AWS Security Hub: Aggregate Coding-Agent Security Findings Across Accounts

Your coding-agent platform spans a management account, three prod agent accounts, and a rotating pool of ephemeral sandboxes. GuardDuty fires in account A, Macie in account B, Config non-compliance in account C, and a custom Lambda posts “prompt-injection suspected” into CloudWatch. Nobody has a single pane. AWS Security Hub is the unfair advantage: one aggregator that normalizes findings to ASFF, runs CIS/FSBP standards, and fans out automations — so agent security is an org product, not a per-account hobby. Feed it GuardDuty, Macie, and Detective investigations; cap spend with Budgets so a finding flood cannot hide a cost attack.

⚡ TL;DR: Enable Security Hub + Org auto-enable for agent OUs. Turn on AWS Foundational Security Best Practices and CIS; filter dashboards by coding-agent resource tags. Automate CRITICAL/HIGH → ticket + optional EventBridge contain. Cross-Region aggregation to one home Region. Related: GuardDuty, SCPs, Network Firewall, Detective.

Why agent fleets need an aggregator

Agent platforms multiply finding sources:

Security Hub’s ASFF (AWS Security Finding Format) lets you treat a custom “agent tool jailbreak” finding with the same workflow as GuardDuty CRITICAL — severity, remediation text, GeneratorId, and Resources all first-class.

Enable Hub org-wide for agent OUs

# ✅ delegated admin + enable standards (run in admin account patterns)
aws securityhub enable-security-hub --enable-default-standards
aws securityhub batch-enable-standards --standards-subscription-requests \
  '[{"StandardsArn":"arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0"}]'

# ✅ prefer Organizations configuration / central config for auto-enable members
aws securityhub create-members --account-details AccountId=111122223333,Email=agent-prod@example.com

// ✅ EventBridge: HIGH+ Security Hub findings for tagged agent resources → Lambda
const rule = new events.Rule(this, "HubAgentHigh", {
  eventPattern: {
    source: ["aws.securityhub"],
    detailType: ["Security Hub Findings - Imported"],
    detail: {
      findings: {
        Severity: { Label: ["CRITICAL", "HIGH"] },
        Resources: {
          Tags: { workload: ["coding-agent"] },
        },
      },
    },
  },
});
rule.addTarget(new targets.LambdaFunction(triageFn));

❌ Enabling Hub only in prod while sandboxes stay silent: attackers prefer sandboxes with fat task roles and weak Config rules.

ASFF for custom coding-agent findings

Ship your own detector (prompt-injection classifier, anomalous tool-call rate) as ASFF so it lands next to GuardDuty.

# ✅ BatchImportFindings — custom agent abuse finding
import boto3, datetime, uuid

hub = boto3.client("securityhub")
ACCOUNT = "111122223333"
REGION = "us-east-1"

def import_agent_finding(
    tenant_id: str,
    severity: str,
    title: str,
    description: str,
    resource_arn: str,
):
    finding_id = str(uuid.uuid4())
    now = datetime.datetime.utcnow().strftime("%Y-%m-%dT%H:%M:%S.000Z")
    finding = {
        "SchemaVersion": "2018-10-08",
        "Id": f"coding-agent/{tenant_id}/{finding_id}",
        "ProductArn": f"arn:aws:securityhub:{REGION}:{ACCOUNT}:product/{ACCOUNT}/default",
        "GeneratorId": "coding-agent-runtime-detector",
        "AwsAccountId": ACCOUNT,
        "Types": ["TTPs/Defense Evasion/AgentPromptInjection"],
        "CreatedAt": now,
        "UpdatedAt": now,
        "Severity": {"Label": severity},
        "Title": title,
        "Description": description,
        "Resources": [{
            "Type": "AwsIamRole",
            "Id": resource_arn,
            "Tags": {"workload": "coding-agent", "tenant_id": tenant_id},
            "Region": REGION,
        }],
        "RecordState": "ACTIVE",
        "Workflow": {"Status": "NEW"},
    }
    # ❌ Do not invent free-form JSON in a private DynamoDB table and call it “security”
    return hub.batch_import_findings(Findings=[finding])

Cross-account + cross-Region aggregation

For multi-account agent platforms:

1. Designate a Security Hub administrator (delegated admin)
2. Auto-enable members in agent OUs
3. Configure cross-Region aggregation to one home Region so on-call does not flip Regions
4. Insight filters: ResourceTags.workload = coding-agent OR GeneratorId prefix

# ✅ insight: open CRITICAL findings for agent-tagged resources
aws securityhub create-insight \
  --name "coding-agent-critical" \
  --filters '{"SeverityLabel":[{"Value":"CRITICAL","Comparison":"EQUALS"}],"ResourceTags":[{"Key":"workload","Value":"coding-agent","Comparison":"EQUALS"}]}' \
  --group-by-attribute "ProductName"

Automation: from finding to contain

Security Hub Automations / EventBridge rules should do more than Slack:

Wire CRITICAL credential-class findings to the same revoke playbook as GuardDuty and investigate graphs in Detective when available.

// ✅ suppress known canary — never suppress all agent findings
await hub.batchUpdateFindings({
  FindingIdentifiers: [{ Id: findingId, ProductArn: productArn }],
  Note: { Text: "Canary account intentional finding", UpdatedBy: "secops" },
  Workflow: { Status: "SUPPRESSED" },
});

Standards that matter for agent accounts

Prioritize:

• AWS FSBP — S3 public access, IAM keys, CloudTrail, KMS
• CIS AWS Foundations — root MFA, password policy, logging
• Custom controls via Config + Hub for “agent task roles must deny iam:*”

Combine with SCPs so non-compliant APIs fail closed even when a Config rule is still NEW.

Production checklist

• [ ] Security Hub delegated admin; agent OUs auto-enrolled
• [ ] FSBP + CIS standards enabled; failing controls owned
• [ ] Cross-Region aggregation to on-call home Region
• [ ] Insights filtered by workload=coding-agent tags
• [ ] Custom ASFF importer for runtime agent detectors
• [ ] EventBridge automation for CRITICAL/HIGH → ticket + optional contain
• [ ] Suppression rules reviewed quarterly (no blanket agent suppress)
• [ ] Findings retention / export to SIEM ≥ 90 days

FAQ

Q: Security Hub vs GuardDuty vs Detective?
A: GuardDuty detects threats; Detective investigates AWS entity graphs; Security Hub aggregates and scores compliance + findings across products and accounts. You want Hub as the dashboard/workflow layer.

Q: Will Hub slow agent deploys?
A: Only if you gate releases on failing FSBP without a waiver process. Use Inspector + image scanning in CI for containers; use Hub for fleet posture, not per-PR blocks.

Q: Cost?
A: Per-finding ingestion adds up with noisy custom detectors — sample or severity-gate what you import; do not ASFF every debug log line.

Mapping agent architecture onto Hub product integrations

Turn on the integrations that actually fire for coding-agent stacks — ignore the rest initially:

1. GuardDuty — credential exfil, anomalous API (must-have)
2. Macie — secret/PII in artifact buckets
3. Inspector — CVEs in Fargate/ECR images your agents run
4. IAM Access Analyzer — external shares of agent roles/buckets
5. Firewall Manager / Network Firewall posture if you centralize egress (Network Firewall)

# ✅ list enabled products; confirm GuardDuty + Macie show as ENABLED
import boto3
hub = boto3.client("securityhub")
for p in hub.list_enabled_products_for_import()["ProductSubscriptions"]:
    print(p)

Tag every agent resource at create time (workload=coding-agent, env=prod|sandbox, tenant_id=…). Untagged resources will not match your Insights — and on-call will drown in unfiltered CIS noise from shared accounts. Enforce tags with SCPs or a Config rule that Hub surfaces as FAIL until fixed.

When a CRITICAL finding lands, the default path should be: Hub ticket → optional auto-contain Lambda → Detective graph for IAM entities → Lake SQL for the 24h API set. Document that path once; do not reinvent it per finding type.

Related reading

• Amazon GuardDuty: Compromised Coding-Agent Credentials
• Amazon Macie: Artifact Bucket Secrets
• AWS Organizations SCPs for Agent Accounts
• AWS Network Firewall: Egress Filtering

Security Hub turns scattered agent-account findings into one severity-normalized product: standards for posture, ASFF for custom detectors, and automations that revoke and ticket — so coding-agent security scales with your OU count, not your Slack scroll speed.

Last updated on September 26, 2026