implementing-aws-security-hub-compliance

Enable Security Hub in the management account, designate a delegated administrator with enable-organization-admin-account, then run update-organization-configuration with --auto-enable so existing and new member accounts enroll automatically. Create a finding aggregator with ALL_REGIONS linking for cross-region consolidation.

Create an EventBridge rule matching Security Hub Findings - Imported events filtered by severity and compliance status, then target a Lambda function. The Lambda remediates the resource and must call batch_update_findings with Workflow.Status set to RESOLVED, or findings reappear as NEW.

Controls show No data when AWS Config is not recording in that account or region, since Security Hub controls evaluate Config items. Verify a running recorder per region with aws configservice describe-configuration-recorder-status and enable Config everywhere Security Hub runs.

No. Security Hub aggregates findings from GuardDuty, Inspector, Macie, and third-party tools but does not perform threat detection, vulnerability scanning, or data classification itself. Use GuardDuty for threat detection and Inspector for vulnerability scanning alongside Security Hub.

Security Hub supports CIS AWS Foundations Benchmark, AWS Foundational Security Best Practices, PCI DSS, and NIST 800-53. Enable them with batch-enable-standards using each standard's ARN, then track compliance scores per standard.