skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-aws-security-hub

Deploy AWS Security Hub to aggregate findings and automate compliance across multi-account organizations.

954|172|Updated Mar 13, 2026
Search Tags:#cloud security#compliance automation#CSPM#CIS Benchmark#finding aggregation#aws security hub#eventbridge remediation
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-aws-security-hub
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-aws-security-hub
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/cloud-security/implementing-aws-security-hub
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-aws-security-hub

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Security teams managing multiple AWS accounts struggle to consolidate findings from GuardDuty, Inspector, Macie, and third-party tools into one view, and lack continuous compliance scoring against standards like CIS, PCI-DSS, and NIST.

Core Features & Use Cases

  • Centralized Finding Aggregation: Enable Security Hub with delegated administrator accounts, auto-enroll organization members, and consolidate findings across all regions.
  • Compliance Standards Automation: Activate CIS AWS Foundations Benchmark v5.0, AWS Foundational Security Best Practices, and PCI DSS v3.2.1 with automated control checks.
  • Automated Remediation: Connect Security Hub custom actions to EventBridge rules and Lambda functions for one-click or fully automated remediation of failed controls.
  • Use Case: An enterprise with 50 AWS accounts enables CIS Benchmark, discovers 340 failed controls, and uses EventBridge-driven remediation to fix recurring issues like public S3 access and missing CloudTrail configuration.

Quick Start

Enable AWS Security Hub in the delegated administrator account with the CIS AWS Foundations Benchmark and show me the current compliance score and top failed controls.

Frequently Asked Questions about implementing-aws-security-hub

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enable AWS Security Hub across multiple accounts?▼

Designate a delegated administrator account with enable-organization-admin-account, then run update-organization-configuration with auto-enable to enroll all organization members. Use create-finding-aggregator with ALL_REGIONS mode to consolidate findings into one region.

How to automate remediation of Security Hub findings?▼

Create a custom action target in Security Hub, then build an EventBridge rule matching Security Hub Findings - Imported events filtered by compliance status and severity. The rule triggers Lambda functions or Systems Manager Automation documents to remediate failed controls.

What compliance standards does AWS Security Hub support?▼

Security Hub CSPM supports CIS AWS Foundations Benchmark v5.0, AWS Foundational Security Best Practices, PCI DSS v3.2.1, and NIST SP 800-53. Standards are enabled via batch-enable-standards with the corresponding standards ARNs.

Does Security Hub replace GuardDuty for threat detection?▼

No, Security Hub aggregates and normalizes findings but does not perform real-time threat detection. GuardDuty, Inspector, and Macie must be activated separately and integrated as finding sources into Security Hub.

Why do automated remediations break production workloads?▼

Remediating controls like S3 public access blocking can disrupt workloads that legitimately require public access. Test remediation in a staging account first and roll out automated fixes gradually rather than enabling all controls at once.

Related Skills

Explore More Software Engineering Skills→
awsaws
2.5k

aws-security

Review AWS security service configurations and summarize findings using read-only CLI APIs.

Official
Advanced
webrix-aiwebrix-ai
1

cloud-security-posture-review

Review AWS, GCP, and Azure environments against CIS benchmarks and write scored findings to Google Sheets.

Official
Advanced
johngutierrez31johngutierrez31

cybersecurity-analyst

Analyze security events using threat modeling and zero-trust frameworks.

Community
Advanced
balsm-healthbalsm-health
2

implementing-cloud-security-posture-management

Automate continuous security posture monitoring across AWS, Azure, and GCP.

Official
Advanced