What problem does Security Hub solve that individual scanners do not?
Quick Answer
Each AWS security service produces findings in its own shape; Security Hub normalises them all into ASFF (a single finding format) and aggregates Inspector, GuardDuty, Macie, IAM Access Analyzer and partner tools into one view, cross-region and cross-account via a delegated admin.
Detailed Answer
Each AWS security service produces findings in its own shape; Security Hub normalises them all into ASFF (a single finding format) and aggregates Inspector, GuardDuty, Macie, IAM Access Analyzer and partner tools into one view, cross-region and cross-account via a delegated admin. It runs compliance standards (CIS, AWS Foundational Security Best Practices) that continuously check config and produce a security score, and custom actions let an analyst fire a remediation from a finding.
Code Example
# Deep-dive: AWS Security Hub # aggregating findings from Inspector, GuardDuty, Macie and partners into ASFF, security standards such as CIS and AWS FSBP, the security score, cross-region and delegated-admin aggregation, and custom actions for remediation # apply the reasoning in the detailed answer to your own pipeline, # and prove it with a test/dry-run before enforcing in production
Interview Tip
This is where depth shows — be concrete about AWS Security Hub, not generic about "security".