AWSDOP-C02
On this page
Beginner-friendly overview

Security Hub

Security Hub is AWS's centralized security findings aggregator and compliance dashboard. It collects findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, Firewall Manager, and third-party security tools, normalizes them into a standard format, and presents them in one place alongside a continuous compliance assessment against industry standards.

The Fragmentation Problem

A typical AWS security posture involves multiple specialized tools: GuardDuty detects threats, Inspector finds vulnerabilities, Macie identifies exposed sensitive data, and your own tooling generates findings. Without Security Hub, each tool has its own console, its own format, and its own alert fatigue. Security Hub is the single pane of glass that brings it all together.

Many sensors, one format (ASFF), one pane of glass GuardDuty active threats Inspector CVE vulnerabilities Config config compliance Macie · 3rd party exposed data · SIEM tools Security Hub normalizes everything into ASFF findings Single pane of glass search all findings, all sources Standards scores FSBP · CIS · PCI-DSS · NIST EventBridge automated response Security Hub consumes findings — it doesn't scan resources itself. The sensors do the detecting.

Security Standards

Security Hub evaluates your AWS environment against several security frameworks automatically:

  • AWS Foundational Security Best Practices (FSBP) — AWS's own curated set of security controls
  • CIS AWS Foundations Benchmark — a widely adopted industry standard
  • PCI-DSS — for environments handling payment card data
  • NIST 800-53 — for US government compliance requirements

For each standard, Security Hub runs hundreds of automated checks and gives you a compliance score. You see at a glance which controls are passing and which resources are failing.

Findings Aggregation

All findings from integrated services flow into Security Hub in the ASFF (Amazon Security Finding Format) — a normalized JSON structure. This consistency lets you search, filter, and correlate findings across sources: "show me all HIGH severity findings on instances tagged Environment=Production, from any source."

Security Hub is the newsroom, not the reporters. GuardDuty, Inspector, Macie, and Config are reporters in the field filing stories; Security Hub edits them all into one house style (ASFF) and prints the front page (single pane + compliance scores). The newsroom never investigates the streets itself — even its "own" standards checks are AWS Config rules it manages for you.

Automated Response

Security Hub integrates with EventBridge, so you can trigger automated responses when specific findings appear. A new CRITICAL finding from GuardDuty can automatically isolate the affected instance by modifying its security group — all without human intervention during the initial response.

Multi-Account Aggregation

In an organization, Security Hub can aggregate findings from every member account into a designated administrator account. The security team has a complete, cross-account view of findings and compliance without logging into individual accounts.