Original reporting credit: InfoQ. Original AWS announcement date: 2019.
What Is AWS Security Hub?
AWS Security Hub is a cloud security posture management (CSPM) service that gives AWS customers a single, centralized location to manage security alerts and compliance status across all of their AWS accounts. Amazon first previewed the service at AWS re:Invent 2018 and later announced its general availability (GA), positioning it as a direct answer to four common enterprise pain points:
- Ensuring AWS infrastructure meets industry compliance requirements
- Normalizing findings from multiple security tools that use different data formats
- Managing and prioritizing a large volume of security alerts
- Providing a unified “single pane of glass” across security and compliance tooling
How AWS Security Hub Works
When you enable AWS Security Hub, it automatically creates the necessary IAM service-linked roles and begins running automated compliance checks against your AWS infrastructure immediately. There is no manual bootstrapping required to start collecting findings.
Aggregating Findings from Multiple Sources
Security Hub ingests findings from a wide range of native AWS security services, including:
- Amazon GuardDuty – Threat detection service that monitors for malicious activity
- Amazon Inspector – Automated vulnerability assessment for EC2 workloads
- Amazon Macie – Data security service focused on sensitive data discovery in S3
- AWS Partner Network (APN) solutions – A growing list of third-party security products that publish findings in the AWS Security Finding Format (ASFF)
All findings are normalized into a standard schema, which eliminates the need to manually correlate data from tools that use different formats. Each finding includes the severity of the issue, the reporting system, the affected resources, and additional metadata to help responders act quickly.
Dashboards, Insights, and Prioritization
Findings are visualized on integrated dashboards using actionable graphs and tables, giving security teams an at-a-glance view of their highest-priority issues. To reduce alert fatigue, users can group related findings into Insights — saved queries built with aggregation statements and filters — making it easier to focus on what matters most.
Automated Compliance Checks
AWS Security Hub continuously evaluates your environment against established security standards. At GA launch, the first supported standard was the Center for Internet Security (CIS) AWS Foundations Benchmark, with additional compliance frameworks planned. Failed checks appear as findings in the same unified view alongside threat detections, so compliance gaps and active threats are managed in one place.
AWS Security Hub and AWS Control Tower
The GA release of AWS Security Hub coincided with the general availability of AWS Control Tower, Amazon’s service for setting up and governing a secure, multi-account AWS environment. Together, the two services form a complementary solution: Control Tower establishes guardrails and account structure at the organizational level, while Security Hub provides continuous visibility into the security and compliance posture of workloads running inside that structure.
This pairing places Amazon in direct competition with similar offerings from other major cloud providers, including Microsoft Azure Security Center and Google Cloud Security Command Center.
Regional Availability at GA Launch
At general availability, AWS Security Hub was available in the following regions:
Americas
- US East (Ohio)
- US East (N. Virginia)
- US West (N. California)
- US West (Oregon)
- Canada (Central)
- South America (São Paulo)
Asia Pacific
- Asia Pacific (Mumbai)
- Asia Pacific (Seoul)
- Asia Pacific (Singapore)
- Asia Pacific (Sydney)
- Asia Pacific (Tokyo)
Europe
- Europe (Frankfurt)
- Europe (Ireland)
- Europe (London)
- Europe (Paris)
Note: AWS Security Hub is now available in significantly more regions than those listed above. Check the AWS Security Hub product page for the current region list.
Pricing Model
AWS Security Hub uses a consumption-based pricing model with no upfront commitments. Customers are charged based on two dimensions:
- Compliance checks performed – priced per check per month
- Security finding events ingested – priced per finding event after the free tier
At launch, the first 10,000 security finding events ingested each month were free of charge. Pricing details may have changed since the original announcement — refer to the official AWS Security Hub pricing page for current rates.
Key Takeaways for DevOps and Security Teams
- Centralization reduces context switching — instead of logging into GuardDuty, Inspector, and Macie separately, findings flow into a single dashboard.
- Automated compliance checking starts immediately — no additional configuration is needed to begin evaluating against the CIS AWS Foundations Benchmark.
- Insights help manage alert volume — custom filters and aggregations let teams triage high-severity, high-impact issues without drowning in noise.
- APN integration extends coverage — third-party tools that support ASFF can push findings directly into Security Hub, making it a genuine aggregation layer rather than an AWS-only tool.
- Pairs naturally with Infrastructure as Code — Security Hub can be enabled programmatically via AWS CloudFormation or Terraform, fitting standard DevOps automation pipelines.