Security, Identity, and Compliance
CoreAWS Security Hub
Centralized security posture management and aggregation/correlation of findings from AWS and partner services.
Key points
- Security Hub organizes and prioritizes findings; source services still perform the underlying detection or assessment.
- Multi-account and multi-Region design determines visibility and delegated administration.
- Findings require response workflows and ownership rather than passive dashboard collection.
Best-known use cases
- Aggregate GuardDuty, Inspector, Macie, and partner findings.
- Assess security posture against supported controls.
What candidates often confuse it with
- Security Hub aggregates findings; GuardDuty, Inspector, and Macie generate specialized findings.
- Security Hub is findings/posture, while Detective supports deeper investigation relationships.
Key takeaway
Choose Security Hub for centralized posture and findings, not as a replacement for detection sources.
Related services
- Amazon GuardDuty
- Amazon Inspector
- Amazon Macie
- Amazon Detective
Relevant exam tasks
- D1.2
- D1.3