AWS Security Hub CSPM pricing

3 plans on the record · a free trial

Every plan

Security Hub Essentials

Priced on request

Pay-as-you-go; resource unit / mo; prorated by monitored time

Per-resource charges apply to EC2 instances, ECR container images, Lambda functions, and IAM users/roles; other monitored resources are included; AWS and Azure coverage

Read 4 Oct 2026 · aws.amazon.com

Security Hub Extended Plan

Priced on request

Pay-as-you-go per partner; no upfront commitments

Essentials must be enabled first; charges are additional to Essentials; 23 curated partner solutions across 10 security categories

Read 4 Oct 2026 · aws.amazon.com

Threat Analytics + Lambda Code Scanning add-ons

Priced on request

Tiered by volume; in addition to Essentials

Threat Analytics covers CloudTrail management events, S3 data events, VPC Flow Logs, DNS query logs, and EKS audit logs; Lambda code scanning scans on deployment and periodically

Read 4 Oct 2026 · aws.amazon.com