Security Hub CSPM
- Docs: https://docs.aws.amazon.com/securityhub/latest/userguide/
- Docs (llms.txt): https://docs.aws.amazon.com/securityhub/latest/userguide/llms.txt
AWS Security Hub CSPM (Cloud Security Posture Management) evaluates AWS resource configurations against AWS and industry compliance standards. It uses ASFF format and provides automation rules, custom actions, and organization-wide configuration policies. It also receives findings from GuardDuty, Inspector, and Macie in ASFF format.
Data Sources
Security Hub CSPM receives:
- AWS Config evaluations (compliance checks against standards)
- GuardDuty findings (in ASFF format)
- Inspector findings (in ASFF format)
- Macie findings (in ASFF format)
- Third-party findings (via
BatchImportFindingsAPI, ASFF format)
CSPM generates its own compliance findings by evaluating resources against enabled standards.
Operator prerequisites
Prerequisite: Operator must assume an IAM role with least-privilege read-only permissions. Scope permissions to the actions listed in the Read-Only APIs table; avoid FullAccess managed policies and securityhub:* wildcards. Do not use long-lived IAM user access keys.
Available Standards
Discover enabled and available standards dynamically:
# List currently enabled standards
aws securityhub get-enabled-standards
# List all available standard definitions
aws securityhub describe-standardsDo not rely on a static standards list in this reference. Use describe-standards output as the authoritative source for current names, versions, ARNs, and regional availability.
Always use describe-standards to discover the current standards list before naming specific standard versions or ARNs.
API Convention
Security Hub CSPM APIs share the aws securityhub CLI namespace with Security Hub V2 but do NOT have a -v2 suffix. All APIs in this file are unsuffixed. V2 APIs (with -v2 suffix) are in references/security-hub.md. Shared APIs (used by both) are listed separately below.
Read-Only APIs
CSPM APIs (V1 — ASFF)
| API | Purpose |
|---|---|
securityhub:DescribeHub |
Check if Security Hub CSPM is enabled and get hub details |
securityhub:GetEnabledStandards |
List enabled compliance standards |
securityhub:DescribeStandards |
List all available standard definitions |
securityhub:DescribeStandardsControls |
List controls for a standard |
securityhub:ListSecurityControlDefinitions |
Get security control definitions |
securityhub:BatchGetSecurityControls |
Batch check specific controls |
securityhub:DescribeActionTargets |
List custom actions |
securityhub:ListAutomationRules |
List V1 automation rules |
securityhub:BatchGetAutomationRules |
Get automation rule details |
securityhub:GetFindings |
Get ASFF findings with filters |
securityhub:ListMembers |
List member accounts (org + invitation) |
securityhub:ListInvitations |
List pending invitations |
Shared APIs (used by both V1 and V2)
| API | Purpose |
|---|---|
securityhub:DescribeOrganizationConfiguration |
Get org enrollment settings |
securityhub:ListConfigurationPolicies |
List configuration policies |
securityhub:GetConfigurationPolicy |
Get specific policy details |
securityhub:ListConfigurationPolicyAssociations |
Check policy target associations |
Severity Scoring
CSPM compliance findings use the same normalized severity as Security Hub:
| Label | Meaning for Compliance |
|---|---|
| INFORMATIONAL | Control passed or not applicable |
| LOW | Non-critical control failed |
| MEDIUM | Moderate-risk control failed |
| HIGH | High-risk control failed |
| CRITICAL | Critical control failed (e.g., root account without MFA) |
Key notes:
- Severity is assigned per control definition, not per resource
- The same control failure has the same severity regardless of which account it appears in
- Enabled standards define severity per control; use
describe-standards-controlsfor the current control metadata
Security Check
See SKILL.md Security considerations for CloudTrail audit logging, CloudWatch anomaly alarms, KMS/TLS encryption, SNS recipient validation, and current AWS security best-practice references.
Service Notes
No service-specific notes.
Output Sensitivity
Security Hub CSPM findings (GetFindings ASFF) contain:
- AWS account IDs and resource ARNs across the organization
- Resource configuration details (security group rules, IAM policies, encryption settings)
- Compliance standard and control identifiers
- Third-party integration findings (GuardDuty, Inspector, Macie in ASFF format)
- Automation rule configurations and suppression logic
Present compliance pass/fail rates and severity distribution first. Offer full ASFF finding bodies on request. Avoid logging raw ASFF finding or configuration responses in plaintext, store exported CSPM data only in downstream destinations encrypted at rest, and transmit exported data only over encrypted channels such as TLS. If logging to CloudWatch Logs, verify the log group is encrypted with a KMS key. If CSPM findings or automation outputs are forwarded to SNS topics or S3 buckets, verify those destinations use KMS encryption and resource policies include aws:SourceArn and aws:SourceAccount condition keys.