Check ID: securityhub_enabled
Provider: AWS
Service: securityhub
Severity: HIGH
Resource type: Other

​
What this check verifies

AWS Security Hub is ACTIVE in the Region and has at least one enabled security standard or connected integration. Otherwise, it is either not enabled or enabled without standards/integrations.

​
Risk

Absent Security Hub coverage or standards, security signals are fragmented and control checks don’t run. High-risk findings can be missed or delayed, enabling data exfiltration, persistence, and lateral movement. This reduces visibility and undermines confidentiality, integrity, and availability across accounts/Regions.

​
Recommendation

  • Enable in all required accounts/Regions
  • Turn on relevant standards (AWS FSBP, CIS)
  • Connect AWS and third-party integrations
  • Use central configuration and least privilege
  • Automate triage and monitor continuously for defense in depth

​
Remediation

# Enable Security Hub
resource "aws_securityhub_account" "<example_resource_name>" {}

# Critical: Enable at least one standard so the check passes
resource "aws_securityhub_standards_subscription" "<example_resource_name>_fsbp" {
  standards_arn = "arn:aws:securityhub:<REGION>::standards/aws-foundational-security-best-practices/v/1.0.0" # Enables AWS FSBP
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = securityhub_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks