Implementing AWS Security Hub Compliance

When to Use

• When establishing centralized security posture management across multiple AWS accounts
• When compliance requirements demand continuous monitoring against CIS, PCI DSS, or NIST 800-53 standards
• When aggregating findings from GuardDuty, Inspector, Macie, Firewall Manager, and third-party tools
• When building automated remediation workflows triggered by security findings
• When executive stakeholders require a security compliance dashboard across the organization

Do not use for real-time threat detection (use GuardDuty), for vulnerability scanning (use Inspector), or for data classification (use Macie). Security Hub aggregates findings from these services but does not replace them.

Prerequisites

• AWS Organizations with delegated administrator for Security Hub
• IAM permissions for securityhub:*, config:*, events:*, and lambda:*
• AWS Config enabled in all target accounts and regions (required by Security Hub)
• CloudFormation StackSets or Terraform for multi-account deployment
• SNS topics configured for alert routing to security team

Workflow

Step 1: Enable Security Hub with Compliance Standards

Enable Security Hub in the management account and select compliance standards to evaluate.

# Enable Security Hub in the current account/region
aws securityhub enable-security-hub \
  --enable-default-standards \
  --control-finding-generator SECURITY_CONTROL

# Enable specific compliance standards
aws securityhub batch-enable-standards --standards-subscription-requests \
  '[
    {"StandardsArn": "arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"},
    {"StandardsArn": "arn:aws:securityhub:us-east-1::standards/cis-aws-foundations-benchmark/v/1.4.0"},
    {"StandardsArn": "arn:aws:securityhub:us-east-1::standards/pci-dss/v/3.2.1"},
    {"StandardsArn": "arn:aws:securityhub:us-east-1::standards/nist-800-53/v/5.0.0"}
  ]'

# Verify enabled standards
aws securityhub get-enabled-standards \
  --query 'StandardsSubscriptions[*].[StandardsArn,StandardsStatus]' --output table

Step 2: Configure Multi-Account Aggregation

Set up a delegated administrator and aggregate findings from all organization accounts.

# Designate a delegated admin (run from management account)
aws securityhub enable-organization-admin-account \
  --admin-account-id 111122223333

# From the delegated admin account, enable auto-enrollment
aws securityhub update-organization-configuration \
  --auto-enable \
  --auto-enable-standards DEFAULT

# Create a finding aggregator for cross-region aggregation
aws securityhub create-finding-aggregator \
  --region-linking-mode ALL_REGIONS

# List member accounts
aws securityhub list-members \
  --query 'Members[*].[AccountId,MemberStatus]' --output table

Step 3: Review Compliance Scores and Failed Controls

Query Security Hub for compliance posture across enabled standards and identify failing controls.

# Get overall compliance score for CIS benchmark
aws securityhub get-standards-control-associations \
  --security-control-id "IAM.1" \
  --query 'StandardsControlAssociationSummaries[*].[StandardsArn,AssociationStatus]' \
  --output table

# List all failed controls
aws securityhub get-findings \
  --filters '{
    "ComplianceStatus": [{"Value": "FAILED", "Comparison": "EQUALS"}],
    "RecordState": [{"Value": "ACTIVE", "Comparison": "EQUALS"}],
    "WorkflowStatus": [{"Value": "NEW", "Comparison": "EQUALS"}]
  }' \
  --sort-criteria '{"Field": "SeverityNormalized", "SortOrder": "desc"}' \
  --max-items 50 \
  --query 'Findings[*].[Title,Severity.Label,Compliance.Status,Resources[0].Id]' \
  --output table

# Get finding counts by severity
aws securityhub get-insight-results \
  --insight-arn "arn:aws:securityhub:us-east-1:111122223333:insight/111122223333/default/2"

Step 4: Create Custom Security Insights

Build custom insights to track organization-specific security priorities.

# Create insight for publicly accessible resources
aws securityhub create-insight \
  --name "Publicly Accessible Resources" \
  --filters '{
    "ResourceType": [
      {"Value": "AwsS3Bucket", "Comparison": "EQUALS"},
      {"Value": "AwsEc2SecurityGroup", "Comparison": "EQUALS"},
      {"Value": "AwsRdsDbInstance", "Comparison": "EQUALS"}
    ],
    "ComplianceStatus": [{"Value": "FAILED", "Comparison": "EQUALS"}],

…