AWS Security Hub

What it is

AWS Security Hub gives you a central view of security across your AWS accounts. The service now comes in two parts:

• AWS Security Hub CSPMCSPM (Cloud security posture management)Continuously checking cloud resources against security best practices and standards, and reporting misconfigurations, such as a public S3 bucket. AWS Security Hub CSPM runs these checks across AWS accounts.Glossary entryClose (cloud security posture management) is the capability long known on the exam as Security Hub. It assesses your environment against security standards, runs security control checks, and aggregates findings from AWS services and partner products in one place.
• The new unified AWS Security Hub builds on that. It correlates and enriches signals from Security Hub CSPM, Amazon Inspector, Amazon Macie, and Amazon GuardDuty to prioritize active risks, with exposure findings, unused access analysis, and automated response workflows.

Choose Security Hub when a question asks for a single pane of glass for security findings, continuous compliance checks against best-practice standards, or central security posture across many accounts.

Security Hub CSPM concepts

• Standards:
  • AWS Foundational Security Best Practices (FSBP).
  • CIS AWS Foundations Benchmark.
  • PCI DSSPCI DSS (Payment Card Industry Data Security Standard)The security standard for organizations that store, process, or send payment card data. AWS is assessed as a PCI DSS Level 1 service provider, but each customer is still responsible for the compliance of what it builds.Glossary entryClose.
  • NIST.
  • Each standard is a set of controls, and each control represents one best practice, such as "S3 buckets should block public access".
• Control findings: Security Hub CSPM runs the checks and creates findings when resources fail. It requires AWS Config to be enabled and recording resources.
• Integrated findings: receives findings from GuardDuty, Inspector, Macie, and other AWS services and third-party products, in the AWS Security Finding Format (ASFF).
• Cross-RegionAWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entryClose aggregation: collect findings from several Regions into a home Region (formerly called the aggregation Region).
• Multi-account: manage all accounts from a delegated administrator in AWS Organizations.
• Automation:
  • Automation rules update findings automatically, for example to raise severity when a critical check fails.
  • EventBridge integration triggers responses such as Lambda functions or ticketing.

Unified Security Hub capabilities

• Exposure findings: correlate CSPM control checks, Inspector findings, and other signals to identify exposed resources.
• Unused access analysis: find IAM roles, users, access keys, and permissions unused in the last 90 days, using IAM Access Analyzer.
• Response workflows and an integrated ticketing system.

Security, resilience, performance, and cost

• Security: one consolidated view of posture and findings; prioritize by severity and exposure.
• Cost: Security Hub CSPM has usage-based pricing; the unified Security Hub uses resource-based pricing with unlimited checks and finding ingestion. There is a 30-day free trial.

Security Hub or another option?

If the requirement is	Choose
One view of findings from GuardDuty, Inspector, Macie, and partners	AWS Security Hub
Continuous checks against CIS, PCI DSS, or AWS best practices	Security Hub CSPM standards
Detect threats	Amazon GuardDuty
Investigate the root cause of a finding	Amazon Detective
Custom configuration rules and history	AWS Config

Reverse mindmap: when the question points here

• Yes, when the question says
  • Single dashboard for all security findings→ leads to Security Hub
  • Check accounts against CIS or PCI DSS→ leads to Security Hub CSPM standards
  • AWS Foundational Security Best Practices→ leads to Security Hub CSPM
  • Findings from all Regions in one place→ leads to Cross-Region aggregation, home Region
  • Correlate risks across GuardDuty, Inspector, Macie→ leads to Unified Security Hub
• Automate
  • Change finding severity automatically→ leads to Automation rules
  • Open a ticket or run Lambda on a finding→ leads to EventBridge
• No, when the question says
  • Investigate root cause→ leads to Detective
  • Detect threats→ leads to GuardDuty

Key takeaways

• Security Hub CSPM (formerly Security Hub) checks posture against standards such as FSBP, CIS, PCI DSS, and NIST, and aggregates findings in ASFF.
• It integrates GuardDuty, Inspector, Macie, AWS Config, and partner products; it aggregates across Regions (home Region) and accounts.
• Automation rules and EventBridge drive response.
• The new unified Security Hub correlates signals into exposure findings and adds unused access analysis.

Sources

• AWS Security Hub User Guide: Introduction to AWS Security Hub CSPM
• AWS Security Hub User Guide: Introduction to AWS Security Hub
• AWS Security Hub User Guide: Understanding security standards in Security Hub CSPM
• AWS Security Hub User Guide: Control reference for Security Hub CSPM
• AWS Security Hub User Guide: Enabling and configuring AWS Config for Security Hub CSPM
• AWS Security Hub User Guide: AWS Security Finding Format (ASFF)
• AWS Security Hub User Guide: Cross-Region aggregation in Security Hub CSPM
• AWS Security Hub pricing