> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-aws-security-hub.md).

# Integrate Prisma Cloud with AWS Security Hub

Learn how to integrate Prisma® Cloud with AWS Security Hub so that you can view and monitor your security posture on AWS Security Hub.

Integrate Prisma® Cloud with AWS Security Hub for centralized visibility into security and compliance risks associated with your cloud assets on the AWS Security Hub console.

As a part of the integration, Prisma Cloud monitors your AWS cloud assets. It sends alerts about resource misconfigurations, compliance violations, network security risks, and anomalous user activities directly to the AWS Security Hub console providing a centralized and comprehensive view of the cloud assets deployed on your AWS accounts.

Prisma Cloud integration with AWS Security Hub is not supported for US Gov Cloud regions.

1. Attach an AWS Security Hub read-only policy to your AWS role to enable this integration on the AWS console.
   1. Log in to the AWS console and select IAM.
   2. Select **Roles** and search for the role name used to onboard your account on Prisma Cloud.
   3. Click on that role name and **Add permissions > Attach Policies**.

      <figure><img src="/files/YfotL8S8zctXqgiWtPJh" alt="securityhub createrole user"><figcaption></figcaption></figure>
   4. Enter **SecurityHubRead** as the search term.
   5. Select **AWSSecurityHubReadOnlyAccess** and then **Attach Policies**.

      <figure><img src="/files/KPq8gQCg8iaoAKauwTie" alt="securityhub grant permissions"><figcaption></figcaption></figure>
2. Sign up for Prisma Cloud on AWS Security Hub.
   1. Log in to the AWS console and select **Security Hub**.

      <figure><img src="/files/KySclsWM41BIOMTFBdtG" alt="securityhub aws"><figcaption></figcaption></figure>
   2. Navigate to **Integrations** and enter **Prisma Cloud Enterprise** as the search term.
   3. Find **Palo Alto Networks: Prisma Cloud Enterprise** and **Accept findings**.

      <figure><img src="/files/BpSu1W6oMyUdLOGxumvb" alt="securityhub enabled prisma cloud"><figcaption></figcaption></figure>
3. Set up the AWS Security Hub Integration on Prisma Cloud.

   Set up the AWS Security Hub as an integration channel on Prisma Cloud so that you can view security alerts and compliance status for all your AWS services from the AWS console.

   1. Log in to Prisma Cloud.
   2. Select **Settings > Integrations & Notifications**.
   3. **Add Integration > AWS Security Hub**. A modal wizard will open, allowing you to add the details for the AWS Security Hub integration.
   4. Set the **Integration Name** to the AWS account to which you assigned AWS Security Hub read-only access.
   5. (tt:\[Optional]) Enter a **Description**.
   6. Select **Regions**.

      Make sure to select the region(s) where Prisma Cloud on AWS Security Hub is enabled for your cloud account, or else you will receive an error while testing the integration.
   7. (tt:\[Optional]) Select a **Default Region**.

      Make sure you select the default region to receive alert notifications for global resources. For example, if you want to receive alerts for IAM resources—which are global and not linked to any specific region—you must choose a default region. If you do not select a default region for global resources, you will not receive alerts.

      <figure><img src="/files/Tl0Qk2KnpMlnVHvGZbiC" alt="aws security hub integrate 1"><figcaption></figcaption></figure>
   8. Click **Next**, review the **Summary**, and then **Test Integration**.

      <figure><img src="/files/gCcVAwOEgNuK20qvyHqf" alt="aws security hub integrate 2"><figcaption></figcaption></figure>
   9. **Save Integration** if the test is successful.

      <figure><img src="/files/vi092RS3NKtB8CKCDucV" alt="aws security hub integrate 3"><figcaption></figcaption></figure>

      Once you successfully set up the integration, you will find it listed on the Integrations page. You can **View**, **Edit**, or **Delete** the integration from the **Actions** panel. You can also check the integration status periodically by clicking on the **Get Status** link.

      <figure><img src="/files/Zv0cupQh5DgK0kPHfjD3" alt="aws security hub integrate 4"><figcaption></figcaption></figure>
4. Modify an existing alert rule or create a new alert rule to specify when to [send alert notifications](/content-collections/alerts/send-prisma-cloud-alert-notifications-to-third-party-tools.md).

   If you have integrated an AWS Organization account with Security Hub on Prisma Cloud, it is considered a standalone account. This means you will only receive alerts for the master account on Security Hub, not its child accounts. To receive alerts for every child account linked to that master account, you must repeat Steps 1 through 3 and then configure alert rules for each account.
5. View Prisma Cloud alerts on AWS Security Hub.
   1. Log in to the AWS console and select **Security Hub**.
   2. Click **Findings** to view the alerts.
   3. Select the **Title** to view details of the alert description.

      <figure><img src="/files/UWN8FwzEu9hy7XAfqS5z" alt="securityhub findings details"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/administration/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-aws-security-hub.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.