Security Hub is enabled with standards or integrations configured
securityhub_enabled
Severityhigh
Servicesecurityhub
AWS Security Hub is ACTIVE in the Region and has at least one enabled security standard or connected integration. Otherwise, it is either not enabled or enabled without standards/integrations.
Risk
Absent Security Hub coverage or standards, security signals are fragmented and control checks don't run. High-risk findings can be missed or delayed, enabling data exfiltration, persistence, and lateral movement. This reduces visibility and undermines confidentiality, integrity, and availability across accounts/Regions.
Run this check with Prowler CLI
prowler aws --checks securityhub_enabled
Fix finding with Prowler CLI
prowler aws --checks securityhub_enabled --fixer
Recommendation
- Enable in all required accounts/Regions
- Turn on relevant standards (
AWS FSBP,CIS) - Connect AWS and third-party integrations
- Use central configuration and least privilege
- Automate triage and monitor continuously for defense in depth
Remediation
Native IaC
Terraform
Other
- Open the AWS console and go to Security Hub
- If prompted (first use): click Enable Security Hub and keep the default standards selected, then choose Enable
- If Security Hub is already enabled: go to Security standards and enable AWS Foundational Security Best Practices
- Wait for the status to show Enabled
Source Code
Resource Type
Other