AWS Security Hub
Centralized security posture, compliance scoring, and finding aggregation.
AWS Security Hub is a cloud security posture management (CSPM) service that provides a centralized view of security findings and compliance status across AWS accounts and regions. It continuously evaluates resources against security best practices — AWS Foundational Security Best Practices (FSBP), CIS AWS Foundations Benchmark, PCI DSS, and other supported standards.
Objectives
- Continuously monitor AWS resources for security risks.
- Centralize security findings from multiple AWS services.
- Detect security misconfigurations and vulnerabilities.
- Measure compliance against industry security standards.
- Improve overall cloud security posture.
- Simplify security operations through a unified dashboard.
Architecture
Contributing services
| Service | What it contributes |
|---|---|
| AWS Security Hub | Collects, normalizes, and prioritizes findings; security score reporting. |
| Amazon GuardDuty | Malicious activity and suspicious behavior — see GuardDuty. |
| Amazon Inspector | Software, package, network, and container image vulnerabilities. |
| AWS Config | Non-compliant resources, configuration drift, and policy violations. |
| IAM Access Analyzer | Public resource access, cross-account permissions, and sharing risks. |
Security monitoring flow
- AWS services continuously monitor resources.
- Security findings are generated.
- Findings are automatically sent to AWS Security Hub.
- Security Hub normalizes and prioritizes findings.
- Administrators review findings through a centralized dashboard.
- High-priority issues are remediated.
- Security posture is continuously reassessed.
Compliance standards
Security Hub supports continuous assessment against multiple frameworks:
- AWS Foundational Security Best Practices (FSBP)
- CIS AWS Foundations Benchmark
- PCI DSS
- NIST (where supported through integrations)
- Organizational security policies
Example security checks
- Root account MFA enabled
- IAM users without MFA
- Publicly accessible S3 buckets
- Security groups allowing unrestricted SSH (port 22)
- Security groups allowing unrestricted RDP (port 3389)
- EBS volume encryption
- RDS encryption enabled
- CloudTrail logging enabled
- AWS Config enabled
- IAM access key rotation
- Public snapshot detection
- EC2 instances with exposed ports