About Us- AWS Security Hub CSPM: The service formerly called AWS Security Hub. It evaluates resources against security standards and best practices, and ingests findings from AWS services and AWS Partner Network solutions, including Prowler, in the AWS Security Finding Format (ASFF).
- AWS Security Hub: A unified cloud security service that correlates findings from Security Hub CSPM, Amazon GuardDuty, Amazon Inspector, and Amazon Macie in the Open Cybersecurity Schema Framework (OCSF) to prioritize the most critical risks.
Key Features and Strengths
- Managed AWS-Native Service: Security Hub runs inside AWS with no infrastructure to operate and is available from the AWS Management Console.
- Centralized Findings for AWS: Security Hub CSPM consolidates findings from AWS services such as GuardDuty, Inspector, Macie, AWS Config, and IAM Access Analyzer, as well as from partner products such as Prowler.
- Managed Security Standards: Security Hub CSPM evaluates standards such as AWS Foundational Security Best Practices, CIS AWS Foundations Benchmark, PCI DSS, and NIST SP 800-53.
- Microsoft Azure Coverage: Both services integrate with Microsoft Azure, including automated checks against the CIS Microsoft Azure Foundations Benchmark v4.0 and Azure Foundational Best Practices standards. See the integration guides for Security Hub and Security Hub CSPM.
- Risk Correlation: Security Hub correlates findings across AWS security services to detect exposures and visualize attack paths.
- AWS-Native Automation: Automation rules and Amazon EventBridge update findings and trigger automated response.
Considerations
- Coverage Centered on AWS and Azure: Other clouds, Kubernetes, and SaaS platforms such as Microsoft 365, GitHub, Google Workspace, or Okta fall outside the built-in standards.
- Dependency on AWS Config: Security Hub CSPM uses AWS Config rules to generate control findings for AWS resources. When the unified Security Hub is also enabled, Security Hub CSPM creates a service-linked configuration recorder automatically. When Security Hub CSPM runs without the unified Security Hub, AWS Config must be enabled manually and recording resources in each region.
- Regional Configuration: Security Hub CSPM is enabled per account and region. Central configuration through AWS Organizations simplifies this for multi-account environments.
- Partner Findings Go to Security Hub CSPM: Third-party partner findings, including Prowler findings, are sent to Security Hub CSPM. The unified Security Hub does not receive findings from third-party partner tools.
Prowler
Prowler is an open-source, multi-cloud security platform available as Prowler Cloud, Prowler Private Cloud, Prowler CLI, and Prowler Local Server. It offers extensive customization and flexibility for organizations with complex or multi-cloud environments.Main Advantages of Prowler
- Multi-Region Scanning by Default: Prowler scans every AWS region without additional configuration and without enabling services such as AWS Config. To cover multiple AWS accounts, Prowler assumes a role in each account: onboard the accounts in Prowler Cloud through AWS Organizations, or run Prowler CLI per account as described in AWS Organizations in Prowler.
- Minimal Setup Requirements: Prowler only needs a role with the appropriate read permissions to start scanning.
- Versatile Execution Environment: Prowler runs from Prowler Cloud, a local workstation, a container, AWS CloudShell, CI/CD pipelines, or another AWS account or cloud provider by assuming a role.
- Flexible Results Storage and Sharing: Prowler stores results locally or directly in an Amazon S3 bucket for analysis and collaborative security assessments.
- Customizable Reporting: Prowler exports results in JSON, CSV, OCSF, ASFF, and HTML formats.
- Custom Checks and Compliance Frameworks: Custom checks, remediations, and compliance frameworks can be written in minutes to match specific security policies.
- Extensive Compliance Support: Prowler supports 40+ compliance framework versions for AWS, including CIS AWS Foundations Benchmark, AWS Foundational Security Best Practices, AWS Well-Architected Framework, NIST SP 800-53, NIST CSF, PCI DSS, ISO/IEC 27001, SOC 2, HIPAA, GDPR, NIS2, ENS, and FedRAMP, and 100+ framework versions across all providers. Explore them in Prowler Hub.
- Multi-Cloud and Beyond: Prowler provides 2,200+ checks across 20+ providers, including AWS, Microsoft Azure, Google Cloud, Kubernetes (including Amazon EKS), Microsoft 365, GitHub, Google Workspace, Okta, Oracle Cloud Infrastructure, Alibaba Cloud, infrastructure as code, and container images. Explore all checks in Prowler Hub.
- All-Region Checks: Prowler runs its checks in all regions, regardless of AWS Config resource type support.
Using Prowler With AWS Security Hub
Prowler is an official partner integration of Security Hub CSPM. Prowler findings are sent in ASFF and appear next to findings from AWS services, so teams keep the AWS-native view while adding Prowler coverage:- Prowler Cloud, Prowler Private Cloud, and Prowler Local Server: Configure the AWS Security Hub integration to export findings automatically after each scan.
-
Prowler CLI: Add the
--security-hubflag to send findings, as described in AWS Security Hub Integration with Prowler. -
Cost Control: In Prowler CLI,
--send-sh-only-failssends only failed findings to Security Hub CSPM while keeping all findings in Prowler outputs.--status FAILalso limits what is sent, but it removes passing findings from Prowler outputs as well.
Comparison Summary
Scope and Environment
- Security Hub suits organizations that want a managed, AWS-native service to monitor, correlate, and automate security across AWS, with additional coverage for Microsoft Azure.
- Prowler suits organizations that need consistent, customizable checks across AWS, Azure, Google Cloud, Kubernetes, SaaS platforms, and more, from a single open-source tool.
Setup and Maintenance
- Security Hub is enabled per account and region, and Security Hub CSPM relies on AWS Config for control findings on AWS resources, which must be set up manually unless the unified Security Hub is also enabled. AWS Organizations and central configuration help manage this at scale.
- Prowler only needs the appropriate permissions and runs from many environments, without requiring additional AWS services.
Customization and Flexibility
- Security Hub offers managed standards and controls, plus automation through AWS services.
- Prowler allows highly customizable checks, remediations, and compliance frameworks that adapt quickly to organizational needs and regulatory changes.
Cost Efficiency
- Security Hub uses resource-based pricing, with finding ingestion included. Refer to AWS Security Hub pricing.
- Security Hub CSPM is billed per security check and per finding ingestion event above a monthly free tier. Refer to AWS Security Hub CSPM pricing.
- Prowler can reduce Security Hub CSPM finding ingestion costs with
--send-sh-only-fails, which sends only failed findings while keeping complete results in its own outputs or in Amazon S3.
Multi-Cloud and Multi-Region Support
- Security Hub covers AWS and Microsoft Azure.
- Prowler is inherently multi-region and multi-cloud, with consistent checks across cloud, Kubernetes, and SaaS environments.
Conclusion
AWS Security Hub and Prowler work best together:- AWS Security Hub provides a managed, AWS-native place to aggregate, correlate, and act on security findings.
- Prowler adds transparent, customizable checks and broad compliance coverage across AWS and every other environment an organization runs, and sends its findings to Security Hub CSPM.