AWS Security Hub pricing

AWS Security Hub is available globally. For a complete list of regions where AWS Security Hub is offered, see AWS Regions. AWS Security Hub is priced along two dimensions. The dimensions are based on the quantity of security checks and the quantity of finding ingestion events.  

Security checks: AWS Security provides customers with prepackaged security standards, such as the CIS AWS Foundations Benchmark and the Payment Card Industry Data Security Standard (PCI DSS). Security Hub automatically evaluates each control in a security standard via rules. The evaluation of a control (using a rule) against a single AWS resource is referred to as a security check and it results in a finding that shows the result of the check. Security checks are charged per number of checks per account per region.

AWS Security Hub’s security checks leverage configuration items recorded by AWS Config. AWS Config is required for these security checks, and configuration items are priced separately from Security Hub. Security Hub customers are not charged separately for any Config rules enabled by Security Hub. The Config rules enabled by Security Hub are referred to as service-linked rules.

Finding ingestion events: AWS Security Hub ingests findings from various AWS services and from partner products. Finding ingestion events include both ingesting new findings and ingesting updates to existing findings. Finding ingestion events associated with Security Hub's security checks are not charged. Finding ingestion events are charged per number of events per account per region.