Security Hub
AWS Security Hub is the single place where findings from every AWS security service land, and where an account's configuration is scored against published security standards. The platform runs it from core-security for the whole organization.
What it does
Security Hub does two things. As a cloud security posture management (CSPM) tool it runs security checks against standards such as the CIS AWS Foundations Benchmark and reports a score. As an aggregator it imports findings from GuardDuty, Inspector, Macie, IAM Access Analyzer and AWS Config through product integrations, normalizes them into one format, and lets a delegated administrator see the findings of every member account. A cross-region aggregator brings findings from other regions into one home region.
How BuiltForProd uses it
Security Hub is on by default (enable_security_hub = true in environments/core/security/security.hcl) and follows the same three-step delegated-administrator pattern as GuardDuty: the security-hub unit in core-security enables the service, the security-hub-delegation unit in core-root names core-security as administrator, and org_auto_enable.security_hub = true then enrolls every member account and creates the cross-region aggregator.
Product integrations follow the other switches in the same file: GuardDuty is on, Inspector and Macie are imported when they are switched on, and IAM Access Analyzer is always imported because the organization analyzer in core-root is always on.
The four standards are built in and switched off by default, because each one adds checks and therefore cost (about $0.001 per check beyond the free tier):
| Standard | Switch |
|---|---|
| CIS AWS Foundations Benchmark v5.0.0 | security_hub_standards.cis_v5 |
| AWS Foundational Security Best Practices v1.0.0 | security_hub_standards.fsbp |
| PCI DSS v4.0.1 | security_hub_standards.pci_dss_v4 |
| AWS Resource Tagging Standard v1.0.0 | security_hub_standards.tagging |
One class of finding is fixed automatically. An EventBridge rule in units/security-remediation matches Security Hub findings about public S3 buckets and runs the SSM Automation document AWS-DisableS3BucketPublicReadWrite; core-public is excluded because it exists to host public assets. Findings about EC2 and VPC resources, such as an open security group, go to the security alerts SNS topic for a person to decide.
The SecurityAuditorAccess permission set can read findings, insights and standards in every account. Together with the aggregator this is the auditor's main evidence source for the detective controls.
Terms you will see
| Term | Meaning |
|---|---|
| Finding | One normalized security issue, from a standard check or an integrated service. |
| Security check | One control of a standard evaluated against a resource. |
| Standard | A published benchmark, such as CIS v5 or FSBP, that Security Hub can score against. |
| Product integration | The setting that imports findings from another service. |
| Delegated administrator | The account that sees and manages findings for the organization. |
| Cross-region aggregator | The setting that gathers findings from every region into one. |
| Insight | A saved filter over findings. |
Where to read more
- AWS Baseline overview for the security account in context.
- Inspector and Access Analyzer for two of the integrated services.
- EventBridge for the remediation and alert rules.