Security Hub Network Scanning Is Finally Available in AWS GovCloud (US)!
Hi, it's Shii-chan!
AWS What's New
aws.amazon.com
A feature that turns "probably fine" into "actually checked" has arrived in GovCloud.
What was announced?
In AWS's What's New feed, the AWS Security Hub Network Scanning feature is now supported in AWS GovCloud (US).
Why it matters
Network Scanning probes your resources from the internet to detect actual reachability, not just what could be reachable based on security group rules and route tables.
What changes
Security Hub already has network reachability findings that identify configurations that could make a resource reachable from the internet. Network Scanning confirms that such configurations do exist.
Dive Deep
What it detects
- Public IP addresses, virtual machines, and load balancers
- Reachable ports
- The services running behind those ports
Output and correlation
- Each reachable port generates a Security Hub finding with evidence of the port and service discovered
- Security Hub Exposures automatically correlates these findings with other findings and resource configurations to determine broader risk
Enablement and pricing
- Existing customers can enable it in individual accounts and Regions, or across an organization with a configuration policy
- For new Security Hub customers, it is on by default
- It is included with Security Hub Essentials at no additional cost in all commercial and GovCloud (US) Regions that support Security Hub
Wrap-up
- Network Scanning is now in GovCloud (US)
- It confirms real reachability instead of inferring it from configuration
- Each reachable port produces a finding with evidence
- Included with Essentials at no additional cost
This is for security teams who want to verify internet exposure in GovCloud!