# Security Hub Network Scanning Is Finally Available in AWS GovCloud (US)!

Hi, it's Shii-chan!

A feature that turns "probably fine" into "actually checked" has arrived in GovCloud.

## What was announced?

In AWS's What's New feed, the AWS Security Hub Network Scanning feature is now supported in AWS GovCloud (US).

## Why it matters

Network Scanning probes your resources from the internet to detect actual reachability, not just what could be reachable based on security group rules and route tables.

## What changes

Security Hub already has network reachability findings that identify configurations that could make a resource reachable from the internet. Network Scanning confirms that such configurations do exist.

## Dive Deep

**What it detects**

- Public IP addresses, virtual machines, and load balancers
- Reachable ports
- The services running behind those ports

**Output and correlation**

- Each reachable port generates a Security Hub finding with evidence of the port and service discovered
- Security Hub Exposures automatically correlates these findings with other findings and resource configurations to determine broader risk

**Enablement and pricing**

- Existing customers can enable it in individual accounts and Regions, or across an organization with a configuration policy
- For new Security Hub customers, it is on by default
- It is included with Security Hub Essentials at no additional cost in all commercial and GovCloud (US) Regions that support Security Hub

## Wrap-up

- Network Scanning is now in GovCloud (US)
- It confirms real reachability instead of inferring it from configuration
- Each reachable port produces a finding with evidence
- Included with Essentials at no additional cost

This is for security teams who want to verify internet exposure in GovCloud!