configuration_policy_associations

Creates, updates, deletes, gets or lists a configuration_policy_associations resource.

Overview

Name	configuration_policy_associations
Type	Resource
Id	aws.securityhub.configuration_policy_associations

Fields

The following fields are returned by SELECT queries:

batch_get_configuration_policy_associations

Name	Datatype	Description
configuration_policy_associations	array	Describes associations for the target accounts, OUs, or the root.
unprocessed_configuration_policy_associations	array	An array of configuration policy associations, one for each configuration policy association identifier, that was specified in the request but couldn’t be processed due to an error.

get_configuration_policy_association

Name	Datatype	Description
association_status	string	The current status of the association between the specified target and the configuration. (PENDING, SUCCESS, FAILED)
association_status_message	string	The explanation for a FAILED value for AssociationStatus. (pattern: <code>.\S.</code>)
association_type	string	Indicates whether the association between the specified target and the configuration was directly applied by the Security Hub CSPM delegated administrator or inherited from a parent. (INHERITED, APPLIED)
configuration_policy_id	string	The universally unique identifier (UUID) of a configuration policy. For self-managed behavior, the value is SELF_MANAGED_SECURITY_HUB. (pattern: <code>.\S.</code>)
target_id	string	The target account ID, organizational unit ID, or the root ID for which the association is retrieved. (pattern: <code>.\S.</code>)
target_type	string	Specifies whether the target is an Amazon Web Services account, organizational unit, or the organization root. (ACCOUNT, ORGANIZATIONAL_UNIT, ROOT)
updated_at	string (date-time)	The date and time, in UTC and ISO 8601 format, that the configuration policy association was last updated.

list_configuration_policy_associations

Name	Datatype	Description
association_status	string	The current status of the association between the specified target and the configuration. (PENDING, SUCCESS, FAILED)
association_status_message	string	The explanation for a FAILED value for AssociationStatus. (pattern: <code>.\S.</code>)
association_type	string	Indicates whether the association between the specified target and the configuration was directly applied by the Security Hub CSPM delegated administrator or inherited from a parent. (INHERITED, APPLIED)
configuration_policy_id	string	The universally unique identifier (UUID) of the configuration policy. (pattern: <code>.\S.</code>)
target_id	string	The identifier of the target account, organizational unit, or the root. (pattern: <code>.\S.</code>)
target_type	string	Specifies whether the target is an Amazon Web Services account, organizational unit, or the root. (ACCOUNT, ORGANIZATIONAL_UNIT, ROOT)
updated_at	string (date-time)	The date and time, in UTC and ISO 8601 format, that the configuration policy association was last updated.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
batch_get_configuration_policy_associations	select	region		Returns associations between an Security Hub CSPM configuration and a batch of target accounts, organizational units, or the root. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region. A configuration can refer to a configuration policy or to a self-managed configuration.
get_configuration_policy_association	select	region		Returns the association between a configuration and a target account, organizational unit, or the root. The configuration can be a configuration policy or self-managed behavior. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.
list_configuration_policy_associations	select	region		Provides information about the associations for your configuration policies and self-managed behavior. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

batch_get_configuration_policy_associations

Returns associations between an Security Hub CSPM configuration and a batch of target accounts, organizational units, or the root. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region. A configuration can refer to a configuration policy or to a self-managed configuration.

SELECT
configuration_policy_associations,
unprocessed_configuration_policy_associations
FROM aws.securityhub.configuration_policy_associations
WHERE region = '{{ region }}' -- required
;

get_configuration_policy_association

Returns the association between a configuration and a target account, organizational unit, or the root. The configuration can be a configuration policy or self-managed behavior. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.

SELECT
association_status,
association_status_message,
association_type,
configuration_policy_id,
target_id,
target_type,
updated_at
FROM aws.securityhub.configuration_policy_associations
WHERE region = '{{ region }}' -- required
;

list_configuration_policy_associations

Provides information about the associations for your configuration policies and self-managed behavior. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.

SELECT
association_status,
association_status_message,
association_type,
configuration_policy_id,
target_id,
target_type,
updated_at
FROM aws.securityhub.configuration_policy_associations
WHERE region = '{{ region }}' -- required
;