording in one or more enrolled account/region pairs, a non-blocking warning banner appears on the Settings page:

AWS Config isn't recording in N account/region pair(s). Enable minimal recording so your standards can fully evaluate.

The banner offers three actions:

  • Open AWS Config page: navigates to the AWS Config recorders page
  • Enable AWS Config: starts minimal recording in the affected pairs immediately without leaving Settings, replacing the banner with "AWS Config recording enabled — track progress on the AWS Config page."
  • Later: dismisses the banner so you can enable Config at a later time
info

The AWS Config banner is non-blocking. Saving standards succeeds regardless of whether Config is recording. Standards will show NO_DATA or UNKNOWN control statuses for accounts and regions without active recorders until recording is enabled.

Regions Tab​

The Regions tab, headed Regions, shows the current linking region configuration and lets you add or remove regions.

  • Home region: read-only; shown as a static line reading "Home region: us-east-1 (read-only)". The home region is set during setup and cannot be changed without disabling CSPM.
  • Linking regions: a multi-select dropdown pre-populated with the current linking regions. Your selection is summarised in the closed field as one chip per region, collapsing to a +N more chip past the first six.

To update linking regions:

  1. Open the Linking regions dropdown. The home region is always included and its checkbox is disabled, so it cannot be deselected.

  2. Check the regions you want to add or uncheck regions you want to remove. A Select all / Deselect all row at the top of the list toggles every region at once.

  3. Click Save regions.

  4. Prism submits the region update and, depending on the change, opens one or two dialogs:

    • If regions were removed and those regions still have recording AWS Config recorders, the Stop AWS Config recording? dialog offers to stop them: "N account/region pair(s) are no longer used by any standard. Stop recording to avoid AWS Config charges? The recorder is kept — you can delete it later from the AWS Config page." Its primary button is Stop recording.
    • After handling removed-region recorders (or if there were none), if the updated linking region set has regions that lack a running recorder, the AWS Config needed for full evaluation dialog offers to enable them, with Enable AWS Config as its primary button.

    Both dialogs list the affected pairs as 123456789012 — us-east-1, and both carry the same two secondary actions alongside the primary one: Open AWS Config page, which navigates to Config Recorders, and Later, which closes the dialog and continues. After the primary action succeeds the dialog's body is replaced by a confirmation — "Enabling AWS Config — track progress on the AWS Config page." or "Stopping AWS Config recording — track progress on the AWS Config page." — and it closes itself a moment later.

  5. After you close the Config dialog(s) — or straight away when neither is needed — Prism navigates back to the Compliance Dashboard.

While the region update is being applied, the engine transitions to an in_progress state and a progress screen appears with "Updating linking regions…" copy.

info

The home region is always retained in the linking regions list. Attempting to remove it has no effect; should it ever be missing when you save, Prism refuses the change with the error "Home region cannot be removed".

Permissions Tab​

Security Hub CSPM works by assuming a role in each enrolled account. Prism keeps a scoped inline policy named CKPrism-SecurityHub-Permissions on that role, listing only the actions this service needs. The Permissions tab, headed Account permissions, reports whether that policy is in place and current in every enrolled account, and repairs it where it is not.

Opening the tab starts a scan automatically; Checking account permissions… shows above a progress bar while it runs. Each account is then listed in a table of Account, Permissions, and Details, with the permissions state as one of three chips:

StateMeaning
CurrentThe expected policy is attached and up to date
Needs updateA policy is attached but does not match what Prism expects
MissingNo policy is attached

Below the table, Fix roles re-applies the policy to the accounts that need it and then re-runs the scan so you can confirm the result; its label changes to Applying… while it works, and it is disabled when nothing needs attention. Re-check re-runs the scan on its own. A summary line beside the buttons reads either "All accounts are up to date." or a count such as "3 accounts need attention."

While a re-check runs, the previous results stay on screen dimmed rather than collapsing the table, so you always see whether the rows shown are the current result.

If CSPM has no enrolled accounts yet, the tab reads "No enrolled accounts to check yet — enroll an account to start tracking its role permissions."

Use this tab when:

  • An account failed enrollment with a permissions or AccessDenied error — fix the roles, then Retry the account from Enrollment
  • The policy was removed or edited directly in AWS
  • A Prism update changed the set of permissions CSPM requires
info

This is a standing grant, not a temporary escalation. The policy stays attached to each enrolled account's access role for as long as that account is enrolled.

Danger Zone Tab​

The Danger zone tab, headed Disable Security Hub, contains the option to disable Security Hub CSPM entirely.

A warning describes what happens on disable:

Disabling tears down all member enrollments, the finding aggregator, and Security Hub in every region. Finding history in Prism is retained; standards progress is lost.

To disable Security Hub CSPM:

  1. Click Disable Security Hub (the red button).
  2. The Confirm disable dialog opens: "Type the customer ID <your-customer-id> to confirm:". Type it into the field exactly as shown — the Disable button stays disabled until the text matches.
  3. Click Disable to confirm, or Cancel to abandon.
  4. Prism submits the teardown request and navigates to the CSPM section. A progress screen appears with "Disabling Security Hub…" copy while the teardown job runs.
  5. When teardown completes, the CSPM section transitions back to the setup wizard.
warning

Disabling Security Hub CSPM is destructive and cannot be undone without running the setup wizard again. The teardown removes all member enrollments, the cross-region finding aggregator, and Security Hub configuration in every linked region. Standards progress (pass/fail history) is permanently lost. Finding records stored in Prism are retained but are unreachable until Security Hub is re-enabled.

What Happens After Each Action​

ActionTransitionScreen shown
Save standardsin_progress (updating standards)Progress screen with "Updating compliance standards…" copy
Save regionsin_progress (updating regions)Progress screen with "Updating linking regions…" copy
Disable Security Hubin_progress (teardown)Progress screen with "Disabling Security Hub…" copy

All three transitions use a shared progress screen for the in-flight period. Once the job settles, the engine returns to the Compliance Dashboard (for standards/region updates) or the setup wizard (for disable).