AWS Security Hub pricing calculator
Essentials Plan and Add-On Capabilities. Estimate your costs using AWS list prices.
Estimates from AWS list prices, not an AWS quote. Discounts, taxes and credit terms may affect your bill.
01 · How AWS Security Hub pricing works
What you pay for
- Essentials: $3.75 per resource unit per month; 1 EC2 instance = 1 unit, 12 Lambda functions = 1, 18 ECR images = 1, 125 IAM users/roles = 1 (prorated).
- Threat Analytics add-on: $4 per million CloudTrail management events; security data tiered $0.55 / $0.25 / $0.10 per GB; runtime per vCPU.
- Lambda code scanning add-on: per function per month.
- Extended plan: partner solutions priced per user, endpoint or TB.
Common cost traps
- Enabling Security Hub moves Inspector and CSPM billing into resource-unit pricing; compare before switching.
- Every EC2 instance is a full resource unit ($3.75/month) regardless of size.
- Extended plan partner solutions carry minimum seat or TB commitments.
Ways to reduce cost
- Use the Security Hub Cost Estimator during the trial.
- Clean up unused IAM roles, old ECR images and dormant Lambda functions.
- Add Threat Analytics only where you need it.
Free Tier & account eligibility
Free Tier depends on account age. Accounts created on or after 15 July 2025 get a $100 sign-up credit plus up to $100 more for completing onboarding activities; on the Free plan these last 6 months (or until used up), on the Paid plan unused Free Tier credits stay usable for 12 months from sign-up. Accounts created before 15 July 2025 keep the legacy Free Tier (12-month offers plus always-free offers). Always-free offers apply on both plans. 30-day free trial of Essentials per account and Region, even if Security Hub CSPM or Inspector trials were used. Add-ons and the Extended plan are not included. No always-free allowance.
02 · AWS credits & runway
Do credits cover AWS Security Hub?
Security Hub Essentials resource units, Threat Analytics and Lambda code scanning add-ons are eligible usage and are offset by credits. Extended plan partner solutions are billed by AWS on a consolidated bill, but credit eligibility for those third-party products is not stated and should not be assumed. General rules: credits only offset charges from the billing cycle in which they were applied onward (never past bills), they apply only to the services listed on the credit in Billing and Cost Management > Credits, they expire on the date shown there, and accounts on the AWS Free plan cannot receive Activate credits until they upgrade to the Paid plan.
Check my creditsExcluded charges & conditions
- Upfront payments for Savings Plans and Reserved Instances (All Upfront, and the upfront part of Partial Upfront). The recurring hourly fee of a No Upfront commitment is billed as normal usage and can be offset.
- AWS Marketplace charges (Activate credits make an exception for third-party foundation models used through Amazon Bedrock).
- AWS Enterprise Support, Enterprise On-Ramp, Unified Operations, resold support and partner-led support.
- Amazon Route 53 domain name registration and transfer fees.
- Taxes (sales, use, VAT and similar), AWS Professional Services, Training and Certification, Mechanical Turk, AWS Managed Services, and any use for cryptocurrency mining.
Illustrative credit runway
Single-service examples from the supplied data, not your calculator result. Months = credit amount ÷ monthly cost, before credit expiry. Credits can expire before these theoretical months are used; coverage and other AWS services can shorten runway.
| Usage profile | Monthly estimate | $10,000 | $25,000 | $100,000 |
|---|---|---|---|---|
| Small | $143.14 | 69.9 mo. | 174.7 mo. | 698.6 mo. |
| Medium | $1,480.00 | 6.8 mo. | 16.9 mo. | 67.6 mo. |
| Large | $12,573.75 | 0.8 mo. | 2.0 mo. | 8.0 mo. |
Small profile assumptions
Essentials for 20 EC2 instances, 50 Lambda functions, 180 ECR images, 500 IAM principals | Resource units (20 + 50/12 + 180/18 + 500/125 = 38.2): 38.17 resource units x $3.75 = $143.14 | Total ~$143.14/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Medium profile assumptions
Essentials for 300 resource units, Threat Analytics on 20 M events and 500 GB data | Resource units: 300 resource units x $3.75 = $1,125.00; Threat analytics: management events: 20 million x $4 = $80.00; Threat analytics: security data: 500 GB tiered (500 @ $0.55) = $275.00 | Total ~$1,480.00/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
Large profile assumptions
Essentials for 2,233 resource units (AWS example), 100 M events, 20 TB security data | Resource units: 2,233 resource units x $3.75 = $8,373.75; Threat analytics: management events: 100 million x $4 = $400.00; Threat analytics: security data: 20,000 GB tiered (1,000 @ $0.55; 9,000 @ $0.25; 10,000 @ $0.1) = $3,800.00 | Total ~$12,573.75/month, us-east-1 on-demand list prices, before Free Tier, taxes and support.
04 · Questions
AWS Security Hub pricing FAQ
How is Security Hub priced?
Per resource unit per month ($3.75), with EC2 instances as 1 unit and Lambda, ECR and IAM resources as fractions.
Is there a free trial?
Yes, 30 days of Essentials per account and Region.
What about my existing Inspector and CSPM bills?
When Security Hub is enabled, those included capabilities are billed through Security Hub instead.
Do credits cover Security Hub?
Essentials and add-ons yes. Do not assume credits cover Extended plan partner products.
05 · Sources & estimate notes
Content pack dated 2026-10-19. Calculator rates remain their existing snapshots; this content update is not a price refresh.
Verification notes
- Security Hub moved to resource-unit pricing (Essentials $3.75/unit) in 2025-2026; legacy CSPM per-check pricing may still apply to accounts without the new plan.
- Credit eligibility of Extended plan partner solutions is not addressed in the credit terms.
- Runway prices come from the calculator repository snapshot rate card security-hub (no AWS Price List mapping in the build). Confirm the main unit prices on https://aws.amazon.com/security-hub/pricing/ before publishing.