AWS Security Hub Pricing Calculator
Model Essentials security checks and finding ingestion across accounts — see why enabling every CIS, PCI, and NIST standard at once doubles the bill.
- No signup
- Instant results
- ~3 min
Rates reviewed
Organization scope
us-east-1list rates, pricing as of 2026-07-04. Essentials consolidates Inspector + CSPM. 30-day free trial not modeled. Source: AWS public pricing.
Resource inventory (billable units)
1 instance = 1 resource unit.
12 functions = 1 resource unit.
18 images = 1 resource unit.
125 IAM resources = 1 resource unit.
Who This Tool Is For
Security and compliance teams enabling Security Hub across multi-account AWS Organizations before a SOC 2, PCI DSS, or CIS benchmark program.
Why We Built This Tool
Essentials consolidates Security Hub, Amazon Inspector, and CSPM into per-resource pricing — but Threat Analytics and large EC2 fleets still compound quickly.
What Problem It Solves
- Inspector double-billing fear. Essentials replaces separate Inspector EC2/ECR/Lambda charges with one resource unit price.
- Multi-account math. Resource units sum across all monitored resources — not per account flat fee.
- Standards sprawl. Enabling every framework increases finding volume and team triage load.
See our Security Hub setup guide or cloud security service.
Frequently Asked Questions
What is a Security Hub resource unit?
Essentials pricing anchors on EC2 instances (1 unit each). Lambda functions count as 1/12 unit, ECR images as 1/18 unit, and IAM users/roles as 1/125 unit. All other monitored resources are included at no extra per-item charge.
Does Essentials replace Amazon Inspector?
Yes. Essentials includes EC2 vulnerability scanning, ECR image scanning, Lambda code scanning, and CIS benchmark assessments in one per-resource price — you do not pay separate Inspector rates for those capabilities.
What is Threat Analytics?
Threat Analytics is an optional add-on powered by GuardDuty that detects active threats across CloudTrail, VPC Flow Logs, DNS, S3, EKS, and Lambda. It bills on event and log volume separately from Essentials.
Is there a free trial?
Security Hub Essentials includes a 30-day unlimited free trial per account per Region. Threat Analytics is not included in the Security Hub trial but may have separate GuardDuty trial eligibility.
How does this compare to standalone GuardDuty + Inspector?
Essentials typically reduces billing complexity by consolidating Inspector and CSPM. Compare your current Inspector instance/image/Lambda line items against the resource unit total from this calculator.
Are prices the same in every region?
Resource unit pricing may vary by region. This calculator uses us-east-1 list rates ($3.75/resource unit in AWS pricing examples) — verify with the Security Hub Cost Estimator in your account.