Note:

You are viewing the documentation for an older major version of the AWS CLI (version 1).

AWS CLI version 2, the latest major version of AWS CLI, is now stable and recommended for general use. To view this page for the AWS CLI version 2, click here. For more information see the AWS CLI version 2 installation instructions and migration guide.

[ aws . securityhub ]

batch-get-standards-control-associations¶

Description¶

For a batch of security controls and standards, identifies whether each control is currently enabled or disabled in a standard.

Synopsis¶

  batch-get-standards-control-associations
--standards-control-association-ids <value>
[--cli-input-json <value>]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]

Options¶

--standards-control-association-ids (list)

An array with one or more objects that includes a security control (identified with SecurityControlId , SecurityControlArn , or a mix of both parameters) and the Amazon Resource Name (ARN) of a standard. This field is used to query the enablement status of a control in a specified standard. The security control ID or ARN is the same across standards.

(structure)

An array with one or more objects that includes a security control (identified with SecurityControlId , SecurityControlArn , or a mix of both parameters) and the Amazon Resource Name (ARN) of a standard. The security control ID or ARN is the same across standards.

SecurityControlId -> (string)

The unique identifier (identified with SecurityControlId , SecurityControlArn , or a mix of both parameters) of a security control across standards.

StandardsArn -> (string)

The ARN of a standard.

Shorthand Syntax:

SecurityControlId=string,StandardsArn=string ...

JSON Syntax:

[
  {
    "SecurityControlId": "string",
    "StandardsArn": "string"
  }
  ...
]

--cli-input-json (string) Performs service operation based on the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, the CLI values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command.

Global Options¶

--debug (boolean)

Turn on debug logging.

--endpoint-url (string)

Override command's default URL with the given URL.

--no-verify-ssl (boolean)

By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.

--no-paginate (boolean)

Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.

--output (string)

The formatting style for command output.

json
text
table

--query (string)

A JMESPath query to use in filtering the response data.

--profile (string)

Use a specific profile from your credential file.

--region (string)

The region to use. Overrides config/env settings.

--version (string)

Display the version of this tool.

--color (string)

Turn on/off color output.

on
off
auto

--no-sign-request (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

--ca-bundle (string)

The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.

--cli-read-timeout (int)

The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.

--cli-connect-timeout (int)

The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.

Examples¶

Note

To use the following examples, you must have the AWS CLI installed and configured. See the Getting started guide in the AWS CLI User Guide for more information.

Unless otherwise stated, all examples have unix-like quotation rules. These examples will need to be adapted to your terminal's quoting rules. See Using quotation marks with strings in the AWS CLI User Guide .

To get the enablement status of a control

The following batch-get-standards-control-associations example identifies whether the specified controls are enabled in the specified standards.

aws securityhub batch-get-standards-control-associations \
    --standards-control-association-ids '[{"SecurityControlId": "Config.1","StandardsArn": "arn:aws:securityhub:us-east-1:123456789012:ruleset/cis-aws-foundations-benchmark/v/1.2.0"}, {"SecurityControlId": "IAM.6","StandardsArn": "arn:aws:securityhub:us-east-1:123456789012:standards/aws-foundational-security-best-practices/v/1.0.0"}]'

Output:

{
    "StandardsControlAssociationDetails": [
        {
            "StandardsArn": "arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0",
            "SecurityControlId": "Config.1",
            "SecurityControlArn": "arn:aws:securityhub:us-east-1:068873283051:security-control/Config.1",
            "AssociationStatus": "ENABLED",
            "RelatedRequirements": [
                "CIS AWS Foundations 2.5"
            ],
            "UpdatedAt": "2022-10-27T16:07:12.960000+00:00",
            "StandardsControlTitle": "Ensure AWS Config is enabled",
            "StandardsControlDescription": "AWS Config is a web service that performs configuration management of supported AWS resources within your account and delivers log files to you. The recorded information includes the configuration item (AWS resource), relationships between configuration items (AWS resources), and any configuration changes between resources. It is recommended to enable AWS Config in all regions.",
            "StandardsControlArns": [
                "arn:aws:securityhub:us-east-1:068873283051:control/cis-aws-foundations-benchmark/v/1.2.0/2.5"
            ]
        },
        {
            "StandardsArn": "arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0",
            "SecurityControlId": "IAM.6",
            "SecurityControlArn": "arn:aws:securityhub:us-east-1:068873283051:security-control/IAM.6",
            "AssociationStatus": "DISABLED",
            "RelatedRequirements": [],
            "UpdatedAt": "2022-11-22T21:30:35.080000+00:00",
            "UpdatedReason": "test",
            "StandardsControlTitle": "Hardware MFA should be enabled for the root user",
            "StandardsControlDescription": "This AWS control checks whether your AWS account is enabled to use a hardware multi-factor authentication (MFA) device to sign in with root user credentials.",
            "StandardsControlArns": [
                "arn:aws:securityhub:us-east-1:068873283051:control/aws-foundational-security-best-practices/v/1.0.0/IAM.6"
            ]
        }
    ]
}

For more information, see Enabling and disabling controls in specific standards in the AWS Security Hub User Guide.

Output¶

StandardsControlAssociationDetails -> (list)

Provides the enablement status of a security control in a specified standard and other details for the control in relation to the specified standard.

(structure)

Provides details about a control's enablement status in a specified standard.

StandardsArn -> (string)

The Amazon Resource Name (ARN) of a security standard.

SecurityControlId -> (string)

The unique identifier of a security control across standards. Values for this field typically consist of an Amazon Web Services service name and a number, such as APIGateway.3.

SecurityControlArn -> (string)

The ARN of a security control across standards, such as arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1 . This parameter doesn't mention a specific standard.

AssociationStatus -> (string)

Specifies whether a control is enabled or disabled in a specified standard.

RelatedRequirements -> (list)

The requirement that underlies a control in the compliance framework related to the standard.

(string)

UpdatedAt -> (timestamp)

The time at which the enablement status of the control in the specified standard was last updated.

UpdatedReason -> (string)

The reason for updating the enablement status of a control in a specified standard.

StandardsControlTitle -> (string)

The title of a control. This field may reference a specific standard.

StandardsControlDescription -> (string)

The description of a control. This typically summarizes how Security Hub evaluates the control and the conditions under which it produces a failed finding. This parameter may reference a specific standard.

StandardsControlArns -> (list)

Provides the input parameter that Security Hub uses to call the UpdateStandardsControl API. This API can be used to enable or disable a control in a specified standard.

(string)

UnprocessedAssociations -> (list)

A security control (identified with SecurityControlId , SecurityControlArn , or a mix of both parameters) whose enablement status in a specified standard cannot be returned.

(structure)

Provides details about which control's enablement status couldn't be retrieved in a specified standard when calling BatchUpdateStandardsControlAssociations . This parameter also provides details about why the request was unprocessed.

StandardsControlAssociationId -> (structure)

An array with one or more objects that includes a security control (identified with SecurityControlId , SecurityControlArn , or a mix of both parameters) and the Amazon Resource Name (ARN) of a standard. This parameter shows the specific controls for which the enablement status couldn't be retrieved in specified standards when calling BatchUpdateStandardsControlAssociations .

SecurityControlId -> (string)

The unique identifier (identified with SecurityControlId , SecurityControlArn , or a mix of both parameters) of a security control across standards.

StandardsArn -> (string)

The ARN of a standard.

ErrorCode -> (string)

The error code for the unprocessed standard and control association.

ErrorReason -> (string)

The reason why the standard and control association was unprocessed.

Table Of Contents

Feedback

User Guide