Security Compliance
AWS Security Hub CSPM control compliance against AWS Foundational Security Best Practices and any other enabled standard, per region — the pass / fail score mirrors the AWS console's Security Score.
What this pane shows
Security Hub CSPM control compliance for the selected region: for each enabled standard (AWS Foundational Security Best Practices, CIS, PCI DSS, NIST 800-53 …) it counts controls PASSED vs FAILED and shows the compliance % — the same maths as the AWS console's Security Score, matched control-for-control. The failing controls are listed by severity so you can see exactly what to fix.
This is the counterpart to Security Findings: that pane is the consolidated Inspector / GuardDuty / Macie product findings; this one is control compliance. Integrated findings are excluded here so a CVE never reads as "non-compliance".
Key use cases
- Track a region's compliance score against a standard, matching the console.
- See the failing controls prioritised by severity — the actionable remediation list.
- Switch region to inspect posture where each standard is actually enabled.
- Confirm a remediation flipped a control from FAILED to PASSED.
How to embed
lp.js is the single-entry loader: it injects the shared LightPane runtime
(and sd-embed.css) once per page. Add this pane's own stylesheet and script;
the pane mounts itself wherever the matching <div> is in the DOM.
<!-- In <head> — this pane's stylesheet -->
<link rel="stylesheet" href="https://lightpane.io/_pane-tests/aws/security-hub/security-hub.css">
<!-- Your access key (inline, or set window.lpEmbed.accessKey from your own JS) -->
<script>window.lpEmbed = { accessKey: "<your-access-key>" };</script>
<!-- Where the pane should appear -->
<div class="lp-security-hub-panel" data-lp-account="<your-account-alias>"></div>
<!-- Before </body> — shared loader + this pane's script -->
<script src="https://lightpane.io/embed/lp.js"></script>
<script src="https://lightpane.io/_pane-tests/aws/security-hub/security-hub.js" defer></script>
Tier
Available on Builder and above.
Build notes
Mock-only at the moment — live-wiring tracked in the roadmap.