From a5252948b60d1a55dba2b451345ff9e81e5708ba Mon Sep 17 00:00:00 2001
From: Sze Siong Teo <29866357+ssteo@users.noreply.github.com>
Date: Wed, 8 Jul 2020 14:27:21 +0200
Subject: [PATCH] Enable standards only when explicitly specified

---
 enablesecurityhub.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/enablesecurityhub.py b/enablesecurityhub.py
index f75e6ef..a49479f 100755
--- a/enablesecurityhub.py
+++ b/enablesecurityhub.py
@@ -259,7 +259,7 @@ def check_config(session,account, region, s3_bucket_name):
         master_clients[aws_region] = master_session.client('securityhub', region_name=aws_region)
         try: 
             # Enable Security Hub for the Master Account 
-            master_clients[aws_region].enable_security_hub()
+            master_clients[aws_region].enable_security_hub(EnableDefaultStandards=False)
 
             # Enable compliance Standards for Master account 
             compliance_standards_arns = [utils.get_standard_arn_for_region_and_resource(aws_region, standard) for standard in standards_arns]
@@ -319,7 +319,7 @@ def check_config(session,account, region, s3_bucket_name):
                     failed_accounts.append({account: "Error validating or enabling AWS Config for account {} in {} - requested standards not enabled".format(account,aws_region)})
                 else:
                     try:
-                        sh_client.enable_security_hub()
+                        sh_client.enable_security_hub(EnableDefaultStandards=False)
                     except ClientError as e:
                         if e.response['Error']['Code'] == 'ResourceConflictException':
                             pass