implementing-aws-security-hub

name	implementing-aws-security-hub
description	Deploy AWS Security Hub as a centralized CSPM platform, backed by AWS Config, aggregating findings from GuardDuty, Inspector, Macie, and third-party tools; enable CIS Foundations, PCI-DSS, and NIST standards; automate remediation via EventBridge/Systems Manager; and produce Audit Manager evidence. Use for a centralized findings dashboard or compliance audit evidence; not for threat detection or container scanning.
domain	cybersecurity
subdomain	cloud-security
tags	["aws-security-hub","cspm","compliance-automation","security-standards","finding-aggregation"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]
mitre_attack	["T1078.004","T1530","T1537","T1580"]

Implementing AWS Security Hub

When to Use

• When establishing a centralized security findings dashboard across multiple AWS accounts
• When enabling automated compliance checks against CIS, PCI-DSS, NIST, or AWS Foundational Security Best Practices
• When integrating findings from GuardDuty, Inspector, Macie, and third-party security tools
• When building automated remediation workflows for recurring security misconfigurations
• When preparing compliance evidence for auditors requiring continuous posture monitoring

Do not use for real-time threat detection (see detecting-cloud-threats-with-guardduty), for Azure compliance monitoring (see securing-azure-with-microsoft-defender), or for deep vulnerability scanning of container images (see securing-container-registry).

Prerequisites

• AWS Organization with a designated security administrator account
• AWS Config enabled in all target accounts and regions
• GuardDuty, Inspector, and Macie activated for finding integration
• IAM permissions for securityhub:* and config:* in the administrator account

Workflow

Step 1: Enable Security Hub with Standards

Activate Security Hub in the delegated administrator account and enable security standards. AWS Security Hub CSPM supports CIS AWS Foundations Benchmark v5.0, AWS Foundational Security Best Practices, PCI DSS v3.2.1, and NIST SP 800-53.

# Enable Security Hub with standards
aws securityhub enable-security-hub \
  --enable-default-standards \
  --tags '{"Environment":"production","ManagedBy":"security-team"}'

# Enable CIS AWS Foundations Benchmark v5.0
aws securityhub batch-enable-standards \
  --standards-subscription-requests '[
    {"StandardsArn": "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/5.0.0"},
    {"StandardsArn": "arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"},
    {"StandardsArn": "arn:aws:securityhub:us-east-1::standards/pci-dss/v/3.2.1"}
  ]'

# Verify enabled standards
aws securityhub get-enabled-standards \
  --query 'StandardsSubscriptions[*].[StandardsArn,StandardsStatus]' --output table

Step 2: Configure Multi-Account Aggregation

Designate a Security Hub administrator and automatically enroll all organization member accounts. Configure cross-region aggregation to consolidate findings into a single region.

# Designate delegated admin
aws securityhub enable-organization-admin-account \
  --admin-account-id 111122223333


aws securityhub update-organization-configuration \
  --auto-enable \
  --organization-configuration 


aws securityhub create-finding-aggregator \
  --region-linking-mode ALL_REGIONS