# AWS Security Hub

> One place where AWS gathers security alerts from many services and ranks them.

- Level: Intermediate
- Topics: AWS, Security
- URL: https://tidbit.legios.com.ar/aws-security-hub/
- In Spanish: [AWS Security Hub](https://tidbit.legios.com.ar/es/aws-security-hub/)

**AWS Security Hub** collects security findings from across your AWS accounts and puts them in a single view. Without it, a security team would have to check Amazon GuardDuty for threats, Amazon Inspector for vulnerable software and Amazon Macie for exposed sensitive data, each in its own console.

Today the name covers two related services. **Security Hub CSPM** (cloud security posture management) runs checks against standards such as the AWS Foundational Security Best Practices, CIS or PCI DSS, and reports which settings fail, like an S3 bucket open to the world or a root account without MFA. **Security Hub** sits on top: it correlates those failed checks with findings from the other services to spot **exposures**, combinations of problems that together make a resource actually reachable by an attacker, and helps you prioritize and respond. AWS recommends turning on both.

The point is triage. A large account can produce thousands of findings, and most teams cannot fix them all at once. Security Hub groups them, highlights what matters most, and can send them to tickets, chat or automated fixes through Amazon EventBridge.

## An analogy

The control room of a building, where the feeds from cameras, smoke detectors and door sensors land on one wall, and a supervisor decides which alarm deserves someone running to it first.

## Keep in mind

- Combines findings from GuardDuty, Inspector, Macie, posture checks and partner tools.
- Security Hub CSPM checks your settings against standards like CIS and PCI DSS.
- Security Hub correlates signals to rank real exposures, not just individual alerts.
- Findings can trigger tickets or automated remediation.

## Go deeper

- [Introduction to AWS Security Hub (official docs)](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub-v2.html)
- [What are Security Hub and Security Hub CSPM? (official docs)](https://docs.aws.amazon.com/securityhub/latest/userguide/what-are-securityhub-services.html)
- [AWS Security Hub product page](https://aws.amazon.com/security-hub/)

## Related terms

- [AWS account and billing](https://tidbit.legios.com.ar/aws-account-and-billing/): What an AWS account is, how you get charged, and how to avoid a surprise bill.
- [Amazon GuardDuty](https://tidbit.legios.com.ar/amazon-guardduty/): An AWS service that watches your account's activity and flags signs of an attack.
- [Amazon Inspector](https://tidbit.legios.com.ar/amazon-inspector/): An AWS service that keeps scanning your servers and code for known vulnerabilities.
- [Amazon Macie](https://tidbit.legios.com.ar/amazon-macie/): An AWS service that finds sensitive data in your S3 buckets and flags risky buckets.
- [Cloud computing](https://tidbit.legios.com.ar/cloud-computing/): Renting computers over the internet instead of buying your own.
- [Security compliance](https://tidbit.legios.com.ar/security-compliance/): Proving to customers and regulators, with an outside audit, that you follow security rules.
- [Amazon S3](https://tidbit.legios.com.ar/amazon-s3/): A giant online drawer for files, rented by the gigabyte.
- [Two-factor authentication](https://tidbit.legios.com.ar/two-factor-authentication/): A second proof that you are you, so a stolen password alone is not enough.