Freedom251 › Cloud Security Platforms
AWS Security Hub CSPM
What AWS Security Hub CSPM is
AWS Security Hub CSPM checks AWS resources against security best practices and brings findings from AWS security services and partner tools together to help identify misconfigurations and assess security posture. It correlates and enriches findings across accounts and AWS Regions to help prioritize critical issues, with customizable dashboard widgets and near-real-time risk analytics. Attack path visualizations map how vulnerabilities and misconfigurations may connect to critical resources. Coverage can extend to Microsoft Azure virtual machines, container images, Function Apps, and identities. The Essentials plan includes findings ingestion and aggregation, Automation Rules, CSPM, selected Inspector scanning capabilities, CIS Benchmark Assessments, and a service-linked AWS Config recorder. Per-resource charges apply to EC2 instances, ECR container images, Lambda functions, and IAM users and roles; other monitored resources are included. The Extended Plan adds curated partner solutions and requires Essentials. Threat Analytics and Lambda code scanning are separate tiered add-ons. AWS offers a 30-day trial, but no free plan. Customers remain responsible for guest operating systems, application software, and configuring AWS security group firewalls.
Who it suits
Security teams managing AWS accounts and Regions may use Security Hub CSPM to review findings and prioritize issues. It may also suit teams seeking visibility into specified Microsoft Azure resources or partner security solutions.
What it does well
- Combines findings from AWS services and partner tools.
- Correlates issues across accounts and AWS Regions.
- Maps potential attack paths to critical resources.
- Essentials includes CSPM and Automation Rules.
- Can extend visibility to specified Azure resources.
What to know first
- No free plan; a 30-day trial is available.
- Per-resource charges apply to four resource types.
- Extended Plan requires Essentials.
- Some GuardDuty and Inspector capabilities retain separate billing.
Limits
Security Hub has no free plan and offers a 30-day trial. Essentials uses pay-as-you-go resource-unit billing, with charges for EC2 instances, ECR container images, Lambda functions, and IAM users and roles; Extended Plan and add-ons cost extra.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Security Hub Essentials | Pay-as-you-go; resource unit / mo; prorated by monitored time · Per-resource charges apply to EC2 instances, ECR container images, Lambda functions, and IAM users/roles; other monitored resources are included; AWS and Azure coverage | On request |
| Security Hub Extended Plan | Pay-as-you-go per partner; no upfront commitments · Essentials must be enabled first; charges are additional to Essentials; 23 curated partner solutions across 10 security categories | On request |
| Threat Analytics + Lambda Code Scanning add-ons | Tiered by volume; in addition to Essentials · Threat Analytics covers CloudTrail management events, S3 data events, VPC Flow Logs, DNS query logs, and EKS audit logs; Lambda code scanning scans on deployment and periodically | On request |
As aws.amazon.com lists them, read 4 Oct 2026. The maker's own page has the final word.
Getting started
- Open the AWS Security Hub CSPM website
- Enable the Security Hub Essentials plan
- Use web access or the API to ingest and aggregate findings
- Add the Extended Plan after Essentials if partner solutions are needed
- Enable Threat Analytics or Lambda code scanning add-ons when required
- Configure Automation Rules and response workflows
Verdict
Security Hub CSPM combines posture checks, findings, and response workflows, with optional partner and analytics capabilities. Review its per-resource charges and shared-responsibility boundaries when deciding whether it fits your security operations.
Questions
Is there a free plan?
No. AWS lists a paid model with a 30-day free trial.
Which platforms are supported?
The service is available through web and API access.
What does Essentials include?
Essentials includes findings ingestion and aggregation, Automation Rules, CSPM, selected Inspector scanning, CIS Benchmark Assessments, and a service-linked AWS Config recorder.
Can it monitor Azure resources?
Yes. Coverage can include Azure virtual machines, container images, Function Apps, and identities.
Does the Extended Plan require Essentials?
Yes. Essentials must be enabled first, and Extended Plan charges are additional.
How is pricing applied?
Plans use pay-as-you-go billing. Per-resource charges apply to EC2, ECR images, Lambda functions, and IAM users and roles; other monitored resources are included.
Facts from AWS Security Hub CSPM's own pages
- Attack path analysis
- Security Hub visualizes potential attack paths by mapping how vulnerabilities and misconfigurations could connect to critical resources. · aws.amazon.com, 4 Oct 2026
- Billing limit
- Other AWS security service capabilities not included in Security Hub plans, including remaining GuardDuty and Inspector capabilities, retain their original service billing. · aws.amazon.com, 4 Oct 2026
- Compliance support
- AWS says it supports 143 security standards and compliance certifications, including PCI-DSS, HIPAA/HITECH, FedRAMP, GDPR, FIPS 140-3, and NIST 800-171. · aws.amazon.com, 4 Oct 2026
- Frameworks
- Its standards align with AWS Foundational Security Best Practices, CIS, PCI DSS, and NIST. · aws.amazon.com, 4 Oct 2026
- Included capabilities
- The Essentials plan includes findings ingestion and aggregation, Automation Rules, CSPM, several Inspector scanning capabilities, CIS Benchmark Assessments, and a service-linked AWS Config recorder. · aws.amazon.com, 4 Oct 2026
- Intended customers
- AWS says its customers range from startups and enterprises to nonprofits and governments. · aws.amazon.com, 4 Oct 2026
- Multicloud
- Security Hub can extend visibility to Microsoft Azure resources, including virtual machines, container images, Function Apps, and identities. · aws.amazon.com, 4 Oct 2026
- Partner integrations
- The Extended Plan offers curated partner solutions across endpoint, identity, email, network, data, browser, cloud, AI, security operations, and supply chain categories. · aws.amazon.com, 4 Oct 2026
- Pricing scope
- Per-resource pricing applies to EC2 instances, ECR container images, Lambda functions, and IAM users and roles; other monitored resources are included. · aws.amazon.com, 4 Oct 2026
- Purpose
- AWS Security Hub CSPM checks AWS resources against security best practices and combines findings from AWS security services and partner tools to identify misconfigurations and assess security posture. · aws.amazon.com, 4 Oct 2026
- Response automation
- Security Hub provides automated response workflows to streamline remediation at scale. · aws.amazon.com, 4 Oct 2026
- Risk prioritization
- Security Hub correlates and enriches findings to prioritize critical issues across accounts and AWS Regions, with customizable dashboard widgets and near-real-time risk analytics. · aws.amazon.com, 4 Oct 2026
- Shared responsibility
- AWS states security and compliance are shared responsibilities, with customers responsible for guest operating systems, application software, and configuration of AWS security group firewalls. · aws.amazon.com, 4 Oct 2026
- Support and procurement
- AWS describes Security Hub as offering one consolidated bill, consolidated support, and flexible pricing across AWS and partner solutions. · aws.amazon.com, 4 Oct 2026