Security Hub Cspm

AWS Security Hub CSPM (Cloud Security Posture Management) evaluates AWS resource configurations against AWS and industry compliance standards. It uses ASFF format and provides automation rules, custom actions, and organization-wide configuration policies. It also receives findings from GuardDuty, Inspector, and Macie in ASFF format.

Data Sources

Security Hub CSPM receives:

• AWS Config evaluations (compliance checks against standards)
• GuardDuty findings (in ASFF format)
• Inspector findings (in ASFF format)
• Macie findings (in ASFF format)
• Third-party findings (via BatchImportFindings API, ASFF format)

CSPM generates its own compliance findings by evaluating resources against enabled standards.

Operator prerequisites

Prerequisite: Operator must assume an IAM role with least-privilege read-only permissions. Scope permissions to the actions listed in the Read-Only APIs table; avoid FullAccess managed policies and securityhub:* wildcards. Do not use long-lived IAM user access keys.

Available Standards

Discover enabled and available standards dynamically:

Do not rely on a static standards list in this reference. Use describe-standards output as the authoritative source for current names, versions, ARNs, and regional availability.

Always use describe-standards to discover the current standards list before naming specific standard versions or ARNs.

API Convention

Security Hub CSPM APIs share the aws securityhub CLI namespace with Security Hub V2 but do NOT have a -v2 suffix. All APIs in this file are unsuffixed. V2 APIs (with -v2 suffix) are in references/security-hub.md. Shared APIs (used by both) are listed separately below.

Read-Only APIs

CSPM APIs (V1 — ASFF)

Shared APIs (used by both V1 and V2)

Severity Scoring

CSPM compliance findings use the same normalized severity as Security Hub:

Key notes:

• Severity is assigned per control definition, not per resource
• The same control failure has the same severity regardless of which account it appears in
• Enabled standards define severity per control; use describe-standards-controls for the current control metadata

Security Check

See SKILL.md Security considerations for CloudTrail audit logging, CloudWatch anomaly alarms, KMS/TLS encryption, SNS recipient validation, and current AWS security best-practice references.

Service Notes

No service-specific notes.

Output Sensitivity

Security Hub CSPM findings (GetFindings ASFF) contain:

• AWS account IDs and resource ARNs across the organization
• Resource configuration details (security group rules, IAM policies, encryption settings)
• Compliance standard and control identifiers
• Third-party integration findings (GuardDuty, Inspector, Macie in ASFF format)
• Automation rule configurations and suppression logic

Present compliance pass/fail rates and severity distribution first. Offer full ASFF finding bodies on request. Avoid logging raw ASFF finding or configuration responses in plaintext, store exported CSPM data only in downstream destinations encrypted at rest, and transmit exported data only over encrypted channels such as TLS. If logging to CloudWatch Logs, verify the log group is encrypted with a KMS key. If CSPM findings or automation outputs are forwarded to SNS topics or S3 buckets, verify those destinations use KMS encryption and resource policies include aws:SourceArn and aws:SourceAccount condition keys.