AWS Security Hub Configuration

10 min read Beginner

Security Hub aggregates security findings from multiple AWS services into a single dashboard. It provides compliance scoring against industry standards and enables centralized security management across accounts. This guide covers configuration options, standards selection, and integration patterns.

Quick Start

Enable Security Hub with default standards:

bash 
aws securityhub enable-security-hub --enable-default-standards

Security Hub begins aggregating findings immediately. Default standards include AWS Foundational Security Best Practices and CIS AWS Foundations Benchmark. See the AWS Security Hub documentation for complete feature details.

Security Standards

Security Hub supports multiple compliance frameworks:

Standard Controls Use Case
AWS Foundational Security Best Practices ~200 General AWS security baseline
CIS AWS Foundations Benchmark v1.4.0 ~50 Industry-recognized compliance framework
CIS AWS Foundations Benchmark v1.2.0 ~43 Legacy compliance requirements
PCI DSS v3.2.1 ~160 Payment card industry compliance
NIST SP 800-53 Rev. 5 ~200+ Federal and government compliance
Recommendation: Start with AWS Foundational Security Best Practices and CIS v1.4.0. These cover most security requirements without excessive noise from controls not applicable to the environment.

Configuration Options

Minimal Configuration

Enable Security Hub with default standards:

hcl 
resource "aws_securityhub_account" "main" {
  enable_default_standards = true
}

Explicit Standards Selection

Disable defaults and subscribe to specific standards:

hcl 
resource "aws_securityhub_account" "main" {
  enable_default_standards = false
}

# CIS AWS Foundations Benchmark v1.4.0
resource "aws_securityhub_standards_subscription" "cis" {
  depends_on    = [aws_securityhub_account.main]
  standards_arn = "arn:aws:securityhub:${data.aws_region.current.name}::standards/cis-aws-foundations-benchmark/v/1.4.0"
}

# AWS Foundational Security Best Practices
resource "aws_securityhub_standards_subscription" "fsbp" {
  depends_on    = [aws_securityhub_account.main]
  standards_arn = "arn:aws:securityhub:${data.aws_region.current.name}::standards/aws-foundational-security-best-practices/v/1.0.0"
}

Standards Selection Considerations

Overlapping Controls Multiple standards often check the same resources. Enabling all standards increases findings volume without additional security coverage.
Regional Deployment Security Hub and standards must be enabled in each region. Consider automation for multi-region deployment.
Control Disabling Individual controls can be disabled if not applicable. Document justification for audit purposes.

Findings Management

Security Hub aggregates findings from multiple sources:

GuardDuty Threat detection findings
AWS Config Configuration compliance findings
Inspector Vulnerability scan findings
Macie Sensitive data findings
IAM Access Analyzer Access policy findings

Finding Severity Levels

Critical / High

Immediate action required. Active vulnerabilities or misconfigurations with significant risk.

Medium

Review within 30 days. Potential security gaps requiring attention.

Low / Informational

Best practice recommendations. Address during regular maintenance cycles.

Compliance Scoring

Security Hub calculates compliance scores for each enabled standard:

  • Score calculation: Passed controls / Total applicable controls × 100
  • Control status: Passed, Failed, Unknown, Not available
  • Suppressed findings: Excluded from score calculation
Score Interpretation: A 100% score does not guarantee security. It indicates compliance with checked controls only. Security posture depends on additional factors including architecture design, access management, and operational practices.

Multi-Account Setup

For AWS Organizations, designate a security account as the delegated administrator:

bash 
# From management account
aws securityhub enable-organization-admin-account \
  --admin-account-id 123456789012

The delegated administrator aggregates findings from all member accounts and manages organization-wide settings.

Recommended Architecture

  • Security Account: Security Hub administrator, centralized dashboard
  • Member Accounts: Auto-enrolled via Organizations integration
  • Aggregation Region: Designate one region for cross-region finding aggregation
Cross-Region Aggregation: Security Hub can aggregate findings from multiple regions into a single aggregation region, providing unified visibility without switching between regional consoles.

EventBridge Integration

Route high-severity findings to notification systems via EventBridge:

json 
{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Imported"],
  "detail": {
    "findings": {
      "Severity": {
        "Label": ["CRITICAL", "HIGH"]
      }
    }
  }
}

This pattern captures CRITICAL and HIGH severity findings. Common targets include SNS for email notifications or Lambda for Slack/PagerDuty integration.

Automation Actions

Security Hub supports automated response through AWS Security Hub Automated Response and Remediation (SHARR):

  • Automatic remediation of common misconfigurations
  • Custom Lambda functions for organization-specific responses
  • Integration with Systems Manager for EC2 remediation

Cost Considerations

Security Hub pricing is based on:

Component Pricing Notes
Security checks $0.0010 per check Per account/region/month
Finding ingestion events $0.00003 per event First 10,000 events free
Automation rules $0.000003 per evaluation Rule evaluation charges
Free Trial: AWS offers a 30-day free trial for Security Hub. Typical costs range from $10-50/month for small environments to $200-500/month for large multi-account deployments.

Integration Points

Security Hub serves as the central aggregation point for AWS security services:

GuardDuty Sends threat detection findings to Security Hub for centralized visibility
AWS Config Provides configuration compliance data for Security Hub standards
EventBridge Routes Security Hub findings to notification and remediation workflows
CloudTrail Logs Security Hub API activity for audit and compliance purposes
Architecture Pattern: Security Hub aggregates findings from GuardDuty, Config, Inspector, and other services. EventBridge routes findings to SNS for notifications or Lambda for automated remediation. This creates a unified security operations pipeline.

Next Steps

  1. Enable GuardDuty and AWS Config for comprehensive finding sources
  2. Configure EventBridge rules for high-severity notifications
  3. Review and suppress non-applicable controls with documented justification
  4. Schedule weekly compliance score reviews and remediation cycles