AWS for DevOps — Security Hub

13.2 — Security Hub

Security Hub aggregates security findings from GuardDuty, Inspector, IAM Access Analyzer, Firewall Manager, and third-party tools into a single dashboard. It also runs automated compliance checks against industry standards.

Real-World Analogy

Security Hub is like a security operations center (SOC) dashboard. All the cameras (GuardDuty), access logs (CloudTrail), fire alarms (Config), and guard reports (Inspector) feed into one central screen. The SOC manager sees everything in one place and can prioritize what to address first.

How It Works

  ┌───────────┐  ┌────────────┐  ┌───────────────┐
  │ GuardDuty │  │ Inspector  │  │ IAM Access    │
  │           │  │            │  │ Analyzer      │
  └─────┬─────┘  └─────┬──────┘  └──────┬────────┘
        │               │                │
        └───────────────┼────────────────┘
                        ▼
                ┌──────────────┐
                │ Security Hub │
                │              │
                │ • Dashboard  │
                │ • Standards  │
                │ • Findings   │
                └──────┬───────┘
                       │
                       ▼
               ┌──────────────┐
               │ EventBridge  │──→ Auto-remediation
               └──────────────┘

Enabling Security Hub

# Enable Security Hub with default standards
$ aws securityhub enable-security-hub \
    --enable-default-standards
{
    "SecurityHubArn": "arn:aws:securityhub:ap-south-1:123456789012:hub/default"
}

Compliance Standards

Standard	What It Checks
AWS Foundational Security Best Practices	AWS-specific security controls
CIS AWS Foundations Benchmark	CIS security hardening standards
PCI DSS	Payment card industry compliance
NIST 800-53	US federal security framework

Viewing Findings

# Get findings with high severity
$ aws securityhub get-findings \
    --filters '{
      "SeverityLabel": [{"Value": "CRITICAL", "Comparison": "EQUALS"}]
    }' \
    --max-results 10

# Get compliance status for a specific standard
$ aws securityhub get-enabled-standards
{
    "StandardsSubscriptions": [{
        "StandardsArn": "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0",
        "StandardsStatus": "READY"
    }]
}

Common Findings and Fixes

Finding	Standard	Fix
Root account has access keys	CIS 1.4	Delete root access keys
MFA not enabled for root	CIS 1.5	Enable MFA on root account
S3 bucket is public	FSBP	Block public access
CloudTrail not enabled	CIS 2.1	Enable multi-region trail
VPC flow logs disabled	CIS 2.9	Enable flow logs on all VPCs
Security group allows 0.0.0.0/0 on SSH	FSBP	Restrict to known IPs

Common Mistakes

Mistake	Why It Hurts	Fix
Not enabling integrations	Missing findings from GuardDuty/Inspector	Enable all available integrations
Ignoring CRITICAL findings	High-risk vulnerabilities persist	Triage CRITICAL findings within 24 hours
No automated remediation	Manual response is too slow	Use EventBridge + Lambda for auto-fix
Single-region only	Miss findings in other regions	Enable in all active regions

Quick Reference

Task	Command
Enable Security Hub	aws securityhub enable-security-hub --enable-default-standards
Get findings	aws securityhub get-findings --filters '...'
List standards	aws securityhub get-enabled-standards
Batch update findings	aws securityhub batch-update-findings --finding-identifiers '[...]' --workflow Status=RESOLVED

---

Next → IAM Access Analyzer