implementing-aws-security-hub

name	implementing-aws-security-hub
description	This skill covers deploying AWS Security Hub as a centralized cloud security posture management platform that aggregates findings from GuardDuty, Inspector, Macie, and third-party tools. It details enabling security standards like CIS AWS Foundations Benchmark, configuring automated remediation, and building executive dashboards for compliance tracking across multi-account AWS organizations.
domain	cybersecurity
subdomain	cloud-security
tags	["aws-security-hub","cspm","compliance-automation","security-standards","finding-aggregation"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01"]
mitre_attack	["T1078.004","T1530","T1537","T1580"]
source	https://github.com/mukul975/Anthropic-Cybersecurity-Skills
source_commit	04450304b12645cb2b974ab96d28c0664758a88d

Implementing AWS Security Hub

When to Use

• When establishing a centralized security findings dashboard across multiple AWS accounts
• When enabling automated compliance checks against CIS, PCI-DSS, NIST, or AWS Foundational Security Best Practices
• When integrating findings from GuardDuty, Inspector, Macie, and third-party security tools
• When building automated remediation workflows for recurring security misconfigurations
• When preparing compliance evidence for auditors requiring continuous posture monitoring

Do not use for real-time threat detection (see detecting-cloud-threats-with-guardduty), for Azure compliance monitoring (see securing-azure-with-microsoft-defender), or for deep vulnerability scanning of container images (see securing-container-registry).

Prerequisites

• AWS Organization with a designated security administrator account
• AWS Config enabled in all target accounts and regions
• GuardDuty, Inspector, and Macie activated for finding integration
• IAM permissions for securityhub:* and config:* in the administrator account

Workflow

Step 1: Enable Security Hub with Standards

Activate Security Hub in the delegated administrator account and enable security standards. AWS Security Hub CSPM supports CIS AWS Foundations Benchmark v5.0, AWS Foundational Security Best Practices, PCI DSS v3.2.1, and NIST SP 800-53.

# Enable Security Hub with standards
aws securityhub enable-security-hub \
  --enable-default-standards \
  --tags '{"Environment":"production","ManagedBy":"security-team"}'

# Enable CIS AWS Foundations Benchmark v5.0
aws securityhub batch-enable-standards \
  --standards-subscription-requests '[
    {"StandardsArn": "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/5.0.0"},
    {"StandardsArn": "arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"},
    {"StandardsArn": "arn:aws:securityhub:us-east-1::standards/pci-dss/v/3.2.1"}
  ]'

# Verify enabled standards
aws securityhub get-enabled-standards \
  --query 'StandardsSubscriptions[*].[StandardsArn,StandardsStatus]' --output table

Step 2: Configure Multi-Account Aggregation

Designate a Security Hub administrator and automatically enroll all organization member accounts. Configure cross-region aggregation to consolidate findings into a single region.

# Designate delegated admin
aws securityhub enable-organization-admin-account \
  --admin-account-id 111122223333


aws securityhub update-organization-configuration \
  --auto-enable \
  --organization-configuration 


aws securityhub create-finding-aggregator \
  --region-linking-mode ALL_REGIONS