Linking AWS Security Hub as a source

Beta release

This source is currently in beta. It works end to end, but you may still hit rough edges. Let us know if you do.

Let AI connect your sources for you

Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.

Learn more

The AWS Security Hub connector syncs security findings, enabled standards, controls, product integrations, and member accounts into the PostHog data warehouse, so you can analyze your security posture alongside your product data.

Prerequisites

You need an AWS account with Security Hub CSPM enabled in your region. If you select an aggregation region, AWS can also return findings from linked regions.

You also need an IAM user or role with the following permissions:

securityhub:GetFindings
securityhub:DescribeStandards
securityhub:GetEnabledStandards
securityhub:GetInsights
securityhub:DescribeStandardsControls
securityhub:ListSecurityControlDefinitions
securityhub:DescribeProducts
securityhub:ListMembers

Adding a data source

In PostHog, go to the Sources tab of the data pipeline section.
Click + New source and click Link next to this source.
Enter your credentials (see Configuration below) and click Next.
Select the tables you want to sync, choose a sync method and frequency, then click Import.

Once the syncs are complete, you can start querying this data in PostHog.

When linking AWS Security Hub, you'll need:

AWS access key ID – the access key ID for your IAM user or role (starts with AKIA...).
AWS secret access key – the corresponding secret access key.
AWS session token (optional) – only required if you're using temporary STS credentials. Temporary credentials expire, so you'll need to reconnect when they do.
AWS region – the region where Security Hub is enabled (for example, us-east-1).

Creating IAM credentials

In the AWS Console, go to IAM > Users and create a new user (or use an existing one).
Attach a policy with the following permissions:

JSON
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "securityhub:GetFindings",
        "securityhub:DescribeStandards",
        "securityhub:GetEnabledStandards",
        "securityhub:GetInsights",
        "securityhub:DescribeStandardsControls",
        "securityhub:ListSecurityControlDefinitions",
        "securityhub:DescribeProducts",
        "securityhub:ListMembers"
      ],
      "Resource": "*"
    }
  ]
}

Create an access key for your IAM user under Security credentials > Access keys.
Copy the Access key ID and Secret access key – you'll need both when linking the source in PostHog.

Sync modes

Each table can be synced in one of several modes, depending on what the source supports:

Webhook (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes.
Incremental – only new or updated rows are synced on each run, using a cursor field (such as an updated_at timestamp). Cheaper than a full refresh, but deletes aren't captured.
Append only – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs.
Full refresh – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected.

See sync methods for a full explanation of how each mode works and how to choose between them.

The findings table supports incremental sync using updated_at as the cursor. All other tables use full refresh, replacing the entire table contents on each sync.

Configuration

Option	Description
`AWS access key ID` Type: text Required: True
`AWS secret access key` Type: password Required: True
`AWS session token` Type: password Required: False	Temporary credentials expire. Reconnect with new credentials when the session token expires.
`AWS region` Type: text Required: True

Supported tables

Table	Description	Sync method	Incremental field	Primary key
`findings`	Security findings with severity, resources, compliance status, and workflow status.	Incremental, Full refresh	updated_at	—
`standards`	Available security standards and their descriptions.	Full refresh	—	—
`enabled_standards`	Enabled security standards and their subscription status.	Full refresh	—	—
`insights`	Custom insights with their filters and grouping fields. AWS managed insights are excluded.	Full refresh	—	—
`standards_controls`	Controls in each enabled standard, with enablement status, severity, and disablement reasons.	Full refresh	—	—
`security_control_definitions`	Security control definitions with titles, severity, and remediation guidance.	Full refresh	—	—
`products`	Product integrations that can send findings to Security Hub, with vendor names and descriptions.	Full refresh	—	—
`members`	Member accounts of the Security Hub administrator account and their relationship status.	Full refresh	—	—
`remediations`	Remediation targets for exposure findings, sorted by priority, with their expected outcome and affected resource.	Full refresh	—	—
`remediation_exposures`	Exposure findings linked to each remediation target, with severity before and after the fix.	Full refresh	—	—
`insight_results`	Finding counts for each group of every custom insight.	Full refresh	—	—
`finding_history`	Changes to each finding over time, with the fields that changed and who changed them.	Incremental, Full refresh	update_time	—
`findings_v2`	Security Hub findings in the Open Cybersecurity Schema Framework (OCSF) format.	Incremental, Full refresh	modified_time	—
`resources_v2`	Resources that Security Hub tracks, with their configuration, tags, and finding summaries.	Full refresh	—	—

Troubleshooting

If you see "AWS rejected the credentials", check that the access key ID and secret access key are correct and that the key is still active in IAM.
If you see a signature error, re-enter the secret access key. If you're using temporary credentials, the session token may have expired.
If you see "Grant the required securityhub read permissions", ensure all eight securityhub:* permissions are attached to the IAM user or role.
If you see "Enable AWS Security Hub CSPM in the configured region", enable Security Hub in the AWS region you specified.
If the standards_controls table syncs no rows, your account may not have any enabled standards. Enable a security standard in Security Hub first.

If your sync is failing or data looks wrong, see the Data warehouse troubleshooting guide. If that doesn't help, contact support – we're happy to help.