Security Hub CSPM not enabled in a scanned Region
MEDIUMWhat's the problem
Without Security Hub CSPM, AWS Foundational Security Best Practices controls are not evaluated continuously and GuardDuty, Inspector and Access Analyzer findings are not collected in one place. Security Hub needs AWS Config resource recording
How 6WAF detects it
- Deterministic checks through AWS API calls (IAM, S3, EC2/VPC, CloudTrail, KMS, Secrets Manager, ACM, detection services) — no LLM is used for detection; severity is the value the scanner assigns, shown above.
- Scanning uses an IAM Role you deploy yourself via CloudFormation; 6WAF stores no credentials and you revoke access any time by deleting the stack.
- Automated scoring covers only part of the scope of standards such as ISO 27001 — this is a technical assessment, not a certification.
Pillar: Security — Fast Scan
Group: Detection services (GuardDuty, Security Hub, Config, Inspector, Access Analyzer, Cost Anomaly Detection, Regions outside the scan)
Reference standard: 6WAF classification (no Security Hub control checks Security Hub itself)
Scan this check (and the other 101) automatically in ~10 minutes
Start free