AWS Security Hub

AWS Security Hub is the central security-posture service for AWS accounts. It aggregates findings from native services (GuardDuty, Inspector, Macie, Config, IAM Access Analyzer, Firewall Manager) and third-party tools into the AWS Security Finding Format (ASFF), evaluates accounts against industry standards (CIS, PCI-DSS, NIST, AWS Foundational Security Best Practices), and serves as the routing point for automated response.

1. Overview & Hub-and-Spoke

Security Hub sits at the centre of an AWS security posture — findings flow in from many sources, are normalised and deduplicated, and flow out to response actions and external SIEMs. Enabling a delegated administrator account in AWS Organizations gives a single pane of glass over every member account and every region.

┌──────────────────────────────────────────────────────────────────────────────────────────┐
│                              FINDING SOURCES                                             │
│ ┌────────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐ ┌────────────────┐                 │
│ │ GuardDuty  │ │Inspector │ │  Macie   │ │  Config  │ │ IAM Access     │                 │
│ │  Threats   │ │   CVE    │ │   PII    │ │  Drift   │ │ Analyzer       │                 │
│ └────────────┘ └──────────┘ └──────────┘ └──────────┘ └────────────────┘                 │
│ ┌────────────┐ ┌──────────┐ ┌──────────────────────────────────────────┐                 │
│ │ Firewall   │ │ Health   │ │  Third-Party (Wiz, Prisma, Snyk, Splunk) │                 │
│ │  Manager   │ │  Mgr.    │ │  via ASFF Format                         │                 │
│ └────────────┘ └──────────┘ └──────────────────────────────────────────┘                 │
└──────────────────────────────────────────────────────────────────────────────────────────┘
                                             │
                                             ▼
┌──────────────────────────────────────────────────────────────────────────────────────────┐
│                       SECURITY HUB (CENTRAL HUB)                                         │
│  ┌────────────────────┐  ┌────────────────────┐  ┌──────────────────┐                    │
│  │  Standards Engine  │  │  ASFF Normaliser   │  │  Insights /      │                    │
│  │ CIS / PCI / NIST   │  │  Dedup, Severity   │  │  Custom Filters  │                    │
│  └────────────────────┘  └────────────────────┘  └──────────────────┘                    │
│         (Delegated Administrator: Org-wide aggregation, cross-region)                    │
└──────────────────────────────────────────────────────────────────────────────────────────┘
                                             │
                                             ▼
┌──────────────────────────────────────────────────────────────────────────────────────────┐
│                       RESPONSE & OUTPUT                                                  │
│  ┌────────────────────┐  ┌────────────────────┐  ┌──────────────────┐                    │
│  │   EventBridge      │  │  SSM Automation    │  │   SNS / Slack /  │                    │
│  │  Custom Actions    │  │  Auto-Remediate    │  │   PagerDuty      │                    │
│  └────────────────────┘  └────────────────────┘  └──────────────────┘                    │
│  ┌────────────────────┐  ┌────────────────────┐  ┌──────────────────┐                    │
│  │  Lambda Workflow   │  │  Jira / ServiceNow │  │  S3 Audit Bucket │                    │
│  └────────────────────┘  └────────────────────┘  └──────────────────┘                    │
└──────────────────────────────────────────────────────────────────────────────────────────┘

2. Standards (CIS, PCI-DSS, NIST, AWS FSBP)

Security Hub runs continuous compliance checks against these built-in standards (each control maps to a Config rule under the hood):

Each control reports a status (PASSED / FAILED / NOT_AVAILABLE) and a workflow status (NEW / NOTIFIED / SUPPRESSED / RESOLVED). The org-wide compliance score is the percentage of enabled controls passing.

3. Findings Aggregation (ASFF)

Every finding — whether from GuardDuty, a third-party scanner, or a hand-written custom action — is normalised into the AWS Security Finding Format (ASFF). Key fields:


SchemaVersion: "2018-10-08"
Id: "arn:aws:securityhub:us-east-1:111111111111:finding/abcd-1234"
ProductArn: "arn:aws:securityhub:us-east-1::product/aws/inspector"
GeneratorId: "AWSInspector"
AwsAccountId: "111111111111"
Types: ["Software and Configuration Checks/Vulnerabilities/CVE"]
Severity: { Label: "CRITICAL", Normalized: 95 }
Resources:
  - Type: "AwsEc2Instance"
    Id: "arn:aws:ec2:us-east-1:111111111111:instance/i-0abc123"
    Region: "us-east-1"
Workflow: { Status: "NEW" }
RecordState: "ACTIVE"
Title: "CVE-2025-XXXX in openssl"
Description: "EC2 instance has unpatched CRITICAL CVE in openssl."

4. Integrations

5. Automated Response

The standard pattern: Hub finding → EventBridge rule → Lambda or SSM Automation document → remediation. Custom Actions add a manual button on the finding for analyst-driven one-click response.


aws events put-rule \
  --name "SecHub-Critical-Auto-Remediate" \
  --event-pattern '{
    "source": ["aws.securityhub"],
    "detail-type": ["Security Hub Findings - Imported"],
    "detail": {
      "findings": {
        "Severity": { "Label": ["CRITICAL"] },
        "Workflow": { "Status": ["NEW"] }
      }
    }
  }'

aws events put-targets --rule "SecHub-Critical-Auto-Remediate" \
  --targets "Id"="1","Arn"="arn:aws:lambda:us-east-1:111111111111:function:RemediateSecHub"

The Automated Security Response on AWS solution (formerly AWS SHARR) ships pre-built playbooks for CIS / PCI / NIST findings — deploy with one CloudFormation stack and the common remediations work out of the box.

6. Multi-Account Architecture

The recommended deployment uses AWS Organizations with a delegated administrator:

Pricing scales with finding volume and security-check count: roughly $0.0010 per finding ingested and $0.0010 per security check per month, tiered down. Common cost driver: noisy CIS controls in chatty accounts. Suppress accepted-risk failures to avoid paying for findings you've decided to live with.

↑ Back to Top

© Kevin Thomas Luzbetak, MSc