Reviews Security Hub CSPM configuration — standards, controls, and compliance posture management using ASFF format. Covers enabled standards (FSBP, CIS, PCI-DSS, NIST 800-53, NIST 800-171, AI Best Practices, Resource Tagging), control status, automation rules, and organization-wide policy enforcement.

Security Hub CSPM provides two categories of functionality:

Compliance management — standards, controls, compliance findings
ASFF hub features — finding aggregation, automation rules, custom actions, cross-region aggregation

This skill works from both standalone accounts and delegated administrator accounts.

API constraint: MUST use V1 APIs (no -v2 suffix) only. MUST NOT use V2 APIs.

Membership: Supports both Organizations (Central Configuration) and legacy invitation-based membership.

Classify the Request

Signal	Workflow
Standards enabled, control status, disabled controls	A: Review Standards & Controls
Automation rules, org-wide policies, standard enforcement	B: Review Automation & Policies

Workflow A: Review Standards & Controls

List enabled standards:
```
aws securityhub get-enabled-standards
```

For each enabled standard, list controls:

aws securityhub describe-standards-controls --standards-subscription-arn <arn>

Get security control definitions:

aws securityhub list-security-control-definitions

Batch check specific controls:

aws securityhub batch-get-security-controls --security-control-ids '["EC2.1","S3.1","IAM.1"]'

Identify disabled controls:

aws securityhub describe-standards-controls --standards-subscription-arn <arn> --query "Controls[?ControlStatus=='DISABLED']"

Check custom actions:
```
aws securityhub describe-action-targets
```
Constraints:
- MUST enumerate all enabled standards
- MUST report disabled controls with their DisabledReason
- SHOULD flag standards available but not enabled
- SHOULD note control count per standard (enabled vs total)

Workflow B: Review Automation & Policies

Determine membership model:
```
aws securityhub describe-organization-configuration
```
If succeeds: Organizations (Central Configuration). If fails: may use invitation-based or not an admin.
List automation rules:
```
aws securityhub list-automation-rules
```

Get rule details:

aws securityhub batch-get-automation-rules --automation-rules-arns '["<arn>"]'

List configuration policies:

aws securityhub list-configuration-policies

Get policy details:

aws securityhub get-configuration-policy --identifier <policy-id>

Check policy associations:

aws securityhub list-configuration-policy-associations --filters '{"ConfigurationPolicyId":"<policy-id>"}'

Check org configuration:
```
aws securityhub describe-organization-configuration
```
Security check: Verify CloudTrail is enabled and logging Security Hub CSPM API calls (securityhub:* events without -v2 suffix) for audit purposes.

Constraints

MUST run from delegated admin for policy management
MUST report automation rules that suppress or archive findings
MUST NOT paginate through all member accounts by default
MUST only enumerate individual member status if user explicitly requests it
SHOULD verify configuration policies enforce required standards across OUs

Troubleshooting

Symptom	Check
Standard shows enabled but no controls	describe-standards-controls — may be pending initial evaluation
Control status NOT_AVAILABLE	Resource type not present in account
Automation rule not triggering	Check rule criteria and RuleStatus=ENABLED
Configuration policy not applying	Verify association target and policy status

Output Sensitivity

Configuration output reveals enabled compliance standards, disabled controls with reasons, automation rule logic, configuration policy definitions, and organization enrollment structure. Present configuration summary first; offer raw API responses on request.

references/security-hub-cspm-configuration.md

Raw file

aws/agent-toolkit-for-aws