standards_control_associations

Creates, updates, deletes, gets or lists a standards_control_associations resource.

Overview

Name	standards_control_associations
Type	Resource
Id	aws.securityhub.standards_control_associations

Fields

The following fields are returned by SELECT queries:

batch_get_standards_control_associations

Name	Datatype	Description
standards_control_association_details	array	Provides the enablement status of a security control in a specified standard and other details for the control in relation to the specified standard.
unprocessed_associations	array	A security control (identified with SecurityControlId, SecurityControlArn, or a mix of both parameters) whose enablement status in a specified standard cannot be returned.

list_standards_control_associations

Name	Datatype	Description
association_status	string	The enablement status of a control in a specific standard. (ENABLED, DISABLED)
related_requirements	array	The requirement that underlies this control in the compliance framework related to the standard.
security_control_arn	string	The ARN of a control, such as arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1. This parameter doesn't mention a specific standard. (pattern: <code>.\S.</code>)
security_control_id	string	A unique standard-agnostic identifier for a control. Values for this field typically consist of an Amazon Web Services service and a number, such as APIGateway.5. This field doesn't reference a specific standard. (pattern: <code>.\S.</code>)
standards_arn	string	The Amazon Resource Name (ARN) of a standard. (pattern: <code>.\S.</code>)
standards_control_description	string	The description of a control. This typically summarizes how Security Hub CSPM evaluates the control and the conditions under which it produces a failed finding. The parameter may reference a specific standard. (pattern: <code>.\S.</code>)
standards_control_title	string	The title of a control. (pattern: <code>.\S.</code>)
updated_at	string (date-time)	The last time that a control's enablement status in a specified standard was updated.
updated_reason	string	The reason for updating a control's enablement status in a specified standard. (pattern: <code>.\S.</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
batch_get_standards_control_associations	select	region		For a batch of security controls and standards, identifies whether each control is currently enabled or disabled in a standard. Calls to this operation return a RESOURCE_NOT_FOUND_EXCEPTION error when the standard subscription for the association has a NOT_READY_FOR_UPDATES value for StandardsControlsUpdatable.
list_standards_control_associations	select	SecurityControlId, region	NextToken, MaxResults	Specifies whether a control is currently enabled or disabled in each enabled standard in the calling account. This operation omits standards control associations for standard subscriptions where StandardsControlsUpdatable has value NOT_READY_FOR_UPDATES.
batch_update_standards_control_associations	exec	region, StandardsControlAssociationUpdates		For a batch of security controls and standards, this operation updates the enablement status of a control in a standard.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
SecurityControlId	string	The identifier of the control (identified with SecurityControlId, SecurityControlArn, or a mix of both parameters) that you want to determine the enablement status of in each enabled standard.
region	string	AWS region (default: us-east-1)
MaxResults	integer	An optional parameter that limits the total results of the API response to the specified number. If this parameter isn't provided in the request, the results include the first 25 standard and control associations. The results also include a NextToken parameter that you can use in a subsequent API call to get the next 25 associations. This repeats until all associations for the specified control are returned. The number of results is limited by the number of supported Security Hub CSPM standards that you've enabled in the calling account.
NextToken	string	Optional pagination parameter.

SELECT examples

batch_get_standards_control_associations

For a batch of security controls and standards, identifies whether each control is currently enabled or disabled in a standard. Calls to this operation return a RESOURCE_NOT_FOUND_EXCEPTION error when the standard subscription for the association has a NOT_READY_FOR_UPDATES value for StandardsControlsUpdatable.

SELECT
standards_control_association_details,
unprocessed_associations
FROM aws.securityhub.standards_control_associations
WHERE region = '{{ region }}' -- required
;

list_standards_control_associations

Specifies whether a control is currently enabled or disabled in each enabled standard in the calling account. This operation omits standards control associations for standard subscriptions where StandardsControlsUpdatable has value NOT_READY_FOR_UPDATES.

SELECT
association_status,
related_requirements,
security_control_arn,
security_control_id,
standards_arn,
standards_control_description,
standards_control_title,
updated_at,
updated_reason
FROM aws.securityhub.standards_control_associations
WHERE SecurityControlId = '{{ SecurityControlId }}' -- required
AND region = '{{ region }}' -- required
AND NextToken = '{{ NextToken }}'
AND MaxResults = '{{ MaxResults }}'
;

Lifecycle Methods

batch_update_standards_control_associations

For a batch of security controls and standards, this operation updates the enablement status of a control in a standard.

EXEC aws.securityhub.standards_control_associations.batch_update_standards_control_associations 
@region='{{ region }}' --required 
@@json=
'{
"StandardsControlAssociationUpdates": "{{ StandardsControlAssociationUpdates }}"
}'
;