Skip to main content

Enabling Security Hub CSPM

The Security Hub CSPM setup wizard walks you through five steps to configure a delegated administrator account, choose the AWS regions and compliance standards to evaluate, select the member accounts to enroll, and submit. After submission, Prism runs an asynchronous orchestration job that enrolls members, associates standards, and creates the finding aggregator.

Accessing the Wizard​

  • If no engine is enabled yet, open the Security Hub. The Overview page drops straight into the Enable Security Hub panel, subtitled "Choose the security capabilities to turn on". Click Enable on the Posture management card (its source line reads Amazon Security Hub CSPM) to start the wizard.
  • If another engine is already enabled, the Overview page shows one tile per engine instead. The dimmed Security Hub CSPM tile carries its own Enable button. You can also go to Configuration in the sidebar, open the Capabilities tab, and click Enable on the same Posture management card in the Security capabilities panel.
  • From the sidebar, a dimmed Enable Security Hub CSPM row sits in the Security Hub group for as long as CSPM is off. It opens the same wizard.
  • If CSPM setup previously failed, the wizard appears automatically when you open the CSPM section and shows a warning reading "The previous setup attempt failed: {message}. Submitting again will clear that state and retry."

Wizard Steps​

The wizard's page header reads Set up Security Hub, subtitled "Enable AWS Security Hub CSPM across your organization", with a five-step stepper beneath it. Back and Next sit at the bottom right of the card; Next is disabled until the current step is valid.

StepNameWhat you configure
1Admin accountThe AWS account that acts as the Security Hub delegated administrator
2RegionsThe home region and the additional linking regions to aggregate
3StandardsThe compliance standards to enable across all enrolled accounts
4MembersThe member accounts to enroll alongside the admin account
5ReviewA summary of all choices before submission

Prerequisites​

Step 1: Admin Account​

Pick the AWS account that will serve as the Security Hub delegated administrator. This account receives aggregated findings from all enrolled member accounts.

FieldRequiredNotes
Admin accountYesA single-select field listing every linked account as Name (123456789012); type to narrow the list by name or account ID. The admin account is always enrolled alongside the members you add in Step 4

The step carries an on-screen warning:

The admin account is permanent for this deployment. To change it later you must disable Security Hub entirely and set it up again — workflow-status history will be lost.

warning

The home region chosen in Step 2 is permanent in the same way: Settings shows it as read-only text, so changing it also means disabling Security Hub and running the wizard again.

Step 2: Regions​

Choose the home region and the additional AWS regions from which Security Hub should aggregate findings.

FieldRequiredDefaultNotes
Home regionYesus-east-1The primary AWS region where the finding aggregator is created; cannot be removed later without disabling CSPM
Linking regionsYes[us-east-1]A checkbox multi-select with a Select all / Deselect all row; findings from linking regions are aggregated into the home region

The home region is automatically added to linking regions if you change it, and its checkbox is then locked so it cannot be deselected. The field summarises your choice as chips, collapsing to +N more past six regions. You can add or remove linking regions after setup on the Settings page.

Step 3: Standards​

Select the compliance standards to enable across every enrolled account and region.

FieldRequiredDefaultNotes
StandardsAt least oneAll available standardsOne checkbox per standard, labelled with its display name (for example "AWS Foundational Security Best Practices v1.0.0"); all are pre-selected by default

Standards are enabled uniformly across every member account and region. You can change the set of enabled standards later on the Settings page.

note

A freshly enabled standard has no score. Its card on Security standards shows a No data yet chip and the line "Scores appear once AWS finishes evaluating this standard." AWS needs time to evaluate the controls, and Prism only sees the result after a Refresh findings run has pulled the findings into Prism.

Step 4: Members​

Select the member accounts to enroll. The admin account you selected in Step 1 is always included and does not appear in the member list.

FieldRequiredNotes
Member accountsOptionalThe same checkbox multi-select used for regions, with a Select all / Deselect all row; accounts are listed as Name (123456789012). Accounts can also be added after setup on the Enrollment page

Step 5: Review​

The Review step summarizes your choices before submission:

  • Admin account: the selected AWS account ID
  • Home region: the primary aggregation region
  • Linking regions: all selected regions
  • Standards: the number of standards selected
  • Member accounts: the total count, rendered as "N (including admin)"

Click Enable Security Hub to submit; the button reads Enabling… while the request is in flight. If the submission request fails, an error message appears on this step and you can retry without losing your selections.

What Happens After Submission​

After you click Enable Security Hub, Prism starts an asynchronous orchestration job. The wizard transitions to a progress view showing:

  • "Setting up Security Hub…" as the heading, above the line "Enrolling member accounts, associating standards, and creating the finding aggregator. This can take a few minutes."
  • A progress bar with a percentage and a live label that update automatically as the job advances
  • A panel repeating the Admin account and Home region you chose

The view polls the job status automatically until it settles. If the job reports a non-fatal problem, the message appears above the panel as a warning. Once the job finishes the wizard hands off to the Compliance Dashboard — you normally do not see the settled heading ("Security Hub is enabled", "Security Hub enabled with partial failures", or "Setup failed").

info

Security Hub setup involves multiple IAM propagation steps and can take several minutes. The job retries IAM-dependent steps automatically for approximately four minutes before marking an account as failed.

After the orchestration job completes, Prism checks whether AWS Config recording is active in every enrolled account and region. If any account/region pair has no recorder at all, or has one that is stopped, the AWS Config needed for full evaluation dialog appears. It reads "AWS Config isn't recording in N account/region pair(s). Enable minimal recording so your standards can fully evaluate.", lists each affected pair as 123456789012 — us-east-1, and offers three actions:

  • Enable AWS Config, the primary button, starts minimal recording in the listed pairs straight away and then closes, handing off to the Compliance Dashboard
  • Open AWS Config page navigates to the Config Recorders page
  • Later dismisses the dialog and proceeds to the Compliance Dashboard, leaving Config for another time

Standards cannot fully evaluate most resource types until Config recording is running. See AWS Config for details.

If any member accounts fail enrollment, CSPM is marked partial_failure. The Compliance Dashboard shows a warning banner with a Review link that opens the Enrollment page, where you can retry failed accounts.