L16. Automated Remediation: Security Hub, EventBridge & Lambda

One Format for Every Finding

AWS Security Hub aggregates findings from GuardDuty, Amazon Inspector, Amazon Macie, IAM Access Analyzer, AWS Config, and supported third-party security tools, and normalizes all of them into a single schema called the AWS Security Finding Format (ASFF). Instead of a SOC analyst switching between five different consoles with five different finding shapes, every finding lands in Security Hub with the same structure: severity, resource, remediation guidance, and workflow status, regardless of which service originally generated it. This is what makes Security Hub the aggregation layer the exam expects you to reach for whenever a scenario mentions multiple security services and a need for a single pane of glass.

Continuous Compliance, Not Periodic Audits

Beyond aggregation, Security Hub runs automated compliance checks against recognized standards, including the CIS AWS Foundations Benchmark, PCI DSS, the AWS Foundational Security Best Practices standard, and NIST 800-53. Each standard produces a compliance score that updates as resources change, replacing a periodic manual audit cycle with an always-current view of posture.

Centrally Managed, Same Pattern as GuardDuty

Security Hub follows the same organization-wide management pattern as GuardDuty: a delegated administrator account can enable and configure Security Hub across every member account in an AWS Organization, rather than requiring per-account setup. Any exam scenario about consistent security tooling across many accounts should make you think of this delegated administrator pattern for both services.

The Automated Remediation Pattern

The standard architecture for auto-remediating a Security Hub or GuardDuty finding follows a consistent pipeline:

1. A finding is published as an event to Amazon EventBridge.
2. An EventBridge rule matches on finding type, severity, or another attribute.
3. The rule invokes a Lambda function (or a Step Functions workflow, or an SSM Automation document) that performs the actual remediation.

Typical remediations triggered this way include revoking a leaked IAM access key, isolating a compromised instance's security group, or closing an overly permissive security group rule that opened a port to 0.0.0.0/0. This is the same finding-to-EventBridge-to-Lambda shape used for GuardDuty findings, which is why the two services are usually taught together.

Custom Actions for Human-in-the-Loop Response

Not every remediation should be fully automatic. Security Hub supports custom actions, which let an analyst select a specific finding in the console and manually trigger a pre-built remediation workflow for it, rather than waiting for or relying on full automation. This is the answer whenever a scenario describes an analyst wanting to kick off a specific response for one finding on demand, as opposed to a pipeline that runs unattended for every matching finding. Exam tip: If a question mentions findings from more than one security service and asks about a single aggregated view with compliance scoring, that is Security Hub. If it then asks how a finding gets automatically fixed, the answer is the EventBridge-to-Lambda pattern, not Security Hub acting on the resource directly.