AWS Security Hub pricing: two models (2026)

AWS Security Hub pricing now means two different price lists. The page at aws.amazon.com/security-hub/pricing/ describes the new Security Hub, billed per resource unit at $3.75 a month in US East (N. Virginia), with the rate varying by Region. The per-check model sits on a separate page under the name Security Hub CSPM, and that model has a second bill attached: AWS Config configuration items, which AWS prices separately and which the checks cannot run without.

How much does AWS Security Hub cost in 2026?

It depends on which of the two services you have enabled, and AWS documents them as separate products. The Security Hub and Security Hub CSPM overview says "AWS Security Hub and AWS Security Hub CSPM are AWS services that protect your cloud environment", and recommends enabling both. They price on completely different units.

The new AWS Security Hub pricing page bundles several services under one meter. Its Essentials plan lists "Cloud Security Posture Management (Security Hub CSPM)", "EC2 vulnerability scanning (Inspector)" and "Service Linked Config Recorder (AWS Config)" among the capabilities included in the per-resource unit price. Threat Analytics, powered by GuardDuty, is a separate add-on billed per event and per GB, and the Extended plan adds third-party partner products on top.

Enabling the new service changes where existing charges land. The pricing FAQ states: "You'll receive consolidated charges under Security Hub instead of separate service bills for the capabilities included in Security Hub plans." The choice is made account by account: "When you don't enable Security Hub in an account, that account uses individual service pricing for each security service."

What is a resource unit in Security Hub Essentials pricing?

A resource unit is one EC2 instance, and four resource types are converted into it. On AWS, everything else Security Hub monitors is included. From the pricing page: "per-resource pricing only applies to four primary resource types: EC2 instances, ECR container images, Lambda functions, and IAM users and roles. All other monitored resources are included." Azure is not free once connected: "For Microsoft Azure, the same pricing applies to Azure equivalent resources, once you create an integration with Microsoft Azure."

The $3.75 figure is the US East (N. Virginia) rate used in AWS's examples, and it is not the same everywhere. The AWS Price List offer file for Security Hub lists "$0.0052083 per EC2 instance-hour for AWS Security Hub Essentials plan in US East (N. Virginia)" but "$0.0056944 per EC2 instance-hour for AWS Security Hub Essentials plan in South America (Sao Paulo)", which is about $4.10 a unit over a 720-hour month. The threat analytics per-GB rates vary by Region as well, so check the Region selector on the pricing page before budgeting.

Counts are averages, not month-end snapshots. The FAQ divides instance hours by a 720-hour month, so three instances running 360, 350 and 10 hours count as one. Lambda functions only count if they are "marked $LATEST and were invoked or updated in the last 90 days", and IAM principals are counted as those "that existed during the month, prorated daily."

Check AWS's second worked example before you copy it into a budget. It lists 1,000 instances, 5,000 functions, 2,000 images and 3,000 IAM principals, and its own breakdown line converts those to 1,000 + 417 + 111 + 24, which is 1,552 units. The charge line above it bills "2,233 resource units x $3.75" for $8,374.99. At the 1,552 units the page itself derives, that line is about $5,820. The example also labels itself an Essentials plan example while including $400 of threat detection and $53,000 of security data processing, both of which are add-on meters. The data tiers do reconcile: in US East (N. Virginia), $0.55 per GB for the first 1,000 GB, $0.25 for the next 9,000 and $0.10 above that gives exactly the $53,000 AWS prints for 500 TB.

What does Security Hub CSPM charge per security check?

The Security Hub CSPM pricing page keeps the original model: "Security Hub CSPM is priced along three dimensions: the quantity of security checks, the quantity of finding ingestion events, and the quantity of rule evaluations processed per month." A check is one control evaluated against one resource, and "You are only charged once for a check when identical controls that are common across different standards are evaluated against the same resource."

Two details change the estimate. First, findings from your own checks are free: "You are not charged for finding ingestion events associated with Security Hub CSPM security checks." The ingestion meter bills findings arriving from GuardDuty, Inspector, Macie and partner products, and in AWS's third example that meter is the largest line, $899.10 of a $1,683.00 total.

Second, the tiers do not pool across Regions in AWS's arithmetic. The page says AWS Organizations support lets you "enjoy tiered pricing for your entire organization's security checks", but every example prices one Region's volume and then multiplies by the Region count. Example 3 runs 200,000 checks in each of three Regions and bills $180.00 per Region, $540.00 in total. Had the 600,000 checks been tiered as one pool, the bill would be $470.00. In AWS's examples, accounts share the tiers and each Region starts them again. The price list describes them more narrowly still, as "The first 100,000 security checks per account per region per month cost USD0.001 per check", so confirm on your own bill how the tiers were applied before counting on an organization-wide discount.

Does Security Hub CSPM need AWS Config, and who pays for it?

Yes, and on the older model you pay AWS Config directly. The CSPM pricing page is explicit: "AWS Config is required for AWS security checks, and configuration items are priced separately from Security Hub CSPM." What it does waive is the rule charge: "Security Hub CSPM customers are not charged separately for any AWS Config rules enabled by Security Hub CSPM."

So the Config line on a CSPM bill is configuration items, which the AWS Config pricing page prices in its first example at "$0.003 per continuous configuration item". How those items accumulate, and why churn rather than resource count drives them, is covered in what AWS Config actually costs. The Security Hub specific part is in the AWS Config prerequisites for Security Hub CSPM, which name a configuration item that Security Hub itself generates:

"Security Hub CSPM can impact your AWS Config configuration recorder costs by updating the AWS::Config::ResourceCompliance configuration item."

That item updates when a control changes compliance state, and AWS recommends turning its recording off if nothing else uses it: "You don't need to record AWS::Config::ResourceCompliance for security checks to work in Security Hub CSPM." The same page recommends recording global resources such as IAM in one Region only, since recording them in every Region pays for the same items repeatedly.

The new Security Hub moves this cost. With both services enabled, "Security Hub CSPM automatically creates a service-linked configuration recorder", and the Security Hub concepts page says that recording "is provided to all Security Hub customers as part of the Essential plan pricing." The catch is on the Config side. The prerequisites page adds that "Security Hub does not use the customer-managed configuration recorder in AWS Config", so a recorder you already run for Config rules or conformance packs keeps billing as before. And the AWS Config recorder documentation warns that when a service-linked recorder with a PAID scope records the same types, "the recorder with the higher recording frequency takes precedence", even if your own recorder is set to daily. AWS does not state which scope Security Hub's own recorders use, so watch your Config line for the first month after enabling it.

Is Security Hub Essentials cheaper than Security Hub CSPM plus AWS Config?

Only if your account runs a lot of checks per resource unit, and AWS's pages give you enough to find the break-even. At the US East (N. Virginia) rate of $3.75 a unit, one resource unit costs the same as 3,750 CSPM security checks at $0.0010, or 1,250 continuous configuration items at $0.003. Each EC2 instance, or each 12 Lambda functions, has to account for that much CSPM and Config usage before the Essentials plan comes out ahead on those two lines alone.

A hypothetical serverless account in one Region shows how the unit ratios work. The resource counts, check volume and configuration item volume below are illustrative assumptions, not AWS figures. The rates are AWS's US East (N. Virginia) rates.

Three things fall out of it. Lambda functions are 20 of the 28 units, so on a serverless account the resource unit bill follows function count, not the two instances that look like the workload. To reach $105.00 on the CSPM side, the same account would need 90,000 security checks a month alongside its 5,000 configuration items. And the comparison is not like-for-like: the Essentials price includes Inspector vulnerability scanning, which the CSPM column does not buy at all.

Replace the Config assumption with your own number before trusting the result. CSPM without the new service needs a customer-managed recorder, and the prerequisites page notes that "By default, AWS Config records all supported Regional resources that it discovers in the AWS Region in which it is running." A default recorder therefore produces configuration items for every supported resource type in the Region, not just the ones your enabled controls check.

How long is the AWS Security Hub free trial, and what does it exclude?

Thirty days for each account in each Region, on both products. For the new service, the pricing page says "Every AWS account in each Region enabled with Security Hub receives a free trial, even if you previously used AWS Security Hub CSPM or Amazon Inspector free trials." It does not cover everything: "Add-on capabilities (threat analytics powered by Amazon GuardDuty and AWS Lambda code scanning powered by Amazon Inspector) and the Extended plan are not included in the Security Hub free trial".

For CSPM, the trial waives Security Hub's own charges and nothing around them. The Security Hub CSPM user guide says "you are charged for usage of other services that Security Hub CSPM interacts with, such as AWS Config items." The first month of Config recording is billed in full while the Security Hub line reads zero. The same page describes enrolment as happening "When you enable Security Hub CSPM in an AWS account for the first time", while the CSPM pricing page grants a trial to every account in each Region. Treat a newly enabled Region as possibly still in trial, and check the usage page rather than assuming.

Does the Security Hub cost estimator show your real bill?

It shows a comparison, with two limits worth knowing. The Security Hub cost estimator documentation describes it as showing "what your individual service costs are across AWS Security Hub CSPM, Amazon Inspector, and Amazon GuardDuty and what your estimated costs would be in Security Hub". Then:

• Every estimate uses one Region's rates. The notes state "All estimates use us-east-1 (N. Virginia) rates", whichever Regions your resources run in.
• Discounts are left out. "Modified estimates do not include enterprise discounts; only Cost Explorer data reflects actual discounted costs".

It also does not price Extended plan partner solutions. Once the service is on, the Security Hub usage page projects a month from "the last 7 days of usage, extrapolated to a full 30-day billing cycle", and warns that it "does not currently detect when Security Hub has been disabled on an account", so allow a week after disabling. Aggregation is free: according to the cross-Region aggregation documentation, "Cross-Region aggregation does not add to the cost of Security Hub."

Which AWS security costs sit next to a Security Hub bill?

Threat detection is the neighbouring bill to price first: see why GuardDuty bills flow logs you never made, which is the capability the Threat Analytics add-on repackages. If you run CSPM without the new service, the configuration item side is in the AWS Config cost breakdown. Two adjacent meters are worth knowing as well: what CloudTrail trails and data events cost and AWS KMS key pricing at scale. For web ACLs, see how AWS WAF pricing actually adds up.