AWS Security Hub across multiple accounts, explained
Most teams outgrow a single AWS account quickly: one for production, one for staging, one for experiments. Security Hub can bring their findings together, but the set-up involves administrator accounts, AWS Organizations, configuration policies and a home Region. This guide explains each piece in plain English, so you can choose the set-up that fits your team.
Two ways to connect accounts
In Security Hub, one account becomes the administrator and the others become member accounts. The administrator sees findings from every member and can act on them; members only see their own. AWS now calls the posture-checking part of the service Security Hub CSPM, and its account management documentation describes two ways to link accounts:
| With AWS Organizations | By invitation | |
|---|---|---|
| How it works | The Organizations management account designates a delegated administrator, which can add organisation accounts as members | The administrator invites each account, and each account accepts |
| Central configuration | Yes | No; each account configures itself in each Region |
| New accounts | Can be enabled automatically | Must be invited one by one |
| Best for | Teams already using AWS Organizations | Standalone accounts, or accounts outside your organisation |
AWS recommends the Organizations route. AWS Organizations itself has no extra charge, and it also lets you manage GuardDuty and other security services the same way.
Central configuration
With central configuration, the delegated administrator writes configuration policies that say whether Security Hub is on, and which standards and controls are enabled, for the whole organisation or for particular accounts and organisational units. Settings apply across Regions from one place, so a new staging account gets the same checks as production without anyone remembering to set it up.
Without central configuration, the administrator can only switch on Security Hub and the default standards for new accounts in the current Region. Existing accounts keep their own settings, and each account must be configured separately in each Region, which is how standards drift apart over time.
Bringing Regions together
Security Hub works Region by Region. Cross-Region aggregation copies findings, insights, control statuses and Security Hub’s own security scores from linked Regions into one home Region, and keeps updates in sync both ways. AWS says aggregation itself adds no cost.
Two details catch people out. Security Hub must already be enabled in each linked Region, because aggregation does not switch it on for you. And you must be signed in to the home Region to see the combined view.
A sensible set-up for a small team
- Create a dedicated security account in AWS Organizations, rather than using the management account for day-to-day security work.
- Make it the delegated administrator for Security Hub, and for GuardDuty while you are there.
- Choose a home Region, usually the Region where most of your workloads run, and link the other Regions you use.
- Turn on central configuration with one policy for the whole organisation, enabling the AWS Foundational Security Best Practices standard.
- Check AWS Config recording. Security Hub CSPM runs most controls as AWS Config rules. If the unified Security Hub is also enabled, AWS creates a service-linked configuration recorder for you. If you use Security Hub CSPM on its own, turn on AWS Config resource recording yourself in the administrator account and every member account, in every Region you use; otherwise controls return
WARNINGfindings instead of evaluating your resources. AWS bills Config recording separately (AWS Config prerequisites). - Decide who reads the findings. Aggregation puts everything in one place; someone still has to work through it every week.
What it costs
Connecting accounts does not reduce what AWS charges: Security Hub is billed for usage in every account and Region where it is enabled, and each account gets a 30-day free trial in each Region. Cross-Region aggregation adds nothing. Security Hub CSPM is charged by checks and finding ingestion, while the newer, unified Security Hub is priced per resource. See AWS Security Hub pricing and our CSPM cost guide for how the models compare.
If you do not use your home Region for workloads, AWS suggests disabling Security Hub standards and integrations there to avoid charges, while keeping aggregation.
Common pitfalls
- Forgotten Regions. Attackers like Regions you never look at. Enable Security Hub and GuardDuty in every Region you might use, and consider blocking the others with a service control policy.
- Invitations in one Region only. With invited accounts, the administrator must invite each member in the home Region and every linked Region, or aggregation will miss them.
- Drifting standards. Without central configuration, a new account can end up with different checks from the rest.
- Findings nobody reads. One dashboard with thousands of technical findings is still a lot of work for a team without a security engineer. Our guide to Security Hub findings in plain English helps you prioritise.
How bearhug handles multiple accounts
bearhug takes a simpler route. You connect each AWS account individually with a CloudFormation stack, with no need for AWS Organizations or a delegated administrator, and findings from every connected account and every Region where Security Hub is enabled appear in one multi-account dashboard. Each finding is explained in plain English, grouped by severity and resource, with daily trends. Each account costs $100 per month, with every feature included.