| name | implementing-aws-security-hub |
| description | Deploy AWS Security Hub as a centralized CSPM platform, backed by AWS Config, aggregating findings from GuardDuty, Inspector, Macie, and third-party tools; enable CIS Foundations, PCI-DSS, and NIST standards; automate remediation via EventBridge/Systems Manager; and produce Audit Manager evidence. Use for a centralized findings dashboard or compliance audit evidence; not for threat detection or container scanning.
|
| domain | cybersecurity |
| subdomain | cloud-security |
| tags | ["aws-security-hub","cspm","compliance-automation","security-standards","finding-aggregation"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"] |
| mitre_attack | ["T1078.004","T1530","T1537","T1580"] |
Implementing AWS Security Hub
When to Use
- When establishing a centralized security findings dashboard across multiple AWS accounts
- When enabling automated compliance checks against CIS, PCI-DSS, NIST, or AWS Foundational Security Best Practices
- When integrating findings from GuardDuty, Inspector, Macie, and third-party security tools
- When building automated remediation workflows for recurring security misconfigurations
- When preparing compliance evidence for auditors requiring continuous posture monitoring
Do not use for real-time threat detection (see detecting-cloud-threats-with-guardduty), for Azure compliance monitoring (see securing-azure-with-microsoft-defender), or for deep vulnerability scanning of container images (see securing-container-registry).
Prerequisites
- AWS Organization with a designated security administrator account
- AWS Config enabled in all target accounts and regions
- GuardDuty, Inspector, and Macie activated for finding integration
- IAM permissions for securityhub:* and config:* in the administrator account
Workflow
Step 1: Enable Security Hub with Standards
Activate Security Hub in the delegated administrator account and enable security standards. AWS Security Hub CSPM supports CIS AWS Foundations Benchmark v5.0, AWS Foundational Security Best Practices, PCI DSS v3.2.1, and NIST SP 800-53.
aws securityhub enable-security-hub \
--enable-default-standards \
--tags '{"Environment":"production","ManagedBy":"security-team"}'
aws securityhub batch-enable-standards \
--standards-subscription-requests '[
{"StandardsArn": "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/5.0.0"},
{"StandardsArn": "arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"},
{"StandardsArn": "arn:aws:securityhub:us-east-1::standards/pci-dss/v/3.2.1"}
]'
aws securityhub get-enabled-standards \
--query 'StandardsSubscriptions[*].[StandardsArn,StandardsStatus]' --output table
Step 2: Configure Multi-Account Aggregation
Designate a Security Hub administrator and automatically enroll all organization member accounts. Configure cross-region aggregation to consolidate findings into a single region.
aws securityhub enable-organization-admin-account \
--admin-account-id 111122223333
aws securityhub update-organization-configuration \
--auto-enable \
--organization-configuration
aws securityhub create-finding-aggregator \
--region-linking-mode ALL_REGIONS
