feat(aws): add securityhub + config org-wide delegated admin checks

[ernestprovo23]

Context

Fixes #8710 (remaining 2 of the 3 checks proposed there; the GuardDuty check shipped via #9867)

In AWS Organizations, delegated administrators for core security services (GuardDuty, Security Hub, AWS Config) should be configured consistently across all opted-in regions. #9867 added guardduty_delegated_admin_enabled_all_regions; this PR adds the remaining two checks @danibarranqueroo flagged as still open for contribution.

Description

New check: securityhub_delegated_admin_enabled_all_regions — verifies:

• A Security Hub delegated administrator account is configured in each region (securityhub:ListOrganizationAdminAccounts)
• The hub is ACTIVE (existing service state)
• Organization auto-enable is on for new accounts (securityhub:DescribeOrganizationConfiguration → AutoEnable)

New check: config_delegated_admin_and_org_aggregator_all_regions — verifies:

• A delegated administrator is registered for config.amazonaws.com (organizations:ListDelegatedAdministrators with ServicePrincipal filter)
• At least one Configuration Aggregator exists per region with OrganizationAggregationSource.AllAwsRegions=true (config:DescribeConfigurationAggregators)
• AccessDenied on the Organizations call surfaces as "delegated administrator status could not be determined" rather than a misleading FAIL

Changes

• prowler/providers/aws/services/securityhub/securityhub_service.py: added OrganizationAdminAccount model, paginated _list_organization_admin_accounts, per-hub _describe_organization_configuration, and organization_auto_enable / auto_enable_standards / organization_config_available fields on SecurityHubHub. Both new fetchers tolerate the InvalidAccessException/AccessDeniedException/BadRequestException triad that Security Hub raises when not running from the management or delegated admin account.
• prowler/providers/aws/services/config/config_service.py: added Aggregator and ConfigDelegatedAdministrator models, per-region _describe_configuration_aggregators, and a single _list_config_delegated_administrators call against the Organizations API (uses a freshly built self.session.client("organizations") since the call is global). AccessDenied is surfaced via a delegated_administrators_lookup_failed flag the check inspects.
• New check directories + metadata + check logic for both, mirroring the structure of guardduty_delegated_admin_enabled_all_regions/.
• prowler/CHANGELOG.md: two ### 🚀 Added entries under 5.28.0.

Tests

• 4 new SecurityHub tests + 5 new Config tests (9 new, all passing)
• Full local regression on securityhub/, config/, organizations/, guardduty/: 108/108 passing
• One small caveat addressed in the SecurityHub test file: a teardown_method evicts securityhub_client from sys.modules so the legacy mock.patch-based securityhub_enabled_test.py (which assumes a fresh module import) keeps working in the same pytest session. Tested across 3 random seeds with pytest-randomly to confirm no order-dependent failures.

Steps to review

1. securityhub_service.py — two new methods, one new model, three new fields on SecurityHubHub
2. config_service.py — two new models, two new methods (one regional, one global)
3. The two new check .py files for logic + mute_non_default_regions support
4. The two new .metadata.json files for Risk length (352, 340 — both ≤ 400), RelatedUrl="", severity, and resource-group selection
5. Test files for moto coverage of pass/fail paths

To run the new tests:

poetry run pytest tests/providers/aws/services/securityhub/securityhub_delegated_admin_enabled_all_regions/ tests/providers/aws/services/config/config_delegated_admin_and_org_aggregator_all_regions/ -v

Notes on the Config check name

The original issue proposed config_delegated_admin_and_org_aggregator_all_regions. I used that exact name (per @danibarranqueroo's 2026-03-10 comment) since the Config check is structurally different from the SecurityHub/GuardDuty siblings — Config has no per-service delegated-admin API, so we go through Organizations and verify aggregator coverage rather than per-region enablement.

License

This contribution is submitted under the Apache 2.0 license, consistent with the project license.

Checklist

• This feature is listed in Org-aware checks for GuardDuty / Security Hub / AWS Config (Delegated Admin + all opted-in Regions) #8710
• Code is covered by tests
• CHANGELOG updated under ### 🚀 Added
• No regressions in existing test suite (108/108)
• Conventional commit message

[github-actions]

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.