View a markdown version of this page

Supported resource types for exposure findings in Security Hub - Amazon Security Hub
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Supported resource types for exposure findings in Security Hub

Amazon Security Hub generates exposure findings for the following types of Amazon resources:

  • AWS::DynamoDB::Table

  • AWS::EC2::Instance

  • AWS::ECS::Service

  • AWS::EKS::Cluster

  • AWS::IAM::User

  • AWS::Lambda::Function

  • AWS::RDS::DBInstance

  • AWS::S3::Bucket

  • AWS::SageMaker::NotebookInstance

If you have an Azure connector, Security Hub also generates exposure findings for the following types of Azure resources:

  • microsoft.app/containerapps

  • microsoft.compute/virtualmachines

  • microsoft.containerservice/managedclusters

  • microsoft.documentdb/databaseaccounts

  • microsoft.graph/user

  • microsoft.sql/servers/databases

  • microsoft.storage/storageaccounts/blobservices/containers

  • microsoft.web/sites

Security Hub generates one exposure finding per primary resource. If a resource does not have any exposure traits or has insufficient traits, Security Hub does not generate an exposure finding for that resource.