Security Hub automatic severity change

This behavior is expected and by design—but it can be confusing. Here's why:

1. Severity in Security Hub findings is dynamic.

   • The severity reflects the current risk posed by the resource's compliance state.

   • When a control status is FAILED, severity is based on how critical that control is.

   • When the same control flips to PASSED, the finding is still kept (for visibility), but:

     • Its status becomes PASSED.
     • Its severity drops to INFORMATIONAL.

2. This is documented behavior.

   • From AWS Docs:

     If a finding is resolved, the record is retained with a severity of INFORMATIONAL and a compliance status of PASSED.

3. Impact of the New Console (Preview)

   • While the preview console itself didn't change this core logic, the recent update may have made these transitions more visible or highlighted finding state transitions in new ways.
   • The finding history UI and filters are now more granular, which may be why you're only noticing it post-preview.

Use Compliance.Status + Severity together

Instead of relying solely on severity, use both in your logic:

{
  "Compliance.Status": "FAILED",
  "Severity.Label": "HIGH"
}

This ensures you only act on active, high-risk issues.