---
title: Security Hub should be enabled in all active regions
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Security Hub should be enabled in all
  active regions
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Security Hub should be enabled in all active regions
 
## Description{% #description %}

AWS regions should each have AWS Security Hub enabled, meaning the account is subscribed to Security Hub in that region (a hub is returned by `aws securityhub describe-hub` instead of an `InvalidAccessException`). Enabling Security Hub in every region surfaces misconfiguration and threat-detection findings everywhere workloads run instead of leaving regional blind spots. Security Hub requires AWS Config to be enabled in the region.

## Remediation{% #remediation %}

Attach the `AWSSecurityHubFullAccess` managed policy to the IAM identity used, then enable Security Hub in each region from the console by following the [Enabling Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-settingup.html) guide, or run `aws securityhub enable-security-hub --enable-default-standards` (or `--no-enable-default-standards`) with the [enable-security-hub CLI command](https://docs.aws.amazon.com/cli/latest/reference/securityhub/enable-security-hub.html) in each region.

## References{% #references %}

- [AWS CLI describe-hub command](https://docs.aws.amazon.com/cli/latest/reference/securityhub/describe-hub.html)
- [AWS managed policies for Security Hub](https://docs.aws.amazon.com/securityhub/latest/userguide/security-iam-awsmanpol.html)
- [CIS Amazon Web Services Benchmarks](https://www.cisecurity.org/benchmark/amazon_web_services)