AWS Security Hub
Central security hub
Aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, and third-party tools in one place, and checks configurations against standards (AWS Foundational Best Practices, CIS) to produce a security score.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?No
- Serverless
- In examsCLF · SAA · SOA
Think of it asLike a security control room that brings every camera feed onto one screen.
When to use it
✓ Use it when
You need an overall view of security across many accounts.
✗ Avoid it when
Deep investigation of a single incident → Detective.
Common uses
- Security dashboard for the whole Organization
- CIS Benchmark compliance checks
- Automated remediation via EventBridge
What does it cost?
- Pricing model: Charged by the number of security checks, findings ingested, and resources assessed.
⚠️ Cost traps
Enabling every standard in every Region multiplies the number of checks; AWS Config is also required.
Related services
SAA-C03 study guide
Security Hub is covered in these study modules: