standards_controls

Creates, updates, deletes, gets or lists a standards_controls resource.

Overview

Name	standards_controls
Type	Resource
Id	aws.securityhub.standards_controls

Fields

The following fields are returned by SELECT queries:

describe_standards_controls

Name	Datatype	Description
control_id	string	The identifier of the security standard control. (pattern: <code>.\S.</code>)
control_status	string	The current status of the security standard control. Indicates whether the control is enabled or disabled. Security Hub CSPM does not check against disabled controls. (ENABLED, DISABLED)
control_status_updated_at	string (date-time)	The date and time that the status of the security standard control was most recently updated.
description	string	The longer description of the security standard control. Provides information about what the control is checking for. (pattern: <code>.\S.</code>)
disabled_reason	string	The reason provided for the most recent change in status for the control. (pattern: <code>.\S.</code>)
related_requirements	array	The list of requirements that are related to this control.
remediation_url	string	A link to remediation information for the control in the Security Hub CSPM user documentation. (pattern: <code>.\S.</code>)
severity_rating	string	The severity of findings generated from this security standard control. The finding severity is based on an assessment of how easy it would be to compromise Amazon Web Services resources if the issue is detected. (LOW, MEDIUM, HIGH, CRITICAL)
standards_control_arn	string	The ARN of the security standard control. (pattern: <code>.\S.</code>)
title	string	The title of the security standard control. (pattern: <code>.\S.</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_standards_controls	select	standards_subscription_arn, region	NextToken, MaxResults	Returns a list of security standards controls. For each control, the results include information about whether it is currently enabled, the severity, and a link to remediation information. This operation returns an empty list for standard subscriptions where StandardsControlsUpdatable has value NOT_READY_FOR_UPDATES.
update_standards_control	update	standards_control_arn, region		Used to control whether an individual security standard control is enabled or disabled. Calls to this operation return a RESOURCE_NOT_FOUND_EXCEPTION error when the standard subscription for the control has StandardsControlsUpdatable value NOT_READY_FOR_UPDATES.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)
standards_control_arn	string	The ARN of the security standard control to enable or disable.
standards_subscription_arn	string	The ARN of a resource that represents your subscription to a supported standard. To get the subscription ARNs of the standards you have enabled, use the GetEnabledStandards operation.
MaxResults	integer	The maximum number of security standard controls to return.
NextToken	string	The token that is required for pagination. On your first call to the DescribeStandardsControls operation, set the value of this parameter to NULL. For subsequent calls to the operation, to continue listing data, set the value of this parameter to the value returned from the previous response.

SELECT examples

describe_standards_controls

Returns a list of security standards controls. For each control, the results include information about whether it is currently enabled, the severity, and a link to remediation information. This operation returns an empty list for standard subscriptions where StandardsControlsUpdatable has value NOT_READY_FOR_UPDATES.

SELECT
control_id,
control_status,
control_status_updated_at,
description,
disabled_reason,
related_requirements,
remediation_url,
severity_rating,
standards_control_arn,
title
FROM aws.securityhub.standards_controls
WHERE standards_subscription_arn = '{{ standards_subscription_arn }}' -- required
AND region = '{{ region }}' -- required
AND NextToken = '{{ NextToken }}'
AND MaxResults = '{{ MaxResults }}'
;

UPDATE examples

update_standards_control

Used to control whether an individual security standard control is enabled or disabled. Calls to this operation return a RESOURCE_NOT_FOUND_EXCEPTION error when the standard subscription for the control has StandardsControlsUpdatable value NOT_READY_FOR_UPDATES.

UPDATE aws.securityhub.standards_controls
SET 
ControlStatus = '{{ ControlStatus }}',
DisabledReason = '{{ DisabledReason }}'
WHERE 
standards_control_arn = '{{ standards_control_arn }}' --required
AND region = '{{ region }}' --required;