AWS Security Hub
One place where AWS gathers security alerts from many services and ranks them.
AWS Security Hub collects security findings from across your AWS accounts and puts them in a single view. Without it, a security team would have to check Amazon GuardDuty for threats, Amazon Inspector for vulnerable software and Amazon Macie for exposed sensitive data, each in its own console.
Today the name covers two related services. Security Hub CSPM (cloud security posture management) runs checks against standards such as the AWS Foundational Security Best Practices, CIS or PCI DSS, and reports which settings fail, like an S3 bucket open to the world or a root account without MFA. Security Hub sits on top: it correlates those failed checks with findings from the other services to spot exposures, combinations of problems that together make a resource actually reachable by an attacker, and helps you prioritize and respond. AWS recommends turning on both.
The point is triage. A large account can produce thousands of findings, and most teams cannot fix them all at once. Security Hub groups them, highlights what matters most, and can send them to tickets, chat or automated fixes through Amazon EventBridge.
Keep in mind
- Combines findings from GuardDuty, Inspector, Macie, posture checks and partner tools.
- Security Hub CSPM checks your settings against standards like CIS and PCI DSS.
- Security Hub correlates signals to rank real exposures, not just individual alerts.
- Findings can trigger tickets or automated remediation.
Go deeper
- Introduction to AWS Security Hub (official docs)
- What are Security Hub and Security Hub CSPM? (official docs)
- AWS Security Hub product page
