AWS Security Hub CSPM Setup: $0.001/Check, 12 Steps [2026]

AWS Security Hub turned into a genuinely different product this year. What used to be a finding aggregator that dumped GuardDuty, Inspector, Macie, and Config alerts into one dashboard is now billed as an “AI and multicloud security control plane,” according to reporting from SiliconANGLE in July 2026. The pricing model changed, the partner ecosystem tripled, and the setup steps that worked in 2024 no longer match the console you’ll see today. This tutorial walks through standing up AWS Security Hub CSPM from scratch, in a multi-account AWS Organizations environment, with the current 2026 pricing tiers, the delegated administrator pattern AWS now recommends, and the Security Hub Extended partner catalog that launched earlier this year.

By the end, you’ll have Security Hub CSPM enabled across a management account and at least one member account, a working delegated administrator, three compliance standards active, and an automation rule routing high-severity findings to Slack or email. Budget about 90 minutes if you’re following along in a sandbox AWS account, longer if you’re rolling this out across a real Organization with dozens of member accounts.

What AWS Security Hub CSPM Actually Does in 2026

Security Hub CSPM is AWS’s cloud security posture management service. It runs continuous configuration checks against your AWS resources, compares them to security standards like the CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices (FSBP), and rolls the results into a security score per account. It also ingests findings from GuardDuty (threat detection), Inspector (vulnerability scanning), Macie (data classification), and AWS Config (configuration drift), normalizing everything into the Open Cybersecurity Schema Framework (OCSF) so a SOC analyst can triage one queue instead of five consoles.

What changed in the CSPM rebrand is the deduplication logic. AWS’s own pricing documentation states plainly: “You are only charged once for a check when identical controls that are common across different standards are evaluated against the same resource,” according to the AWS Security Hub CSPM pricing page. Under the old model, enabling CIS, PCI DSS, and FSBP simultaneously meant paying for overlapping checks three times over. That’s gone now, which matters a lot once you’re running Security Hub across a 50-account Organization.

The other big shift is scope. Security Hub in 2026 isn’t purely an AWS product anymore. Coverage now extends to Azure resources through the same per-resource pricing model, positioning it as a control plane that spans clouds rather than a single-provider tool. If your organization runs a hybrid AWS-Azure footprint, that’s worth knowing before you commit to a competing CSPM vendor for the Azure side.

Prerequisites and Versions

Before you start, confirm you have the following in place. Security Hub CSPM depends on several other AWS services being enabled first, and skipping this step is the single most common reason people get stuck halfway through setup.

• An AWS account with administrator-level IAM permissions (or a role with SecurityHubFullAccess plus AWSConfigRole attached)
• AWS Config enabled in every Region and account where you plan to run Security Hub checks — this is a hard requirement, not optional
• AWS CLI v2 installed and configured (run aws --version to confirm; if you’re on CLI v1, upgrade first since several Security Hub CSPM subcommands aren’t backported)
• Python 3.9+ with boto3 1.34 or newer if you plan to script the multi-account rollout
• AWS Organizations set up if you’re deploying across more than one account (strongly recommended even for small teams)
• A dedicated security-tooling account to serve as the delegated administrator, separate from your Organization’s management account
• Billing alerts or a budget threshold configured, since Security Hub CSPM has no free tier for security checks themselves

One prerequisite trips up more people than any other: AWS Config must be running before Security Hub CSPM will generate a single finding. If Config isn’t recording resources in a Region, Security Hub silently shows zero checks there instead of throwing a clear error, which looks like the service is broken when it’s actually just waiting on a dependency.

Step 1: Enable AWS Config First

Start in the account and Region where you’ll run your first Security Hub checks. Open the AWS Config console, or run this from the CLI:

aws configservice put-configuration-recorder 
  --configuration-recorder name=default,roleARN=arn:aws:iam::123456789012:role/aws-service-role/config.amazonaws.com/AWSServiceRoleForConfig 
  --recording-group allSupported=true,includeGlobalResourceTypes=true

aws configservice start-configuration-recorder 
  --configuration-recorder-name default

Verify the recorder is active before moving on:

aws configservice describe-configuration-recorder-status 
  --configuration-recorder-names default

Look for "recording": true in the output. If you skip this and jump straight to enabling Security Hub, you’ll enable the service successfully, see standards listed as “enabled,” and then wait indefinitely for findings that never arrive.

Step 2: Enable Security Hub CSPM in Your First Account

With Config running, enable Security Hub itself. In the console, this means navigating to Security Hub and clicking “Go to Security Hub,” then “Enable Security Hub.” Via CLI:

aws securityhub enable-security-hub 
  --enable-default-standards 
  --region us-east-1

The --enable-default-standards flag turns on AWS Foundational Security Best Practices and CIS AWS Foundations Benchmark automatically. If you’d rather choose standards manually — useful if you only need PCI DSS for a specific workload — drop that flag and enable standards individually in the next step.

Give it 5-10 minutes. The first batch of security checks runs asynchronously, and the console will show a spinner on the summary dashboard until initial results populate.

Step 3: Enable Additional Compliance Standards

Most teams need more than the default two standards. List what’s available and subscribe to the ones your compliance program requires:

aws securityhub describe-standards

aws securityhub batch-enable-standards 
  --standards-subscription-requests 
  StandardsArn=arn:aws:securityhub:us-east-1::standards/pci-dss/v/3.2.1 
  StandardsArn=arn:aws:securityhub:us-east-1::standards/nist-800-53/v/5.0.0

Because CSPM pricing deduplicates overlapping checks across standards, adding PCI DSS and NIST 800-53 on top of FSBP and CIS costs far less than it did under the old per-standard billing model. You’re not paying four times for the same underlying resource check just because four standards happen to reference it.

Step 4: Designate a Delegated Administrator Account

This is the step that separates a real production rollout from a single-account demo. From your AWS Organizations management account, designate a dedicated security-tooling account as the Security Hub delegated administrator. Never use the management account itself for this — AWS’s own guidance and general security best practice both steer you toward a separate, locked-down account.

# Run from the Organizations management account
aws securityhub enable-organization-admin-account 
  --admin-account-id 111122223333

Then switch to that delegated administrator account (111122223333 in the example) to configure organization-wide settings:

aws securityhub update-organization-configuration 
  --auto-enable true 
  --auto-enable-standards DEFAULT

With auto-enable turned on, every new account that joins your Organization automatically gets Security Hub CSPM and the default standards, so you’re not manually onboarding accounts one at a time as your Organization grows.

Step 5: Turn On Central Configuration

Central configuration lets the delegated administrator push standards, controls, and automation rules to member accounts from one place instead of logging into each account individually. From the delegated administrator account:

aws securityhub update-security-hub-configuration 
  --auto-enable-controls true

aws securityhub create-configuration-policy 
  --name "org-baseline-policy" 
  --configuration-policy '{
    "securityHub": {
      "serviceEnabled": true,
      "enabledStandardIdentifiers": [
        "standards/aws-foundational-security-best-practices/v/1.0.0",
        "standards/cis-aws-foundations-benchmark/v/1.4.0"
      ]
    }
  }'

Associate that policy with an Organizational Unit (OU) in the console under Settings > Configuration > Policies, and every account under that OU inherits the same baseline without further manual work on your end.

Step 6: Understand the 2026 Pricing Model Before You Scale

Security Hub CSPM pricing has two dimensions: security checks and finding ingestion events. Neither has a free trial period — billing starts on your very first check. There is, however, a perpetual free tier on ingestion: the first 10,000 finding ingestion events per account per Region per month cost nothing, and findings generated by Security Hub’s own native checks never incur ingestion charges at all, according to the official AWS Security Hub pricing page.

Billing Component	Tier	Price
Security checks	First 100,000/account/Region/month	$0.0010 per check
Security checks	Next 400,000/account/Region/month	$0.0008 per check
Security checks	Over 500,000/account/Region/month	$0.0005 per check
Finding ingestion events	First 10,000/account/Region/month	Free
Finding ingestion events	Over 10,000/account/Region/month	$0.00003 per event
Native Security Hub check findings	Any volume	Free (no ingestion charge)

Notice the deduplication rule again here: a control that’s shared across CIS, FSBP, and PCI DSS only bills once per resource evaluation, not three times. That’s the single biggest pricing change from the pre-CSPM era, and it’s why AWS can now push multi-standard compliance without the bill tripling for every standard you add.

Step 6b: Deploy Security Hub as Code With Terraform

Clicking through the console works for a single sandbox account, but nobody rolls Security Hub out across a real Organization by hand, account by account. Once you’ve validated the setup manually in steps 1 through 5, the next move is codifying it so every new account picks up the same baseline automatically. Here’s a minimal Terraform module that enables Security Hub, subscribes to two standards, and wires up a finding aggregator in a single account:

resource "aws_securityhub_account" "main" {
  enable_default_standards = true
}

resource "aws_securityhub_standards_subscription" "pci_dss" {
  depends_on    = [aws_securityhub_account.main]
  standards_arn = "arn:aws:securityhub:us-east-1::standards/pci-dss/v/3.2.1"
}

resource "aws_securityhub_standards_subscription" "nist" {
  depends_on    = [aws_securityhub_account.main]
  standards_arn = "arn:aws:securityhub:us-east-1::standards/nist-800-53/v/5.0.0"
}

resource "aws_securityhub_finding_aggregator" "org_aggregator" {
  depends_on          = [aws_securityhub_account.main]
  linking_mode        = "ALL_REGIONS"
}

resource "aws_securityhub_automation_rule" "critical_findings" {
  depends_on  = [aws_securityhub_account.main]
  rule_name   = "route-critical-findings"
  rule_order  = 1
  is_terminal = false

  criteria {
    severity_label {
      comparison = "EQUALS"
      value      = "CRITICAL"
    }
  }

  actions {
    type = "FINDING_FIELDS_UPDATE"
    finding_fields_update {
      workflow {
        status = "NOTIFIED"
      }
    }
  }
}

Wrap this module in a Terraform workspace per account, or better, deploy it through AWS Organizations’ StackSets equivalent for Terraform (Terraform Cloud’s no-code provisioning, or a CI pipeline that iterates over an account list). The depends_on chains matter here — Security Hub’s standards subscriptions and automation rules will fail if they’re created before the account-level aws_securityhub_account resource finishes provisioning, and Terraform won’t infer that ordering automatically from resource references alone in every provider version.

If your team already manages infrastructure with AWS CDK instead of Terraform, the same resources exist as CfnHub, CfnStandard, and CfnAutomationRule constructs in the aws-cdk-lib.aws_securityhub module, and the dependency ordering rules are identical.

Sample Monthly Cost Breakdown for a Mid-Size Organization

Pricing tiers are easy to read and hard to estimate against a real environment until you run the numbers for a specific account count. Here’s a worked example for a 20-account AWS Organization running three standards (FSBP, CIS, and PCI DSS) with moderate GuardDuty and Inspector noise feeding into Security Hub.

Cost Driver	Monthly Volume	Rate	Estimated Cost
Security checks (deduplicated across 3 standards)	~180,000 checks/account × 20 accounts	$0.0010 (first 100K), $0.0008 (next 400K)	~$3,168/month
Native Security Hub finding ingestion	Unlimited	Free	$0
GuardDuty/Inspector findings ingested (above free tier)	~35,000 events/account above 10K free	$0.00003/event	~$21/month
Security Hub Extended (2 partner solutions, 150 resources)	150 resources × 2 partners	~$3.75/resource/month	~$1,125/month
Estimated total	—	—	~$4,314/month

Two line items dominate this estimate: the raw check volume across 20 accounts and three standards, and any Security Hub Extended partner solutions you’ve layered on top. The check volume scales roughly linearly with account count, so a 50-account Organization running the same three standards should expect security-check costs in the $7,500-$8,000 range before Extended add-ons. If that number surprises you, it’s usually because teams underestimate how many resources (EC2 instances, S3 buckets, IAM roles, security groups) each account actually has — every one of them gets evaluated against every applicable control in every enabled standard, every day.

The good news is the deduplication rule caps the downside. Before the CSPM pricing model, adding a fourth or fifth standard could multiply your bill by roughly the number of standards enabled, since each standard’s checks were billed independently even when they evaluated the same underlying control. Under CSPM pricing, a shared control across FSBP, CIS, and PCI DSS is billed once, so the marginal cost of adding a fourth standard is usually much smaller than the cost of the first three combined — you’re mostly paying for the standard-specific checks that don’t overlap with anything you already enabled.

Monitoring Security Hub Findings With Dashboards and SIEM Integration

Security Hub’s built-in summary dashboard is fine for a quick health check, but most security teams pipe findings somewhere with better querying, longer retention, and correlation against other log sources. The standard pattern uses EventBridge as the fan-out point, since Security Hub publishes every finding change as an EventBridge event by default once Security Hub is enabled.

aws events put-rule 
  --name "securityhub-to-siem" 
  --event-pattern '{
    "source": ["aws.securityhub"],
    "detail-type": ["Security Hub Findings - Imported"],
    "detail": {
      "findings": {
        "Severity": {
          "Label": ["CRITICAL", "HIGH"]
        }
      }
    }
  }'

aws events put-targets 
  --rule "securityhub-to-siem" 
  --targets "Id"="1","Arn"="arn:aws:firehose:us-east-1:111122223333:deliverystream/securityhub-to-splunk"

This pattern routes only CRITICAL and HIGH severity findings to a Kinesis Firehose stream feeding Splunk, Datadog, or an equivalent SIEM, keeping the noisier LOW and INFORMATIONAL findings inside Security Hub’s own console rather than paying to ship them somewhere else. If your team already runs a SIEM with an AWS-native EventBridge or Kinesis integration, this is almost always less work than configuring a Security Hub Extended partner just for log shipping.

For teams that want visualization inside AWS itself rather than a third-party SIEM, Security Hub findings can also feed Amazon QuickSight through Athena queries against a Security Lake subscription, giving you a native dashboard with drill-down by account, Region, standard, and severity without exporting data outside AWS at all. This matters for organizations with data residency requirements that make shipping security findings to an external SaaS SIEM a compliance question rather than a purely technical one.

Step 7: Enable Security Hub Extended for Partner Coverage (Optional)

In May 2026, AWS launched Security Hub Extended, a curated marketplace of partner security products sold through a single AWS bill. It started at 21 solutions across nine categories and grew to 23 curated partner solutions after AWS added supply-chain security coverage in August 2026, according to the AWS What’s New announcement. Partners in the catalog include SentinelOne for endpoint protection, CyberArk for identity, Varonis for data security, and Zenity for AI security — all billed per-resource-per-month, all eligible for Enterprise Discount Program pricing, and all with no long-term commitment required.

To browse and enable an Extended partner solution, go to Security Hub > Integrations > Extended in the console. Each listing shows a 30-day unlimited free trial for new customers, which is worth using before you commit a production account to a specific vendor’s checks.

This step is genuinely optional. If you only need native AWS coverage — GuardDuty, Inspector, Macie, Config — skip Extended entirely and move to automation rules. Extended exists for teams that want a single AWS invoice to cover third-party tooling too, not as a required part of core CSPM setup.

Step 8: Create Automation Rules to Route Findings

Raw findings in a console nobody checks daily are worthless. Automation rules let you route critical and high-severity findings to EventBridge, which can then trigger a Lambda function, an SNS topic, or a Slack webhook.

aws securityhub create-automation-rule 
  --rule-name "route-critical-findings" 
  --description "Send critical/high severity findings to SNS" 
  --rule-order 1 
  --is-terminal false 
  --criteria '{
    "SeverityLabel": [{"Value": "CRITICAL", "Comparison": "EQUALS"}]
  }' 
  --actions '[{
    "Type": "FINDING_FIELDS_UPDATE",
    "FindingFieldsUpdate": {
      "Note": {"Text": "Auto-flagged for immediate triage", "UpdatedBy": "automation-rule"},
      "Workflow": {"Status": "NOTIFIED"}
    }
  }]'

Pair this with an EventBridge rule watching for Security Hub findings with a CRITICAL or HIGH severity label, targeting an SNS topic subscribed to your on-call Slack channel. This is where Security Hub stops being a dashboard you occasionally check and becomes part of your actual incident response pipeline.

Step 9: Verify Cross-Account Aggregation Is Working

From the delegated administrator account, confirm findings from member accounts are actually flowing in:

aws securityhub get-findings 
  --filters '{"RecordState":[{"Value":"ACTIVE","Comparison":"EQUALS"}]}' 
  --max-results 20 
  --query 'Findings[*].[AwsAccountId,Title,Severity.Label]' 
  --output table

You should see a mix of account IDs in the output, not just the delegated administrator’s own account. If you only see findings from one account, double-check that member accounts have Config enabled and that the organization configuration policy actually associated with the OU those accounts sit in — a mismatched OU association is the most common cause of “member account findings just aren’t showing up.”

Step 10: Set Up Cross-Region Aggregation

If your workloads span multiple Regions, you don’t want to check five different Security Hub consoles every morning. Designate one Region as your aggregation Region:

aws securityhub create-finding-aggregator 
  --region-linking-mode ALL_REGIONS 
  --region us-east-1

Use ALL_REGIONS if you want everything linked automatically, or SPECIFIED_REGIONS with a region list if you only operate in a handful of Regions and don’t want Security Hub polling ones you’ve never touched. Note that CSPM pricing is still applied per account per Region under the hood — aggregation changes where you view findings, not how the bill is calculated.

Step 11: Understand What Security Hub Is (and Isn’t) Detecting

A source of confusion for teams new to Security Hub: it doesn’t do its own threat detection, vulnerability scanning, or data classification. It aggregates and correlates findings from services that do.

Service	What It Detects	Billed Separately?
GuardDuty	Threat detection — malware, compromised credentials, anomalous API calls	Yes
Inspector	Vulnerability scanning for EC2, ECR images, Lambda functions	Yes
Macie	Sensitive data discovery and classification in S3	Yes
AWS Config	Configuration drift and compliance rule evaluation	Yes
Security Hub CSPM	Aggregation, correlation, scoring, and native posture checks	Charged per check/ingestion event

If you enable Security Hub without also enabling GuardDuty and Inspector, you’re only getting Security Hub’s own native configuration checks — you’re missing threat detection and vulnerability scanning entirely. This is a design decision, not a bug, but it catches people who assume “enabling Security Hub” means “enabling everything security-related in AWS.”

Common Pitfalls When Setting Up Security Hub CSPM

Five mistakes account for most of the support tickets and forum posts about Security Hub setup going wrong.

• Enabling Security Hub before AWS Config. The service accepts the enable command fine, then sits at zero findings indefinitely with no error message pointing you to the actual cause.
• Using the Organizations management account as the delegated administrator. This works technically but violates the principle of least privilege and makes your most sensitive account a bigger target. Use a dedicated security-tooling account instead.
• Enabling every standard at once without checking the deduplication math. While overlapping controls are deduplicated, standards with genuinely unique controls (like PCI DSS-specific checks) still add real check volume. Model your expected monthly bill before enabling four or five standards across 50+ accounts.
• Forgetting that member accounts need Config enabled individually. Turning on Security Hub CSPM organization-wide doesn’t retroactively enable AWS Config in every member account if Config wasn’t already running there.
• Ignoring the free-tier boundary on finding ingestion. Teams that connect several third-party tools to Security Hub via the Extended catalog can blow past the 10,000 free ingestion events per account per Region far faster than expected, especially in noisy environments with a lot of low-severity Inspector findings.

Comparing Security Hub to GuardDuty, Macie, and Third-Party CSPM Tools

Teams evaluating Security Hub often ask whether they still need standalone GuardDuty or a third-party CSPM platform. The honest answer: Security Hub complements native AWS detection services, it doesn’t replace them, and it competes with (rather than replaces) dedicated multicloud CSPM vendors if your footprint spans more than AWS and Azure.

Capability	Security Hub CSPM	Standalone GuardDuty	Third-party multicloud CSPM
Native AWS posture checks	Yes	No	Varies by vendor
Threat detection	Aggregates only	Yes, native	Varies
Multicloud coverage (AWS + Azure)	Yes, as of 2026	No	Often yes, broader (GCP too)
Single AWS bill	Yes	Yes	No, separate vendor billing
OCSF-normalized findings	Yes	N/A	Varies

For teams already committed to AWS as a primary cloud, Security Hub CSPM is the lowest-friction way to get unified posture visibility without adding a new vendor relationship. For organizations running a genuinely multi-cloud stack across AWS, Azure, and GCP with heavy compliance requirements, a dedicated third-party CSPM platform may still offer broader coverage than AWS’s current two-cloud scope.

Real-World Walkthrough: Triaging a Critical Finding

Reading pricing tables and CLI commands only gets you so far. Here’s what the actual triage flow looks like once Security Hub is live and catches something real. Say GuardDuty flags anomalous API activity on an EC2 instance — a credential that started making calls from an unfamiliar geographic region. That finding lands in GuardDuty first, then flows into Security Hub within a few minutes as an imported finding, tagged with the original GuardDuty severity and enriched with the account, Region, and resource ARN.

Because you configured the automation rule from Step 8 earlier, that CRITICAL-severity finding immediately gets its workflow status updated to NOTIFIED and triggers the EventBridge rule feeding your SIEM or Slack channel. A security analyst opens the finding in the Security Hub console, sees not just the GuardDuty alert but also any related Inspector findings on the same instance (an unpatched CVE, for instance) and any Config findings showing the instance’s security group allows broader ingress than the baseline policy permits. That correlation — one compromised-credential alert plus one unpatched vulnerability plus one overly permissive security group, all on the same resource — is exactly the kind of picture that’s hard to piece together by checking GuardDuty, Inspector, and Config consoles separately under time pressure.

After remediation — rotating the credential, patching the CVE, tightening the security group — the analyst updates the finding’s workflow status to RESOLVED via batch-update-findings, with a note documenting what was done. That note becomes part of the audit trail Security Hub retains, which is exactly the kind of evidence a PCI DSS or SOC 2 auditor asks for months later: not just that a control existed, but that it caught something and someone acted on it within a defined window.

Where Security Hub Fits Into a Broader Compliance Program

Security Hub CSPM is a tool, not a compliance program by itself, and it’s worth being direct about that distinction before a security team leans on it as their entire audit story. Enabling the PCI DSS standard in Security Hub tells you whether your AWS resource configurations match PCI DSS’s technical controls — encrypted storage, restricted network access, logging enabled, and so on. It does not, by itself, cover the procedural and organizational requirements auditors also check: documented incident response plans, access review cadences, vendor risk assessments, and employee security training records. Teams that treat a green Security Hub score as “we’re PCI compliant” tend to have an uncomfortable conversation with their QSA during the actual audit.

What Security Hub does provide is continuous evidence generation for the technical control subset of a compliance framework, which is genuinely valuable — it replaces a quarterly manual configuration review with a daily automated one, and the finding history gives you a timestamped record of when a control started failing and when it was fixed. Pair that continuous evidence with a governance, risk, and compliance (GRC) platform that tracks the procedural side, and Security Hub becomes the technical backbone of an audit story rather than the whole story. Several Security Hub Extended partners specifically target this gap, offering GRC workflow layers that consume Security Hub findings and map them to specific audit framework requirements automatically.

Building the Complete Project: A Security Operations Baseline

Putting the steps above together, here’s what a complete, working Security Hub CSPM deployment looks like for a small-to-midsize AWS Organization with a handful of accounts.

#!/bin/bash
# security-hub-org-baseline.sh
# Run from the Organizations management account first, then the delegated admin account

set -e

ADMIN_ACCOUNT_ID="111122223333"
REGION="us-east-1"

echo "Step 1: Designating delegated administrator..."
aws securityhub enable-organization-admin-account 
  --admin-account-id "$ADMIN_ACCOUNT_ID"

echo "Step 2: Waiting for delegation to propagate..."
sleep 30

echo "Step 3: Enabling org-wide auto-enable with default standards..."
aws securityhub update-organization-configuration 
  --auto-enable true 
  --auto-enable-standards DEFAULT 
  --region "$REGION"

echo "Step 4: Creating cross-region finding aggregator..."
aws securityhub create-finding-aggregator 
  --region-linking-mode ALL_REGIONS 
  --region "$REGION"

echo "Step 5: Enabling additional compliance standards..."
aws securityhub batch-enable-standards 
  --standards-subscription-requests 
  StandardsArn="arn:aws:securityhub:${REGION}::standards/pci-dss/v/3.2.1" 
  --region "$REGION"

echo "Step 6: Creating automation rule for critical findings..."
aws securityhub create-automation-rule 
  --rule-name "route-critical-findings" 
  --rule-order 1 
  --is-terminal false 
  --criteria '{"SeverityLabel":[{"Value":"CRITICAL","Comparison":"EQUALS"}]}' 
  --actions '[{"Type":"FINDING_FIELDS_UPDATE","FindingFieldsUpdate":{"Workflow":{"Status":"NOTIFIED"}}}]' 
  --region "$REGION"

echo "Security Hub CSPM baseline deployment complete."

Run this after Config is confirmed active in every target account and Region. The script is idempotent for the standards subscription and automation rule steps, but re-running enable-organization-admin-account against an account that’s already delegated will return an error, which is expected and safe to ignore on reruns.

Expected Output When Everything Works

A healthy Security Hub deployment shows a specific pattern in the console and CLI. Running aws securityhub get-findings against a working setup returns output resembling this:

-------------------------------------------------------
|                     GetFindings                       |
+------------------+---------------------------+--------+
|  222233334444    |  S3 bucket allows public   | HIGH   |
|                   |  read access                |        |
+------------------+---------------------------+--------+
|  333344445555    |  IAM user has no MFA       | MEDIUM |
|                   |  enabled                    |        |
+------------------+---------------------------+--------+
|  111122223333    |  Security group allows     | CRITICAL|
|                   |  unrestricted SSH access    |        |
+------------------+---------------------------+--------+

Multiple account IDs appearing in one query confirms cross-account aggregation is functioning. The Security Score on the Security Hub summary page should also start climbing above 0% within the first hour as checks complete — a score stuck at 0% after an hour usually points back to the Config prerequisite.

Troubleshooting Security Hub CSPM

These eight issues cover the majority of real-world problems teams hit after enabling Security Hub CSPM.

• Security score stuck at 0% after an hour. AWS Config isn’t recording in that account/Region. Check describe-configuration-recorder-status and confirm recording: true.
• Member account findings not appearing in the delegated administrator view. Confirm the member account actually accepted the Organization invitation and that its OU has the configuration policy associated, not just a sibling OU.
• “AccessDeniedException” when running enable-organization-admin-account. This command must be run from the Organizations management account, not the intended delegated administrator account. It’s a common copy-paste mistake when following a runbook.
• Standards show as “PENDING” indefinitely. This is usually a transient state that resolves in under 30 minutes; if it persists past an hour, disable and re-enable the specific standard.
• Bill higher than expected within the first billing cycle. Check whether Inspector or a noisy Extended partner integration is generating a high volume of low-severity findings that are each counted as an ingestion event past the 10,000 free threshold.
• Automation rules not firing. Verify rule-order doesn’t conflict with an earlier terminal rule (is-terminal: true) that’s intercepting findings before your rule evaluates them.
• Cross-region aggregation shows stale data. The aggregation Region can lag behind linked Regions by several minutes; this is expected eventual consistency, not a failure.
• Central configuration policy won’t apply to a specific OU. Confirm the delegated administrator account has central configuration explicitly turned on via update-security-hub-configuration before creating policies — policies created before this step silently fail to propagate.

Advanced Tips for Production Environments

Once the basic setup is running, a few refinements make Security Hub genuinely useful day to day rather than another dashboard nobody opens.

Suppress findings you’ve accepted as risk, rather than leaving them active and cluttering your triage queue. Use batch-update-findings with Workflow.Status set to SUPPRESSED and a note explaining why, so the audit trail survives a compliance review months later. Build a weekly digest Lambda that queries findings by severity and posts a summary to your team’s chat tool instead of relying on people to remember to check the console. Tag resources consistently across accounts before you scale Security Hub past a handful of accounts, since finding-to-owner mapping gets painful fast without a tagging standard already in place. And if you’re running Security Hub Extended, review partner integrations quarterly — the catalog grew from 21 to 23 solutions in a single quarter in 2026, and it’s easy to accumulate integrations you enabled for a 30-day trial and forgot to disable.

Finally, treat the security score as a trend, not an absolute number. A newly onboarded account will show a low score simply because it hasn’t been remediated yet, not because Security Hub is malfunctioning. Track the trajectory over the first 30 days rather than panicking over a low initial reading.

Frequently Asked Questions

Does AWS Security Hub CSPM have a free tier?
There’s no free tier for security checks — billing starts from the first check. There is a perpetual free tier for finding ingestion events: the first 10,000 events per account per Region per month are free, and findings from Security Hub’s own native checks never count toward that limit at all.

Do I need to enable AWS Config separately from Security Hub?
Yes. AWS Config is a hard prerequisite. Security Hub CSPM will accept the enable command and show a green status even without Config running, but it won’t generate findings until Config is recording resources in that account and Region.

What’s the difference between Security Hub CSPM and the older “classic” Security Hub?
The CSPM rebrand introduced deduplicated cross-standard billing (you’re charged once per control even if it appears in multiple enabled standards), expanded scope to include Azure resources, and added the Extended partner marketplace. The underlying finding aggregation from GuardDuty, Inspector, Macie, and Config works the same way as before.

Can Security Hub replace GuardDuty or Inspector?
No. Security Hub aggregates and correlates findings from those services; it doesn’t perform threat detection or vulnerability scanning itself. You still need GuardDuty and Inspector running independently for Security Hub to have anything meaningful to aggregate.

How many partner integrations does Security Hub Extended support?
As of August 2026, the Extended catalog includes 23 curated partner solutions across nine security categories, including endpoint (SentinelOne), identity (CyberArk), data security (Varonis), and supply-chain security, added most recently.

Should the delegated administrator be the same as my Organizations management account?
No. Best practice is a dedicated security-tooling account separate from the management account, so a compromise of your security tooling doesn’t also compromise your most privileged Organizations account.

Which compliance standards can I enable in Security Hub CSPM?
Commonly enabled standards include AWS Foundational Security Best Practices, the CIS AWS Foundations Benchmark, PCI DSS, and NIST 800-53. Because CSPM deduplicates shared controls across standards, enabling several at once costs far less than the old per-standard pricing model.

Does Security Hub work across multiple AWS Regions automatically?
Not by default. You need to create a finding aggregator and choose either ALL_REGIONS or a specific list of Regions to link. Pricing is still calculated per account per Region regardless of aggregation settings.

Is Security Hub CSPM available for GCP resources, not just AWS and Azure?
As of September 2026, AWS’s own positioning of Security Hub as a multicloud control plane covers AWS and Azure resources through the per-resource pricing model. Broader third-party CSPM platforms remain the more common choice for teams that also need native GCP coverage in the same tool.

Related Coverage

• AWS Lambda MicroVMs Setup: 12 Steps, 4x Peak Scaling [2026]
• AWS Global Accelerator Game Server Setup: 12 Steps [2026]
• AWS Systems Manager Azure Setup: 12 Steps, 90 Min [2026]
• PlayFab Multiplayer Servers Setup: 12 Steps, 90 Min [2026]
• Palworld Cloud Server Setup: 12 Steps, No Ports [2026]