IAM / security / securityhub

AWS Security Hub (IAM)

AWSsecurityhubsecurity

AWS Security Hub is a cloud security posture management service that performs security best practice checks, aggregates alerts, and enables automated remediation.

iamaws

docs ↗

Permissions

Actions in this service

securityhub:DescribeHub

securityhub:GetFindings

securityhub:GetInsights

securityhub:ListMembers

securityhub:UpdateFindings

securityhub:GetInsightResults

securityhub:ListInvitations

securityhub:TagResource

Policy

Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "securityhub:DescribeHub", "securityhub:GetFindings", "securityhub:GetInsights", "securityhub:ListMembers", "securityhub:UpdateFindings", "securityhub:GetInsightResults", "securityhub:ListInvitations", "securityhub:TagResource" ], "Resource": "*" } ] }

SDK mapping

Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns

Known gotchas

Avoid securityhub:* — grants full control including hub deletion and member management

Avoid securityhub:DeleteMembers and securityhub:DeleteInsight — can break security aggregation and monitoring

Resources

docshttps://servicereference.us-east-1.amazonaws.com/v1/securityhub/securityhub.json ↗