Security Hub overview in AWS - Commands & Configuration

Introduction

Security Hub helps you see and manage security alerts from many AWS services in one place. It collects findings and shows you where your cloud setup might have security problems.

When you want to check your AWS account for security issues regularly without logging into many different services.

When you need a single dashboard to see all security alerts from AWS services like GuardDuty, Inspector, and Macie.

When you want to automate security checks and get recommendations to fix problems.

When you manage multiple AWS accounts and want to see their security status in one place.

When you want to follow AWS best practices for cloud security and compliance.

Commands

This command turns on Security Hub in your AWS account so it can start collecting security findings.

Terminal

aws securityhub enable-security-hub

Expected Output

{"HubArn": "arn:aws:securityhub:us-east-1:123456789012:hub/default", "SubscribedAt": "2024-06-01T12:00:00Z"}

This command retrieves the current security findings that Security Hub has collected for your account.

Terminal

aws securityhub get-findings

Expected Output

{"Findings": []}

This command enables a security standard, like the CIS AWS Foundations Benchmark, which provides automated checks and recommendations.

Terminal

aws securityhub batch-enable-standards --standards-subscription-requests StandardsArn=arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0

Expected Output

{"StandardsSubscriptions": [{"StandardsSubscriptionArn": "arn:aws:securityhub:us-east-1:123456789012:subscription/cis-aws-foundations-benchmark", "StandardsArn": "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0", "Status": "ENABLED"}]}

→

--standards-subscription-requests - Specifies which security standards to enable

This command turns off Security Hub in your AWS account when you no longer want to use it.

Terminal

aws securityhub disable-security-hub

Expected Output

No output (command runs silently)

Key Concept

If you remember nothing else from this pattern, remember: Security Hub collects and shows all your AWS security alerts in one easy place.

Common Mistakes

Trying to get findings before enabling Security Hub

Security Hub must be enabled first to collect any security data, otherwise the get-findings command returns empty.

Always run 'aws securityhub enable-security-hub' before retrieving findings.

Not enabling security standards after turning on Security Hub

Without enabling standards, Security Hub won't run automated checks or provide recommendations.

Use 'aws securityhub batch-enable-standards' to activate useful security checks.

Summary

Enable Security Hub to start collecting security alerts in your AWS account.

Retrieve security findings to see current issues and alerts.

Enable security standards to get automated security checks and recommendations.

Disable Security Hub when you no longer need centralized security monitoring.