Skip to content

Commit 08a57e7

Browse files
author
awstools
committed
feat(client-securityhub): Security Hub now lets you opt-out of auto-enabling the defaults standards (CIS and FSBP) in accounts that are auto-enabled with Security Hub via Security Hub's integration with AWS Organizations.
1 parent 50c7324 commit 08a57e7

File tree

8 files changed

+123
-58
lines changed

8 files changed

+123
-58
lines changed

clients/client-securityhub/README.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,10 @@ AWS SDK for JavaScript SecurityHub Client for Node.js, Browser and React Native.
1111
of your environment based on controls from supported security standards. Security Hub collects
1212
security data from Amazon Web Services accounts, services, and integrated third-party products and helps
1313
you analyze security trends in your environment to identify the highest priority security
14-
issues. For more information about Security Hub, see the <i>Security Hub<a href="https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html">User
15-
Guide</a>
16-
</i>.</p>
14+
issues. For more information about Security Hub, see the <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html">
15+
<i>Security HubUser
16+
Guide</i>
17+
</a>.</p>
1718
<p>When you use operations in the Security Hub API, the requests are executed only in the Amazon Web Services
1819
Region that is currently active or in the specific Amazon Web Services Region that you specify in your
1920
request. Any configuration or settings change that results from the operation is applied

clients/client-securityhub/src/SecurityHub.ts

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -263,9 +263,10 @@ import { SecurityHubClient } from "./SecurityHubClient";
263263
* of your environment based on controls from supported security standards. Security Hub collects
264264
* security data from Amazon Web Services accounts, services, and integrated third-party products and helps
265265
* you analyze security trends in your environment to identify the highest priority security
266-
* issues. For more information about Security Hub, see the <i>Security Hub<a href="https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html">User
267-
* Guide</a>
268-
* </i>.</p>
266+
* issues. For more information about Security Hub, see the <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html">
267+
* <i>Security HubUser
268+
* Guide</i>
269+
* </a>.</p>
269270
* <p>When you use operations in the Security Hub API, the requests are executed only in the Amazon Web Services
270271
* Region that is currently active or in the specific Amazon Web Services Region that you specify in your
271272
* request. Any configuration or settings change that results from the operation is applied
@@ -680,7 +681,7 @@ export class SecurityHub extends SecurityHubClient {
680681

681682
/**
682683
* <p>Used to enable finding aggregation. Must be called from the aggregation Region.</p>
683-
* <p>For more details about cross-Region replication, see <a href="securityhub/latest/userguide/finding-aggregation.html">Configuring finding aggregation</a> in the <i>Security Hub User Guide</i>.
684+
* <p>For more details about cross-Region replication, see <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/finding-aggregation.html">Configuring finding aggregation</a> in the <i>Security Hub User Guide</i>.
684685
* </p>
685686
*/
686687
public createFindingAggregator(

clients/client-securityhub/src/SecurityHubClient.ts

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -470,9 +470,10 @@ export interface SecurityHubClientResolvedConfig extends SecurityHubClientResolv
470470
* of your environment based on controls from supported security standards. Security Hub collects
471471
* security data from Amazon Web Services accounts, services, and integrated third-party products and helps
472472
* you analyze security trends in your environment to identify the highest priority security
473-
* issues. For more information about Security Hub, see the <i>Security Hub<a href="https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html">User
474-
* Guide</a>
475-
* </i>.</p>
473+
* issues. For more information about Security Hub, see the <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html">
474+
* <i>Security HubUser
475+
* Guide</i>
476+
* </a>.</p>
476477
* <p>When you use operations in the Security Hub API, the requests are executed only in the Amazon Web Services
477478
* Region that is currently active or in the specific Amazon Web Services Region that you specify in your
478479
* request. Any configuration or settings change that results from the operation is applied

clients/client-securityhub/src/commands/CreateFindingAggregatorCommand.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ export interface CreateFindingAggregatorCommandOutput extends CreateFindingAggre
2323

2424
/**
2525
* <p>Used to enable finding aggregation. Must be called from the aggregation Region.</p>
26-
* <p>For more details about cross-Region replication, see <a href="securityhub/latest/userguide/finding-aggregation.html">Configuring finding aggregation</a> in the <i>Security Hub User Guide</i>.
26+
* <p>For more details about cross-Region replication, see <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/finding-aggregation.html">Configuring finding aggregation</a> in the <i>Security Hub User Guide</i>.
2727
* </p>
2828
* @example
2929
* Use a bare-bones client and the command you need to make an API call.

clients/client-securityhub/src/models/models_0.ts

Lines changed: 5 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -821,6 +821,11 @@ export namespace AdminAccount {
821821
});
822822
}
823823

824+
export enum AutoEnableStandards {
825+
DEFAULT = "DEFAULT",
826+
NONE = "NONE",
827+
}
828+
824829
/**
825830
* <p>Information about an Availability Zone.</p>
826831
*/
@@ -11454,32 +11459,3 @@ export namespace AwsRdsDbSubnetGroup {
1145411459
...obj,
1145511460
});
1145611461
}
11457-
11458-
/**
11459-
* <p>Specifies the connection endpoint.</p>
11460-
*/
11461-
export interface AwsRdsDbInstanceEndpoint {
11462-
/**
11463-
* <p>Specifies the DNS address of the DB instance.</p>
11464-
*/
11465-
Address?: string;
11466-
11467-
/**
11468-
* <p>Specifies the port that the database engine is listening on.</p>
11469-
*/
11470-
Port?: number;
11471-
11472-
/**
11473-
* <p>Specifies the ID that Amazon Route 53 assigns when you create a hosted zone.</p>
11474-
*/
11475-
HostedZoneId?: string;
11476-
}
11477-
11478-
export namespace AwsRdsDbInstanceEndpoint {
11479-
/**
11480-
* @internal
11481-
*/
11482-
export const filterSensitiveLog = (obj: AwsRdsDbInstanceEndpoint): any => ({
11483-
...obj,
11484-
});
11485-
}

clients/client-securityhub/src/models/models_1.ts

Lines changed: 52 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import {
77
ActionTarget,
88
Adjustment,
99
AdminAccount,
10+
AutoEnableStandards,
1011
AwsApiGatewayRestApiDetails,
1112
AwsApiGatewayStageDetails,
1213
AwsApiGatewayV2ApiDetails,
@@ -54,13 +55,41 @@ import {
5455
AwsRdsDbClusterSnapshotDetails,
5556
AwsRdsDbDomainMembership,
5657
AwsRdsDbInstanceAssociatedRole,
57-
AwsRdsDbInstanceEndpoint,
5858
AwsRdsDbInstanceVpcSecurityGroup,
5959
AwsRdsDbParameterGroup,
6060
AwsRdsDbSubnetGroup,
6161
} from "./models_0";
6262
import { SecurityHubServiceException as __BaseException } from "./SecurityHubServiceException";
6363

64+
/**
65+
* <p>Specifies the connection endpoint.</p>
66+
*/
67+
export interface AwsRdsDbInstanceEndpoint {
68+
/**
69+
* <p>Specifies the DNS address of the DB instance.</p>
70+
*/
71+
Address?: string;
72+
73+
/**
74+
* <p>Specifies the port that the database engine is listening on.</p>
75+
*/
76+
Port?: number;
77+
78+
/**
79+
* <p>Specifies the ID that Amazon Route 53 assigns when you create a hosted zone.</p>
80+
*/
81+
HostedZoneId?: string;
82+
}
83+
84+
export namespace AwsRdsDbInstanceEndpoint {
85+
/**
86+
* @internal
87+
*/
88+
export const filterSensitiveLog = (obj: AwsRdsDbInstanceEndpoint): any => ({
89+
...obj,
90+
});
91+
}
92+
6493
/**
6594
* <p>An option group membership.</p>
6695
*/
@@ -5298,19 +5327,15 @@ export interface AwsSecurityFinding {
52985327

52995328
/**
53005329
* <p>The name of the product that generated the finding.</p>
5301-
* <p>Security Hub populates this attribute automatically for each finding. You cannot update it using <code>BatchImportFindings</code> or <code>BatchUpdateFindings</code>. The exception to this is when you use a custom integration.</p>
5302-
* <p>When you use the Security Hub console to filter findings by product name, you use this attribute.</p>
5303-
* <p>When you use the Security Hub API to filter findings by product name, you use the <code>aws/securityhub/ProductName</code> attribute under <code>ProductFields</code>.</p>
5304-
* <p>Security Hub does not synchronize those two attributes.</p>
5330+
* <p>Security Hub populates this attribute automatically for each finding. You cannot update this attribute with <code>BatchImportFindings</code> or <code>BatchUpdateFindings</code>. The exception to this is a custom integration.</p>
5331+
* <p>When you use the Security Hub console or API to filter findings by product name, you use this attribute.</p>
53055332
*/
53065333
ProductName?: string;
53075334

53085335
/**
53095336
* <p>The name of the company for the product that generated the finding.</p>
5310-
* <p>Security Hub populates this attribute automatically for each finding. You cannot be updated using <code>BatchImportFindings</code> or <code>BatchUpdateFindings</code>. The exception to this is when you use a custom integration.</p>
5311-
* <p>When you use the Security Hub console to filter findings by company name, you use this attribute.</p>
5312-
* <p>When you use the Security Hub API to filter findings by company name, you use the <code>aws/securityhub/CompanyName</code> attribute under <code>ProductFields</code>.</p>
5313-
* <p>Security Hub does not synchronize those two attributes.</p>
5337+
* <p>Security Hub populates this attribute automatically for each finding. You cannot update this attribute with <code>BatchImportFindings</code> or <code>BatchUpdateFindings</code>. The exception to this is a custom integration.</p>
5338+
* <p>When you use the Security Hub console or API to filter findings by company name, you use this attribute.</p>
53145339
*/
53155340
CompanyName?: string;
53165341

@@ -5985,14 +6010,12 @@ export interface AwsSecurityFindingFilters {
59856010

59866011
/**
59876012
* <p>The name of the solution (product) that generates findings.</p>
5988-
* <p>Note that this is a filter against the <code>aws/securityhub/ProductName</code> field in <code>ProductFields</code>. It is not a filter for the top-level <code>ProductName</code> field.</p>
59896013
*/
59906014
ProductName?: StringFilter[];
59916015

59926016
/**
59936017
* <p>The name of the findings provider (company) that owns the solution (product) that
59946018
* generates findings.</p>
5995-
* <p>Note that this is a filter against the <code>aws/securityhub/CompanyName</code> field in <code>ProductFields</code>. It is not a filter for the top-level <code>CompanyName</code> field.</p>
59966019
*/
59976020
CompanyName?: StringFilter[];
59986021

@@ -7624,6 +7647,16 @@ export interface DescribeOrganizationConfigurationResponse {
76247647
* Security Hub administrator account.</p>
76257648
*/
76267649
MemberAccountLimitReached?: boolean;
7650+
7651+
/**
7652+
* <p>Whether to automatically enable Security Hub <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-enable-disable.html">default standards</a>
7653+
* for new member accounts in the organization.</p>
7654+
* <p>The default value of this parameter is equal to <code>DEFAULT</code>.</p>
7655+
* <p>If equal to <code>DEFAULT</code>, then Security Hub default standards are automatically enabled for new member
7656+
* accounts. If equal to <code>NONE</code>, then default standards are not automatically enabled for new member
7657+
* accounts.</p>
7658+
*/
7659+
AutoEnableStandards?: AutoEnableStandards | string;
76277660
}
76287661

76297662
export namespace DescribeOrganizationConfigurationResponse {
@@ -9428,6 +9461,14 @@ export interface UpdateOrganizationConfigurationRequest {
94289461
* <p>To automatically enable Security Hub for new accounts, set this to <code>true</code>.</p>
94299462
*/
94309463
AutoEnable: boolean | undefined;
9464+
9465+
/**
9466+
* <p>Whether to automatically enable Security Hub <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-standards-enable-disable.html">default standards</a>
9467+
* for new member accounts in the organization.</p>
9468+
* <p>By default, this parameter is equal to <code>DEFAULT</code>, and new member accounts are automatically enabled with default Security Hub standards.</p>
9469+
* <p>To opt out of enabling default standards for new member accounts, set this parameter equal to <code>NONE</code>.</p>
9470+
*/
9471+
AutoEnableStandards?: AutoEnableStandards | string;
94319472
}
94329473

94339474
export namespace UpdateOrganizationConfigurationRequest {

clients/client-securityhub/src/protocols/Aws_restJson1.ts

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -406,7 +406,6 @@ import {
406406
AwsRdsDbClusterSnapshotDetails,
407407
AwsRdsDbDomainMembership,
408408
AwsRdsDbInstanceAssociatedRole,
409-
AwsRdsDbInstanceEndpoint,
410409
AwsRdsDbInstanceVpcSecurityGroup,
411410
AwsRdsDbParameterGroup,
412411
AwsRdsDbSubnetGroup,
@@ -460,6 +459,7 @@ import {
460459
import {
461460
_Record,
462461
AwsRdsDbInstanceDetails,
462+
AwsRdsDbInstanceEndpoint,
463463
AwsRdsDbOptionGroupMembership,
464464
AwsRdsDbPendingModifiedValues,
465465
AwsRdsDbProcessorFeature,
@@ -2118,6 +2118,8 @@ export const serializeAws_restJson1UpdateOrganizationConfigurationCommand = asyn
21182118
let body: any;
21192119
body = JSON.stringify({
21202120
...(input.AutoEnable !== undefined && input.AutoEnable !== null && { AutoEnable: input.AutoEnable }),
2121+
...(input.AutoEnableStandards !== undefined &&
2122+
input.AutoEnableStandards !== null && { AutoEnableStandards: input.AutoEnableStandards }),
21212123
});
21222124
return new __HttpRequest({
21232125
protocol,
@@ -3233,12 +3235,16 @@ export const deserializeAws_restJson1DescribeOrganizationConfigurationCommand =
32333235
const contents: DescribeOrganizationConfigurationCommandOutput = {
32343236
$metadata: deserializeMetadata(output),
32353237
AutoEnable: undefined,
3238+
AutoEnableStandards: undefined,
32363239
MemberAccountLimitReached: undefined,
32373240
};
32383241
const data: { [key: string]: any } = __expectNonNull(__expectObject(await parseBody(output.body, context)), "body");
32393242
if (data.AutoEnable !== undefined && data.AutoEnable !== null) {
32403243
contents.AutoEnable = __expectBoolean(data.AutoEnable);
32413244
}
3245+
if (data.AutoEnableStandards !== undefined && data.AutoEnableStandards !== null) {
3246+
contents.AutoEnableStandards = __expectString(data.AutoEnableStandards);
3247+
}
32423248
if (data.MemberAccountLimitReached !== undefined && data.MemberAccountLimitReached !== null) {
32433249
contents.MemberAccountLimitReached = __expectBoolean(data.MemberAccountLimitReached);
32443250
}

0 commit comments

Comments
 (0)