security_control_definitions

Creates, updates, deletes, gets or lists a security_control_definitions resource.

Overview

Name	security_control_definitions
Type	Resource
Id	aws.securityhub.security_control_definitions

Fields

The following fields are returned by SELECT queries:

get_security_control_definition

Name	Datatype	Description
current_region_availability	string	Specifies whether a security control is available in the current Amazon Web Services Region. (AVAILABLE, UNAVAILABLE)
customizable_properties	array	Security control properties that you can customize. Currently, only parameter customization is supported for select controls. An empty array is returned for controls that don’t support custom properties.
description	string	The description of a security control across standards. This typically summarizes how Security Hub CSPM evaluates the control and the conditions under which it produces a failed finding. This parameter doesn't reference a specific standard. (pattern: <code>.\S.</code>)
parameter_definitions	object	An object that provides a security control parameter name, description, and the options for customizing it. This object is excluded for a control that doesn't support custom parameters.
provider	string	The cloud provider whose resources the security control evaluates. For example, AWS or Azure. (AWS, Azure)
remediation_url	string	A link to Security Hub CSPM documentation that explains how to remediate a failed finding for a security control. (pattern: <code>.\S.</code>)
security_control_id	string	The unique identifier of a security control across standards. Values for this field typically consist of an Amazon Web Services service name and a number (for example, APIGateway.3). This parameter differs from SecurityControlArn, which is a unique Amazon Resource Name (ARN) assigned to a control. The ARN references the security control ID (for example, arn:aws:securityhub:eu-central-1:123456789012:security-control/APIGateway.3). (pattern: <code>.\S.</code>)
severity_rating	string	The severity of a security control. For more information about how Security Hub CSPM determines control severity, see Assigning severity to control findings in the Security Hub CSPM User Guide. (LOW, MEDIUM, HIGH, CRITICAL)
title	string	The title of a security control. (pattern: <code>.\S.</code>)

list_security_control_definitions

Name	Datatype	Description
current_region_availability	string	Specifies whether a security control is available in the current Amazon Web Services Region. (AVAILABLE, UNAVAILABLE)
customizable_properties	array	Security control properties that you can customize. Currently, only parameter customization is supported for select controls. An empty array is returned for controls that don’t support custom properties.
description	string	The description of a security control across standards. This typically summarizes how Security Hub CSPM evaluates the control and the conditions under which it produces a failed finding. This parameter doesn't reference a specific standard. (pattern: <code>.\S.</code>)
parameter_definitions	object	An object that provides a security control parameter name, description, and the options for customizing it. This object is excluded for a control that doesn't support custom parameters.
provider	string	The cloud provider whose resources the security control evaluates. For example, AWS or Azure. (AWS, Azure)
remediation_url	string	A link to Security Hub CSPM documentation that explains how to remediate a failed finding for a security control. (pattern: <code>.\S.</code>)
security_control_id	string	The unique identifier of a security control across standards. Values for this field typically consist of an Amazon Web Services service name and a number (for example, APIGateway.3). This parameter differs from SecurityControlArn, which is a unique Amazon Resource Name (ARN) assigned to a control. The ARN references the security control ID (for example, arn:aws:securityhub:eu-central-1:123456789012:security-control/APIGateway.3). (pattern: <code>.\S.</code>)
severity_rating	string	The severity of a security control. For more information about how Security Hub CSPM determines control severity, see Assigning severity to control findings in the Security Hub CSPM User Guide. (LOW, MEDIUM, HIGH, CRITICAL)
title	string	The title of a security control. (pattern: <code>.\S.</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_security_control_definition	select	SecurityControlId, region		Retrieves the definition of a security control. The definition includes the control title, description, Region availability, parameter definitions, and other details.
list_security_control_definitions	select	region	StandardsArn, NextToken, MaxResults, Providers	Lists all of the security controls that apply to a specified standard.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
SecurityControlId	string	The ID of the security control to retrieve the definition for. This field doesn’t accept an Amazon Resource Name (ARN).
region	string	AWS region (default: us-east-1)
MaxResults	integer	An optional parameter that limits the total results of the API response to the specified number. If this parameter isn't provided in the request, the results include the first 25 security controls that apply to the specified standard. The results also include a NextToken parameter that you can use in a subsequent API call to get the next 25 controls. This repeats until all controls for the standard are returned.
NextToken	string	Optional pagination parameter.
Providers	array	A list of cloud providers to filter the security control definitions by. For example, specify Azure to return only controls that evaluate Azure resources.
StandardsArn	string	The Amazon Resource Name (ARN) of the standard that you want to view controls for.

SELECT examples

get_security_control_definition

Retrieves the definition of a security control. The definition includes the control title, description, Region availability, parameter definitions, and other details.

SELECT
current_region_availability,
customizable_properties,
description,
parameter_definitions,
provider,
remediation_url,
security_control_id,
severity_rating,
title
FROM aws.securityhub.security_control_definitions
WHERE SecurityControlId = '{{ SecurityControlId }}' -- required
AND region = '{{ region }}' -- required
;

list_security_control_definitions

Lists all of the security controls that apply to a specified standard.

SELECT
current_region_availability,
customizable_properties,
description,
parameter_definitions,
provider,
remediation_url,
security_control_id,
severity_rating,
title
FROM aws.securityhub.security_control_definitions
WHERE region = '{{ region }}' -- required
AND StandardsArn = '{{ StandardsArn }}'
AND NextToken = '{{ NextToken }}'
AND MaxResults = '{{ MaxResults }}'
AND Providers = '{{ Providers }}'
;