Security Hub, Inspector and Macie

What it is

Three services widen detection beyond threat activity. Amazon Inspector finds software vulnerabilities and unintended network exposure, Amazon Macie finds sensitive data in Amazon S3, and AWS Security Hub collects findings from these and other sources into one place.

Think of Inspector and Macie as specialised scanners, and Security Hub as the dashboard and routing layer on top.

How it works

Amazon Inspector

Inspector scans for known vulnerabilities (CVEs, Common Vulnerabilities and Exposures) in three kinds of resource.

• EC2 instances, using the Systems Manager (SSM) agent or an agentless scan that reads the volumes.
• Container images in Amazon ECR (Elastic Container Registry).
• Lambda functions, including their dependencies and, optionally, the code itself.

Inspector scans continuously. It rescans when a new vulnerability is published or when a resource changes, so you do not schedule scans. For EC2 it can also report network reachability, such as a port that is open to the internet.

Each finding carries an Inspector score that takes the environment into account, so a flaw on an internet facing instance ranks higher than the same flaw in an isolated one.

Amazon Macie

Macie inspects S3 buckets for sensitive data such as personal data and credentials, using managed data identifiers and any custom identifiers you define. It runs discovery jobs on selected buckets, or automated sensitive data discovery that samples across the account.

Macie raises two kinds of findings. Policy findings describe bucket changes such as public access or disabled encryption, and sensitive data findings describe what was found in an object. Macie covers S3 only, so it is the wrong answer for a question about databases.

AWS Security Hub

Security Hub receives findings from AWS services (GuardDuty, Inspector, Macie, IAM Access Analyzer, Firewall Manager and others) and from partner tools. The automated checks against security standards are the posture management capability, which AWS now names Security Hub CSPM (cloud security posture management).

The CSPM checks rely on AWS Config. If Config recording is not on, the controls cannot evaluate resources.

Multi account design

Designate a delegated administrator for Security Hub, GuardDuty, Inspector and Macie, usually in a security tooling account rather than the management account. Turn on auto enable for new accounts.

For Security Hub, central configuration policies let the administrator define which standards and controls apply to which accounts and Regions. Cross Region aggregation then collects findings into one Region for a single view. Aggregation is for viewing and alerting, because the resources and the findings still originate in their own Regions.

# AWS CLI, in the Security Hub delegated administrator account
aws securityhub create-finding-aggregator --region us-east-1 \
  --region-linking-mode ALL_REGIONS

Alerting on findings

Security Hub sends findings to EventBridge, so an alert is a rule. This pattern matches high severity, new findings that are not yet resolved.

{
  "source": ["aws.securityhub"],
  "detail-type": ["Security Hub Findings - Imported"],
  "detail": {
    "findings": {
      "Severity": { "Label": ["HIGH", "CRITICAL"] },
      "Workflow": { "Status": ["NEW"] }
    }
  }
}

For manual triage, a custom action in the console sends only the findings you select to EventBridge. That fits a human decided response, while the rule above fits fully automatic handling.

Choosing between them