# AWS Config compliance results proving continuous security monitoring is switched on account-wide — GuardDuty threat detection enabled (optionally centralized to a delegated admin) and Security Hub aggregating control findings

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/config-threat-monitoring-enabled

Recipe id: `config-threat-monitoring-enabled` · cadence continuous · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-MLA-RVL`
- KSI `KSI-SVC-EIS`
- control `si-4`

## Collection

Kind: `config-rule`

```sh
# guardduty-enabled-centralized
aws configservice get-compliance-details-by-config-rule --config-rule-name guardduty-enabled-centralized --compliance-types NON_COMPLIANT
# securityhub-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name securityhub-enabled --compliance-types NON_COMPLIANT
# configuration-recorder-status
aws configservice describe-configuration-recorder-status
# guardduty-enabled-centralized-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names guardduty-enabled-centralized
# securityhub-enabled-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names securityhub-enabled
# describe-regions
aws ec2 describe-regions --query 'Regions[].RegionName' --output text
# list-accounts
aws organizations list-accounts --query 'Accounts[].Id' --output text
```

## Expected output

Two EvaluationResults arrays; empty NON_COMPLIANT sets mean GuardDuty is enabled in the account/Region (and results land in the CentralMonitoringAccount if you set one) and Security Hub is enabled. Managed rule identifiers: GUARDDUTY_ENABLED_CENTRALIZED, SECURITYHUB_ENABLED Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.

## Assertions

- {"field":"guardduty-enabled-centralized.EvaluationResults","op":"count_eq","value":0,"controls":["si-4"],"description":"GuardDuty is enabled in the account and Region, or in the CentralMonitoringAccount when one is named — the parameter moves where the rule looks; it does not prove this account reports anywhere."}
- {"field":"securityhub-enabled.EvaluationResults","op":"count_eq","value":0,"controls":["si-4"],"description":"Security Hub is enabled and aggregating control findings."}
- {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["si-4"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."}
- {"field":"guardduty-enabled-centralized-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["si-4"],"description":"guardduty-enabled-centralized has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"guardduty-enabled-centralized-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["si-4"],"description":"guardduty-enabled-centralized has a successful evaluation on record."}
- {"field":"securityhub-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["si-4"],"description":"securityhub-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"securityhub-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["si-4"],"description":"securityhub-enabled has a successful evaluation on record."}

## GovCloud

AWS Config, GuardDuty, and Security Hub are available in AWS GovCloud (US); detector and hub ARNs use partition arn:aws-us-gov

## Notes

This proves the monitoring capability is ON, which is the automatable half of SI-04. Whether findings are triaged and acted on within your SLA is the review workflow — surface that with the GuardDuty finding-plus-response recipe (see guardduty-suspicious-iam-activity-response) and AU-06 log review. Set CentralMonitoringAccount to your delegated-administrator account id in a multi-account org so member accounts are evaluated against the aggregation point. Both rules are evaluated per Region, so GuardDuty disabled in any Region other than the one queried is invisible; and whether findings are analyzed and acted on — SI-04(a), (b), (d) — is a human workflow. Partial for both reasons.

## References

- {"title":"AWS Config managed rule: guardduty-enabled-centralized","url":"https://docs.aws.amazon.com/config/latest/developerguide/guardduty-enabled-centralized.html"}
- {"title":"AWS Config managed rule: securityhub-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/securityhub-enabled.html"}