Security Hub, standards, and aggregation
Lesson 3 of 4 in Monitoring and Alerting.
Security Hub does two jobs, and keeping them separate in your head is most of what the exam wants.
It aggregates. Integrated AWS services — GuardDuty, Inspector, Macie, Config, IAM Access Analyzer, Firewall Manager, Detective, Systems Manager Patch Manager — and a long list of partner products send findings to it. A delegated administrator collapses the accounts; a finding aggregation Region collapses the Regions. The result is one list, with consistent severity and resource fields, for an entire organization.
It assesses. Enabling a security standard switches on that standard’s controls, which run continuous automated checks against your resources and report PASSED or FAILED, rolling up into a security score.
A great many questions in this domain are really asking you to tell four services apart. Learn the table below as four different questions, not four product descriptions, because that is the form the exam uses: it describes a question somebody needs answered and expects you to name the service whose job it is.
| Service | The question it answers | What it reads | What it emits |
|---|---|---|---|
GuardDuty | “Is someone attacking us right now?” | behaviour — API activity, network flows, DNS, runtime events | threat findings with a type and severity |
Amazon Inspector | “Is our software exploitable?” | inventory — EC2 instances, container images in ECR, Lambda functions and layers | vulnerability findings (CVEs) with a severity and a fix |
AWS Config | “Is this resource configured the way we said?” and “what did it look like last Tuesday?” | configuration — a configuration item per change | COMPLIANT / NON_COMPLIANT per rule, plus a configuration timeline |
Security Hub | “What is our overall posture, across every account and Region, in one list?” | findings from the other three plus partners — and its own standards checks | a normalized finding list, control statuses, and a security score |
Amazon Macie | “Where is our sensitive data, and is it exposed?” | S3 inventory and object content, via discovery jobs | sensitive-data and policy findings naming the bucket and object |
The standards catalogue is short enough to know. AWS Foundational Security Best Practices (FSBP) is AWS-curated, general-purpose, and the right default when a question says a team has no existing framework. CIS AWS Foundations Benchmark is the externally authored configuration benchmark. PCI DSS and NIST SP 800-53 Revision 5 exist so a compliance function can read posture in the language of its own obligations. As of October 2026 the catalogue also includes an AWS Resource Tagging standard and an AI Security Best Practices standard. A control that belongs to several enabled standards is checked once and charged once.
Three facts about controls carry disproportionate exam weight.
First, most controls are implemented with AWS Config rules underneath. That makes the Config configuration recorder a hard prerequisite: with recording off, controls do not fail — they report NO_DATA, and a dashboard full of NO_DATA looks calm. “Security Hub shows no failed controls but we know the bucket is public” is a recorder question, not a Security Hub question.
Second, the security score is relative to enabled controls. Disable the controls you keep failing and the number goes up while nothing improves. That is why a mature review reads the score next to the list of disabled controls, and why an exam option offering “disable the failing controls to meet the score target” is always wrong.
Third, a standard assesses; it does not enforce. FSBP will tell you a security group allows 0.0.0.0/0 on port 22 for as long as you leave it that way. Enforcement lives in service control policies, Config remediation, Firewall Manager and your deployment pipeline — Domain 6 territory.
Which service answers this question?
Interactive decision tree — outcomes:
- Amazon GuardDuty
Threat detection from behaviour, using foundational sources you never enable. Add the matching protection plan when the resource type is S3, EKS, RDS or Lambda.
- GuardDuty Runtime Monitoring
The agent-based plan. In-host process, file and network behaviour is invisible to every control-plane log, so this is the only option — and it is a separate plan with its own cost.
- CloudTrail Insights
Insights events model your own normal API call and error rates and flag deviation. Different question from GuardDuty: change relative to your history, not match against threat intelligence.
- Amazon Inspector
Continuous vulnerability scanning of EC2, ECR container images, and Lambda functions and layers, with CVE detail and remediation guidance. Not a threat detector — an exploitability assessment.
- AWS Config (rule + remediation)
A Config rule produces the verdict and its remediation action runs an SSM Automation runbook. Bundle rules as a conformance pack for organization-wide rollout.
- Systems Manager State Manager
An association re-applies the desired state on a schedule regardless of whether anything drifted — the right answer for keeping an agent installed and configured across a fleet.
- Prevention, not detection
Service control policies, resource control policies, permission boundaries, Firewall Manager, or a failing deployment check. Detection tells you afterwards; this domain’s honest answer is sometimes “the control belongs in Domain 6”.
- AWS Security Hub
Delegated administrator for the accounts, a finding aggregation Region for the Regions, central configuration so settings do not drift, and standards for continuous posture checks.
- Amazon Macie
Sensitive-data discovery over S3 with managed and custom data identifiers. It reports; it never redacts.
Rolling Security Hub out across an organization has two levers you should be able to name. Central configuration lets the delegated administrator write configuration policies — which standards are enabled, which controls are on — and attach them to the organization root, to OUs, or to individual accounts, with new accounts inheriting their OU’s policy. Accounts that genuinely need their own settings can be left self-managed. Without it, enabling Security Hub is per-account, per-Region work that drifts the week after rollout.
Cross-Region aggregation designates a home Region that receives findings and control statuses from linked Regions, with updates flowing back so resolving a finding centrally resolves it at source. Delegated admin collapses accounts; the aggregation Region collapses Regions; you generally want both.
Routing findings outward is where the lesson lands, because this is the part the C03 guide still cares about. Every Security Hub finding is an EventBridge event, so a rule matching on severity, finding type, account or resource tag can fan one finding out to a page, a ticket and an automation at once. Custom actions add the human-initiated path: an analyst viewing a finding picks a named action from the console, which emits a specific EventBridge event your rule is waiting for — “quarantine this instance”, “open a forensics case”. The combination is the pattern the exam rewards: automatic routing for what you have already decided, a custom action for the judgement call.
Key terms: AWS Security Hub (CSPM), Security standard, Security control (Security Hub), Security score, Central configuration, Finding aggregation Region
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.