AWS · Cloud service
AWS Security Hub with OrchestrAI
Catalog exported 2026-09-02
Enable AWS Security Hub and review findings and compliance standards from chat.
OrchestrAI exposes 4 Security Hub operations: 3 are low-risk (read-only or low-impact), and 1 create or modify resources and run only after you confirm the plan. 1 of them also carries a step-level approval gate.
What teams use it for
Security teams use OrchestrAI to enable Security Hub in an account, pull findings filtered by severity or resource for a weekly review, and check which compliance standards such as CIS or the AWS Foundational Security standard are enabled and their scores. Reading findings and standards is low risk, and enabling the service waits for your confirmation. Enabling or disabling individual standards and updating a finding's workflow status are not covered, so triage still happens inside Security Hub.
Every Security Hub operation, with its risk level
| Operation | What it does | Risk | Step-level approval |
|---|---|---|---|
Enable Security Hub |
Enable AWS Security Hub for security posture management | Low risk | No |
Get Security Hub Findings |
Get Security Hub security findings | Low risk | No |
Get Security Hub Standards |
Get Security Hub compliance standards | Low risk | No |
Enable Security Hub |
Enable AWS Security Hub | Creates resources | Yes |
Risk tiers come from the catalog: low is read-only or low-impact, medium creates resources and is reversible, high modifies existing resources, destructive may lose data. Every plan that creates or changes resources is shown with its cost estimate and waits for your confirmation. Operations marked with a step-level approval pause again on their own step. Destructive operations require a typed risk phrase.
Prompts that work
- Enable Security Hub in us-east-1
- Show me all critical Security Hub findings for S3 resources
- Which Security Hub standards are enabled and what are their compliance scores?
Before anything runs
Every mutation shows its plan, cost estimate, and blast radius, then waits for your confirmation. Destructive operations require a typed risk phrase. Credentials are minted per run through OIDC federation and discarded afterward; nothing you create here is invisible later, because every resource lands in the desired-state ledger where drift is detected and can be converged. Details on the security page.
Frequently asked questions
- Can OrchestrAI mark Security Hub findings as resolved?
- No, it reads findings but does not update workflow status, so resolve or suppress them in the console.
- Does OrchestrAI enable Security Hub standards like CIS?
- Not yet; it can enable Security Hub itself and report which standards are active, but turning standards on or off is done in the console.
- Which Security Hub operations need an extra approval step?
- One operation carries a step-level approval gate on top of plan confirmation: Enable Security Hub. None of them is classed destructive.
Other AWS services
Related integrations
Try it on your own account
Connect your cloud read-only and see your resources, drift, and costs before anything runs. $5 minimum to start. Unused credits refunded in your first 14 days.
Unused credits refunded in your first 14 days.