AWS Security Hub
Central dashboard that aggregates security findings from AWS services and runs automated compliance checks against security standards.
Verified against AWS documentation · 2026-08-26
Key facts
- 01Aggregator, not a detector — it collects findings from GuardDuty, Inspector, Macie, and partner tools into one place
- 02Runs continuous automated checks against standards: AWS Foundational Security Best Practices, CIS, PCI DSS, NIST
- 03All findings normalized into one JSON schema: AWS Security Finding Format (ASFF)
- 04Regional service — enable per Region, but a designated aggregation Region can consolidate cross-Region and cross-account (Organizations) findings
- 05Requires AWS Config running — security checks are built on Config's recorded resource state
- 06Naming update: AWS now calls this 'Security Hub CSPM'; exams still say 'Security Hub'
Exam triggers
Phrases and scenarios that point here.
- "Single pane of glass" / "centralize security findings across accounts" → Security Hub
- "Check compliance against CIS / PCI DSS benchmarks automatically" → Security Hub standards
- Automated remediation of findings → Security Hub + EventBridge + Lambda/SSM Automation
- Aggregate GuardDuty + Inspector + Macie results → Security Hub, not any single one of them
Not this service
- Detect actual threats (malware, compromised credentials, crypto mining) → GuardDuty
- Scan EC2/containers for software vulnerabilities → Inspector
- Find sensitive data in S3 → Macie
- Audit who did what via API history → CloudTrail
- Central security incident investigation across accounts → Detective
Use cases
- 01A company with 40 accounts in Organizations pipes every GuardDuty and Inspector finding into one delegated admin account, so the two-person security team stops logging into accounts one by one
- 02Proving PCI DSS posture to an auditor with a live compliance score per control instead of a quarterly spreadsheet exercise
- 03Auto-remediation loop: a public S3 bucket finding fires an EventBridge rule that triggers a Lambda to block public access and post to Slack — no human in the path
- 04New-account guardrail: every account vended by the platform team gets Security Hub + FSBP standard enabled by default, so misconfigurations surface on day one, not at audit time
How it's charged
- 01Priced on three dimensions: security checks, finding ingestion events, and automation rule evaluations — all per account per Region, with tiered volume pricing across an Organization
- 02Findings generated by Security Hub's own checks are not charged as ingestion events — you pay ingestion only for findings from other services and partners
- 03Duplicate controls across standards are charged once per resource, so enabling a second standard doesn't double the bill
- 04AWS Config is a hard dependency and billed separately — Config configuration items are often the real cost surprise, not Security Hub itself
- 0530-day free trial per account per Region, plus a free tier of 10,000 ingested findings per account per Region per month
