# Understanding control parameters in Security Hub CSPM Some controls in AWS Security Hub CSPM use parameters that affect how the control is evaluated. Typically, such controls are evaluated against the default parameter values that Security Hub CSPM defines. However, for a subset of these controls, you can modify the parameter values. When you modify a control parameter value, Security Hub CSPM starts evaluating the control against the value that you specify. If the resource underlying the control satisfies the custom value, Security Hub CSPM generates a `PASSED` finding. If the resource doesn't satisfy the custom value, Security Hub CSPM generates a `FAILED` finding. By customizing control parameters, you can refine the security best practices recommended and monitored by Security Hub CSPM to align with your business requirements and security expectations. Instead of suppressing findings for a control, you can customize one or more of its parameters to get findings that suit your security needs. Here are some sample use cases for modifying control parameters and setting custom values: + **[CloudWatch.16] – CloudWatch log groups should be retained for a specified time period** You can specify the retention time period. + **[IAM.7] – Password policies for IAM users should have strong configurations** You can specify parameters related to password strength. + **[EC2.18] – Security groups should only allow unrestricted incoming traffic for authorized ports** You can specify which ports are authorized to permit unrestricted incoming traffic. + **[Lambda.5] – VPC Lambda functions should operate in multiple Availability Zones** You can specify the minimum number of Availability Zones that produces a passed finding. This section covers things to consider when you modify control parameters. ## Effect of modifying control parameter values When you change a parameter value, you also trigger a new security check that evaluates the control based on the new value. Security Hub CSPM then generates new control findings based on the new value. During periodic updates to control findings, Security Hub CSPM also uses the new parameter value. If you change parameter values for a control, but haven't enabled any standards that include the control, Security Hub CSPM doesn't conduct any security checks using the new values. You have to enable at least one relevant standard for Security Hub CSPM to evaluate the control based on the new parameter value. A control can have one or more customizable parameters. Possible data types for each control parameter include the following: + Boolean + Double + Enum + EnumList + Integer + IntegerList + String + StringList Custom parameter values apply across your enabled standards. You can't customize the parameters for a control that's not supported in your current Region. For a list of Regional limits for individual controls, see [Regional limits on Security Hub CSPM controls](regions-controls.md). For some controls, acceptable parameter values must fall into a specified range to be valid. In these cases, Security Hub CSPM provides the acceptable range. Security Hub CSPM chooses default parameter values and might occasionally update them. After you customize a control parameter, its value continues to be the value that you specified for the parameter unless your change it. That is to say, the parameter stops tracking updates to the default Security Hub CSPM value, even if the custom value of the parameter matches the current, default value defined by Security Hub CSPM. Here's an example for the control **[ACM.1] – Imported and ACM-issued certificates should be renewed after a specified time period**: ``` { "SecurityControlId": "ACM.1", "Parameters": { "daysToExpiration": { "ValueType": "CUSTOM", "Value": { "Integer": 30 } } } } ``` In the preceding example, the `daysToExpiration` parameter has a custom value of `30`. The current default value for this parameter is also `30`. If Security Hub CSPM changes the default value to `14`, the parameter in this example won't track that change. It will retain a value of `30`. If you want to track updates to the default Security Hub CSPM value for a parameter, set the `ValueType` field to `DEFAULT` instead of `CUSTOM`. For more information, see [Reverting to default control parameters in a single account and Region](revert-default-parameter-values.md#revert-default-parameter-values-local-config). ## Controls that support custom parameters For a list of security controls that support custom parameters, see the **Controls** page of the Security Hub CSPM console or the [Control reference for Security Hub CSPM](securityhub-controls-reference.md). To retrieve this list programmatically, you can use the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_ListSecurityControlDefinitions.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_ListSecurityControlDefinitions.html) operation. In the response, the `CustomizableProperties` object indicates which controls support customizable parameters. # Reviewing current control parameter values It can be helpful to know the current value of a control parameter before you modify it. You can review the current values for individual control parameters in your account. If you use central configuration, the delegated AWS Security Hub CSPM administrator can also review parameter values that are specified in a configuration policy. Choose your preferred method, and follow the steps to review current control parameter values. ------ #### [ Security Hub CSPM console ] **To review current control parameter values (console)** 1. Open the AWS Security Hub CSPM console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). 1. In the navigation pane, choose **Controls**. Choose a control. 1. Choose the **Parameters** tab. This tab shows the current parameter values for the control. ------ #### [ Security Hub CSPM API ] **To review current control parameter values (API)** Invoke the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchGetSecurityControls.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchGetSecurityControls.html) API, and provide one or more security control IDs or ARNs. The `Parameters` object in the response shows the current parameter values for the specified controls. For example, the following AWS CLI command shows the current parameter values for `APIGatway.1`, `CloudWatch.15`, and `IAM.7`. This example is formatted for Linux, macOS, or Unix, and it uses the backslash (\$1) line-continuation character to improve readability. ``` $ aws securityhub batch-get-security-controls \ --region us-east-1 \ --security-control-ids '["APIGateway.1", "CloudWatch.15", "IAM.7"]' ``` ------ Choose your preferred method to view the current parameter values in a central configuration policy. ------ #### [ Security Hub CSPM console ] **To review current control parameter values in a configuration policy (console)** 1. Open the AWS Security Hub CSPM console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). Sign in using the credentials of the delegated Security Hub CSPM administrator account in the home Region. 1. In the navigation pane, choose **Settings** and **Configuration**. 1. On the **Policies** tab, select the configuration policy, and then choose **View details**. The policy details then appear, including current parameter values. ------ #### [ Security Hub CSPM API ] **To review current control parameter values in a configuration policy (API)** 1. Invoke the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_GetConfigurationPolicy.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_GetConfigurationPolicy.html) API from the delegated administrator account in the home Region. 1. Provide the ARN or ID of the configuration policy whose details you want to see. The response includes current parameter values. For example, the following AWS CLI command retrieves the current control parameter values in the specified configuration policy. This example is formatted for Linux, macOS, or Unix, and it uses the backslash (\$1) line-continuation character to improve readability. ``` $ aws securityhub get-configuration-policy \ --region us-east-1 \ --identifier "arn:aws:securityhub:us-east-1:123456789012:configuration-policy/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111" ``` ------ Control findings also include the current values of control parameters. In the [AWS Security Finding Format (ASFF)](securityhub-findings-format.md), these values appear in the `Parameters` field of the `Compliance` object. To review findings on the Security Hub CSPM console, choose **Findings** in the navigation pane. To review findings programmatically, use the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_GetFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_GetFindings.html) operation of the Security Hub CSPM API. # Customizing control parameter values The instructions for customizing control parameters vary based on whether you use [central configuration](central-configuration-intro.md) in AWS Security Hub CSPM. Central configuration is a feature that the delegated Security Hub CSPM administrator can use to configure Security Hub CSPM capabilities across AWS Regions, accounts, and organizational units (OUs). If your organization uses central configuration, the delegated administrator can create configuration policies that include custom control parameters. These policies can be associated with centrally managed member accounts and OUs, and they take effect in your home Region and all linked Regions. The delegated administrator can also designate one or more accounts as self-managed, which allows the account owner to configure its own parameters separately in each Region. If your organization doesn't use central configuration, you must customize control parameters separately in each account and Region. We recommend using central configuration because it allows you to align control parameter values across different parts of your organization. For example, all of your test accounts might use certain parameter values, and all production accounts might use different values. ## Customizing control parameters in multiple accounts and Regions If you're the delegated Security Hub CSPM administrator for an organization that uses central configuration, choose your preferred method, and follow the steps to customize control parameters across multiple accounts and Regions. ------ #### [ Security Hub CSPM console ] **To customize control parameter values in multiple accounts and Regions (console)** 1. Open the AWS Security Hub CSPM console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). Ensure that you're signed in to the home Region. 1. In the navigation pane, choose **Settings** and **Configuration**. 1. Choose the **Policies** tab. 1. To create a new configuration policy that includes custom parameters, choose **Create policy**. To specify custom parameters in an existing configuration policy, select the policy, and then choose **Edit**. **To create a new configuration policy with custom control parameter values** 1. In the **Custom policy** section, choose the security standards and controls that you want to enable. 1. Select **Customize control parameters**. 1. Select a control, and then specify custom values for one or more parameters. 1. To customize parameters for more controls, choose **Customize additional control**. 1. In the **Accounts** section, select the accounts or OUs that you want to apply the policy to. 1. Choose **Next**. 1. Choose **Create policy and apply**. In your home Region and all linked Regions, this action overrides the existing configuration settings of accounts and OUs that are associated with this configuration policy. Accounts and OUs can be associated with a configuration policy through direct application or inheritance from a parent. **To customize control parameter values in an existing configuration policy** 1. In the **Controls** section, under **Custom policy**, specify the new custom parameter values that you want. 1. If this is your first time customizing control parameters in this policy, select **Customize control parameters**, and then select a control to customize. To customize parameters for more controls, choose **Customize additional control**. 1. In the **Accounts** section, verify the accounts or OUs that you want to apply the policy to. 1. Choose **Next**. 1. Review your changes, and verify that they're correct. When you finish, choose **Save policy and apply**. In your home Region and all linked Regions, this action overrides the existing configuration settings of accounts and OUs that are associated with this configuration policy. Accounts and OUs can be associated with a configuration policy through direct application or inheritance from a parent. ------ #### [ Security Hub CSPM API ] **To customize control parameter values in multiple accounts and Regions (API)** **To create a new configuration policy with custom control parameter values** 1. Invoke the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_CreateConfigurationPolicy.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_CreateConfigurationPolicy.html) API from the delegated administrator account in the home Region. 1. For the `SecurityControlCustomParameters` object, provide the identifier of each control that you want to customize. 1. For the `Parameters` object, provide the name of each parameter that you want to customize. For each parameter that you customize, provide `CUSTOM` for `ValueType`. For `Value`, provide the data type of the parameter and the custom value. The `Value` field can't be empty when `ValueType` is `CUSTOM`. If your request omits a parameter that the control supports, that parameter retains its current value. You can find supported parameters, data types, and valid values for a control by invoking the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_GetSecurityControlDefinition.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_GetSecurityControlDefinition.html) API. **To customize control parameter values in an existing configuration policy** 1. Invoke the [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateConfigurationPolicy.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateConfigurationPolicy.html) API from the delegated administrator account in the home Region. 1. For the `Identifier` field, provide the Amazon Resource Name (ARN) or ID of the configuration policy that you want to update. 1. For the `SecurityControlCustomParameters` object, provide the identifier of each control that you want to customize. 1. For the `Parameters` object, provide the name of each parameter that you want to customize. For each parameter that you customize, provide `CUSTOM` for `ValueType`. For `Value`, provide the data type of the parameter and the custom value. If your request omits a parameter that the control supports, that parameter retains its current value. You can find supported parameters, data types, and valid values for a control by invoking the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_GetSecurityControlDefinition.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_GetSecurityControlDefinition.html) API. For example, the following AWS CLI command creates a new configuration policy with a custom value for the `daysToExpiration` parameter of `ACM.1`. This example is formatted for Linux, macOS, or Unix, and it uses the backslash (\$1) line-continuation character to improve readability. ``` $ aws securityhub create-configuration-policy \ --region us-east-1 \ --name "SampleConfigurationPolicy" \ --description "Configuration policy for production accounts" \ --configuration-policy '{"SecurityHub": {"ServiceEnabled": true, "EnabledStandardIdentifiers": ["arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0","arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"],"SecurityControlsConfiguration":{"DisabledSecurityControlIdentifiers": ["CloudTrail.2"], "SecurityControlCustomParameters": [{"SecurityControlId": "ACM.1", "Parameters": {"daysToExpiration": {"ValueType": "CUSTOM", "Value": "Integer": 15}}}]}}}' ``` ------ ## Customizing control parameters in a single account and Region If you don't use central configuration or have a self-managed account, you can customize control parameters for your account in one Region at a time only. Choose your preferred method, and follow the steps to customize control parameters. Your changes apply only to your account in the current Region. To customize the control parameters in additional Regions, repeat the following steps in each additional account and Region in which you want to customize parameters. The same control can use different parameter values in different Regions. ------ #### [ Security Hub CSPM console ] **To customize control parameter values in one account and Region (console)** 1. Open the AWS Security Hub CSPM console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). 1. In the navigation pane, choose **Controls**. In the table, choose a control that supports custom parameters and you want to change the parameters for. The **Custom parameters** column indicates which controls support custom parameters. 1. On the details page for the control, choose the **Parameters** tab, and then choose **Edit**. 1. Specify the parameter values that you want. 1. Optionally, in the **Reason for change** section, select a reason for customizing the parameters. 1. Choose **Save**. ------ #### [ Security Hub CSPM API ] **To customize control parameter values in one account and Region (API)** 1. Invoke the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_UpdateSecurityControl.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_UpdateSecurityControl.html) API. 1. For `SecurityControlId`, provide the ID of the control that you want to customize. 1. For the `Parameters` object, provide the name of each parameter that you want to customize. For each parameter that you customize, provide `CUSTOM` for `ValueType`. For `Value`, provide the data type of the parameter and the custom value. If your request omits a parameter that the control supports, that parameter retains its current value. You can find supported parameters, data types, and valid values for a control by invoking the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_GetSecurityControlDefinition.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_GetSecurityControlDefinition.html) API. 1. Optionally, for `LastUpdateReason`, provide a reason for customizing the control parameters. For example, the following AWS CLI command defines a custom value for the `daysToExpiration` parameter of `ACM.1`. This example is formatted for Linux, macOS, or Unix, and it uses the backslash (\$1) line-continuation character to improve readability. ``` $ aws securityhub update-security-control \ --region us-east-1 \ --security-control-id ACM.1 \ --parameters '{"daysToExpiration": {"ValueType": "CUSTOM", "Value": {"Integer": 15}}}' \ --last-update-reason "Internal compliance requirement" ``` ------ # Reverting to default control parameter values A control parameter can have a default value that AWS Security Hub CSPM defines. Occasionally, Security Hub CSPM updates the default value for a parameter to reflect evolving security best practices. If you haven't specified a custom value for a control parameter, the control automatically tracks those updates and uses the new default value. You can revert to using default parameter values for a control. The instructions for reversion depend on whether you use [central configuration](central-configuration-intro.md) in Security Hub CSPM. Central configuration is a feature that the delegated Security Hub CSPM administrator can use to configure Security Hub CSPM capabilities across AWS Regions, accounts, and organizational units (OUs). **Note** Not all control parameters have a default Security Hub CSPM value. In such cases, when `ValueType` is set to `DEFAULT`, there isn't a specific default value that Security Hub CSPM uses. Rather, Security Hub CSPM ignores the parameter in the absence of a custom value. ## Reverting to default control parameters in multiple accounts and Regions If you use central configuration, you can revert control parameters for multiple, centrally managed accounts and OUs in the home Region and linked Regions. Choose your preferred method, and follow the steps to revert to default parameter values across multiple accounts and Regions using central configuration. ------ #### [ Security Hub CSPM console ] **To revert to default control parameter values in multiple accounts and Regions (console)** 1. Open the AWS Security Hub CSPM console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). Sign in using the credentials of the delegated Security Hub CSPM administrator account in the home Region. 1. In the navigation pane, choose **Settings** and **Configuration**. 1. Choose the **Policies** tab. 1. Select a policy, and then choose **Edit**. 1. Under **Custom policy**, the **Controls** section shows a list of controls that you specified custom parameters for. 1. Find the control that has one or more parameter values to revert. Then, choose **Remove** to revert to the default values. 1. In the **Accounts** section, verify the accounts or OUs that you want to apply the policy to. 1. Choose **Next**. 1. Review your changes, and verify that they're correct. When you finish, choose **Save policy and apply**. In your home Region and all linked Regions, this action overrides the existing configuration settings of accounts and OUs that are associated with this configuration policy. Accounts and OUs can be associated with a configuration policy through direct application or inheritance from a parent. ------ #### [ Security Hub CSPM API ] **To revert to default control parameter values in multiple accounts and Regions (API)** 1. Invoke the [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateConfigurationPolicy.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_UpdateConfigurationPolicy.html) API from the delegated administrator account in the home Region. 1. For the `Identifier` field, provide the Amazon Resource Name (ARN) or ID of the policy that you want to update. 1. For the `SecurityControlCustomParameters` object, provide the identifier of each control for which you want to revert one or more parameters. 1. In the `Parameters` object, for each parameter that you want to revert, provide `DEFAULT` for the `ValueType` field. When `ValueType` is set to `DEFAULT`, you don't need to provide a value for the `Value` field. If a value is included in your request, Security Hub CSPM ignores it. If your request omits a parameter that the control supports, that parameter retains its current value. **Warning** If you omit a control object from the `SecurityControlCustomParameters` field, Security Hub CSPM reverts all custom parameters for the control to their default values. A completely empty list for `SecurityControlCustomParameters` reverts custom parameters for all controls to their default values. For example, the following AWS CLI command reverts the `daysToExpiration` control parameter for `ACM.1` to its default value in the specified configuration policy. This example is formatted for Linux, macOS, or Unix, and it uses the backslash (\$1) line-continuation character to improve readability. ``` $ aws securityhub create-configuration-policy \ --region us-east-1 \ --identifier "arn:aws:securityhub:us-east-1:123456789012:configuration-policy/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111" \ --name "TestConfigurationPolicy" \ --description "Updated configuration policy" \ --updated-reason "Revert ACM.1 parameter to default value" --configuration-policy '{"SecurityHub": {"ServiceEnabled": true, "EnabledStandardIdentifiers": ["arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0","arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0"],"SecurityControlsConfiguration":{"DisabledSecurityControlIdentifiers": ["CloudTrail.2"], "SecurityControlCustomParameters": [{"SecurityControlId": "ACM.1", "Parameters": {"daysToExpiration": {"ValueType": "DEFAULT"}}}]}}}' ``` ------ ## Reverting to default control parameters in a single account and Region If you don't use central configuration or have a self-managed account, you can revert to using default parameter values for your account in one Region at a time. Choose your preferred method, and follow the steps to revert to default parameter values for your account in a single Region. To revert to default parameter values in additional Regions, repeat these steps in each additional Region. **Note** If you disable Security Hub CSPM, your custom control parameters are reset. If you enable Security Hub CSPM again in the future, all controls will use default parameter values to start. ------ #### [ Security Hub CSPM console ] **To revert to default control parameter values in one account and Region (console)** 1. Open the AWS Security Hub CSPM console at [https://console.aws.amazon.com/securityhub/](https://console.aws.amazon.com/securityhub/). 1. In the navigation pane, choose **Controls**. Choose the control that you want to revert to default parameter values. 1. On the `Parameters` tab, choose **Customized** next to a control parameter. Then, choose **Remove customization**. This parameter now uses the default Security Hub CSPM value and tracks future updates to the default value. 1. Repeat the preceding step for each parameter value that you want to revert. ------ #### [ Security Hub CSPM API ] **To revert to default control parameter values in one account and Region (API)** 1. Invoke the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_UpdateSecurityControl.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_UpdateSecurityControl.html) API. 1. For `SecurityControlId`, provide the ARN or ID of the control whose parameters you want to revert. 1. In the `Parameters` object, for each parameter that you want to revert, provide `DEFAULT` for the `ValueType` field. When `ValueType` is set to `DEFAULT`, you don't need to provide a value for the `Value` field. If a value is included in your request, Security Hub CSPM ignores it. 1. Optionally, for `LastUpdateReason`, provide a reason for reverting to default parameter values. For example, the following AWS CLI command reverts the `daysToExpiration` control parameter for `ACM.1` to its default value. This example is formatted for Linux, macOS, or Unix, and it uses the backslash (\$1) line-continuation character to improve readability. ``` $ aws securityhub update-security-control \ --region us-east-1 \ --security-control-id ACM.1 \ --parameters '{"daysToExpiration": {"ValueType": "DEFAULT"}}' \ --last-update-reason "New internal requirement" ``` ------ # Checking the status of control parameter changes When you attempt to customize a control parameter or revert to the default value, you can validate whether the desired changes were effective. This helps ensure that a control works as you expect and provides the intended security value. If a parameter update is unsuccessful, Security Hub CSPM retains the current value for the parameter. To verify that a parameter update was successful, you can review the details of the control on the Security Hub CSPM console. On the console, choose **Controls** on the navigation pane. Then, choose a control to display its details. The **Parameters** tab shows the status of the parameter change. Programmatically, if your request to update a parameter is valid, the value of the `UpdateStatus` field is `UPDATING` in a response to the [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchGetSecurityControls.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchGetSecurityControls.html) operation. This means that the update was valid, but all findings might not yet include the updated parameter values. When the value of `UpdateState` changes to `READY`, Security Hub CSPM uses the updated control parameter values when running security checks of the control. Findings include the updated parameter values. The `UpdateSecurityControl` operation returns an `InvalidInputException` response for invalid parameter values. The response provides additional details about the reason for failure. For example, you might have specified a value that's outside the valid range for a parameter. Or, you might have specified a value that doesn't use the correct data type. Submit your request again with valid input. If an internal failure occurs when you try to update a parameter value, Security Hub CSPM automatically retries if you have AWS Config enabled. For more information, see [Considerations before enabling and configuring AWS Config](securityhub-setup-prereqs.md#securityhub-prereq-config).