Security Hub CSPM provides you with a comprehensive view of your security state in Amazon Web Services and helps you assess your Amazon Web Services environment against security industry standards and best practices.
Security Hub CSPM collects security data across Amazon Web Services accounts, Amazon Web Services services, and supported third-party products and helps you analyze your security trends and identify the highest priority security issues.
To help you manage the security state of your organization, Security Hub CSPM supports multiple security standards. These include the Amazon Web Services Foundational Security Best Practices (FSBP) standard developed by Amazon Web Services, and external compliance frameworks such as the Center for Internet Security (CIS), the Payment Card Industry Data Security Standard (PCI DSS), and the National Institute of Standards and Technology (NIST). Each standard includes several security controls, each of which represents a security best practice. Security Hub CSPM runs checks against security controls and generates control findings to help you assess your compliance against security best practices.
In addition to generating control findings, Security Hub CSPM also receives findings from other Amazon Web Services services, such as Amazon GuardDuty and Amazon Inspector, and supported third-party products. This gives you a single pane of glass into a variety of security-related issues. You can also send Security Hub CSPM findings to other Amazon Web Services services and supported third-party products.
Security Hub CSPM offers automation features that help you triage and remediate security issues. For example, you can use automation rules to automatically update critical findings when a security check fails. You can also leverage the integration with Amazon EventBridge to trigger automatic responses to specific findings.
This guide, the Security Hub CSPM API Reference, provides information about the Security Hub CSPM API. This includes supported resources, HTTP methods, parameters, and schemas. If you're new to Security Hub CSPM, you might find it helpful to also review the Security Hub CSPM User Guide . The user guide explains key concepts and provides procedures that demonstrate how to use Security Hub CSPM features. It also provides information about topics such as integrating Security Hub CSPM with other Amazon Web Services services.
In addition to interacting with Security Hub CSPM by making calls to the Security Hub CSPM API, you can use a current version of an Amazon Web Services command line tool or SDK. Amazon Web Services provides tools and SDKs that consist of libraries and sample code for various languages and platforms, such as PowerShell, Java, Go, Python, C++, and .NET. These tools and SDKs provide convenient, programmatic access to Security Hub CSPM and other Amazon Web Services services . They also handle tasks such as signing requests, managing errors, and retrying requests automatically. For information about installing and using the Amazon Web Services tools and SDKs, see Tools to Build on Amazon Web Services.
With the exception of operations that are related to central configuration, Security Hub CSPM API requests are executed only in the Amazon Web Services Region that is currently active or in the specific Amazon Web Services Region that you specify in your request. Any configuration or settings change that results from the operation is applied only to that Region. To make the same change in other Regions, call the same API operation in each Region in which you want to apply the change. When you use central configuration, API requests for enabling Security Hub CSPM, standards, and controls are executed in the home Region and all linked Regions. For a list of central configuration operations, see the Central configuration terms and concepts section of the Security Hub CSPM User Guide.
The following throttling limits apply to Security Hub CSPM API operations.
batch_enable_standards-RateLimitof 1 request per second.BurstLimitof 1 request per second.get_findings-RateLimitof 3 requests per second.BurstLimitof 6 requests per second.batch_import_findings-RateLimitof 10 requests per second.BurstLimitof 30 requests per second.batch_update_findings-RateLimitof 10 requests per second.BurstLimitof 30 requests per second.update_standards_control-RateLimitof 1 request per second.BurstLimitof 5 requests per second.All other operations -
RateLimitof 10 requests per second.BurstLimitof 30 requests per second.
Arguments
- config
Optional configuration of credentials, endpoint, and/or region.
credentials:
creds:
access_key_id: AWS access key ID
secret_access_key: AWS secret access key
session_token: AWS temporary session token
profile: The name of a profile to use. If not given, then the default profile is used.
anonymous: Set anonymous credentials.
endpoint: The complete URL to use for the constructed client.
region: The AWS Region used in instantiating the client.
close_connection: Immediately close all HTTP connections.
timeout: The time in seconds till a timeout exception is thrown when attempting to make a connection. The default is 60 seconds.
s3_force_path_style: Set this to
trueto force the request to use path-style addressing, i.e.http://s3.amazonaws.com/BUCKET/KEY.sts_regional_endpoint: Set sts regional endpoint resolver to regional or legacy https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html
- credentials
Optional credentials shorthand for the config parameter
creds:
access_key_id: AWS access key ID
secret_access_key: AWS secret access key
session_token: AWS temporary session token
profile: The name of a profile to use. If not given, then the default profile is used.
anonymous: Set anonymous credentials.
- endpoint
Optional shorthand for complete URL to use for the constructed client.
- region
Optional shorthand for AWS Region used in instantiating the client.
Value
A client for the service. You can call the service's operations using
syntax like svc$operation(...), where svc is the name you've assigned
to the client. The available operations are listed in the
Operations section.
Service syntax
svc <- securityhub(
config = list(
credentials = list(
creds = list(
access_key_id = "string",
secret_access_key = "string",
session_token = "string"
),
profile = "string",
anonymous = "logical"
),
endpoint = "string",
region = "string",
close_connection = "logical",
timeout = "numeric",
s3_force_path_style = "logical",
sts_regional_endpoint = "string"
),
credentials = list(
creds = list(
access_key_id = "string",
secret_access_key = "string",
session_token = "string"
),
profile = "string",
anonymous = "logical"
),
endpoint = "string",
region = "string"
)Operations
| accept_administrator_invitation | We recommend using Organizations instead of Security Hub CSPM invitations to manage your member accounts |
| accept_invitation | This method is deprecated |
| batch_delete_automation_rules | Deletes one or more automation rules |
| batch_disable_standards | Disables the standards specified by the provided StandardsSubscriptionArns |
| batch_enable_standards | Enables the standards specified by the provided StandardsArn |
| batch_get_automation_rules | Retrieves a list of details for automation rules based on rule Amazon Resource Names (ARNs) |
| batch_get_configuration_policy_associations | Returns associations between an Security Hub CSPM configuration and a batch of target accounts, organizational units, or the root |
| batch_get_security_controls | Provides details about a batch of security controls for the current Amazon Web Services account and Amazon Web Services Region |
| batch_get_standards_control_associations | For a batch of security controls and standards, identifies whether each control is currently enabled or disabled in a standard |
| batch_import_findings | Imports security findings generated by a finding provider into Security Hub CSPM |
| batch_update_automation_rules | Updates one or more automation rules based on rule Amazon Resource Names (ARNs) and input parameters |
| batch_update_findings | Used by Security Hub CSPM customers to update information about their investigation into one or more findings |
| batch_update_findings_v2 | Updates information about a customer's investigation into a finding |
| batch_update_standards_control_associations | For a batch of security controls and standards, this operation updates the enablement status of a control in a standard |
| create_action_target | Creates a custom action target in Security Hub CSPM |
| create_aggregator_v2 | Enables aggregation across Amazon Web Services Regions |
| create_automation_rule | Creates an automation rule based on input parameters |
| create_automation_rule_v2 | Creates a V2 automation rule |
| create_configuration_policy | Creates a configuration policy with the defined configuration |
| create_connector_v2 | Grants permission to create a connectorV2 based on input parameters |
| create_finding_aggregator | The aggregation Region is now called the home Region |
| create_insight | Creates a custom insight in Security Hub CSPM |
| create_members | Creates a member association in Security Hub CSPM between the specified accounts and the account used to make the request, which is the administrator account |
| create_ticket_v2 | Grants permission to create a ticket in the chosen ITSM based on finding information for the provided finding metadata UID |
| decline_invitations | We recommend using Organizations instead of Security Hub CSPM invitations to manage your member accounts |
| delete_action_target | Deletes a custom action target from Security Hub CSPM |
| delete_aggregator_v2 | Deletes the Aggregator V2 |
| delete_automation_rule_v2 | Deletes a V2 automation rule |
| delete_configuration_policy | Deletes a configuration policy |
| delete_connector_v2 | Grants permission to delete a connectorV2 |
| delete_finding_aggregator | The aggregation Region is now called the home Region |
| delete_insight | Deletes the insight specified by the InsightArn |
| delete_invitations | We recommend using Organizations instead of Security Hub CSPM invitations to manage your member accounts |
| delete_members | Deletes the specified member accounts from Security Hub CSPM |
| describe_action_targets | Returns a list of the custom action targets in Security Hub CSPM in your account |
| describe_hub | Returns details about the Hub resource in your account, including the HubArn and the time when you enabled Security Hub CSPM |
| describe_organization_configuration | Returns information about the way your organization is configured in Security Hub CSPM |
| describe_products | Returns information about product integrations in Security Hub CSPM |
| describe_products_v2 | Gets information about the product integration |
| describe_security_hub_v2 | Returns details about the service resource in your account |
| describe_standards | Returns a list of the available standards in Security Hub CSPM |
| describe_standards_controls | Returns a list of security standards controls |
| disable_import_findings_for_product | Disables the integration of the specified product with Security Hub CSPM |
| disable_organization_admin_account | Disables a Security Hub CSPM administrator account |
| disable_security_hub | Disables Security Hub CSPM in your account only in the current Amazon Web Services Region |
| disable_security_hub_v2 | Disable the service for the current Amazon Web Services Region or specified Amazon Web Services Region |
| disassociate_from_administrator_account | Disassociates the current Security Hub CSPM member account from the associated administrator account |
| disassociate_from_master_account | This method is deprecated |
| disassociate_members | Disassociates the specified member accounts from the associated administrator account |
| enable_import_findings_for_product | Enables the integration of a partner product with Security Hub CSPM |
| enable_organization_admin_account | Designates the Security Hub CSPM administrator account for an organization |
| enable_security_hub | Enables Security Hub CSPM for your account in the current Region or the Region you specify in the request |
| enable_security_hub_v2 | Enables the service in account for the current Amazon Web Services Region or specified Amazon Web Services Region |
| generate_recommended_policy_v2 | Begins the recommended policy generation to remediate a Security Hub finding |
| get_administrator_account | Provides the details for the Security Hub CSPM administrator account for the current member account |
| get_aggregator_v2 | Returns the configuration of the specified Aggregator V2 |
| get_automation_rule_v2 | Returns an automation rule for the V2 service |
| get_configuration_policy | Provides information about a configuration policy |
| get_configuration_policy_association | Returns the association between a configuration and a target account, organizational unit, or the root |
| get_connector_v2 | Grants permission to retrieve details for a connectorV2 based on connector id |
| get_enabled_standards | Returns a list of the standards that are currently enabled |
| get_finding_aggregator | The aggregation Region is now called the home Region |
| get_finding_history | Returns the history of a Security Hub CSPM finding |
| get_findings | Returns a list of findings that match the specified criteria |
| get_finding_statistics_v2 | Returns aggregated statistical data about findings |
| get_findings_trends_v2 | Returns findings trend data based on the specified criteria |
| get_findings_v2 | Returns a list of findings that match the specified criteria |
| get_insight_results | Lists the results of the Security Hub CSPM insight specified by the insight ARN |
| get_insights | Lists and describes insights for the specified insight ARNs |
| get_invitations_count | We recommend using Organizations instead of Security Hub CSPM invitations to manage your member accounts |
| get_master_account | This method is deprecated |
| get_members | Returns the details for the Security Hub CSPM member accounts for the specified account IDs |
| get_recommended_policy_v2 | Retrieves the recommended policy to remediate a Security Hub finding |
| get_resources_statistics_v2 | Retrieves statistical information about Amazon Web Services resources and their associated security findings |
| get_resources_trends_v2 | Returns resource trend data based on the specified criteria |
| get_resources_v2 | Returns a list of resources |
| get_security_control_definition | Retrieves the definition of a security control |
| invite_members | We recommend using Organizations instead of Security Hub CSPM invitations to manage your member accounts |
| list_aggregators_v2 | Retrieves a list of V2 aggregators |
| list_automation_rules | A list of automation rules and their metadata for the calling account |
| list_automation_rules_v2 | Returns a list of automation rules and metadata for the calling account |
| list_configuration_policies | Lists the configuration policies that the Security Hub CSPM delegated administrator has created for your organization |
| list_configuration_policy_associations | Provides information about the associations for your configuration policies and self-managed behavior |
| list_connectors_v2 | Grants permission to retrieve a list of connectorsV2 and their metadata for the calling account |
| list_enabled_products_for_import | Lists all findings-generating solutions (products) that you are subscribed to receive findings from in Security Hub CSPM |
| list_finding_aggregators | If cross-Region aggregation is enabled, then ListFindingAggregators returns the Amazon Resource Name (ARN) of the finding aggregator |
| list_invitations | We recommend using Organizations instead of Security Hub CSPM invitations to manage your member accounts |
| list_members | Lists details about all member accounts for the current Security Hub CSPM administrator account |
| list_organization_admin_accounts | Lists the Security Hub CSPM administrator accounts |
| list_security_control_definitions | Lists all of the security controls that apply to a specified standard |
| list_standards_control_associations | Specifies whether a control is currently enabled or disabled in each enabled standard in the calling account |
| list_tags_for_resource | Returns a list of tags associated with a resource |
| register_connector_v2 | Grants permission to complete the authorization based on input parameters |
| start_configuration_policy_association | Associates a target account, organizational unit, or the root with a specified configuration |
| start_configuration_policy_disassociation | Disassociates a target account, organizational unit, or the root from a specified configuration |
| tag_resource | Adds one or more tags to a resource |
| untag_resource | Removes one or more tags from a resource |
| update_action_target | Updates the name and description of a custom action target in Security Hub CSPM |
| update_aggregator_v2 | Udpates the configuration for the Aggregator V2 |
| update_automation_rule_v2 | Updates a V2 automation rule |
| update_configuration_policy | Updates a configuration policy |
| update_connector_v2 | Grants permission to update a connectorV2 based on its id and input parameters |
| update_finding_aggregator | The aggregation Region is now called the home Region |
| update_findings | UpdateFindings is a deprecated operation |
| update_insight | Updates the Security Hub CSPM insight identified by the specified insight ARN |
| update_organization_configuration | Updates the configuration of your organization in Security Hub CSPM |
| update_security_control | Updates the properties of a security control |
| update_security_hub_configuration | Updates configuration options for Security Hub CSPM |
| update_standards_control | Used to control whether an individual security standard control is enabled or disabled |