What happened
AWS has added resource criticality to exposure prioritisation in Security Hub, as announced on AWS What’s New. You can set criticality with an automation rule, for example marking every compute resource in one account as Very High. Security Hub also infers a value from resource tags and names with no configuration, and records which source decided it.
Why it matters
Most small teams have more findings than hours. The hard part is rarely finding issues. It is deciding which one to fix first. Until now, an exposure on a forgotten test instance could look much like one on the service that takes your payments.
Criticality gives Security Hub a way to weigh that. It shows as a column on the Resources page, where you can sort, filter and group, and on the Impact assessment tab of an exposure finding. For a team without a dedicated platform or security function, that is a cheap way to turn “everything is red” into a short, ordered list.
There is a catch. The inferred values come from your tags and names, so they are only as good as your naming habits. If production and staging look alike, the ranking will be less useful. Automation rules apply to resources already in your inventory and to new ones, so a sensible rule covers future growth too.
According to AWS, the feature is included with Security Hub Essentials at no additional cost, needs no new enablement and is always on. Check the Region table to confirm Security Hub is available where you run workloads.
What to do this week
- Open the Resources page and look at the criticality column. Note what Security Hub has already inferred and which source it used.
- Check that the values match reality. Pick your five most important systems and see how they are rated.
- Write one automation rule for the obvious case, such as marking compute resources in your production account as Very High.
- Tidy tags and names where they mislead, so the inferred values improve without more rules.
- Re-sort your exposure findings by criticality and agree who owns the top items.
Need a hand?
Deciding what counts as critical is a business question as much as a technical one, and we help teams turn it into clear rules and a workable fix order. Our Security & Compliance service covers exactly this kind of setup. The first call is free and it is with an engineer, not a salesperson.
Source: AWS Security Hub now supports resource criticality for prioritization
Related service: Security & Compliance