# AWS Security Finding Format (ASFF) AWS Security Hub CSPM consumes and aggregates findings from integrated AWS services and third-party products. Security Hub CSPM processes these findings using a standard findings format called the *AWS Security Finding Format (ASFF)*, which eliminates the need for time-consuming data conversion efforts. This page provides a complete outline of the JSON for a finding in the AWS Security Finding Format (ASFF). The format derives from [JSON Schema](https://json-schema.org/). Choose the name of a linked object to review an example of a finding for that object. Comparing your Security Hub CSPM findings with the resources and examples shown here can help you interpret your findings. For descriptions of individual ASFF attributes, see [Required top-level ASFF attributes](asff-required-attributes.md) and [Optional top-level ASFF attributes](asff-top-level-attributes.md). ``` "Findings": [ { "Action": { "ActionType": "string", "AwsApiCallAction": { "AffectedResources": { "string": "string" }, "Api": "string", "CallerType": "string", "DomainDetails": { "Domain": "string" }, "FirstSeen": "string", "LastSeen": "string", "RemoteIpDetails": { "City": { "CityName": "string" }, "Country": { "CountryCode": "string", "CountryName": "string" }, "IpAddressV4": "string", "Geolocation": { "Lat": number, "Lon": number }, "Organization": { "Asn": number, "AsnOrg": "string", "Isp": "string", "Org": "string" } }, "ServiceName": "string" }, "DnsRequestAction": { "Blocked": boolean, "Domain": "string", "Protocol": "string" }, "NetworkConnectionAction": { "Blocked": boolean, "ConnectionDirection": "string", "LocalPortDetails": { "Port": number, "PortName": "string" }, "Protocol": "string", "RemoteIpDetails": { "City": { "CityName": "string" }, "Country": { "CountryCode": "string", "CountryName": "string" }, "IpAddressV4": "string", "Geolocation": { "Lat": number, "Lon": number }, "Organization": { "Asn": number, "AsnOrg": "string", "Isp": "string", "Org": "string" } }, "RemotePortDetails": { "Port": number, "PortName": "string" } }, "PortProbeAction": { "Blocked": boolean, "PortProbeDetails": [{ "LocalIpDetails": { "IpAddressV4": "string" }, "LocalPortDetails": { "Port": number, "PortName": "string" }, "RemoteIpDetails": { "City": { "CityName": "string" }, "Country": { "CountryCode": "string", "CountryName": "string" }, "GeoLocation": { "Lat": number, "Lon": number }, "IpAddressV4": "string", "Organization": { "Asn": number, "AsnOrg": "string", "Isp": "string", "Org": "string" } } }] } }, "AwsAccountId": "string", "AwsAccountName": "string", "CompanyName": "string", "Compliance": { "AssociatedStandards": [{ "StandardsId": "string" }], "RelatedRequirements": ["string"], "SecurityControlId": "string", "SecurityControlParameters": [ { "Name": "string", "Value": ["string"] } ], "Status": "string", "StatusReasons": [ { "Description": "string", "ReasonCode": "string" } ] }, "Confidence": number, "CreatedAt": "string", "Criticality": number, "Description": "string", "Detection": { "Sequence": { "Uid": "string", "Actors": [{ "Id": "string", "Session": { "Uid": "string", "MfAStatus": "string", "CreatedTime": "string", "Issuer": "string" }, "User": { "CredentialUid": "string", "Name": "string", "Type": "string", "Uid": "string", "Account": { "Uid": "string", "Name": "string" } } }], "Endpoints": [{ "Id": "string", "Ip": "string", "Domain": "string", "Port": number, "Location": { "City": "string", "Country": "string", "Lat": number, "Lon": number }, "AutonomousSystem": { "Name": "string", "Number": number }, "Connection": { "Direction": "string" } }], "Signals": [{ "Id": "string", "Title": "string", "ActorIds": ["string"], "Count": number, "FirstSeenAt": number, "SignalIndicators": [ { "Key": "string", "Title": "string", "Values": ["string"] }, { "Key": "string", "Title": "string", "Values": ["string"] } ], "LastSeenAt": number, "Name": "string", "ResourceIds": ["string"], "Type": "string" }], "SequenceIndicators": [ { "Key": "string", "Title": "string", "Values": ["string"] }, { "Key": "string", "Title": "string", "Values": ["string"] } ] } }, "FindingProviderFields": { "Confidence": number, "Criticality": number, "RelatedFindings": [{ "ProductArn": "string", "Id": "string" }], "Severity": { "Label": "string", "Normalized": number, "Original": "string" }, "Types": ["string"] }, "FirstObservedAt": "string", "GeneratorId": "string", "Id": "string", "LastObservedAt": "string", "Malware": [{ "Name": "string", "Path": "string", "State": "string", "Type": "string" }], "Network": { "DestinationDomain": "string", "DestinationIpV4": "string", "DestinationIpV6": "string", "DestinationPort": number, "Direction": "string", "OpenPortRange": { "Begin": integer, "End": integer }, "Protocol": "string", "SourceDomain": "string", "SourceIpV4": "string", "SourceIpV6": "string", "SourceMac": "string", "SourcePort": number }, "NetworkPath": [{ "ComponentId": "string", "ComponentType": "string", "Egress": { "Destination": { "Address": ["string"], "PortRanges": [{ "Begin": integer, "End": integer }] }, "Protocol": "string", "Source": { "Address": ["string"], "PortRanges": [{ "Begin": integer, "End": integer }] } }, "Ingress": { "Destination": { "Address": ["string"], "PortRanges": [{ "Begin": integer, "End": integer }] }, "Protocol": "string", "Source": { "Address": ["string"], "PortRanges": [{ "Begin": integer, "End": integer }] } } }], "Note": { "Text": "string", "UpdatedAt": "string", "UpdatedBy": "string" }, "PatchSummary": { "FailedCount": number, "Id": "string", "InstalledCount": number, "InstalledOtherCount": number, "InstalledPendingReboot": number, "InstalledRejectedCount": number, "MissingCount": number, "Operation": "string", "OperationEndTime": "string", "OperationStartTime": "string", "RebootOption": "string" }, "Process": { "LaunchedAt": "string", "Name": "string", "ParentPid": number, "Path": "string", "Pid": number, "TerminatedAt": "string" }, "ProductArn": "string", "ProductFields": { "string": "string" }, "ProductName": "string", "RecordState": "string", "Region": "string", "RelatedFindings": [{ "Id": "string", "ProductArn": "string" }], "Remediation": { "Recommendation": { "Text": "string", "Url": "string" } }, "Resources": [{ "ApplicationArn": "string", "ApplicationName": "string", "DataClassification": { "DetailedResultsLocation": "string", "Result": { "AdditionalOccurrences": boolean, "CustomDataIdentifiers": { "Detections": [{ "Arn": "string", "Count": integer, "Name": "string", "Occurrences": { "Cells": [{ "CellReference": "string", "Column": integer, "ColumnName": "string", "Row": integer }], "LineRanges": [{ "End": integer, "Start": integer, "StartColumn": integer }], "OffsetRanges": [{ "End": integer, "Start": integer, "StartColumn": integer }], "Pages": [{ "LineRange": { "End": integer, "Start": integer, "StartColumn": integer }, "OffsetRange": { "End": integer, "Start": integer, "StartColumn": integer }, "PageNumber": integer }], "Records": [{ "JsonPath": "string", "RecordIndex": integer }] } }], "TotalCount": integer }, "MimeType": "string", "SensitiveData": [{ "Category": "string", "Detections": [{ "Count": integer, "Occurrences": { "Cells": [{ "CellReference": "string", "Column": integer, "ColumnName": "string", "Row": integer }], "LineRanges": [{ "End": integer, "Start": integer, "StartColumn": integer }], "OffsetRanges": [{ "End": integer, "Start": integer, "StartColumn": integer }], "Pages": [{ "LineRange": { "End": integer, "Start": integer, "StartColumn": integer }, "OffsetRange": { "End": integer, "Start": integer, "StartColumn": integer }, "PageNumber": integer }], "Records": [{ "JsonPath": "string", "RecordIndex": integer }] }, "Type": "string" }], "TotalCount": integer }], "SizeClassified": integer, "Status": { "Code": "string", "Reason": "string" } } }, "Details": { "AwsAmazonMQBroker": { "AutoMinorVersionUpgrade": boolean, "BrokerArn": "string", "BrokerId": "string", "BrokerName": "string", "Configuration": { "Id": "string", "Revision": integer }, "DeploymentMode": "string", "EncryptionOptions": { "UseAwsOwnedKey": boolean }, "EngineType": "string", "EngineVersion": "string", "HostInstanceType": "string", "Logs": { "Audit": boolean, "AuditLogGroup": "string", "General": boolean, "GeneralLogGroup": "string" }, "MaintenanceWindowStartTime": { "DayOfWeek": "string", "TimeOfDay": "string", "TimeZone": "string" }, "PubliclyAccessible": boolean, "SecurityGroups": [ "string" ], "StorageType": "string", "SubnetIds": [ "string", "string" ], "Users": [{ "Username": "string" }] }, "AwsApiGatewayRestApi": { "ApiKeySource": "string", "BinaryMediaTypes": [" string"], "CreatedDate": "string", "Description": "string", "EndpointConfiguration": { "Types": ["string"] }, "Id": "string", "MinimumCompressionSize": number, "Name": "string", "Version": "string" }, "AwsApiGatewayStage": { "AccessLogSettings": { "DestinationArn": "string", "Format": "string" }, "CacheClusterEnabled": boolean, "CacheClusterSize": "string", "CacheClusterStatus": "string", "CanarySettings": { "DeploymentId": "string", "PercentTraffic": number, "StageVariableOverrides": [{ "string": "string" }], "UseStageCache": boolean }, "ClientCertificateId": "string", "CreatedDate": "string", "DeploymentId": "string", "Description": "string", "DocumentationVersion": "string", "LastUpdatedDate": "string", "MethodSettings": [{ "CacheDataEncrypted": boolean, "CachingEnabled": boolean, "CacheTtlInSeconds": number, "DataTraceEnabled": boolean, "HttpMethod": "string", "LoggingLevel": "string", "MetricsEnabled": boolean, "RequireAuthorizationForCacheControl": boolean, "ResourcePath": "string", "ThrottlingBurstLimit": number, "ThrottlingRateLimit": number, "UnauthorizedCacheControlHeaderStrategy": "string" }], "StageName": "string", "TracingEnabled": boolean, "Variables": { "string": "string" }, "WebAclArn": "string" }, "AwsApiGatewayV2Api": { "ApiEndpoint": "string", "ApiId": "string", "ApiKeySelectionExpression": "string", "CorsConfiguration": { "AllowCredentials": boolean, "AllowHeaders": ["string"], "AllowMethods": ["string"], "AllowOrigins": ["string"], "ExposeHeaders": ["string"], "MaxAge": number }, "CreatedDate": "string", "Description": "string", "Name": "string", "ProtocolType": "string", "RouteSelectionExpression": "string", "Version": "string" }, "AwsApiGatewayV2Stage": { "AccessLogSettings": { "DestinationArn": "string", "Format": "string" }, "ApiGatewayManaged": boolean, "AutoDeploy": boolean, "ClientCertificateId": "string", "CreatedDate": "string", "DefaultRouteSettings": { "DataTraceEnabled": boolean, "DetailedMetricsEnabled": boolean, "LoggingLevel": "string", "ThrottlingBurstLimit": number, "ThrottlingRateLimit": number }, "DeploymentId": "string", "Description": "string", "LastDeploymentStatusMessage": "string", "LastUpdatedDate": "string", "RouteSettings": { "DetailedMetricsEnabled": boolean, "LoggingLevel": "string", "DataTraceEnabled": boolean, "ThrottlingBurstLimit": number, "ThrottlingRateLimit": number }, "StageName": "string", "StageVariables": [{ "string": "string" }] }, "AwsAppSyncGraphQLApi": { "AwsAppSyncGraphQlApi": { "AdditionalAuthenticationProviders": [ { "AuthenticationType": "string", "LambdaAuthorizerConfig": { "AuthorizerResultTtlInSeconds": integer, "AuthorizerUri": "string" } }, { "AuthenticationType": "string" } ], "ApiId": "string", "Arn": "string", "AuthenticationType": "string", "Id": "string", "LogConfig": { "CloudWatchLogsRoleArn": "string", "ExcludeVerboseContent": boolean, "FieldLogLevel": "string" }, "Name": "string", "XrayEnabled": boolean } }, "AwsAthenaWorkGroup": { "Description": "string", "Name": "string", "WorkgroupConfiguration": { "ResultConfiguration": { "EncryptionConfiguration": { "EncryptionOption": "string", "KmsKey": "string" } } }, "State": "string" }, "AwsAutoScalingAutoScalingGroup": { "AvailabilityZones": [{ "Value": "string" }], "CreatedTime": "string", "HealthCheckGracePeriod": integer, "HealthCheckType": "string", "LaunchConfigurationName": "string", "LoadBalancerNames": ["string"], "LaunchTemplate": { "LaunchTemplateId": "string", "LaunchTemplateName": "string", "Version": "string" }, "MixedInstancesPolicy": { "InstancesDistribution": { "OnDemandAllocationStrategy": "string", "OnDemandBaseCapacity": number, "OnDemandPercentageAboveBaseCapacity": number, "SpotAllocationStrategy": "string", "SpotInstancePools": number, "SpotMaxPrice": "string" }, "LaunchTemplate": { "LaunchTemplateSpecification": { "LaunchTemplateId": "string", "LaunchTemplateName": "string", "Version": "string" }, "CapacityRebalance": boolean, "Overrides": [{ "InstanceType": "string", "WeightedCapacity": "string" }] } } }, "AwsAutoScalingLaunchConfiguration": { "AssociatePublicIpAddress": boolean, "BlockDeviceMappings": [{ "DeviceName": "string", "Ebs": { "DeleteOnTermination": boolean, "Encrypted": boolean, "Iops": number, "SnapshotId": "string", "VolumeSize": number, "VolumeType": "string" }, "NoDevice": boolean, "VirtualName": "string" }], "ClassicLinkVpcId": "string", "ClassicLinkVpcSecurityGroups": ["string"], "CreatedTime": "string", "EbsOptimized": boolean, "IamInstanceProfile": "string" }, "ImageId": "string", "InstanceMonitoring": { "Enabled": boolean }, "InstanceType": "string", "KernelId": "string", "KeyName": "string", "LaunchConfigurationName": "string", "MetadataOptions": { "HttpEndPoint": "string", "HttpPutReponseHopLimit": number, "HttpTokens": "string" }, "PlacementTenancy": "string", "RamdiskId": "string", "SecurityGroups": ["string"], "SpotPrice": "string", "UserData": "string" }, "AwsBackupBackupPlan": { "BackupPlan": { "AdvancedBackupSettings": [{ "BackupOptions": { "WindowsVSS":"string" }, "ResourceType":"string" }], "BackupPlanName": "string", "BackupPlanRule": [{ "CompletionWindowMinutes": integer, "CopyActions": [{ "DestinationBackupVaultArn": "string", "Lifecycle": { "DeleteAfterDays": integer, "MoveToColdStorageAfterDays": integer } }], "Lifecycle": { "DeleteAfterDays": integer }, "RuleName": "string", "ScheduleExpression": "string", "StartWindowMinutes": integer, "TargetBackupVault": "string" }] }, "BackupPlanArn": "string", "BackupPlanId": "string", "VersionId": "string" }, "AwsBackupBackupVault": { "AccessPolicy": { "Statement": [{ "Action": ["string"], "Effect": "string", "Principal": { "AWS": "string" }, "Resource": "string" }], "Version": "string" }, "BackupVaultArn": "string", "BackupVaultName": "string", "EncryptionKeyArn": "string", "Notifications": { "BackupVaultEvents": ["string"], "SNSTopicArn": "string" } }, "AwsBackupRecoveryPoint": { "BackupSizeInBytes": integer, "BackupVaultName": "string", "BackupVaultArn": "string", "CalculatedLifecycle": { "DeleteAt": "string", "MoveToColdStorageAt": "string" }, "CompletionDate": "string", "CreatedBy": { "BackupPlanArn": "string", "BackupPlanId": "string", "BackupPlanVersion": "string", "BackupRuleId": "string" }, "CreationDate": "string", "EncryptionKeyArn": "string", "IamRoleArn": "string", "IsEncrypted": boolean, "LastRestoreTime": "string", "Lifecycle": { "DeleteAfterDays": integer, "MoveToColdStorageAfterDays": integer }, "RecoveryPointArn": "string", "ResourceArn": "string", "ResourceType": "string", "SourceBackupVaultArn": "string", "Status": "string", "StatusMessage": "string", "StorageClass": "string" }, "AwsCertificateManagerCertificate": { "CertificateAuthorityArn": "string", "CreatedAt": "string", "DomainName": "string", "DomainValidationOptions": [{ "DomainName": "string", "ResourceRecord": { "Name": "string", "Type": "string", "Value": "string" }, "ValidationDomain": "string", "ValidationEmails": ["string"], "ValidationMethod": "string", "ValidationStatus": "string" }], "ExtendedKeyUsages": [{ "Name": "string", "OId": "string" }], "FailureReason": "string", "ImportedAt": "string", "InUseBy": ["string"], "IssuedAt": "string", "Issuer": "string", "KeyAlgorithm": "string", "KeyUsages": [{ "Name": "string" }], "NotAfter": "string", "NotBefore": "string", "Options": { "CertificateTransparencyLoggingPreference": "string" }, "RenewalEligibility": "string", "RenewalSummary": { "DomainValidationOptions": [{ "DomainName": "string", "ResourceRecord": { "Name": "string", "Type": "string", "Value": "string" }, "ValidationDomain": "string", "ValidationEmails": ["string"], "ValidationMethod": "string", "ValidationStatus": "string" }], "RenewalStatus": "string", "RenewalStatusReason": "string", "UpdatedAt": "string" }, "Serial": "string", "SignatureAlgorithm": "string", "Status": "string", "Subject": "string", "SubjectAlternativeNames": ["string"], "Type": "string" }, "AwsCloudFormationStack": { "Capabilities": ["string"], "CreationTime": "string", "Description": "string", "DisableRollback": boolean, "DriftInformation": { "StackDriftStatus": "string" }, "EnableTerminationProtection": boolean, "LastUpdatedTime": "string", "NotificationArns": ["string"], "Outputs": [{ "Description": "string", "OutputKey": "string", "OutputValue": "string" }], "RoleArn": "string", "StackId": "string", "StackName": "string", "StackStatus": "string", "StackStatusReason": "string", "TimeoutInMinutes": number }, "AwsCloudFrontDistribution": { "CacheBehaviors": { "Items": [{ "ViewerProtocolPolicy": "string" }] }, "DefaultCacheBehavior": { "ViewerProtocolPolicy": "string" }, "DefaultRootObject": "string", "DomainName": "string", "Etag": "string", "LastModifiedTime": "string", "Logging": { "Bucket": "string", "Enabled": boolean, "IncludeCookies": boolean, "Prefix": "string" }, "OriginGroups": { "Items": [{ "FailoverCriteria": { "StatusCodes": { "Items": [number], "Quantity": number } } }] }, "Origins": { "Items": [{ "CustomOriginConfig": { "HttpPort": number, "HttpsPort": number, "OriginKeepaliveTimeout": number, "OriginProtocolPolicy": "string", "OriginReadTimeout": number, "OriginSslProtocols": { "Items": ["string"], "Quantity": number } }, "DomainName": "string", "Id": "string", "OriginPath": "string", "S3OriginConfig": { "OriginAccessIdentity": "string" } }] }, "Status": "string", "ViewerCertificate": { "AcmCertificateArn": "string", "Certificate": "string", "CertificateSource": "string", "CloudFrontDefaultCertificate": boolean, "IamCertificateId": "string", "MinimumProtocolVersion": "string", "SslSupportMethod": "string" }, "WebAclId": "string" }, "AwsCloudTrailTrail": { "CloudWatchLogsLogGroupArn": "string", "CloudWatchLogsRoleArn": "string", "HasCustomEventSelectors": boolean, "HomeRegion": "string", "IncludeGlobalServiceEvents": boolean, "IsMultiRegionTrail": boolean, "IsOrganizationTrail": boolean, "KmsKeyId": "string", "LogFileValidationEnabled": boolean, "Name": "string", "S3BucketName": "string", "S3KeyPrefix": "string", "SnsTopicArn": "string", "SnsTopicName": "string", "TrailArn": "string" }, "AwsCloudWatchAlarm": { "ActionsEnabled": boolean, "AlarmActions": ["string"], "AlarmArn": "string", "AlarmConfigurationUpdatedTimestamp": "string", "AlarmDescription": "string", "AlarmName": "string", "ComparisonOperator": "string", "DatapointsToAlarm": number, "Dimensions": [{ "Name": "string", "Value": "string" }], "EvaluateLowSampleCountPercentile": "string", "EvaluationPeriods": number, "ExtendedStatistic": "string", "InsufficientDataActions": ["string"], "MetricName": "string", "Namespace": "string", "OkActions": ["string"], "Period": number, "Statistic": "string", "Threshold": number, "ThresholdMetricId": "string", "TreatMissingData": "string", "Unit": "string" }, "AwsCodeBuildProject": { "Artifacts": [{ "ArtifactIdentifier": "string", "EncryptionDisabled": boolean, "Location": "string", "Name": "string", "NamespaceType": "string", "OverrideArtifactName": boolean, "Packaging": "string", "Path": "string", "Type": "string" }], "SecondaryArtifacts": [{ "ArtifactIdentifier": "string", "Type": "string", "Location": "string", "Name": "string", "NamespaceType": "string", "Packaging": "string", "Path": "string", "EncryptionDisabled": boolean, "OverrideArtifactName": boolean }], "EncryptionKey": "string", "Certificate": "string", "Environment": { "Certificate": "string", "EnvironmentVariables": [{ "Name": "string", "Type": "string", "Value": "string" }], "ImagePullCredentialsType": "string", "PrivilegedMode": boolean, "RegistryCredential": { "Credential": "string", "CredentialProvider": "string" }, "Type": "string" }, "LogsConfig": { "CloudWatchLogs": { "GroupName": "string", "Status": "string", "StreamName": "string" }, "S3Logs": { "EncryptionDisabled": boolean, "Location": "string", "Status": "string" } }, "Name": "string", "ServiceRole": "string", "Source": { "Type": "string", "Location": "string", "GitCloneDepth": integer }, "VpcConfig": { "VpcId": "string", "Subnets": ["string"], "SecurityGroupIds": ["string"] } }, "AwsDmsEndpoint": { "CertificateArn": "string", "DatabaseName": "string", "EndpointArn": "string", "EndpointIdentifier": "string", "EndpointType": "string", "EngineName": "string", "KmsKeyId": "string", "Port": integer, "ServerName": "string", "SslMode": "string", "Username": "string" }, "AwsDmsReplicationInstance": { "AllocatedStorage": integer, "AutoMinorVersionUpgrade": boolean, "AvailabilityZone": "string", "EngineVersion": "string", "KmsKeyId": "string", "MultiAZ": boolean, "PreferredMaintenanceWindow": "string", "PubliclyAccessible": boolean, "ReplicationInstanceClass": "string", "ReplicationInstanceIdentifier": "string", "ReplicationSubnetGroup": { "ReplicationSubnetGroupIdentifier": "string" }, "VpcSecurityGroups": [ { "VpcSecurityGroupId": "string" } ] }, "AwsDmsReplicationTask": { "CdcStartPosition": "string", "Id": "string", "MigrationType": "string", "ReplicationInstanceArn": "string", "ReplicationTaskIdentifier": "string", "ReplicationTaskSettings": { "string": "string" }, "SourceEndpointArn": "string", "TableMappings": { "string": "string" }, "TargetEndpointArn": "string" }, "AwsDynamoDbTable": { "AttributeDefinitions": [{ "AttributeName": "string", "AttributeType": "string" }], "BillingModeSummary": { "BillingMode": "string", "LastUpdateToPayPerRequestDateTime": "string" }, "CreationDateTime": "string", "DeletionProtectionEnabled": boolean, "GlobalSecondaryIndexes": [{ "Backfilling": boolean, "IndexArn": "string", "IndexName": "string", "IndexSizeBytes": number, "IndexStatus": "string", "ItemCount": number, "KeySchema": [{ "AttributeName": "string", "KeyType": "string" }], "Projection": { "NonKeyAttributes": ["string"], "ProjectionType": "string" }, "ProvisionedThroughput": { "LastDecreaseDateTime": "string", "LastIncreaseDateTime": "string", "NumberOfDecreasesToday": number, "ReadCapacityUnits": number, "WriteCapacityUnits": number } }], "GlobalTableVersion": "string", "ItemCount": number, "KeySchema": [{ "AttributeName": "string", "KeyType": "string" }], "LatestStreamArn": "string", "LatestStreamLabel": "string", "LocalSecondaryIndexes": [{ "IndexArn": "string", "IndexName": "string", "KeySchema": [{ "AttributeName": "string", "KeyType": "string" }], "Projection": { "NonKeyAttributes": ["string"], "ProjectionType": "string" } }], "ProvisionedThroughput": { "LastDecreaseDateTime": "string", "LastIncreaseDateTime": "string", "NumberOfDecreasesToday": number, "ReadCapacityUnits": number, "WriteCapacityUnits": number }, "Replicas": [{ "GlobalSecondaryIndexes": [{ "IndexName": "string", "ProvisionedThroughputOverride": { "ReadCapacityUnits": number } }], "KmsMasterKeyId": "string", "ProvisionedThroughputOverride": { "ReadCapacityUnits": number }, "RegionName": "string", "ReplicaStatus": "string", "ReplicaStatusDescription": "string" }], "RestoreSummary": { "RestoreDateTime": "string", "RestoreInProgress": boolean, "SourceBackupArn": "string", "SourceTableArn": "string" }, "SseDescription": { "InaccessibleEncryptionDateTime": "string", "KmsMasterKeyArn": "string", "SseType": "string", "Status": "string" }, "StreamSpecification": { "StreamEnabled": boolean, "StreamViewType": "string" }, "TableId": "string", "TableName": "string", "TableSizeBytes": number, "TableStatus": "string" }, "AwsEc2ClientVpnEndpoint": { "AuthenticationOptions": [ { "MutualAuthentication": { "ClientRootCertificateChainArn": "string" }, "Type": "string" } ], "ClientCidrBlock": "string", "ClientConnectOptions": { "Enabled": boolean }, "ClientLoginBannerOptions": { "Enabled": boolean }, "ClientVpnEndpointId": "string", "ConnectionLogOptions": { "Enabled": boolean }, "Description": "string", "DnsServer": ["string"], "ServerCertificateArn": "string", "SecurityGroupIdSet": [ "string" ], "SelfServicePortalUrl": "string", "SessionTimeoutHours": "integer", "SplitTunnel": boolean, "TransportProtocol": "string", "VpcId": "string", "VpnPort": integer }, "AwsEc2Eip": { "AllocationId": "string", "AssociationId": "string", "Domain": "string", "InstanceId": "string", "NetworkBorderGroup": "string", "NetworkInterfaceId": "string", "NetworkInterfaceOwnerId": "string", "PrivateIpAddress": "string", "PublicIp": "string", "PublicIpv4Pool": "string" }, "AwsEc2Instance": { "IamInstanceProfileArn": "string", "ImageId": "string", "IpV4Addresses": ["string"], "IpV6Addresses": ["string"], "KeyName": "string", "LaunchedAt": "string", "MetadataOptions": { "HttpEndpoint": "string", "HttpProtocolIpv6": "string", "HttpPutResponseHopLimit": number, "HttpTokens": "string", "InstanceMetadataTags": "string" }, "Monitoring": { "State": "string" }, "NetworkInterfaces": [{ "NetworkInterfaceId": "string" }], "SubnetId": "string", "Type": "string", "VirtualizationType": "string", "VpcId": "string" }, "AwsEc2LaunchTemplate": { "DefaultVersionNumber": "string", "ElasticGpuSpecifications": ["string"], "ElasticInferenceAccelerators": ["string"], "Id": "string", "ImageId": "string", "LatestVersionNumber": "string", "LaunchTemplateData": { "BlockDeviceMappings": [{ "DeviceName": "string", "Ebs": { "DeleteonTermination": boolean, "Encrypted": boolean, "SnapshotId": "string", "VolumeSize": number, "VolumeType": "string" } }], "MetadataOptions": { "HttpTokens": "string", "HttpPutResponseHopLimit" : number }, "Monitoring": { "Enabled": boolean }, "NetworkInterfaces": [{ "AssociatePublicIpAddress" : boolean }] }, "LaunchTemplateName": "string", "LicenseSpecifications": ["string"], "SecurityGroupIds": ["string"], "SecurityGroups": ["string"], "TagSpecifications": ["string"] }, "AwsEc2NetworkAcl": { "Associations": [{ "NetworkAclAssociationId": "string", "NetworkAclId": "string", "SubnetId": "string" }], "Entries": [{ "CidrBlock": "string", "Egress": boolean, "IcmpTypeCode": { "Code": number, "Type": number }, "Ipv6CidrBlock": "string", "PortRange": { "From": number, "To": number }, "Protocol": "string", "RuleAction": "string", "RuleNumber": number }], "IsDefault": boolean, "NetworkAclId": "string", "OwnerId": "string", "VpcId": "string" }, "AwsEc2NetworkInterface": { "Attachment": { "AttachmentId": "string", "AttachTime": "string", "DeleteOnTermination": boolean, "DeviceIndex": number, "InstanceId": "string", "InstanceOwnerId": "string", "Status": "string" }, "Ipv6Addresses": [{ "Ipv6Address": "string" }], "NetworkInterfaceId": "string", "PrivateIpAddresses": [{ "PrivateDnsName": "string", "PrivateIpAddress": "string" }], "PublicDnsName": "string", "PublicIp": "string", "SecurityGroups": [{ "GroupId": "string", "GroupName": "string" }], "SourceDestCheck": boolean }, "AwsEc2RouteTable": { "AssociationSet": [{ "AssociationState": { "State": "string" }, "Main": boolean, "RouteTableAssociationId": "string", "RouteTableId": "string" }], "PropogatingVgwSet": [], "RouteTableId": "string", "RouteSet": [ { "DestinationCidrBlock": "string", "GatewayId": "string", "Origin": "string", "State": "string" }, { "DestinationCidrBlock": "string", "GatewayId": "string", "Origin": "string", "State": "string" } ], "VpcId": "string" }, "AwsEc2SecurityGroup": { "GroupId": "string", "GroupName": "string", "IpPermissions": [{ "FromPort": number, "IpProtocol": "string", "IpRanges": [{ "CidrIp": "string" }], "Ipv6Ranges": [{ "CidrIpv6": "string" }], "PrefixListIds": [{ "PrefixListId": "string" }], "ToPort": number, "UserIdGroupPairs": [{ "GroupId": "string", "GroupName": "string", "PeeringStatus": "string", "UserId": "string", "VpcId": "string", "VpcPeeringConnectionId": "string" }] }], "IpPermissionsEgress": [{ "FromPort": number, "IpProtocol": "string", "IpRanges": [{ "CidrIp": "string" }], "Ipv6Ranges": [{ "CidrIpv6": "string" }], "PrefixListIds": [{ "PrefixListId": "string" }], "ToPort": number, "UserIdGroupPairs": [{ "GroupId": "string", "GroupName": "string", "PeeringStatus": "string", "UserId": "string", "VpcId": "string", "VpcPeeringConnectionId": "string" }] }], "OwnerId": "string", "VpcId": "string" }, "AwsEc2Subnet": { "AssignIpv6AddressOnCreation": boolean, "AvailabilityZone": "string", "AvailabilityZoneId": "string", "AvailableIpAddressCount": number, "CidrBlock": "string", "DefaultForAz": boolean, "Ipv6CidrBlockAssociationSet": [{ "AssociationId": "string", "Ipv6CidrBlock": "string", "CidrBlockState": "string" }], "MapPublicIpOnLaunch": boolean, "OwnerId": "string", "State": "string", "SubnetArn": "string", "SubnetId": "string", "VpcId": "string" }, "AwsEc2TransitGateway": { "AmazonSideAsn": number, "AssociationDefaultRouteTableId": "string", "AutoAcceptSharedAttachments": "string", "DefaultRouteTableAssociation": "string", "DefaultRouteTablePropagation": "string", "Description": "string", "DnsSupport": "string", "Id": "string", "MulticastSupport": "string", "PropagationDefaultRouteTableId": "string", "TransitGatewayCidrBlocks": ["string"], "VpnEcmpSupport": "string" }, "AwsEc2Volume": { "Attachments": [{ "AttachTime": "string", "DeleteOnTermination": boolean, "InstanceId": "string", "Status": "string" }], "CreateTime": "string", "DeviceName": "string", "Encrypted": boolean, "KmsKeyId": "string", "Size": number, "SnapshotId": "string", "Status": "string", "VolumeId": "string", "VolumeScanStatus": "string", "VolumeType": "string" }, "AwsEc2Vpc": { "CidrBlockAssociationSet": [{ "AssociationId": "string", "CidrBlock": "string", "CidrBlockState": "string" }], "DhcpOptionsId": "string", "Ipv6CidrBlockAssociationSet": [{ "AssociationId": "string", "CidrBlockState": "string", "Ipv6CidrBlock": "string" }], "State": "string" }, "AwsEc2VpcEndpointService": { "AcceptanceRequired": boolean, "AvailabilityZones": ["string"], "BaseEndpointDnsNames": ["string"], "ManagesVpcEndpoints": boolean, "GatewayLoadBalancerArns": ["string"], "NetworkLoadBalancerArns": ["string"], "PrivateDnsName": "string", "ServiceId": "string", "ServiceName": "string", "ServiceState": "string", "ServiceType": [{ "ServiceType": "string" }] }, "AwsEc2VpcPeeringConnection": { "AccepterVpcInfo": { "CidrBlock": "string", "CidrBlockSet": [{ "CidrBlock": "string" }], "Ipv6CidrBlockSet": [{ "Ipv6CidrBlock": "string" }], "OwnerId": "string", "PeeringOptions": { "AllowDnsResolutionFromRemoteVpc": boolean, "AllowEgressFromLocalClassicLinkToRemoteVpc": boolean, "AllowEgressFromLocalVpcToRemoteClassicLink": boolean }, "Region": "string", "VpcId": "string" }, "ExpirationTime": "string", "RequesterVpcInfo": { "CidrBlock": "string", "CidrBlockSet": [{ "CidrBlock": "string" }], "Ipv6CidrBlockSet": [{ "Ipv6CidrBlock": "string" }], "OwnerId": "string", "PeeringOptions": { "AllowDnsResolutionFromRemoteVpc": boolean, "AllowEgressFromLocalClassicLinkToRemoteVpc": boolean, "AllowEgressFromLocalVpcToRemoteClassicLink": boolean }, "Region": "string", "VpcId": "string" }, "Status": { "Code": "string", "Message": "string" }, "VpcPeeringConnectionId": "string" }, "AwsEcrContainerImage": { "Architecture": "string", "ImageDigest": "string", "ImagePublishedAt": "string", "ImageTags": ["string"], "RegistryId": "string", "RepositoryName": "string" }, "AwsEcrRepository": { "Arn": "string", "ImageScanningConfiguration": { "ScanOnPush": boolean }, "ImageTagMutability": "string", "LifecyclePolicy": { "LifecyclePolicyText": "string", "RegistryId": "string" }, "RepositoryName": "string", "RepositoryPolicyText": "string" }, "AwsEcsCluster": { "ActiveServicesCount": number, "CapacityProviders": ["string"], "ClusterArn": "string", "ClusterName": "string", "ClusterSettings": [{ "Name": "string", "Value": "string" }], "Configuration": { "ExecuteCommandConfiguration": { "KmsKeyId": "string", "LogConfiguration": { "CloudWatchEncryptionEnabled": boolean, "CloudWatchLogGroupName": "string", "S3BucketName": "string", "S3EncryptionEnabled": boolean, "S3KeyPrefix": "string" }, "Logging": "string" } }, "DefaultCapacityProviderStrategy": [{ "Base": number, "CapacityProvider": "string", "Weight": number }], "RegisteredContainerInstancesCount": number, "RunningTasksCount": number, "Status": "string" }, "AwsEcsContainer": { "Image": "string", "MountPoints": [{ "ContainerPath": "string", "SourceVolume": "string" }], "Name": "string", "Privileged": boolean }, "AwsEcsService": { "CapacityProviderStrategy": [{ "Base": number, "CapacityProvider": "string", "Weight": number }], "Cluster": "string", "DeploymentConfiguration": { "DeploymentCircuitBreaker": { "Enable": boolean, "Rollback": boolean }, "MaximumPercent": number, "MinimumHealthyPercent": number }, "DeploymentController": { "Type": "string" }, "DesiredCount": number, "EnableEcsManagedTags": boolean, "EnableExecuteCommand": boolean, "HealthCheckGracePeriodSeconds": number, "LaunchType": "string", "LoadBalancers": [{ "ContainerName": "string", "ContainerPort": number, "LoadBalancerName": "string", "TargetGroupArn": "string" }], "Name": "string", "NetworkConfiguration": { "AwsVpcConfiguration": { "AssignPublicIp": "string", "SecurityGroups": ["string"], "Subnets": ["string"] } }, "PlacementConstraints": [{ "Expression": "string", "Type": "string" }], "PlacementStrategies": [{ "Field": "string", "Type": "string" }], "PlatformVersion": "string", "PropagateTags": "string", "Role": "string", "SchedulingStrategy": "string", "ServiceArn": "string", "ServiceName": "string", "ServiceRegistries": [{ "ContainerName": "string", "ContainerPort": number, "Port": number, "RegistryArn": "string" }], "TaskDefinition": "string" }, "AwsEcsTask": { "CreatedAt": "string", "ClusterArn": "string", "Group": "string", "StartedAt": "string", "StartedBy": "string", "TaskDefinitionArn": "string", "Version": number, "Volumes": [{ "Name": "string", "Host": { "SourcePath": "string" } }], "Containers": [{ "Image": "string", "MountPoints": [{ "ContainerPath": "string", "SourceVolume": "string" }], "Name": "string", "Privileged": boolean }] }, "AwsEcsTaskDefinition": { "ContainerDefinitions": [{ "Command": ["string"], "Cpu": number, "DependsOn": [{ "Condition": "string", "ContainerName": "string" }], "DisableNetworking": boolean, "DnsSearchDomains": ["string"], "DnsServers": ["string"], "DockerLabels": { "string": "string" }, "DockerSecurityOptions": ["string"], "EntryPoint": ["string"], "Environment": [{ "Name": "string", "Value": "string" }], "EnvironmentFiles": [{ "Type": "string", "Value": "string" }], "Essential": boolean, "ExtraHosts": [{ "Hostname": "string", "IpAddress": "string" }], "FirelensConfiguration": { "Options": { "string": "string" }, "Type": "string" }, "HealthCheck": { "Command": ["string"], "Interval": number, "Retries": number, "StartPeriod": number, "Timeout": number }, "Hostname": "string", "Image": "string", "Interactive": boolean, "Links": ["string"], "LinuxParameters": { "Capabilities": { "Add": ["string"], "Drop": ["string"] }, "Devices": [{ "ContainerPath": "string", "HostPath": "string", "Permissions": ["string"] }], "InitProcessEnabled": boolean, "MaxSwap": number, "SharedMemorySize": number, "Swappiness": number, "Tmpfs": [{ "ContainerPath": "string", "MountOptions": ["string"], "Size": number }] }, "LogConfiguration": { "LogDriver": "string", "Options": { "string": "string" }, "SecretOptions": [{ "Name": "string", "ValueFrom": "string" }] }, "Memory": number, "MemoryReservation": number, "MountPoints": [{ "ContainerPath": "string", "ReadOnly": boolean, "SourceVolume": "string" }], "Name": "string", "PortMappings": [{ "ContainerPort": number, "HostPort": number, "Protocol": "string" }], "Privileged": boolean, "PseudoTerminal": boolean, "ReadonlyRootFilesystem": boolean, "RepositoryCredentials": { "CredentialsParameter": "string" }, "ResourceRequirements": [{ "Type": "string", "Value": "string" }], "Secrets": [{ "Name": "string", "ValueFrom": "string" }], "StartTimeout": number, "StopTimeout": number, "SystemControls": [{ "Namespace": "string", "Value": "string" }], "Ulimits": [{ "HardLimit": number, "Name": "string", "SoftLimit": number }], "User": "string", "VolumesFrom": [{ "ReadOnly": boolean, "SourceContainer": "string" }], "WorkingDirectory": "string" }], "Cpu": "string", "ExecutionRoleArn": "string", "Family": "string", "InferenceAccelerators": [{ "DeviceName": "string", "DeviceType": "string" }], "IpcMode": "string", "Memory": "string", "NetworkMode": "string", "PidMode": "string", "PlacementConstraints": [{ "Expression": "string", "Type": "string" }], "ProxyConfiguration": { "ContainerName": "string", "ProxyConfigurationProperties": [{ "Name": "string", "Value": "string" }], "Type": "string" }, "RequiresCompatibilities": ["string"], "Status": "string", "TaskRoleArn": "string", "Volumes": [{ "DockerVolumeConfiguration": { "Autoprovision": boolean, "Driver": "string", "DriverOpts": { "string": "string" }, "Labels": { "string": "string" }, "Scope": "string" }, "EfsVolumeConfiguration": { "AuthorizationConfig": { "AccessPointId": "string", "Iam": "string" }, "FilesystemId": "string", "RootDirectory": "string", "TransitEncryption": "string", "TransitEncryptionPort": number }, "Host": { "SourcePath": "string" }, "Name": "string" }] }, "AwsEfsAccessPoint": { "AccessPointId": "string", "Arn": "string", "ClientToken": "string", "FileSystemId": "string", "PosixUser": { "Gid": "string", "SecondaryGids": ["string"], "Uid": "string" }, "RootDirectory": { "CreationInfo": { "OwnerGid": "string", "OwnerUid": "string", "Permissions": "string" }, "Path": "string" } }, "AwsEksCluster": { "Arn": "string", "CertificateAuthorityData": "string", "ClusterStatus": "string", "Endpoint": "string", "Logging": { "ClusterLogging": [{ "Enabled": boolean, "Types": ["string"] }] }, "Name": "string", "ResourcesVpcConfig": { "EndpointPublicAccess": boolean, "SecurityGroupIds": ["string"], "SubnetIds": ["string"] }, "RoleArn": "string", "Version": "string" }, "AwsElasticBeanstalkEnvironment": { "ApplicationName": "string", "Cname": "string", "DateCreated": "string", "DateUpdated": "string", "Description": "string", "EndpointUrl": "string", "EnvironmentArn": "string", "EnvironmentId": "string", "EnvironmentLinks": [{ "EnvironmentName": "string", "LinkName": "string" }], "EnvironmentName": "string", "OptionSettings": [{ "Namespace": "string", "OptionName": "string", "ResourceName": "string", "Value": "string" }], "PlatformArn": "string", "SolutionStackName": "string", "Status": "string", "Tier": { "Name": "string", "Type": "string", "Version": "string" }, "VersionLabel": "string" }, "AwsElasticSearchDomain": { "AccessPolicies": "string", "DomainStatus": { "DomainId": "string", "DomainName": "string", "Endpoint": "string", "Endpoints": { "string": "string" } }, "DomainEndpointOptions": { "EnforceHTTPS": boolean, "TLSSecurityPolicy": "string" }, "ElasticsearchClusterConfig": { "DedicatedMasterCount": number, "DedicatedMasterEnabled": boolean, "DedicatedMasterType": "string", "InstanceCount": number, "InstanceType": "string", "ZoneAwarenessConfig": { "AvailabilityZoneCount": number }, "ZoneAwarenessEnabled": boolean }, "ElasticsearchVersion": "string", "EncryptionAtRestOptions": { "Enabled": boolean, "KmsKeyId": "string" }, "LogPublishingOptions": { "AuditLogs": { "CloudWatchLogsLogGroupArn": "string", "Enabled": boolean }, "IndexSlowLogs": { "CloudWatchLogsLogGroupArn": "string", "Enabled": boolean }, "SearchSlowLogs": { "CloudWatchLogsLogGroupArn": "string", "Enabled": boolean } }, "NodeToNodeEncryptionOptions": { "Enabled": boolean }, "ServiceSoftwareOptions": { "AutomatedUpdateDate": "string", "Cancellable": boolean, "CurrentVersion": "string", "Description": "string", "NewVersion": "string", "UpdateAvailable": boolean, "UpdateStatus": "string" }, "VPCOptions": { "AvailabilityZones": [ "string" ], "SecurityGroupIds": [ "string" ], "SubnetIds": [ "string" ], "VPCId": "string" } }, "AwsElbLoadBalancer": { "AvailabilityZones": ["string"], "BackendServerDescriptions": [{ "InstancePort": number, "PolicyNames": ["string"] }], "CanonicalHostedZoneName": "string", "CanonicalHostedZoneNameID": "string", "CreatedTime": "string", "DnsName": "string", "HealthCheck": { "HealthyThreshold": number, "Interval": number, "Target": "string", "Timeout": number, "UnhealthyThreshold": number }, "Instances": [{ "InstanceId": "string" }], "ListenerDescriptions": [{ "Listener": { "InstancePort": number, "InstanceProtocol": "string", "LoadBalancerPort": number, "Protocol": "string", "SslCertificateId": "string" }, "PolicyNames": ["string"] }], "LoadBalancerAttributes": { "AccessLog": { "EmitInterval": number, "Enabled": boolean, "S3BucketName": "string", "S3BucketPrefix": "string" }, "ConnectionDraining": { "Enabled": boolean, "Timeout": number }, "ConnectionSettings": { "IdleTimeout": number }, "CrossZoneLoadBalancing": { "Enabled": boolean }, "AdditionalAttributes": [{ "Key": "string", "Value": "string" }] }, "LoadBalancerName": "string", "Policies": { "AppCookieStickinessPolicies": [{ "CookieName": "string", "PolicyName": "string" }], "LbCookieStickinessPolicies": [{ "CookieExpirationPeriod": number, "PolicyName": "string" }], "OtherPolicies": ["string"] }, "Scheme": "string", "SecurityGroups": ["string"], "SourceSecurityGroup": { "GroupName": "string", "OwnerAlias": "string" }, "Subnets": ["string"], "VpcId": "string" }, "AwsElbv2LoadBalancer": { "AvailabilityZones": { "SubnetId": "string", "ZoneName": "string" }, "CanonicalHostedZoneId": "string", "CreatedTime": "string", "DNSName": "string", "IpAddressType": "string", "LoadBalancerAttributes": [{ "Key": "string", "Value": "string" }], "Scheme": "string", "SecurityGroups": ["string"], "State": { "Code": "string", "Reason": "string" }, "Type": "string", "VpcId": "string" }, "AwsEventSchemasRegistry": { "Description": "string", "RegistryArn": "string", "RegistryName": "string" }, "AwsEventsEndpoint": { "Arn": "string", "Description": "string", "EndpointId": "string", "EndpointUrl": "string", "EventBuses": [ { "EventBusArn": "string" }, { "EventBusArn": "string" } ], "Name": "string", "ReplicationConfig": { "State": "string" }, "RoleArn": "string", "RoutingConfig": { "FailoverConfig": { "Primary": { "HealthCheck": "string" }, "Secondary": { "Route": "string" } } }, "State": "string" }, "AwsEventsEventBus": { "Arn": "string", "Name": "string", "Policy": "string" }, "AwsGuardDutyDetector": { "FindingPublishingFrequency": "string", "ServiceRole": "string", "Status": "string", "DataSources": { "CloudTrail": { "Status": "string" }, "DnsLogs": { "Status": "string" }, "FlowLogs": { "Status": "string" }, "S3Logs": { "Status": "string" }, "Kubernetes": { "AuditLogs": { "Status": "string" } }, "MalwareProtection": { "ScanEc2InstanceWithFindings": { "EbsVolumes": { "Status": "string" } }, "ServiceRole": "string" } } }, "AwsIamAccessKey": { "AccessKeyId": "string", "AccountId": "string", "CreatedAt": "string", "PrincipalId": "string", "PrincipalName": "string", "PrincipalType": "string", "SessionContext": { "Attributes": { "CreationDate": "string", "MfaAuthenticated": boolean }, "SessionIssuer": { "AccountId": "string", "Arn": "string", "PrincipalId": "string", "Type": "string", "UserName": "string" } }, "Status": "string" }, "AwsIamGroup": { "AttachedManagedPolicies": [{ "PolicyArn": "string", "PolicyName": "string" }], "CreateDate": "string", "GroupId": "string", "GroupName": "string", "GroupPolicyList": [{ "PolicyName": "string" }], "Path": "string" }, "AwsIamPolicy": { "AttachmentCount": number, "CreateDate": "string", "DefaultVersionId": "string", "Description": "string", "IsAttachable": boolean, "Path": "string", "PermissionsBoundaryUsageCount": number, "PolicyId": "string", "PolicyName": "string", "PolicyVersionList": [{ "CreateDate": "string", "IsDefaultVersion": boolean, "VersionId": "string" }], "UpdateDate": "string" }, "AwsIamRole": { "AssumeRolePolicyDocument": "string", "AttachedManagedPolicies": [{ "PolicyArn": "string", "PolicyName": "string" }], "CreateDate": "string", "InstanceProfileList": [{ "Arn": "string", "CreateDate": "string", "InstanceProfileId": "string", "InstanceProfileName": "string", "Path": "string", "Roles": [{ "Arn": "string", "AssumeRolePolicyDocument": "string", "CreateDate": "string", "Path": "string", "RoleId": "string", "RoleName": "string" }] }], "MaxSessionDuration": number, "Path": "string", "PermissionsBoundary": { "PermissionsBoundaryArn": "string", "PermissionsBoundaryType": "string" }, "RoleId": "string", "RoleName": "string", "RolePolicyList": [{ "PolicyName": "string" }] }, "AwsIamUser": { "AttachedManagedPolicies": [{ "PolicyArn": "string", "PolicyName": "string" }], "CreateDate": "string", "GroupList": ["string"], "Path": "string", "PermissionsBoundary": { "PermissionsBoundaryArn": "string", "PermissionsBoundaryType": "string" }, "UserId": "string", "UserName": "string", "UserPolicyList": [{ "PolicyName": "string" }] }, "AwsKinesisStream": { "Arn": "string", "Name": "string", "RetentionPeriodHours": number, "ShardCount": number, "StreamEncryption": { "EncryptionType": "string", "KeyId": "string" } }, "AwsKmsKey": { "AWSAccountId": "string", "CreationDate": "string", "Description": "string", "KeyId": "string", "KeyManager": "string", "KeyRotationStatus": boolean, "KeyState": "string", "Origin": "string" }, "AwsLambdaFunction": { "Architectures": [ "string" ], "Code": { "S3Bucket": "string", "S3Key": "string", "S3ObjectVersion": "string", "ZipFile": "string" }, "CodeSha256": "string", "DeadLetterConfig": { "TargetArn": "string" }, "Environment": { "Variables": { "Stage": "string" }, "Error": { "ErrorCode": "string", "Message": "string" } }, "FunctionName": "string", "Handler": "string", "KmsKeyArn": "string", "LastModified": "string", "Layers": { "Arn": "string", "CodeSize": number }, "PackageType": "string", "RevisionId": "string", "Role": "string", "Runtime": "string", "Timeout": integer, "TracingConfig": { "Mode": "string" }, "Version": "string", "VpcConfig": { "SecurityGroupIds": ["string"], "SubnetIds": ["string"] }, "MasterArn": "string", "MemorySize": number }, "AwsLambdaLayerVersion": { "CompatibleRuntimes": [ "string" ], "CreatedDate": "string", "Version": number }, "AwsMskCluster": { "ClusterInfo": { "ClientAuthentication": { "Sasl": { "Scram": { "Enabled": boolean }, "Iam": { "Enabled": boolean } }, "Tls": { "CertificateAuthorityArnList": [], "Enabled": boolean }, "Unauthenticated": { "Enabled": boolean } }, "ClusterName": "string", "CurrentVersion": "string", "EncryptionInfo": { "EncryptionAtRest": { "DataVolumeKMSKeyId": "string" }, "EncryptionInTransit": { "ClientBroker": "string", "InCluster": boolean } }, "EnhancedMonitoring": "string", "NumberOfBrokerNodes": integer } }, "AwsNetworkFirewallFirewall": { "DeleteProtection": boolean, "Description": "string", "FirewallArn": "string", "FirewallId": "string", "FirewallName": "string", "FirewallPolicyArn": "string", "FirewallPolicyChangeProtection": boolean, "SubnetChangeProtection": boolean, "SubnetMappings": [{ "SubnetId": "string" }], "VpcId": "string" }, "AwsNetworkFirewallFirewallPolicy": { "Description": "string", "FirewallPolicy": { "StatefulRuleGroupReferences": [{ "ResourceArn": "string" }], "StatelessCustomActions": [{ "ActionDefinition": { "PublishMetricAction": { "Dimensions": [{ "Value": "string" }] } }, "ActionName": "string" }], "StatelessDefaultActions": ["string"], "StatelessFragmentDefaultActions": ["string"], "StatelessRuleGroupReferences": [{ "Priority": number, "ResourceArn": "string" }] }, "FirewallPolicyArn": "string", "FirewallPolicyId": "string", "FirewallPolicyName": "string" }, "AwsNetworkFirewallRuleGroup": { "Capacity": number, "Description": "string", "RuleGroup": { "RulesSource": { "RulesSourceList": { "GeneratedRulesType": "string", "Targets": ["string"], "TargetTypes": ["string"] }, "RulesString": "string", "StatefulRules": [{ "Action": "string", "Header": { "Destination": "string", "DestinationPort": "string", "Direction": "string", "Protocol": "string", "Source": "string", "SourcePort": "string" }, "RuleOptions": [{ "Keyword": "string", "Settings": ["string"] }] }], "StatelessRulesAndCustomActions": { "CustomActions": [{ "ActionDefinition": { "PublishMetricAction": { "Dimensions": [{ "Value": "string" }] } }, "ActionName": "string" }], "StatelessRules": [{ "Priority": number, "RuleDefinition": { "Actions": ["string"], "MatchAttributes": { "DestinationPorts": [{ "FromPort": number, "ToPort": number }], "Destinations": [{ "AddressDefinition": "string" }], "Protocols": [number], "SourcePorts": [{ "FromPort": number, "ToPort": number }], "Sources": [{ "AddressDefinition": "string" }], "TcpFlags": [{ "Flags": ["string"], "Masks": ["string"] }] } } }] } }, "RuleVariables": { "IpSets": { "Definition": ["string"] }, "PortSets": { "Definition": ["string"] } } }, "RuleGroupArn": "string", "RuleGroupId": "string", "RuleGroupName": "string", "Type": "string" }, "AwsOpenSearchServiceDomain": { "AccessPolicies": "string", "AdvancedSecurityOptions": { "Enabled": boolean, "InternalUserDatabaseEnabled": boolean, "MasterUserOptions": { "MasterUserArn": "string", "MasterUserName": "string", "MasterUserPassword": "string" } }, "Arn": "string", "ClusterConfig": { "DedicatedMasterCount": number, "DedicatedMasterEnabled": boolean, "DedicatedMasterType": "string", "InstanceCount": number, "InstanceType": "string", "WarmCount": number, "WarmEnabled": boolean, "WarmType": "string", "ZoneAwarenessConfig": { "AvailabilityZoneCount": number }, "ZoneAwarenessEnabled": boolean }, "DomainEndpoint": "string", "DomainEndpointOptions": { "CustomEndpoint": "string", "CustomEndpointCertificateArn": "string", "CustomEndpointEnabled": boolean, "EnforceHTTPS": boolean, "TLSSecurityPolicy": "string" }, "DomainEndpoints": { "string": "string" }, "DomainName": "string", "EncryptionAtRestOptions": { "Enabled": boolean, "KmsKeyId": "string" }, "EngineVersion": "string", "Id": "string", "LogPublishingOptions": { "AuditLogs": { "CloudWatchLogsLogGroupArn": "string", "Enabled": boolean }, "IndexSlowLogs": { "CloudWatchLogsLogGroupArn": "string", "Enabled": boolean }, "SearchSlowLogs": { "CloudWatchLogsLogGroupArn": "string", "Enabled": boolean } }, "NodeToNodeEncryptionOptions": { "Enabled": boolean }, "ServiceSoftwareOptions": { "AutomatedUpdateDate": "string", "Cancellable": boolean, "CurrentVersion": "string", "Description": "string", "NewVersion": "string", "OptionalDeployment": boolean, "UpdateAvailable": boolean, "UpdateStatus": "string" }, "VpcOptions": { "SecurityGroupIds": ["string"], "SubnetIds": ["string"] } }, "AwsRdsDbCluster": { "ActivityStreamStatus": "string", "AllocatedStorage": number, "AssociatedRoles": [{ "RoleArn": "string", "Status": "string" }], "AutoMinorVersionUpgrade": boolean, "AvailabilityZones": ["string"], "BackupRetentionPeriod": integer, "ClusterCreateTime": "string", "CopyTagsToSnapshot": boolean, "CrossAccountClone": boolean, "CustomEndpoints": ["string"], "DatabaseName": "string", "DbClusterIdentifier": "string", "DbClusterMembers": [{ "DbClusterParameterGroupStatus": "string", "DbInstanceIdentifier": "string", "IsClusterWriter": boolean, "PromotionTier": integer }], "DbClusterOptionGroupMemberships": [{ "DbClusterOptionGroupName": "string", "Status": "string" }], "DbClusterParameterGroup": "string", "DbClusterResourceId": "string", "DbSubnetGroup": "string", "DeletionProtection": boolean, "DomainMemberships": [{ "Domain": "string", "Fqdn": "string", "IamRoleName": "string", "Status": "string" }], "EnabledCloudwatchLogsExports": ["string"], "Endpoint": "string", "Engine": "string", "EngineMode": "string", "EngineVersion": "string", "HostedZoneId": "string", "HttpEndpointEnabled": boolean, "IamDatabaseAuthenticationEnabled": boolean, "KmsKeyId": "string", "MasterUsername": "string", "MultiAz": boolean, "Port": integer, "PreferredBackupWindow": "string", "PreferredMaintenanceWindow": "string", "ReaderEndpoint": "string", "ReadReplicaIdentifiers": ["string"], "Status": "string", "StorageEncrypted": boolean, "VpcSecurityGroups": [{ "Status": "string", "VpcSecurityGroupId": "string" }] }, "AwsRdsDbClusterSnapshot": { "AllocatedStorage": integer, "AvailabilityZones": ["string"], "ClusterCreateTime": "string", "DbClusterIdentifier": "string", "DbClusterSnapshotAttributes": [{ "AttributeName": "string", "AttributeValues": ["string"] }], "DbClusterSnapshotIdentifier": "string", "Engine": "string", "EngineVersion": "string", "IamDatabaseAuthenticationEnabled": boolean, "KmsKeyId": "string", "LicenseModel": "string", "MasterUsername": "string", "PercentProgress": integer, "Port": integer, "SnapshotCreateTime": "string", "SnapshotType": "string", "Status": "string", "StorageEncrypted": boolean, "VpcId": "string" }, "AwsRdsDbInstance": { "AllocatedStorage": number, "AssociatedRoles": [{ "RoleArn": "string", "FeatureName": "string", "Status": "string" }], "AutoMinorVersionUpgrade": boolean, "AvailabilityZone": "string", "BackupRetentionPeriod": number, "CACertificateIdentifier": "string", "CharacterSetName": "string", "CopyTagsToSnapshot": boolean, "DBClusterIdentifier": "string", "DBInstanceClass": "string", "DBInstanceIdentifier": "string", "DbInstancePort": number, "DbInstanceStatus": "string", "DbiResourceId": "string", "DBName": "string", "DbParameterGroups": [{ "DbParameterGroupName": "string", "ParameterApplyStatus": "string" }], "DbSecurityGroups": ["string"], "DbSubnetGroup": { "DbSubnetGroupArn": "string", "DbSubnetGroupDescription": "string", "DbSubnetGroupName": "string", "SubnetGroupStatus": "string", "Subnets": [{ "SubnetAvailabilityZone": { "Name": "string" }, "SubnetIdentifier": "string", "SubnetStatus": "string" }], "VpcId": "string" }, "DeletionProtection": boolean, "Endpoint": { "Address": "string", "Port": number, "HostedZoneId": "string" }, "DomainMemberships": [{ "Domain": "string", "Fqdn": "string", "IamRoleName": "string", "Status": "string" }], "EnabledCloudwatchLogsExports": ["string"], "Engine": "string", "EngineVersion": "string", "EnhancedMonitoringResourceArn": "string", "IAMDatabaseAuthenticationEnabled": boolean, "InstanceCreateTime": "string", "Iops": number, "KmsKeyId": "string", "LatestRestorableTime": "string", "LicenseModel": "string", "ListenerEndpoint": { "Address": "string", "HostedZoneId": "string", "Port": number }, "MasterUsername": "admin", "MaxAllocatedStorage": number, "MonitoringInterval": number, "MonitoringRoleArn": "string", "MultiAz": boolean, "OptionGroupMemberships": [{ "OptionGroupName": "string", "Status": "string" }], "PendingModifiedValues": { "AllocatedStorage": number, "BackupRetentionPeriod": number, "CaCertificateIdentifier": "string", "DbInstanceClass": "string", "DbInstanceIdentifier": "string", "DbSubnetGroupName": "string", "EngineVersion": "string", "Iops": number, "LicenseModel": "string", "MasterUserPassword": "string", "MultiAZ": boolean, "PendingCloudWatchLogsExports": { "LogTypesToDisable": ["string"], "LogTypesToEnable": ["string"] }, "Port": number, "ProcessorFeatures": [{ "Name": "string", "Value": "string" }], "StorageType": "string" }, "PerformanceInsightsEnabled": boolean, "PerformanceInsightsKmsKeyId": "string", "PerformanceInsightsRetentionPeriod": number, "PreferredBackupWindow": "string", "PreferredMaintenanceWindow": "string", "ProcessorFeatures": [{ "Name": "string", "Value": "string" }], "PromotionTier": number, "PubliclyAccessible": boolean, "ReadReplicaDBClusterIdentifiers": ["string"], "ReadReplicaDBInstanceIdentifiers": ["string"], "ReadReplicaSourceDBInstanceIdentifier": "string", "SecondaryAvailabilityZone": "string", "StatusInfos": [{ "Message": "string", "Normal": boolean, "Status": "string", "StatusType": "string" }], "StorageEncrypted": boolean, "TdeCredentialArn": "string", "Timezone": "string", "VpcSecurityGroups": [{ "VpcSecurityGroupId": "string", "Status": "string" }] }, "AwsRdsDbSecurityGroup": { "DbSecurityGroupArn": "string", "DbSecurityGroupDescription": "string", "DbSecurityGroupName": "string", "Ec2SecurityGroups": [{ "Ec2SecurityGroupuId": "string", "Ec2SecurityGroupName": "string", "Ec2SecurityGroupOwnerId": "string", "Status": "string" }], "IpRanges": [{ "CidrIp": "string", "Status": "string" }], "OwnerId": "string", "VpcId": "string" }, "AwsRdsDbSnapshot": { "AllocatedStorage": integer, "AvailabilityZone": "string", "DbInstanceIdentifier": "string", "DbiResourceId": "string", "DbSnapshotIdentifier": "string", "Encrypted": boolean, "Engine": "string", "EngineVersion": "string", "IamDatabaseAuthenticationEnabled": boolean, "InstanceCreateTime": "string", "Iops": number, "KmsKeyId": "string", "LicenseModel": "string", "MasterUsername": "string", "OptionGroupName": "string", "PercentProgress": integer, "Port": integer, "ProcessorFeatures": [], "SnapshotCreateTime": "string", "SnapshotType": "string", "SourceDbSnapshotIdentifier": "string", "SourceRegion": "string", "Status": "string", "StorageType": "string", "TdeCredentialArn": "string", "Timezone": "string", "VpcId": "string" }, "AwsRdsEventSubscription": { "CustomerAwsId": "string", "CustSubscriptionId": "string", "Enabled": boolean, "EventCategoriesList": ["string"], "EventSubscriptionArn": "string", "SnsTopicArn": "string", "SourceIdsList": ["string"], "SourceType": "string", "Status": "string", "SubscriptionCreationTime": "string" }, "AwsRedshiftCluster": { "AllowVersionUpgrade": boolean, "AutomatedSnapshotRetentionPeriod": number, "AvailabilityZone": "string", "ClusterAvailabilityStatus": "string", "ClusterCreateTime": "string", "ClusterIdentifier": "string", "ClusterNodes": [{ "NodeRole": "string", "PrivateIPAddress": "string", "PublicIPAddress": "string" }], "ClusterParameterGroups": [{ "ClusterParameterStatusList": [{ "ParameterApplyErrorDescription": "string", "ParameterApplyStatus": "string", "ParameterName": "string" }], "ParameterApplyStatus": "string", "ParameterGroupName": "string" }], "ClusterPublicKey": "string", "ClusterRevisionNumber": "string", "ClusterSecurityGroups": [{ "ClusterSecurityGroupName": "string", "Status": "string" }], "ClusterSnapshotCopyStatus": { "DestinationRegion": "string", "ManualSnapshotRetentionPeriod": number, "RetentionPeriod": number, "SnapshotCopyGrantName": "string" }, "ClusterStatus": "string", "ClusterSubnetGroupName": "string", "ClusterVersion": "string", "DBName": "string", "DeferredMaintenanceWindows": [{ "DeferMaintenanceEndTime": "string", "DeferMaintenanceIdentifier": "string", "DeferMaintenanceStartTime": "string" }], "ElasticIpStatus": { "ElasticIp": "string", "Status": "string" }, "ElasticResizeNumberOfNodeOptions": "string", "Encrypted": boolean, "Endpoint": { "Address": "string", "Port": number }, "EnhancedVpcRouting": boolean, "ExpectedNextSnapshotScheduleTime": "string", "ExpectedNextSnapshotScheduleTimeStatus": "string", "HsmStatus": { "HsmClientCertificateIdentifier": "string", "HsmConfigurationIdentifier": "string", "Status": "string" }, "IamRoles": [{ "ApplyStatus": "string", "IamRoleArn": "string" }], "KmsKeyId": "string", "LoggingStatus":{ "BucketName": "string", "LastFailureMessage": "string", "LastFailureTime": "string", "LastSuccessfulDeliveryTime": "string", "LoggingEnabled": boolean, "S3KeyPrefix": "string" }, "MaintenanceTrackName": "string", "ManualSnapshotRetentionPeriod": number, "MasterUsername": "string", "NextMaintenanceWindowStartTime": "string", "NodeType": "string", "NumberOfNodes": number, "PendingActions": ["string"], "PendingModifiedValues": { "AutomatedSnapshotRetentionPeriod": number, "ClusterIdentifier": "string", "ClusterType": "string", "ClusterVersion": "string", "EncryptionType": "string", "EnhancedVpcRouting": boolean, "MaintenanceTrackName": "string", "MasterUserPassword": "string", "NodeType": "string", "NumberOfNodes": number, "PubliclyAccessible": "string" }, "PreferredMaintenanceWindow": "string", "PubliclyAccessible": boolean, "ResizeInfo": { "AllowCancelResize": boolean, "ResizeType": "string" }, "RestoreStatus": { "CurrentRestoreRateInMegaBytesPerSecond": number, "ElapsedTimeInSeconds": number, "EstimatedTimeToCompletionInSeconds": number, "ProgressInMegaBytes": number, "SnapshotSizeInMegaBytes": number, "Status": "string" }, "SnapshotScheduleIdentifier": "string", "SnapshotScheduleState": "string", "VpcId": "string", "VpcSecurityGroups": [{ "Status": "string", "VpcSecurityGroupId": "string" }] }, "AwsRoute53HostedZone": { "HostedZone": { "Id": "string", "Name": "string", "Config": { "Comment": "string" } }, "NameServers": ["string"], "QueryLoggingConfig": { "CloudWatchLogsLogGroupArn": { "CloudWatchLogsLogGroupArn": "string", "Id": "string", "HostedZoneId": "string" } }, "Vpcs": [ { "Id": "string", "Region": "string" } ] }, "AwsS3AccessPoint": { "AccessPointArn": "string", "Alias": "string", "Bucket": "string", "BucketAccountId": "string", "Name": "string", "NetworkOrigin": "string", "PublicAccessBlockConfiguration": { "BlockPublicAcls": boolean, "BlockPublicPolicy": boolean, "IgnorePublicAcls": boolean, "RestrictPublicBuckets": boolean }, "VpcConfiguration": { "VpcId": "string" } }, "AwsS3AccountPublicAccessBlock": { "BlockPublicAcls": boolean, "BlockPublicPolicy": boolean, "IgnorePublicAcls": boolean, "RestrictPublicBuckets": boolean }, "AwsS3Bucket": { "AccessControlList": "string", "BucketLifecycleConfiguration": { "Rules": [{ "AbortIncompleteMultipartUpload": { "DaysAfterInitiation": number }, "ExpirationDate": "string", "ExpirationInDays": number, "ExpiredObjectDeleteMarker": boolean, "Filter": { "Predicate": { "Operands": [{ "Prefix": "string", "Type": "string" }, { "Tag": { "Key": "string", "Value": "string" }, "Type": "string" } ], "Type": "string" } }, "Id": "string", "NoncurrentVersionExpirationInDays": number, "NoncurrentVersionTransitions": [{ "Days": number, "StorageClass": "string" }], "Prefix": "string", "Status": "string", "Transitions": [{ "Date": "string", "Days": number, "StorageClass": "string" }] }] }, "BucketLoggingConfiguration": { "DestinationBucketName": "string", "LogFilePrefix": "string" }, "BucketName": "string", "BucketNotificationConfiguration": { "Configurations": [{ "Destination": "string", "Events": ["string"], "Filter": { "S3KeyFilter": { "FilterRules": [{ "Name": "string", "Value": "string" }] } }, "Type": "string" }] }, "BucketVersioningConfiguration": { "IsMfaDeleteEnabled": boolean, "Status": "string" }, "BucketWebsiteConfiguration": { "ErrorDocument": "string", "IndexDocumentSuffix": "string", "RedirectAllRequestsTo": { "HostName": "string", "Protocol": "string" }, "RoutingRules": [{ "Condition": { "HttpErrorCodeReturnedEquals": "string", "KeyPrefixEquals": "string" }, "Redirect": { "HostName": "string", "HttpRedirectCode": "string", "Protocol": "string", "ReplaceKeyPrefixWith": "string", "ReplaceKeyWith": "string" } }] }, "CreatedAt": "string", "ObjectLockConfiguration": { "ObjectLockEnabled": "string", "Rule": { "DefaultRetention": { "Days": integer, "Mode": "string", "Years": integer } } }, "OwnerAccountId": "string", "OwnerId": "string", "OwnerName": "string", "PublicAccessBlockConfiguration": { "BlockPublicAcls": boolean, "BlockPublicPolicy": boolean, "IgnorePublicAcls": boolean, "RestrictPublicBuckets": boolean }, "ServerSideEncryptionConfiguration": { "Rules": [{ "ApplyServerSideEncryptionByDefault": { "KMSMasterKeyID": "string", "SSEAlgorithm": "string" } }] } }, "AwsS3Object": { "ContentType": "string", "ETag": "string", "LastModified": "string", "ServerSideEncryption": "string", "SSEKMSKeyId": "string", "VersionId": "string" }, "AwsSagemakerNotebookInstance": { "DirectInternetAccess": "string", "InstanceMetadataServiceConfiguration": { "MinimumInstanceMetadataServiceVersion": "string" }, "InstanceType": "string", "LastModifiedTime": "string", "NetworkInterfaceId": "string", "NotebookInstanceArn": "string", "NotebookInstanceName": "string", "NotebookInstanceStatus": "string", "PlatformIdentifier": "string", "RoleArn": "string", "RootAccess": "string", "SecurityGroups": ["string"], "SubnetId": "string", "Url": "string", "VolumeSizeInGB": number }, "AwsSecretsManagerSecret": { "Deleted": boolean, "Description": "string", "KmsKeyId": "string", "Name": "string", "RotationEnabled": boolean, "RotationLambdaArn": "string", "RotationOccurredWithinFrequency": boolean, "RotationRules": { "AutomaticallyAfterDays": integer } }, "AwsSnsTopic": { "ApplicationSuccessFeedbackRoleArn": "string", "FirehoseFailureFeedbackRoleArn": "string", "FirehoseSuccessFeedbackRoleArn": "string", "HttpFailureFeedbackRoleArn": "string", "HttpSuccessFeedbackRoleArn": "string", "KmsMasterKeyId": "string", "Owner": "string", "SqsFailureFeedbackRoleArn": "string", "SqsSuccessFeedbackRoleArn": "string", "Subscription": { "Endpoint": "string", "Protocol": "string" }, "TopicName": "string" }, "AwsSqsQueue": { "DeadLetterTargetArn": "string", "KmsDataKeyReusePeriodSeconds": number, "KmsMasterKeyId": "string", "QueueName": "string" }, "AwsSsmPatchCompliance": { "Patch": { "ComplianceSummary": { "ComplianceType": "string", "CompliantCriticalCount": integer, "CompliantHighCount": integer, "CompliantInformationalCount": integer, "CompliantLowCount": integer, "CompliantMediumCount": integer, "CompliantUnspecifiedCount": integer, "ExecutionType": "string", "NonCompliantCriticalCount": integer, "NonCompliantHighCount": integer, "NonCompliantInformationalCount": integer, "NonCompliantLowCount": integer, "NonCompliantMediumCount": integer, "NonCompliantUnspecifiedCount": integer, "OverallSeverity": "string", "PatchBaselineId": "string", "PatchGroup": "string", "Status": "string" } } }, "AwsStepFunctionStateMachine": { "StateMachineArn": "string", "Name": "string", "Status": "string", "RoleArn": "string", "Type": "string", "LoggingConfiguration": { "Level": "string", "IncludeExecutionData": boolean }, "TracingConfiguration": { "Enabled": boolean } }, "AwsWafRateBasedRule": { "MatchPredicates": [{ "DataId": "string", "Negated": boolean, "Type": "string" }], "MetricName": "string", "Name": "string", "RateKey": "string", "RateLimit": number, "RuleId": "string" }, "AwsWafRegionalRateBasedRule": { "MatchPredicates": [{ "DataId": "string", "Negated": boolean, "Type": "string" }], "MetricName": "string", "Name": "string", "RateKey": "string", "RateLimit": number, "RuleId": "string" }, "AwsWafRegionalRule": { "MetricName": "string", "Name": "string", "RuleId": "string", "PredicateList": [{ "DataId": "string", "Negated": boolean, "Type": "string" }] }, "AwsWafRegionalRuleGroup": { "MetricName": "string", "Name": "string", "RuleGroupId": "string", "Rules": [{ "Action": { "Type": "string" }, "Priority": number, "RuleId": "string", "Type": "string" }] }, "AwsWafRegionalWebAcl": { "DefaultAction": "string", "MetricName" : "string", "Name": "string", "RulesList" : [{ "Action": { "Type": "string" }, "Priority": number, "RuleId": "string", "Type": "string", "ExcludedRules": [{ "ExclusionType": "string", "RuleId": "string" }], "OverrideAction": { "Type": "string" } }], "WebAclId": "string" }, "AwsWafRule": { "MetricName": "string", "Name": "string", "PredicateList": [{ "DataId": "string", "Negated": boolean, "Type": "string" }], "RuleId": "string" }, "AwsWafRuleGroup": { "MetricName": "string", "Name": "string", "RuleGroupId": "string", "Rules": [{ "Action": { "Type": "string" }, "Priority": number, "RuleId": "string", "Type": "string" }] }, "AwsWafv2RuleGroup": { "Arn": "string", "Capacity": number, "Description": "string", "Id": "string", "Name": "string", "Rules": [{ "Action": { "Allow": { "CustomRequestHandling": { "InsertHeaders": [ { "Name": "string", "Value": "string" }, { "Name": "string", "Value": "string" } ] } } }, "Name": "string", "Priority": number, "VisibilityConfig": { "CloudWatchMetricsEnabled": boolean, "MetricName": "string", "SampledRequestsEnabled": boolean } }], "VisibilityConfig": { "CloudWatchMetricsEnabled": boolean, "MetricName": "string", "SampledRequestsEnabled": boolean } }, "AwsWafWebAcl": { "DefaultAction": "string", "Name": "string", "Rules": [{ "Action": { "Type": "string" }, "ExcludedRules": [{ "RuleId": "string" }], "OverrideAction": { "Type": "string" }, "Priority": number, "RuleId": "string", "Type": "string" }], "WebAclId": "string" }, "AwsWafv2WebAcl": { "Arn": "string", "Capacity": number, "CaptchaConfig": { "ImmunityTimeProperty": { "ImmunityTime": number } }, "DefaultAction": { "Block": {} }, "Description": "string", "ManagedbyFirewallManager": boolean, "Name": "string", "Rules": [{ "Action": { "RuleAction": { "Block": {} } }, "Name": "string", "Priority": number, "VisibilityConfig": { "SampledRequestsEnabled": boolean, "CloudWatchMetricsEnabled": boolean, "MetricName": "string" } }], "VisibilityConfig": { "SampledRequestsEnabled": boolean, "CloudWatchMetricsEnabled": boolean, "MetricName": "string" } }, "AwsXrayEncryptionConfig": { "KeyId": "string", "Status": "string", "Type": "string" }, "CodeRepository": { "CodeSecurityIntegrationArn": "string", "ProjectName": "string", "ProviderType": "string" }, "Container": { "ContainerRuntime": "string", "ImageId": "string", "ImageName": "string", "LaunchedAt": "string", "Name": "string", "Privileged": boolean, "VolumeMounts": [{ "Name": "string", "MountPath": "string" }] }, "Other": { "string": "string" }, "Id": "string", "Partition": "string", "Region": "string", "ResourceRole": "string", "Tags": { "string": "string" }, "Type": "string" }], "SchemaVersion": "string", "Severity": { "Label": "string", "Normalized": number, "Original": "string" }, "Sample": boolean, "SourceUrl": "string", "Threats": [{ "FilePaths": [{ "FileName": "string", "FilePath": "string", "Hash": "string", "ResourceId": "string" }], "ItemCount": number, "Name": "string", "Severity": "string" }], "ThreatIntelIndicators": [{ "Category": "string", "LastObservedAt": "string", "Source": "string", "SourceUrl": "string", "Type": "string", "Value": "string" }], "Title": "string", "Types": ["string"], "UpdatedAt": "string", "UserDefinedFields": { "string": "string" }, "VerificationState": "string", "Vulnerabilities": [{ "CodeVulnerabilities": [{ "Cwes": [ "string", "string" ], "FilePath": { "EndLine": integer, "FileName": "string", "FilePath": "string", "StartLine": integer }, "SourceArn":"string" }], "Cvss": [{ "Adjustments": [{ "Metric": "string", "Reason": "string" }], "BaseScore": number, "BaseVector": "string", "Source": "string", "Version": "string" }], "EpssScore": number, "ExploitAvailable": "string", "FixAvailable": "string", "Id": "string", "LastKnownExploitAt": "string", "ReferenceUrls": ["string"], "RelatedVulnerabilities": ["string"], "Vendor": { "Name": "string", "Url": "string", "VendorCreatedAt": "string", "VendorSeverity": "string", "VendorUpdatedAt": "string" }, "VulnerablePackages": [{ "Architecture": "string", "Epoch": "string", "FilePath": "string", "FixedInVersion": "string", "Name": "string", "PackageManager": "string", "Release": "string", "Remediation": "string", "SourceLayerArn": "string", "SourceLayerHash": "string", "Version": "string" }] }], "Workflow": { "Status": "string" }, "WorkflowState": "string" } ] ``` # Impact of consolidation on ASFF fields and values AWS Security Hub CSPM offers two types of consolidation for controls: + **Consolidated controls view** – With this type of consolidation, each control has a single identifier across all standards. In addition, on the Security Hub CSPM console, the **Controls** page displays all controls across all standards. + **Consolidated control findings** – With this type of consolidation, Security Hub CSPM produces a single finding for a control, even if the control applies to multiple enabled standards. This can reduce finding noise. You can't enable or disable consolidated controls view. Consolidated control findings is enabled by default if you enable Security Hub CSPM on or after February 23, 2023. Otherwise, it's disabled by default. However, for organizations, consolidated control findings is enabled for Security Hub CSPM member accounts only if it's enabled for the administrator account. To learn more about consolidated control findings, see [Generating and updating control findings](controls-findings-create-update.md). Both types of consolidation affect fields and values for control findings in the [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). **Topics** + [ ## Consolidated controls view – ASFF changes ](#securityhub-findings-format-consolidated-controls-view) + [ ## Consolidated control findings – ASFF changes ](#securityhub-findings-format-consolidated-control-findings) + [ ## Generator IDs before and after enabling consolidated control findings ](#securityhub-findings-format-changes-generator-ids) + [ ## How consolidation impacts control IDs and titles ](#securityhub-findings-format-changes-ids-titles) + [ ## Updating workflows for consolidation ](#securityhub-findings-format-changes-prepare) ## Consolidated controls view – ASFF changes The consolidated controls view feature introduced the following changes to fields and values for control findings in the ASFF. If your workflows don’t rely on values for these ASFF fields, no action is required. If you have workflows that rely on specific values for these fields, update your workflows to use the current values. | ASFF field | Sample value before consolidated controls view | Sample value after consolidated controls view, and a description of the change | | --- | --- | --- | | Compliance.SecurityControlId | Not applicable (new field) | EC2.2 Introduces a single control ID across standards. `ProductFields.RuleId` still provides the standard-based control ID for CIS v1.2.0 controls. `ProductFields.ControlId` still provides the standard-based control ID for controls in other standards. | | Compliance.AssociatedStandards | Not applicable (new field) | [\$1"StandardsId": "standards/aws-foundational-security-best-practices/v/1.0.0"\$1] Shows which standards a control is enabled in. | | ProductFields.ArchivalReasons:0/Description | Not applicable (new field) | "The finding is in an ARCHIVED state because consolidated control findings has been turned on or off. This causes findings in the previous state to be archived when new findings are being generated." Describes why Security Hub CSPM has archived existing findings. | | ProductFields.ArchivalReasons:0/ReasonCode | Not applicable (new field) | "CONSOLIDATED\$1CONTROL\$1FINDINGS\$1UPDATE" Provides the reason why Security Hub CSPM has archived existing findings. | | ProductFields.RecommendationUrl | https://docs.aws.amazon.com/console/securityhub/PCI.EC2.2/remediation | https://docs.aws.amazon.com/console/securityhub/EC2.2/remediation This field no longer references a standard. | | Remediation.Recommendation.Text | "For directions on how to fix this issue, consult the AWS Security Hub CSPM PCI DSS documentation." | "For directions on how to correct this issue, consult the AWS Security Hub CSPM controls documentation." This field no longer references a standard. | | Remediation.Recommendation.Url | https://docs.aws.amazon.com/console/securityhub/PCI.EC2.2/remediation | https://docs.aws.amazon.com/console/securityhub/EC2.2/remediation This field no longer references a standard. | ## Consolidated control findings – ASFF changes If you enable consolidated control findings, you might be affected by the following changes to fields and values for control findings in the ASFF. These changes are in addition to the changes introduced by the consolidated controls view feature. If your workflows don’t rely on values for these ASFF fields, no action is required. If you have workflows that rely on specific values for these fields, update your workflows to use the current values. **Tip** If you use the [Automated Security Response on AWS v2.0.0](https://aws.amazon.com/solutions/implementations/aws-security-hub-automated-response-and-remediation/) solution, note that it supports consolidated control findings. This means that you can maintain your current workflows if you enable consolidated control findings. | ASFF field | Example value before enabling consolidated control findings | Example value after enabling consolidated control findings, and a description of the change | | --- | --- | --- | | GeneratorId | aws-foundational-security-best-practices/v/1.0.0/Config.1 | security-control/Config.1 This field no longer references a standard. | | Title | PCI.Config.1 AWS Config should be enabled | AWS Config should be enabled This field no longer references standard-specific information. | | Id | arn:aws:securityhub:eu-central-1:123456789012:subscription/pci-dss/v/3.2.1/PCI.IAM.5/finding/ab6d6a26-a156-48f0-9403-115983e5a956 | arn:aws:securityhub:eu-central-1:123456789012:security-control/iam.9/finding/ab6d6a26-a156-48f0-9403-115983e5a956 This field no longer references a standard. | | ProductFields.ControlId | PCI.EC2.2 | Removed. See `Compliance.SecurityControlId` instead. This field is removed in favor of a single, standard-agnostic control ID. | | ProductFields.RuleId | 1.3 | Removed. See `Compliance.SecurityControlId` instead. This field is removed in favor of a single, standard-agnostic control ID. | | Description | This PCI DSS control checks whether AWS Config is enabled in the current account and region. | This AWS control checks whether AWS Config is enabled in the current account and region.This field no longer references a standard. | | Severity | "Severity": \$1 "Product": 90, "Label": "CRITICAL", "Normalized": 90, "Original": "CRITICAL" \$1 | "Severity": \$1 "Label": "CRITICAL", "Normalized": 90, "Original": "CRITICAL" \$1 Security Hub CSPM no longer uses the Product field to describe the severity of a finding. | | Types | ["Software and Configuration Checks/Industry and Regulatory Standards/PCI-DSS"] | ["Software and Configuration Checks/Industry and Regulatory Standards"] This field no longer references a standard. | | Compliance.RelatedRequirements | ["PCI DSS 10.5.2", "PCI DSS 11.5", "CIS AWS Foundations 2.5"] | ["PCI DSS v3.2.1/10.5.2", "PCI DSS v3.2.1/11.5", "CIS AWS Foundations Benchmark v1.2.0/2.5"] This field shows related requirements in all enabled standards. | | CreatedAt | 2022-05-05T08:18:13.138Z | 2022-09-25T08:18:13.138Z Format remains the same, but value resets when you enable consolidated control findings. | | FirstObservedAt | 2022-05-07T08:18:13.138Z | 2022-09-28T08:18:13.138Z Format remains the same, but value resets when you enable consolidated control findings. | | ProductFields.RecommendationUrl | https://docs.aws.amazon.com/console/securityhub/EC2.2/remediation | Removed. See `Remediation.Recommendation.Url` instead. | | ProductFields.StandardsArn | arn:aws:securityhub:::standards/aws-foundational-security-best-practices/v/1.0.0 | Removed. See `Compliance.AssociatedStandards` instead. | | ProductFields.StandardsControlArn | arn:aws:securityhub:us-east-1:123456789012:control/aws-foundational-security-best-practices/v/1.0.0/Config.1 | Removed. Security Hub CSPM generates one finding for a security check across standards. | | ProductFields.StandardsGuideArn | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0 | Removed. See `Compliance.AssociatedStandards` instead. | | ProductFields.StandardsGuideSubscriptionArn | arn:aws:securityhub:us-east-2:123456789012:subscription/cis-aws-foundations-benchmark/v/1.2.0 | Removed. Security Hub CSPM generates one finding for a security check across standards. | | ProductFields.StandardsSubscriptionArn | arn:aws:securityhub:us-east-1:123456789012:subscription/aws-foundational-security-best-practices/v/1.0.0 | Removed. Security Hub CSPM generates one finding for a security check across standards. | | ProductFields.aws/securityhub/FindingId | arn:aws:securityhub:us-east-1::product/aws/securityhub/arn:aws:securityhub:us-east-1:123456789012:subscription/aws-foundational-security-best-practices/v/1.0.0/Config.1/finding/751c2173-7372-4e12-8656-a5210dfb1d67 | arn:aws:securityhub:us-east-1::product/aws/securityhub/arn:aws:securityhub:us-east-1:123456789012:security-control/Config.1/finding/751c2173-7372-4e12-8656-a5210dfb1d67 This field no longer references a standard. | ### Values for customer-provided ASFF fields after turning on consolidated control findings If you enable consolidated control findings, Security Hub CSPM generates one finding across standards and archives the original findings (separate findings for each standard). Updates that you made to the original findings by using the Security Hub CSPM console or the [https://docs.aws.amazon.com/securityhub/latest/userguide/finding-update-batchupdatefindings.html](https://docs.aws.amazon.com/securityhub/latest/userguide/finding-update-batchupdatefindings.html) operation won't be preserved in the new findings. If necessary, you can recover this data by referring to the archived findings. To review archived findings, you can use the **Findings** page on the Security Hub CSPM console and set the **Record state** filter to **ARCHIVED**. Alternatively, you can use the [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindings.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_GetFindings.html) operation of the Security Hub CSPM API. | Customer-provided ASFF field | Description of change after enabling consolidated control findings | | --- | --- | | Confidence | Resets to empty state. | | Criticality | Resets to empty state. | | Note | Resets to empty state. | | RelatedFindings | Resets to empty state. | | Severity | Default severity of the finding (matches the severity of the control). | | Types | Resets to standard-agnostic value. | | UserDefinedFields | Resets to empty state. | | VerificationState | Resets to empty state. | | Workflow | New failed findings have a default value of NEW. New passed findings have a default value of RESOLVED. | ## Generator IDs before and after enabling consolidated control findings The following table lists changes to generator ID values for controls when you enable consolidated control findings. These changes apply to controls that Security Hub CSPM supported as of February 15, 2023. | GeneratorID before enabling consolidated control findings | GeneratorID after enabling consolidated control findings | | --- | --- | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.1 | security-control/CloudWatch.1 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.10 | security-control/IAM.16 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.11 | security-control/IAM.17 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.12 | security-control/IAM.4 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.13 | security-control/IAM.9 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.14 | security-control/IAM.6 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.16 | security-control/IAM.2 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.2 | security-control/IAM.5 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.20 | security-control/IAM.18 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.22 | security-control/IAM.1 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.3 | security-control/IAM.8 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.4 | security-control/IAM.3 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.5 | security-control/IAM.11 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.6 | security-control/IAM.12 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.7 | security-control/IAM.13 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.8 | security-control/IAM.14 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/1.9 | security-control/IAM.15 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/2.1 | security-control/CloudTrail.1 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/2.2 | security-control/CloudTrail.4 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/2.3 | security-control/CloudTrail.6 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/2.4 | security-control/CloudTrail.5 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/2.5 | security-control/Config.1 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/2.6 | security-control/CloudTrail.7 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/2.7 | security-control/CloudTrail.2 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/2.8 | security-control/KMS.4 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/2.9 | security-control/EC2.6 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.1 | security-control/CloudWatch.2 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.2 | security-control/CloudWatch.3 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.3 | security-control/CloudWatch.1 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.4 | security-control/CloudWatch.4 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.5 | security-control/CloudWatch.5 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.6 | security-control/CloudWatch.6 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.7 | security-control/CloudWatch.7 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.8 | security-control/CloudWatch.8 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.9 | security-control/CloudWatch.9 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.10 | security-control/CloudWatch.10 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.11 | security-control/CloudWatch.11 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.12 | security-control/CloudWatch.12 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.13 | security-control/CloudWatch.13 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/3.14 | security-control/CloudWatch.14 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/4.1 | security-control/EC2.13 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/4.2 | security-control/EC2.14 | | arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0/rule/4.3 | security-control/EC2.2 | | cis-aws-foundations-benchmark/v/1.4.0/1.10 | security-control/IAM.5 | | cis-aws-foundations-benchmark/v/1.4.0/1.14 | security-control/IAM.3 | | cis-aws-foundations-benchmark/v/1.4.0/1.16 | security-control/IAM.1 | | cis-aws-foundations-benchmark/v/1.4.0/1.17 | security-control/IAM.18 | | cis-aws-foundations-benchmark/v/1.4.0/1.4 | security-control/IAM.4 | | cis-aws-foundations-benchmark/v/1.4.0/1.5 | security-control/IAM.9 | | cis-aws-foundations-benchmark/v/1.4.0/1.6 | security-control/IAM.6 | | cis-aws-foundations-benchmark/v/1.4.0/1.7 | security-control/CloudWatch.1 | | cis-aws-foundations-benchmark/v/1.4.0/1.8 | security-control/IAM.15 | | cis-aws-foundations-benchmark/v/1.4.0/1.9 | security-control/IAM.16 | | cis-aws-foundations-benchmark/v/1.4.0/2.1.2 | security-control/S3.5 | | cis-aws-foundations-benchmark/v/1.4.0/2.1.5.1 | security-control/S3.1 | | cis-aws-foundations-benchmark/v/1.4.0/2.1.5.2 | security-control/S3.8 | | cis-aws-foundations-benchmark/v/1.4.0/2.2.1 | security-control/EC2.7 | | cis-aws-foundations-benchmark/v/1.4.0/2.3.1 | security-control/RDS.3 | | cis-aws-foundations-benchmark/v/1.4.0/3.1 | security-control/CloudTrail.1 | | cis-aws-foundations-benchmark/v/1.4.0/3.2 | security-control/CloudTrail.4 | | cis-aws-foundations-benchmark/v/1.4.0/3.4 | security-control/CloudTrail.5 | | cis-aws-foundations-benchmark/v/1.4.0/3.5 | security-control/Config.1 | | cis-aws-foundations-benchmark/v/1.4.0/3.6 | security-control/S3.9 | | cis-aws-foundations-benchmark/v/1.4.0/3.7 | security-control/CloudTrail.2 | | cis-aws-foundations-benchmark/v/1.4.0/3.8 | security-control/KMS.4 | | cis-aws-foundations-benchmark/v/1.4.0/3.9 | security-control/EC2.6 | | cis-aws-foundations-benchmark/v/1.4.0/4.3 | security-control/CloudWatch.1 | | cis-aws-foundations-benchmark/v/1.4.0/4.4 | security-control/CloudWatch.4 | | cis-aws-foundations-benchmark/v/1.4.0/4.5 | security-control/CloudWatch.5 | | cis-aws-foundations-benchmark/v/1.4.0/4.6 | security-control/CloudWatch.6 | | cis-aws-foundations-benchmark/v/1.4.0/4.7 | security-control/CloudWatch.7 | | cis-aws-foundations-benchmark/v/1.4.0/4.8 | security-control/CloudWatch.8 | | cis-aws-foundations-benchmark/v/1.4.0/4.9 | security-control/CloudWatch.9 | | cis-aws-foundations-benchmark/v/1.4.0/4.10 | security-control/CloudWatch.10 | | cis-aws-foundations-benchmark/v/1.4.0/4.11 | security-control/CloudWatch.11 | | cis-aws-foundations-benchmark/v/1.4.0/4.12 | security-control/CloudWatch.12 | | cis-aws-foundations-benchmark/v/1.4.0/4.13 | security-control/CloudWatch.13 | | cis-aws-foundations-benchmark/v/1.4.0/4.14 | security-control/CloudWatch.14 | | cis-aws-foundations-benchmark/v/1.4.0/5.1 | security-control/EC2.21 | | cis-aws-foundations-benchmark/v/1.4.0/5.3 | security-control/EC2.2 | | aws-foundational-security-best-practices/v/1.0.0/Account.1 | security-control/Account.1 | | aws-foundational-security-best-practices/v/1.0.0/ACM.1 | security-control/ACM.1 | | aws-foundational-security-best-practices/v/1.0.0/APIGateway.1 | security-control/APIGateway.1 | | aws-foundational-security-best-practices/v/1.0.0/APIGateway.2 | security-control/APIGateway.2 | | aws-foundational-security-best-practices/v/1.0.0/APIGateway.3 | security-control/APIGateway.3 | | aws-foundational-security-best-practices/v/1.0.0/APIGateway.4 | security-control/APIGateway.4 | | aws-foundational-security-best-practices/v/1.0.0/APIGateway.5 | security-control/APIGateway.5 | | aws-foundational-security-best-practices/v/1.0.0/APIGateway.8 | security-control/APIGateway.8 | | aws-foundational-security-best-practices/v/1.0.0/APIGateway.9 | security-control/APIGateway.9 | | aws-foundational-security-best-practices/v/1.0.0/AutoScaling.1 | security-control/AutoScaling.1 | | aws-foundational-security-best-practices/v/1.0.0/AutoScaling.2 | security-control/AutoScaling.2 | | aws-foundational-security-best-practices/v/1.0.0/AutoScaling.3 | security-control/AutoScaling.3 | | aws-foundational-security-best-practices/v/1.0.0/Autoscaling.5 | security-control/Autoscaling.5 | | aws-foundational-security-best-practices/v/1.0.0/AutoScaling.6 | security-control/AutoScaling.6 | | aws-foundational-security-best-practices/v/1.0.0/AutoScaling.9 | security-control/AutoScaling.9 | | aws-foundational-security-best-practices/v/1.0.0/CloudFront.1 | security-control/CloudFront.1 | | aws-foundational-security-best-practices/v/1.0.0/CloudFront.3 | security-control/CloudFront.3 | | aws-foundational-security-best-practices/v/1.0.0/CloudFront.4 | security-control/CloudFront.4 | | aws-foundational-security-best-practices/v/1.0.0/CloudFront.5 | security-control/CloudFront.5 | | aws-foundational-security-best-practices/v/1.0.0/CloudFront.6 | security-control/CloudFront.6 | | aws-foundational-security-best-practices/v/1.0.0/CloudFront.7 | security-control/CloudFront.7 | | aws-foundational-security-best-practices/v/1.0.0/CloudFront.8 | security-control/CloudFront.8 | | aws-foundational-security-best-practices/v/1.0.0/CloudFront.9 | security-control/CloudFront.9 | | aws-foundational-security-best-practices/v/1.0.0/CloudFront.10 | security-control/CloudFront.10 | | aws-foundational-security-best-practices/v/1.0.0/CloudFront.12 | security-control/CloudFront.12 | | aws-foundational-security-best-practices/v/1.0.0/CloudTrail.1 | security-control/CloudTrail.1 | | aws-foundational-security-best-practices/v/1.0.0/CloudTrail.2 | security-control/CloudTrail.2 | | aws-foundational-security-best-practices/v/1.0.0/CloudTrail.4 | security-control/CloudTrail.4 | | aws-foundational-security-best-practices/v/1.0.0/CloudTrail.5 | security-control/CloudTrail.5 | | aws-foundational-security-best-practices/v/1.0.0/CodeBuild.1 | security-control/CodeBuild.1 | | aws-foundational-security-best-practices/v/1.0.0/CodeBuild.2 | security-control/CodeBuild.2 | | aws-foundational-security-best-practices/v/1.0.0/CodeBuild.3 | security-control/CodeBuild.3 | | aws-foundational-security-best-practices/v/1.0.0/CodeBuild.4 | security-control/CodeBuild.4 | | aws-foundational-security-best-practices/v/1.0.0/Config.1 | security-control/Config.1 | | aws-foundational-security-best-practices/v/1.0.0/DMS.1 | security-control/DMS.1 | | aws-foundational-security-best-practices/v/1.0.0/DynamoDB.1 | security-control/DynamoDB.1 | | aws-foundational-security-best-practices/v/1.0.0/DynamoDB.2 | security-control/DynamoDB.2 | | aws-foundational-security-best-practices/v/1.0.0/DynamoDB.3 | security-control/DynamoDB.3 | | aws-foundational-security-best-practices/v/1.0.0/EC2.1 | security-control/EC2.1 | | aws-foundational-security-best-practices/v/1.0.0/EC2.3 | security-control/EC2.3 | | aws-foundational-security-best-practices/v/1.0.0/EC2.4 | security-control/EC2.4 | | aws-foundational-security-best-practices/v/1.0.0/EC2.6 | security-control/EC2.6 | | aws-foundational-security-best-practices/v/1.0.0/EC2.7 | security-control/EC2.7 | | aws-foundational-security-best-practices/v/1.0.0/EC2.8 | security-control/EC2.8 | | aws-foundational-security-best-practices/v/1.0.0/EC2.9 | security-control/EC2.9 | | aws-foundational-security-best-practices/v/1.0.0/EC2.10 | security-control/EC2.10 | | aws-foundational-security-best-practices/v/1.0.0/EC2.15 | security-control/EC2.15 | | aws-foundational-security-best-practices/v/1.0.0/EC2.16 | security-control/EC2.16 | | aws-foundational-security-best-practices/v/1.0.0/EC2.17 | security-control/EC2.17 | | aws-foundational-security-best-practices/v/1.0.0/EC2.18 | security-control/EC2.18 | | aws-foundational-security-best-practices/v/1.0.0/EC2.19 | security-control/EC2.19 | | aws-foundational-security-best-practices/v/1.0.0/EC2.2 | security-control/EC2.2 | | aws-foundational-security-best-practices/v/1.0.0/EC2.20 | security-control/EC2.20 | | aws-foundational-security-best-practices/v/1.0.0/EC2.21 | security-control/EC2.21 | | aws-foundational-security-best-practices/v/1.0.0/EC2.23 | security-control/EC2.23 | | aws-foundational-security-best-practices/v/1.0.0/EC2.24 | security-control/EC2.24 | | aws-foundational-security-best-practices/v/1.0.0/EC2.25 | security-control/EC2.25 | | aws-foundational-security-best-practices/v/1.0.0/ECR.1 | security-control/ECR.1 | | aws-foundational-security-best-practices/v/1.0.0/ECR.2 | security-control/ECR.2 | | aws-foundational-security-best-practices/v/1.0.0/ECR.3 | security-control/ECR.3 | | aws-foundational-security-best-practices/v/1.0.0/ECS.1 | security-control/ECS.1 | | aws-foundational-security-best-practices/v/1.0.0/ECS.10 | security-control/ECS.10 | | aws-foundational-security-best-practices/v/1.0.0/ECS.12 | security-control/ECS.12 | | aws-foundational-security-best-practices/v/1.0.0/ECS.2 | security-control/ECS.2 | | aws-foundational-security-best-practices/v/1.0.0/ECS.3 | security-control/ECS.3 | | aws-foundational-security-best-practices/v/1.0.0/ECS.4 | security-control/ECS.4 | | aws-foundational-security-best-practices/v/1.0.0/ECS.5 | security-control/ECS.5 | | aws-foundational-security-best-practices/v/1.0.0/ECS.8 | security-control/ECS.8 | | aws-foundational-security-best-practices/v/1.0.0/EFS.1 | security-control/EFS.1 | | aws-foundational-security-best-practices/v/1.0.0/EFS.2 | security-control/EFS.2 | | aws-foundational-security-best-practices/v/1.0.0/EFS.3 | security-control/EFS.3 | | aws-foundational-security-best-practices/v/1.0.0/EFS.4 | security-control/EFS.4 | | aws-foundational-security-best-practices/v/1.0.0/EKS.2 | security-control/EKS.2 | | aws-foundational-security-best-practices/v/1.0.0/ElasticBeanstalk.1 | security-control/ElasticBeanstalk.1 | | aws-foundational-security-best-practices/v/1.0.0/ElasticBeanstalk.2 | security-control/ElasticBeanstalk.2 | | aws-foundational-security-best-practices/v/1.0.0/ELBv2.1 | security-control/ELB.1 | | aws-foundational-security-best-practices/v/1.0.0/ELB.2 | security-control/ELB.2 | | aws-foundational-security-best-practices/v/1.0.0/ELB.3 | security-control/ELB.3 | | aws-foundational-security-best-practices/v/1.0.0/ELB.4 | security-control/ELB.4 | | aws-foundational-security-best-practices/v/1.0.0/ELB.5 | security-control/ELB.5 | | aws-foundational-security-best-practices/v/1.0.0/ELB.6 | security-control/ELB.6 | | aws-foundational-security-best-practices/v/1.0.0/ELB.7 | security-control/ELB.7 | | aws-foundational-security-best-practices/v/1.0.0/ELB.8 | security-control/ELB.8 | | aws-foundational-security-best-practices/v/1.0.0/ELB.9 | security-control/ELB.9 | | aws-foundational-security-best-practices/v/1.0.0/ELB.10 | security-control/ELB.10 | | aws-foundational-security-best-practices/v/1.0.0/ELB.11 | security-control/ELB.11 | | aws-foundational-security-best-practices/v/1.0.0/ELB.12 | security-control/ELB.12 | | aws-foundational-security-best-practices/v/1.0.0/ELB.13 | security-control/ELB.13 | | aws-foundational-security-best-practices/v/1.0.0/ELB.14 | security-control/ELB.14 | | aws-foundational-security-best-practices/v/1.0.0/EMR.1 | security-control/EMR.1 | | aws-foundational-security-best-practices/v/1.0.0/ES.1 | security-control/ES.1 | | aws-foundational-security-best-practices/v/1.0.0/ES.2 | security-control/ES.2 | | aws-foundational-security-best-practices/v/1.0.0/ES.3 | security-control/ES.3 | | aws-foundational-security-best-practices/v/1.0.0/ES.4 | security-control/ES.4 | | aws-foundational-security-best-practices/v/1.0.0/ES.5 | security-control/ES.5 | | aws-foundational-security-best-practices/v/1.0.0/ES.6 | security-control/ES.6 | | aws-foundational-security-best-practices/v/1.0.0/ES.7 | security-control/ES.7 | | aws-foundational-security-best-practices/v/1.0.0/ES.8 | security-control/ES.8 | | aws-foundational-security-best-practices/v/1.0.0/GuardDuty.1 | security-control/GuardDuty.1 | | aws-foundational-security-best-practices/v/1.0.0/IAM.1 | security-control/IAM.1 | | aws-foundational-security-best-practices/v/1.0.0/IAM.2 | security-control/IAM.2 | | aws-foundational-security-best-practices/v/1.0.0/IAM.21 | security-control/IAM.21 | | aws-foundational-security-best-practices/v/1.0.0/IAM.3 | security-control/IAM.3 | | aws-foundational-security-best-practices/v/1.0.0/IAM.4 | security-control/IAM.4 | | aws-foundational-security-best-practices/v/1.0.0/IAM.5 | security-control/IAM.5 | | aws-foundational-security-best-practices/v/1.0.0/IAM.6 | security-control/IAM.6 | | aws-foundational-security-best-practices/v/1.0.0/IAM.7 | security-control/IAM.7 | | aws-foundational-security-best-practices/v/1.0.0/IAM.8 | security-control/IAM.8 | | aws-foundational-security-best-practices/v/1.0.0/Kinesis.1 | security-control/Kinesis.1 | | aws-foundational-security-best-practices/v/1.0.0/KMS.1 | security-control/KMS.1 | | aws-foundational-security-best-practices/v/1.0.0/KMS.2 | security-control/KMS.2 | | aws-foundational-security-best-practices/v/1.0.0/KMS.3 | security-control/KMS.3 | | aws-foundational-security-best-practices/v/1.0.0/Lambda.1 | security-control/Lambda.1 | | aws-foundational-security-best-practices/v/1.0.0/Lambda.2 | security-control/Lambda.2 | | aws-foundational-security-best-practices/v/1.0.0/Lambda.5 | security-control/Lambda.5 | | aws-foundational-security-best-practices/v/1.0.0/NetworkFirewall.3 | security-control/NetworkFirewall.3 | | aws-foundational-security-best-practices/v/1.0.0/NetworkFirewall.4 | security-control/NetworkFirewall.4 | | aws-foundational-security-best-practices/v/1.0.0/NetworkFirewall.5 | security-control/NetworkFirewall.5 | | aws-foundational-security-best-practices/v/1.0.0/NetworkFirewall.6 | security-control/NetworkFirewall.6 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch.1 | security-control/Opensearch.1 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch.2 | security-control/Opensearch.2 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch.3 | security-control/Opensearch.3 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch.4 | security-control/Opensearch.4 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch.5 | security-control/Opensearch.5 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch.6 | security-control/Opensearch.6 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch.7 | security-control/Opensearch.7 | | aws-foundational-security-best-practices/v/1.0.0/Opensearch.8 | security-control/Opensearch.8 | | aws-foundational-security-best-practices/v/1.0.0/RDS.1 | security-control/RDS.1 | | aws-foundational-security-best-practices/v/1.0.0/RDS.10 | security-control/RDS.10 | | aws-foundational-security-best-practices/v/1.0.0/RDS.11 | security-control/RDS.11 | | aws-foundational-security-best-practices/v/1.0.0/RDS.12 | security-control/RDS.12 | | aws-foundational-security-best-practices/v/1.0.0/RDS.13 | security-control/RDS.13 | | aws-foundational-security-best-practices/v/1.0.0/RDS.14 | security-control/RDS.14 | | aws-foundational-security-best-practices/v/1.0.0/RDS.15 | security-control/RDS.15 | | aws-foundational-security-best-practices/v/1.0.0/RDS.16 | security-control/RDS.16 | | aws-foundational-security-best-practices/v/1.0.0/RDS.17 | security-control/RDS.17 | | aws-foundational-security-best-practices/v/1.0.0/RDS.19 | security-control/RDS.19 | | aws-foundational-security-best-practices/v/1.0.0/RDS.2 | security-control/RDS.2 | | aws-foundational-security-best-practices/v/1.0.0/RDS.20 | security-control/RDS.20 | | aws-foundational-security-best-practices/v/1.0.0/RDS.21 | security-control/RDS.21 | | aws-foundational-security-best-practices/v/1.0.0/RDS.22 | security-control/RDS.22 | | aws-foundational-security-best-practices/v/1.0.0/RDS.23 | security-control/RDS.23 | | aws-foundational-security-best-practices/v/1.0.0/RDS.24 | security-control/RDS.24 | | aws-foundational-security-best-practices/v/1.0.0/RDS.25 | security-control/RDS.25 | | aws-foundational-security-best-practices/v/1.0.0/RDS.3 | security-control/RDS.3 | | aws-foundational-security-best-practices/v/1.0.0/RDS.4 | security-control/RDS.4 | | aws-foundational-security-best-practices/v/1.0.0/RDS.5 | security-control/RDS.5 | | aws-foundational-security-best-practices/v/1.0.0/RDS.6 | security-control/RDS.6 | | aws-foundational-security-best-practices/v/1.0.0/RDS.7 | security-control/RDS.7 | | aws-foundational-security-best-practices/v/1.0.0/RDS.8 | security-control/RDS.8 | | aws-foundational-security-best-practices/v/1.0.0/RDS.9 | security-control/RDS.9 | | aws-foundational-security-best-practices/v/1.0.0/Redshift.1 | security-control/Redshift.1 | | aws-foundational-security-best-practices/v/1.0.0/Redshift.2 | security-control/Redshift.2 | | aws-foundational-security-best-practices/v/1.0.0/Redshift.3 | security-control/Redshift.3 | | aws-foundational-security-best-practices/v/1.0.0/Redshift.4 | security-control/Redshift.4 | | aws-foundational-security-best-practices/v/1.0.0/Redshift.6 | security-control/Redshift.6 | | aws-foundational-security-best-practices/v/1.0.0/Redshift.7 | security-control/Redshift.7 | | aws-foundational-security-best-practices/v/1.0.0/Redshift.8 | security-control/Redshift.8 | | aws-foundational-security-best-practices/v/1.0.0/Redshift.9 | security-control/Redshift.9 | | aws-foundational-security-best-practices/v/1.0.0/S3.1 | security-control/S3.1 | | aws-foundational-security-best-practices/v/1.0.0/S3.12 | security-control/S3.12 | | aws-foundational-security-best-practices/v/1.0.0/S3.13 | security-control/S3.13 | | aws-foundational-security-best-practices/v/1.0.0/S3.2 | security-control/S3.2 | | aws-foundational-security-best-practices/v/1.0.0/S3.3 | security-control/S3.3 | | aws-foundational-security-best-practices/v/1.0.0/S3.5 | security-control/S3.5 | | aws-foundational-security-best-practices/v/1.0.0/S3.6 | security-control/S3.6 | | aws-foundational-security-best-practices/v/1.0.0/S3.8 | security-control/S3.8 | | aws-foundational-security-best-practices/v/1.0.0/S3.9 | security-control/S3.9 | | aws-foundational-security-best-practices/v/1.0.0/SageMaker.1 | security-control/SageMaker.1 | | aws-foundational-security-best-practices/v/1.0.0/SageMaker.2 | security-control/SageMaker.2 | | aws-foundational-security-best-practices/v/1.0.0/SageMaker.3 | security-control/SageMaker.3 | | aws-foundational-security-best-practices/v/1.0.0/SecretsManager.1 | security-control/SecretsManager.1 | | aws-foundational-security-best-practices/v/1.0.0/SecretsManager.2 | security-control/SecretsManager.2 | | aws-foundational-security-best-practices/v/1.0.0/SecretsManager.3 | security-control/SecretsManager.3 | | aws-foundational-security-best-practices/v/1.0.0/SecretsManager.4 | security-control/SecretsManager.4 | | aws-foundational-security-best-practices/v/1.0.0/SQS.1 | security-control/SQS.1 | | aws-foundational-security-best-practices/v/1.0.0/SSM.1 | security-control/SSM.1 | | aws-foundational-security-best-practices/v/1.0.0/SSM.2 | security-control/SSM.2 | | aws-foundational-security-best-practices/v/1.0.0/SSM.3 | security-control/SSM.3 | | aws-foundational-security-best-practices/v/1.0.0/SSM.4 | security-control/SSM.4 | | aws-foundational-security-best-practices/v/1.0.0/WAF.1 | security-control/WAF.1 | | aws-foundational-security-best-practices/v/1.0.0/WAF.2 | security-control/WAF.2 | | aws-foundational-security-best-practices/v/1.0.0/WAF.3 | security-control/WAF.3 | | aws-foundational-security-best-practices/v/1.0.0/WAF.4 | security-control/WAF.4 | | aws-foundational-security-best-practices/v/1.0.0/WAF.6 | security-control/WAF.6 | | aws-foundational-security-best-practices/v/1.0.0/WAF.7 | security-control/WAF.7 | | aws-foundational-security-best-practices/v/1.0.0/WAF.8 | security-control/WAF.8 | | aws-foundational-security-best-practices/v/1.0.0/WAF.10 | security-control/WAF.10 | | pci-dss/v/3.2.1/PCI.AutoScaling.1 | security-control/AutoScaling.1 | | pci-dss/v/3.2.1/PCI.CloudTrail.1 | security-control/CloudTrail.2 | | pci-dss/v/3.2.1/PCI.CloudTrail.2 | security-control/CloudTrail.3 | | pci-dss/v/3.2.1/PCI.CloudTrail.3 | security-control/CloudTrail.4 | | pci-dss/v/3.2.1/PCI.CloudTrail.4 | security-control/CloudTrail.5 | | pci-dss/v/3.2.1/PCI.CodeBuild.1 | security-control/CodeBuild.1 | | pci-dss/v/3.2.1/PCI.CodeBuild.2 | security-control/CodeBuild.2 | | pci-dss/v/3.2.1/PCI.Config.1 | security-control/Config.1 | | pci-dss/v/3.2.1/PCI.CW.1 | security-control/CloudWatch.1 | | pci-dss/v/3.2.1/PCI.DMS.1 | security-control/DMS.1 | | pci-dss/v/3.2.1/PCI.EC2.1 | security-control/EC2.1 | | pci-dss/v/3.2.1/PCI.EC2.2 | security-control/EC2.2 | | pci-dss/v/3.2.1/PCI.EC2.4 | security-control/EC2.12 | | pci-dss/v/3.2.1/PCI.EC2.5 | security-control/EC2.13 | | pci-dss/v/3.2.1/PCI.EC2.6 | security-control/EC2.6 | | pci-dss/v/3.2.1/PCI.ELBv2.1 | security-control/ELB.1 | | pci-dss/v/3.2.1/PCI.ES.1 | security-control/ES.2 | | pci-dss/v/3.2.1/PCI.ES.2 | security-control/ES.1 | | pci-dss/v/3.2.1/PCI.GuardDuty.1 | security-control/GuardDuty.1 | | pci-dss/v/3.2.1/PCI.IAM.1 | security-control/IAM.4 | | pci-dss/v/3.2.1/PCI.IAM.2 | security-control/IAM.2 | | pci-dss/v/3.2.1/PCI.IAM.3 | security-control/IAM.1 | | pci-dss/v/3.2.1/PCI.IAM.4 | security-control/IAM.6 | | pci-dss/v/3.2.1/PCI.IAM.5 | security-control/IAM.9 | | pci-dss/v/3.2.1/PCI.IAM.6 | security-control/IAM.19 | | pci-dss/v/3.2.1/PCI.IAM.7 | security-control/IAM.8 | | pci-dss/v/3.2.1/PCI.IAM.8 | security-control/IAM.10 | | pci-dss/v/3.2.1/PCI.KMS.1 | security-control/KMS.4 | | pci-dss/v/3.2.1/PCI.Lambda.1 | security-control/Lambda.1 | | pci-dss/v/3.2.1/PCI.Lambda.2 | security-control/Lambda.3 | | pci-dss/v/3.2.1/PCI.Opensearch.1 | security-control/Opensearch.2 | | pci-dss/v/3.2.1/PCI.Opensearch.2 | security-control/Opensearch.1 | | pci-dss/v/3.2.1/PCI.RDS.1 | security-control/RDS.1 | | pci-dss/v/3.2.1/PCI.RDS.2 | security-control/RDS.2 | | pci-dss/v/3.2.1/PCI.Redshift.1 | security-control/Redshift.1 | | pci-dss/v/3.2.1/PCI.S3.1 | security-control/S3.3 | | pci-dss/v/3.2.1/PCI.S3.2 | security-control/S3.2 | | pci-dss/v/3.2.1/PCI.S3.3 | security-control/S3.7 | | pci-dss/v/3.2.1/PCI.S3.5 | security-control/S3.5 | | pci-dss/v/3.2.1/PCI.S3.6 | security-control/S3.1 | | pci-dss/v/3.2.1/PCI.SageMaker.1 | security-control/SageMaker.1 | | pci-dss/v/3.2.1/PCI.SSM.1 | security-control/SSM.2 | | pci-dss/v/3.2.1/PCI.SSM.2 | security-control/SSM.3 | | pci-dss/v/3.2.1/PCI.SSM.3 | security-control/SSM.1 | | service-managed-aws-control-tower/v/1.0.0/ACM.1 | security-control/ACM.1 | | service-managed-aws-control-tower/v/1.0.0/APIGateway.1 | security-control/APIGateway.1 | | service-managed-aws-control-tower/v/1.0.0/APIGateway.2 | security-control/APIGateway.2 | | service-managed-aws-control-tower/v/1.0.0/APIGateway.3 | security-control/APIGateway.3 | | service-managed-aws-control-tower/v/1.0.0/APIGateway.4 | security-control/APIGateway.4 | | service-managed-aws-control-tower/v/1.0.0/APIGateway.5 | security-control/APIGateway.5 | | service-managed-aws-control-tower/v/1.0.0/AutoScaling.1 | security-control/AutoScaling.1 | | service-managed-aws-control-tower/v/1.0.0/AutoScaling.2 | security-control/AutoScaling.2 | | service-managed-aws-control-tower/v/1.0.0/AutoScaling.3 | security-control/AutoScaling.3 | | service-managed-aws-control-tower/v/1.0.0/AutoScaling.4 | security-control/AutoScaling.4 | | service-managed-aws-control-tower/v/1.0.0/Autoscaling.5 | security-control/Autoscaling.5 | | service-managed-aws-control-tower/v/1.0.0/AutoScaling.6 | security-control/AutoScaling.6 | | service-managed-aws-control-tower/v/1.0.0/AutoScaling.9 | security-control/AutoScaling.9 | | service-managed-aws-control-tower/v/1.0.0/CloudTrail.1 | security-control/CloudTrail.1 | | service-managed-aws-control-tower/v/1.0.0/CloudTrail.2 | security-control/CloudTrail.2 | | service-managed-aws-control-tower/v/1.0.0/CloudTrail.4 | security-control/CloudTrail.4 | | service-managed-aws-control-tower/v/1.0.0/CloudTrail.5 | security-control/CloudTrail.5 | | service-managed-aws-control-tower/v/1.0.0/CodeBuild.1 | security-control/CodeBuild.1 | | service-managed-aws-control-tower/v/1.0.0/CodeBuild.2 | security-control/CodeBuild.2 | | service-managed-aws-control-tower/v/1.0.0/CodeBuild.4 | security-control/CodeBuild.4 | | service-managed-aws-control-tower/v/1.0.0/CodeBuild.5 | security-control/CodeBuild.5 | | service-managed-aws-control-tower/v/1.0.0/DMS.1 | security-control/DMS.1 | | service-managed-aws-control-tower/v/1.0.0/DynamoDB.1 | security-control/DynamoDB.1 | | service-managed-aws-control-tower/v/1.0.0/DynamoDB.2 | security-control/DynamoDB.2 | | service-managed-aws-control-tower/v/1.0.0/EC2.1 | security-control/EC2.1 | | service-managed-aws-control-tower/v/1.0.0/EC2.2 | security-control/EC2.2 | | service-managed-aws-control-tower/v/1.0.0/EC2.3 | security-control/EC2.3 | | service-managed-aws-control-tower/v/1.0.0/EC2.4 | security-control/EC2.4 | | service-managed-aws-control-tower/v/1.0.0/EC2.6 | security-control/EC2.6 | | service-managed-aws-control-tower/v/1.0.0/EC2.7 | security-control/EC2.7 | | service-managed-aws-control-tower/v/1.0.0/EC2.8 | security-control/EC2.8 | | service-managed-aws-control-tower/v/1.0.0/EC2.9 | security-control/EC2.9 | | service-managed-aws-control-tower/v/1.0.0/EC2.10 | security-control/EC2.10 | | service-managed-aws-control-tower/v/1.0.0/EC2.15 | security-control/EC2.15 | | service-managed-aws-control-tower/v/1.0.0/EC2.16 | security-control/EC2.16 | | service-managed-aws-control-tower/v/1.0.0/EC2.17 | security-control/EC2.17 | | service-managed-aws-control-tower/v/1.0.0/EC2.18 | security-control/EC2.18 | | service-managed-aws-control-tower/v/1.0.0/EC2.19 | security-control/EC2.19 | | service-managed-aws-control-tower/v/1.0.0/EC2.20 | security-control/EC2.20 | | service-managed-aws-control-tower/v/1.0.0/EC2.21 | security-control/EC2.21 | | service-managed-aws-control-tower/v/1.0.0/EC2.22 | security-control/EC2.22 | | service-managed-aws-control-tower/v/1.0.0/ECR.1 | security-control/ECR.1 | | service-managed-aws-control-tower/v/1.0.0/ECR.2 | security-control/ECR.2 | | service-managed-aws-control-tower/v/1.0.0/ECR.3 | security-control/ECR.3 | | service-managed-aws-control-tower/v/1.0.0/ECS.1 | security-control/ECS.1 | | service-managed-aws-control-tower/v/1.0.0/ECS.2 | security-control/ECS.2 | | service-managed-aws-control-tower/v/1.0.0/ECS.3 | security-control/ECS.3 | | service-managed-aws-control-tower/v/1.0.0/ECS.4 | security-control/ECS.4 | | service-managed-aws-control-tower/v/1.0.0/ECS.5 | security-control/ECS.5 | | service-managed-aws-control-tower/v/1.0.0/ECS.8 | security-control/ECS.8 | | service-managed-aws-control-tower/v/1.0.0/ECS.10 | security-control/ECS.10 | | service-managed-aws-control-tower/v/1.0.0/ECS.12 | security-control/ECS.12 | | service-managed-aws-control-tower/v/1.0.0/EFS.1 | security-control/EFS.1 | | service-managed-aws-control-tower/v/1.0.0/EFS.2 | security-control/EFS.2 | | service-managed-aws-control-tower/v/1.0.0/EFS.3 | security-control/EFS.3 | | service-managed-aws-control-tower/v/1.0.0/EFS.4 | security-control/EFS.4 | | service-managed-aws-control-tower/v/1.0.0/EKS.2 | security-control/EKS.2 | | service-managed-aws-control-tower/v/1.0.0/ELB.2 | security-control/ELB.2 | | service-managed-aws-control-tower/v/1.0.0/ELB.3 | security-control/ELB.3 | | service-managed-aws-control-tower/v/1.0.0/ELB.4 | security-control/ELB.4 | | service-managed-aws-control-tower/v/1.0.0/ELB.5 | security-control/ELB.5 | | service-managed-aws-control-tower/v/1.0.0/ELB.6 | security-control/ELB.6 | | service-managed-aws-control-tower/v/1.0.0/ELB.7 | security-control/ELB.7 | | service-managed-aws-control-tower/v/1.0.0/ELB.8 | security-control/ELB.8 | | service-managed-aws-control-tower/v/1.0.0/ELB.9 | security-control/ELB.9 | | service-managed-aws-control-tower/v/1.0.0/ELB.10 | security-control/ELB.10 | | service-managed-aws-control-tower/v/1.0.0/ELB.12 | security-control/ELB.12 | | service-managed-aws-control-tower/v/1.0.0/ELB.13 | security-control/ELB.13 | | service-managed-aws-control-tower/v/1.0.0/ELB.14 | security-control/ELB.14 | | service-managed-aws-control-tower/v/1.0.0/ELBv2.1 | security-control/ELBv2.1 | | service-managed-aws-control-tower/v/1.0.0/EMR.1 | security-control/EMR.1 | | service-managed-aws-control-tower/v/1.0.0/ES.1 | security-control/ES.1 | | service-managed-aws-control-tower/v/1.0.0/ES.2 | security-control/ES.2 | | service-managed-aws-control-tower/v/1.0.0/ES.3 | security-control/ES.3 | | service-managed-aws-control-tower/v/1.0.0/ES.4 | security-control/ES.4 | | service-managed-aws-control-tower/v/1.0.0/ES.5 | security-control/ES.5 | | service-managed-aws-control-tower/v/1.0.0/ES.6 | security-control/ES.6 | | service-managed-aws-control-tower/v/1.0.0/ES.7 | security-control/ES.7 | | service-managed-aws-control-tower/v/1.0.0/ES.8 | security-control/ES.8 | | service-managed-aws-control-tower/v/1.0.0/ElasticBeanstalk.1 | security-control/ElasticBeanstalk.1 | | service-managed-aws-control-tower/v/1.0.0/ElasticBeanstalk.2 | security-control/ElasticBeanstalk.2 | | service-managed-aws-control-tower/v/1.0.0/GuardDuty.1 | security-control/GuardDuty.1 | | service-managed-aws-control-tower/v/1.0.0/IAM.1 | security-control/IAM.1 | | service-managed-aws-control-tower/v/1.0.0/IAM.2 | security-control/IAM.2 | | service-managed-aws-control-tower/v/1.0.0/IAM.3 | security-control/IAM.3 | | service-managed-aws-control-tower/v/1.0.0/IAM.4 | security-control/IAM.4 | | service-managed-aws-control-tower/v/1.0.0/IAM.5 | security-control/IAM.5 | | service-managed-aws-control-tower/v/1.0.0/IAM.6 | security-control/IAM.6 | | service-managed-aws-control-tower/v/1.0.0/IAM.7 | security-control/IAM.7 | | service-managed-aws-control-tower/v/1.0.0/IAM.8 | security-control/IAM.8 | | service-managed-aws-control-tower/v/1.0.0/IAM.21 | security-control/IAM.21 | | service-managed-aws-control-tower/v/1.0.0/Kinesis.1 | security-control/Kinesis.1 | | service-managed-aws-control-tower/v/1.0.0/KMS.1 | security-control/KMS.1 | | service-managed-aws-control-tower/v/1.0.0/KMS.2 | security-control/KMS.2 | | service-managed-aws-control-tower/v/1.0.0/KMS.3 | security-control/KMS.3 | | service-managed-aws-control-tower/v/1.0.0/Lambda.1 | security-control/Lambda.1 | | service-managed-aws-control-tower/v/1.0.0/Lambda.2 | security-control/Lambda.2 | | service-managed-aws-control-tower/v/1.0.0/Lambda.5 | security-control/Lambda.5 | | service-managed-aws-control-tower/v/1.0.0/NetworkFirewall.3 | security-control/NetworkFirewall.3 | | service-managed-aws-control-tower/v/1.0.0/NetworkFirewall.4 | security-control/NetworkFirewall.4 | | service-managed-aws-control-tower/v/1.0.0/NetworkFirewall.5 | security-control/NetworkFirewall.5 | | service-managed-aws-control-tower/v/1.0.0/NetworkFirewall.6 | security-control/NetworkFirewall.6 | | service-managed-aws-control-tower/v/1.0.0/Opensearch.1 | security-control/Opensearch.1 | | service-managed-aws-control-tower/v/1.0.0/Opensearch.2 | security-control/Opensearch.2 | | service-managed-aws-control-tower/v/1.0.0/Opensearch.3 | security-control/Opensearch.3 | | service-managed-aws-control-tower/v/1.0.0/Opensearch.4 | security-control/Opensearch.4 | | service-managed-aws-control-tower/v/1.0.0/Opensearch.5 | security-control/Opensearch.5 | | service-managed-aws-control-tower/v/1.0.0/Opensearch.6 | security-control/Opensearch.6 | | service-managed-aws-control-tower/v/1.0.0/Opensearch.7 | security-control/Opensearch.7 | | service-managed-aws-control-tower/v/1.0.0/Opensearch.8 | security-control/Opensearch.8 | | service-managed-aws-control-tower/v/1.0.0/RDS.1 | security-control/RDS.1 | | service-managed-aws-control-tower/v/1.0.0/RDS.2 | security-control/RDS.2 | | service-managed-aws-control-tower/v/1.0.0/RDS.3 | security-control/RDS.3 | | service-managed-aws-control-tower/v/1.0.0/RDS.4 | security-control/RDS.4 | | service-managed-aws-control-tower/v/1.0.0/RDS.5 | security-control/RDS.5 | | service-managed-aws-control-tower/v/1.0.0/RDS.6 | security-control/RDS.6 | | service-managed-aws-control-tower/v/1.0.0/RDS.8 | security-control/RDS.8 | | service-managed-aws-control-tower/v/1.0.0/RDS.9 | security-control/RDS.9 | | service-managed-aws-control-tower/v/1.0.0/RDS.10 | security-control/RDS.10 | | service-managed-aws-control-tower/v/1.0.0/RDS.11 | security-control/RDS.11 | | service-managed-aws-control-tower/v/1.0.0/RDS.13 | security-control/RDS.13 | | service-managed-aws-control-tower/v/1.0.0/RDS.17 | security-control/RDS.17 | | service-managed-aws-control-tower/v/1.0.0/RDS.18 | security-control/RDS.18 | | service-managed-aws-control-tower/v/1.0.0/RDS.19 | security-control/RDS.19 | | service-managed-aws-control-tower/v/1.0.0/RDS.20 | security-control/RDS.20 | | service-managed-aws-control-tower/v/1.0.0/RDS.21 | security-control/RDS.21 | | service-managed-aws-control-tower/v/1.0.0/RDS.22 | security-control/RDS.22 | | service-managed-aws-control-tower/v/1.0.0/RDS.23 | security-control/RDS.23 | | service-managed-aws-control-tower/v/1.0.0/RDS.25 | security-control/RDS.25 | | service-managed-aws-control-tower/v/1.0.0/Redshift.1 | security-control/Redshift.1 | | service-managed-aws-control-tower/v/1.0.0/Redshift.2 | security-control/Redshift.2 | | service-managed-aws-control-tower/v/1.0.0/Redshift.4 | security-control/Redshift.4 | | service-managed-aws-control-tower/v/1.0.0/Redshift.6 | security-control/Redshift.6 | | service-managed-aws-control-tower/v/1.0.0/Redshift.7 | security-control/Redshift.7 | | service-managed-aws-control-tower/v/1.0.0/Redshift.8 | security-control/Redshift.8 | | service-managed-aws-control-tower/v/1.0.0/Redshift.9 | security-control/Redshift.9 | | service-managed-aws-control-tower/v/1.0.0/S3.1 | security-control/S3.1 | | service-managed-aws-control-tower/v/1.0.0/S3.2 | security-control/S3.2 | | service-managed-aws-control-tower/v/1.0.0/S3.3 | security-control/S3.3 | | service-managed-aws-control-tower/v/1.0.0/S3.5 | security-control/S3.5 | | service-managed-aws-control-tower/v/1.0.0/S3.6 | security-control/S3.6 | | service-managed-aws-control-tower/v/1.0.0/S3.8 | security-control/S3.8 | | service-managed-aws-control-tower/v/1.0.0/S3.9 | security-control/S3.9 | | service-managed-aws-control-tower/v/1.0.0/S3.12 | security-control/S3.12 | | service-managed-aws-control-tower/v/1.0.0/S3.13 | security-control/S3.13 | | service-managed-aws-control-tower/v/1.0.0/SageMaker.1 | security-control/SageMaker.1 | | service-managed-aws-control-tower/v/1.0.0/SecretsManager.1 | security-control/SecretsManager.1 | | service-managed-aws-control-tower/v/1.0.0/SecretsManager.2 | security-control/SecretsManager.2 | | service-managed-aws-control-tower/v/1.0.0/SecretsManager.3 | security-control/SecretsManager.3 | | service-managed-aws-control-tower/v/1.0.0/SecretsManager.4 | security-control/SecretsManager.4 | | service-managed-aws-control-tower/v/1.0.0/SQS.1 | security-control/SQS.1 | | service-managed-aws-control-tower/v/1.0.0/SSM.1 | security-control/SSM.1 | | service-managed-aws-control-tower/v/1.0.0/SSM.2 | security-control/SSM.2 | | service-managed-aws-control-tower/v/1.0.0/SSM.3 | security-control/SSM.3 | | service-managed-aws-control-tower/v/1.0.0/SSM.4 | security-control/SSM.4 | | service-managed-aws-control-tower/v/1.0.0/WAF.2 | security-control/WAF.2 | | service-managed-aws-control-tower/v/1.0.0/WAF.3 | security-control/WAF.3 | | service-managed-aws-control-tower/v/1.0.0/WAF.4 | security-control/WAF.4 | ## How consolidation impacts control IDs and titles Consolidated controls view and consolidated control findings standardize control IDs and titles across standards. The terms *security control ID* and *security control title* refer to these standard-agnostic values. The Security Hub CSPM console displays standard-agnostic security control IDs and security control titles, regardless of whether consolidated control findings is enabled or disabled for your account. However, Security Hub CSPM findings contain standard-specific control titles, for PCI DSS and CIS v1.2.0, if consolidated control findings is disabled for your account. In addition, Security Hub CSPM findings contain the standard-specific control ID and security control ID. For examples of how consolidation impacts control findings, see [Samples of control findings](sample-control-findings.md). For controls that are part of the [AWS Control Tower service-managed standard](service-managed-standard-aws-control-tower.md), the prefix `CT.` is removed from the control ID and title in findings when consolidated control findings is enabled. To disable a security control in Security Hub CSPM, you must disable all standard controls that correspond to the security control. The following table shows the mapping of security control IDs and titles to standard-specific control IDs and titles. IDs and titles for controls that belong to the AWS Foundational Security Best Practices (FSBP) standard are already standard-agnostic. For a mapping of controls to the requirements of Center for Internet Security (CIS) v3.0.0, see [Mapping of controls to CIS requirements in each version](cis-aws-foundations-benchmark.md#cis-version-comparison). To run your own scripts on this table, you can [download it as a .csv file](samples/Consolidation_ID_Title_Changes.csv.zip). | Standard | Standard control ID and title | Security control ID and title | | --- | --- | --- | | CIS v1.2.0 | 1.1 Avoid the use of the root user | [[CloudWatch.1] A log metric filter and alarm should exist for usage of the "root" user](cloudwatch-controls.md#cloudwatch-1) | | CIS v1.2.0 | 1.10 Ensure IAM password policy prevents password reuse | [[IAM.16] Ensure IAM password policy prevents password reuse](iam-controls.md#iam-16) | | CIS v1.2.0 | 1.11 Ensure IAM password policy expires passwords within 90 days or less | [[IAM.17] Ensure IAM password policy expires passwords within 90 days or less](iam-controls.md#iam-17) | | CIS v1.2.0 | 1.12 Ensure no root user access key exists | [[IAM.4] IAM root user access key should not exist](iam-controls.md#iam-4) | | CIS v1.2.0 | 1.13 Ensure MFA is enabled for the root user | [[IAM.9] MFA should be enabled for the root user](iam-controls.md#iam-9) | | CIS v1.2.0 | 1.14 Ensure hardware MFA is enabled for the root user | [[IAM.6] Hardware MFA should be enabled for the root user](iam-controls.md#iam-6) | | CIS v1.2.0 | 1.16 Ensure IAM policies are attached only to groups or roles | [[IAM.2] IAM users should not have IAM policies attached](iam-controls.md#iam-2) | | CIS v1.2.0 | 1.2 Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password | [[IAM.5] MFA should be enabled for all IAM users that have a console password](iam-controls.md#iam-5) | | CIS v1.2.0 | 1.20 Ensure a support role has been created to manage incidents with Support | [[IAM.18] Ensure a support role has been created to manage incidents with AWS Support](iam-controls.md#iam-18) | | CIS v1.2.0 | 1.22 Ensure IAM policies that allow full "\$1:\$1" administrative privileges are not created | [[IAM.1] IAM policies should not allow full "\$1" administrative privileges](iam-controls.md#iam-1) | | CIS v1.2.0 | 1.3 Ensure credentials unused for 90 days or greater are disabled | [[IAM.8] Unused IAM user credentials should be removed](iam-controls.md#iam-8) | | CIS v1.2.0 | 1.4 Ensure access keys are rotated every 90 days or less | [[IAM.3] IAM users' access keys should be rotated every 90 days or less](iam-controls.md#iam-3) | | CIS v1.2.0 | 1.5 Ensure IAM password policy requires at least one uppercase letter | [[IAM.11] Ensure IAM password policy requires at least one uppercase letter](iam-controls.md#iam-11) | | CIS v1.2.0 | 1.6 Ensure IAM password policy requires at least one lowercase letter | [[IAM.12] Ensure IAM password policy requires at least one lowercase letter](iam-controls.md#iam-12) | | CIS v1.2.0 | 1.7 Ensure IAM password policy requires at least one symbol | [[IAM.13] Ensure IAM password policy requires at least one symbol](iam-controls.md#iam-13) | | CIS v1.2.0 | 1.8 Ensure IAM password policy requires at least one number | [[IAM.14] Ensure IAM password policy requires at least one number](iam-controls.md#iam-14) | | CIS v1.2.0 | 1.9 Ensure IAM password policy requires minimum password length of 14 or greater | [[IAM.15] Ensure IAM password policy requires minimum password length of 14 or greater](iam-controls.md#iam-15) | | CIS v1.2.0 | 2.1 Ensure CloudTrail is enabled in all regions | [[CloudTrail.1] CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events](cloudtrail-controls.md#cloudtrail-1) | | CIS v1.2.0 | 2.2 Ensure CloudTrail log file validation is enabled | [[CloudTrail.4] CloudTrail log file validation should be enabled](cloudtrail-controls.md#cloudtrail-4) | | CIS v1.2.0 | 2.3 Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible | [[CloudTrail.6] Ensure the S3 bucket used to store CloudTrail logs is not publicly accessible](cloudtrail-controls.md#cloudtrail-6) | | CIS v1.2.0 | 2.4 Ensure CloudTrail trails are integrated with CloudWatch Logs | [[CloudTrail.5] CloudTrail trails should be integrated with Amazon CloudWatch Logs](cloudtrail-controls.md#cloudtrail-5) | | CIS v1.2.0 | 2.5 Ensure AWS Config is enabled | [[Config.1] AWS Config should be enabled and use the service-linked role for resource recording](config-controls.md#config-1) | | CIS v1.2.0 | 2.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket | [[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket](cloudtrail-controls.md#cloudtrail-7) | | CIS v1.2.0 | 2.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs | [[CloudTrail.2] CloudTrail should have encryption at-rest enabled](cloudtrail-controls.md#cloudtrail-2) | | CIS v1.2.0 | 2.8 Ensure rotation for customer created CMKs is enabled | [[KMS.4] AWS KMS key rotation should be enabled](kms-controls.md#kms-4) | | CIS v1.2.0 | 2.9 Ensure VPC flow logging is enabled in all VPCs | [[EC2.6] VPC flow logging should be enabled in all VPCs](ec2-controls.md#ec2-6) | | CIS v1.2.0 | 3.1 Ensure a log metric filter and alarm exist for unauthorized API calls | [[CloudWatch.2] Ensure a log metric filter and alarm exist for unauthorized API calls](cloudwatch-controls.md#cloudwatch-2) | | CIS v1.2.0 | 3.10 Ensure a log metric filter and alarm exist for security group changes | [[CloudWatch.10] Ensure a log metric filter and alarm exist for security group changes](cloudwatch-controls.md#cloudwatch-10) | | CIS v1.2.0 | 3.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) | [[CloudWatch.11] Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)](cloudwatch-controls.md#cloudwatch-11) | | CIS v1.2.0 | 3.12 Ensure a log metric filter and alarm exist for changes to network gateways | [[CloudWatch.12] Ensure a log metric filter and alarm exist for changes to network gateways](cloudwatch-controls.md#cloudwatch-12) | | CIS v1.2.0 | 3.13 Ensure a log metric filter and alarm exist for route table changes | [[CloudWatch.13] Ensure a log metric filter and alarm exist for route table changes](cloudwatch-controls.md#cloudwatch-13) | | CIS v1.2.0 | 3.14 Ensure a log metric filter and alarm exist for VPC changes | [[CloudWatch.14] Ensure a log metric filter and alarm exist for VPC changes](cloudwatch-controls.md#cloudwatch-14) | | CIS v1.2.0 | 3.2 Ensure a log metric filter and alarm exist for Management Console sign-in without MFA | [[CloudWatch.3] Ensure a log metric filter and alarm exist for Management Console sign-in without MFA](cloudwatch-controls.md#cloudwatch-3) | | CIS v1.2.0 | 3.3 Ensure a log metric filter and alarm exist for usage of root user | [[CloudWatch.1] A log metric filter and alarm should exist for usage of the "root" user](cloudwatch-controls.md#cloudwatch-1) | | CIS v1.2.0 | 3.4 Ensure a log metric filter and alarm exist for IAM policy changes | [[CloudWatch.4] Ensure a log metric filter and alarm exist for IAM policy changes](cloudwatch-controls.md#cloudwatch-4) | | CIS v1.2.0 | 3.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes | [[CloudWatch.5] Ensure a log metric filter and alarm exist for CloudTrail configuration changes](cloudwatch-controls.md#cloudwatch-5) | | CIS v1.2.0 | 3.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures | [[CloudWatch.6] Ensure a log metric filter and alarm exist for AWS Management Console authentication failures](cloudwatch-controls.md#cloudwatch-6) | | CIS v1.2.0 | 3.7 Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs | [[CloudWatch.7] Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer managed keys](cloudwatch-controls.md#cloudwatch-7) | | CIS v1.2.0 | 3.8 Ensure a log metric filter and alarm exist for S3 bucket policy changes | [[CloudWatch.8] Ensure a log metric filter and alarm exist for S3 bucket policy changes](cloudwatch-controls.md#cloudwatch-8) | | CIS v1.2.0 | 3.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes | [[CloudWatch.9] Ensure a log metric filter and alarm exist for AWS Config configuration changes](cloudwatch-controls.md#cloudwatch-9) | | CIS v1.2.0 | 4.1 Ensure no security groups allow ingress from 0.0.0.0/0 to port 22 | [[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22](ec2-controls.md#ec2-13) | | CIS v1.2.0 | 4.2 Ensure no security groups allow ingress from 0.0.0.0/0 to port 3389 | [[EC2.14] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389](ec2-controls.md#ec2-14) | | CIS v1.2.0 | 4.3 Ensure the default security group of every VPC restricts all traffic | [[EC2.2] VPC default security groups should not allow inbound or outbound traffic](ec2-controls.md#ec2-2) | | CIS v1.4.0 | 1.10 Ensure multi-factor authentication (MFA) is enabled for all IAM users that have a console password | [[IAM.5] MFA should be enabled for all IAM users that have a console password](iam-controls.md#iam-5) | | CIS v1.4.0 | 1.14 Ensure access keys are rotated every 90 days or less | [[IAM.3] IAM users' access keys should be rotated every 90 days or less](iam-controls.md#iam-3) | | CIS v1.4.0 | 1.16 Ensure IAM policies that allow full "\$1:\$1" administrative privileges are not attached | [[IAM.1] IAM policies should not allow full "\$1" administrative privileges](iam-controls.md#iam-1) | | CIS v1.4.0 | 1.17 Ensure a support role has been created to manage incidents with Support | [[IAM.18] Ensure a support role has been created to manage incidents with AWS Support](iam-controls.md#iam-18) | | CIS v1.4.0 | 1.4 Ensure no root user account access key exists | [[IAM.4] IAM root user access key should not exist](iam-controls.md#iam-4) | | CIS v1.4.0 | 1.5 Ensure MFA is enabled for the root user account | [[IAM.9] MFA should be enabled for the root user](iam-controls.md#iam-9) | | CIS v1.4.0 | 1.6 Ensure hardware MFA is enabled for the root user account | [[IAM.6] Hardware MFA should be enabled for the root user](iam-controls.md#iam-6) | | CIS v1.4.0 | 1.7 Eliminate use of the root user for administrative and daily tasks | [[CloudWatch.1] A log metric filter and alarm should exist for usage of the "root" user](cloudwatch-controls.md#cloudwatch-1) | | CIS v1.4.0 | 1.8 Ensure IAM password policy requires minimum length of 14 or greater | [[IAM.15] Ensure IAM password policy requires minimum password length of 14 or greater](iam-controls.md#iam-15) | | CIS v1.4.0 | 1.9 Ensure IAM password policy prevents password reuse | [[IAM.16] Ensure IAM password policy prevents password reuse](iam-controls.md#iam-16) | | CIS v1.4.0 | 2.1.2 Ensure S3 Bucket Policy is set to deny HTTP requests | [[S3.5] S3 general purpose buckets should require requests to use SSL](s3-controls.md#s3-5) | | CIS v1.4.0 | 2.1.5.1 S3 Block Public Access setting should be enabled | [[S3.1] S3 general purpose buckets should have block public access settings enabled](s3-controls.md#s3-1) | | CIS v1.4.0 | 2.1.5.2 S3 Block Public Access setting should be enabled at the bucket level | [[S3.8] S3 general purpose buckets should block public access](s3-controls.md#s3-8) | | CIS v1.4.0 | 2.2.1 Ensure EBS volume encryption is enabled | [[EC2.7] EBS default encryption should be enabled](ec2-controls.md#ec2-7) | | CIS v1.4.0 | 2.3.1 Ensure that encryption is enabled for RDS Instances | [[RDS.3] RDS DB instances should have encryption at-rest enabled](rds-controls.md#rds-3) | | CIS v1.4.0 | 3.1 Ensure CloudTrail is enabled in all regions | [[CloudTrail.1] CloudTrail should be enabled and configured with at least one multi-Region trail that includes read and write management events](cloudtrail-controls.md#cloudtrail-1) | | CIS v1.4.0 | 3.2 Ensure CloudTrail log file validation is enabled | [[CloudTrail.4] CloudTrail log file validation should be enabled](cloudtrail-controls.md#cloudtrail-4) | | CIS v1.4.0 | 3.4 Ensure CloudTrail trails are integrated with CloudWatch Logs | [[CloudTrail.5] CloudTrail trails should be integrated with Amazon CloudWatch Logs](cloudtrail-controls.md#cloudtrail-5) | | CIS v1.4.0 | 3.5 Ensure AWS Config is enabled in all regions | [[Config.1] AWS Config should be enabled and use the service-linked role for resource recording](config-controls.md#config-1) | | CIS v1.4.0 | 3.6 Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket | [[CloudTrail.7] Ensure S3 bucket access logging is enabled on the CloudTrail S3 bucket](cloudtrail-controls.md#cloudtrail-7) | | CIS v1.4.0 | 3.7 Ensure CloudTrail logs are encrypted at rest using KMS CMKs | [[CloudTrail.2] CloudTrail should have encryption at-rest enabled](cloudtrail-controls.md#cloudtrail-2) | | CIS v1.4.0 | 3.8 Ensure rotation for customer created CMKs is enabled | [[KMS.4] AWS KMS key rotation should be enabled](kms-controls.md#kms-4) | | CIS v1.4.0 | 3.9 Ensure VPC flow logging is enabled in all VPCs | [[EC2.6] VPC flow logging should be enabled in all VPCs](ec2-controls.md#ec2-6) | | CIS v1.4.0 | 4.4 Ensure a log metric filter and alarm exist for IAM policy changes | [[CloudWatch.4] Ensure a log metric filter and alarm exist for IAM policy changes](cloudwatch-controls.md#cloudwatch-4) | | CIS v1.4.0 | 4.5 Ensure a log metric filter and alarm exist for CloudTrail configuration changes | [[CloudWatch.5] Ensure a log metric filter and alarm exist for CloudTrail configuration changes](cloudwatch-controls.md#cloudwatch-5) | | CIS v1.4.0 | 4.6 Ensure a log metric filter and alarm exist for AWS Management Console authentication failures | [[CloudWatch.6] Ensure a log metric filter and alarm exist for AWS Management Console authentication failures](cloudwatch-controls.md#cloudwatch-6) | | CIS v1.4.0 | 4.7 Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer created CMKs | [[CloudWatch.7] Ensure a log metric filter and alarm exist for disabling or scheduled deletion of customer managed keys](cloudwatch-controls.md#cloudwatch-7) | | CIS v1.4.0 | 4.8 Ensure a log metric filter and alarm exist for S3 bucket policy changes | [[CloudWatch.8] Ensure a log metric filter and alarm exist for S3 bucket policy changes](cloudwatch-controls.md#cloudwatch-8) | | CIS v1.4.0 | 4.9 Ensure a log metric filter and alarm exist for AWS Config configuration changes | [[CloudWatch.9] Ensure a log metric filter and alarm exist for AWS Config configuration changes](cloudwatch-controls.md#cloudwatch-9) | | CIS v1.4.0 | 4.10 Ensure a log metric filter and alarm exist for security group changes | [[CloudWatch.10] Ensure a log metric filter and alarm exist for security group changes](cloudwatch-controls.md#cloudwatch-10) | | CIS v1.4.0 | 4.11 Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL) | [[CloudWatch.11] Ensure a log metric filter and alarm exist for changes to Network Access Control Lists (NACL)](cloudwatch-controls.md#cloudwatch-11) | | CIS v1.4.0 | 4.12 Ensure a log metric filter and alarm exist for changes to network gateways | [[CloudWatch.12] Ensure a log metric filter and alarm exist for changes to network gateways](cloudwatch-controls.md#cloudwatch-12) | | CIS v1.4.0 | 4.13 Ensure a log metric filter and alarm exist for route table changes | [[CloudWatch.13] Ensure a log metric filter and alarm exist for route table changes](cloudwatch-controls.md#cloudwatch-13) | | CIS v1.4.0 | 4.14 Ensure a log metric filter and alarm exist for VPC changes | [[CloudWatch.14] Ensure a log metric filter and alarm exist for VPC changes](cloudwatch-controls.md#cloudwatch-14) | | CIS v1.4.0 | 5.1 Ensure no Network ACLs allow ingress from 0.0.0.0/0 to remote server administration ports | [[EC2.21] Network ACLs should not allow ingress from 0.0.0.0/0 to port 22 or port 3389](ec2-controls.md#ec2-21) | | CIS v1.4.0 | 5.3 Ensure the default security group of every VPC restricts all traffic | [[EC2.2] VPC default security groups should not allow inbound or outbound traffic](ec2-controls.md#ec2-2) | | PCI DSS v3.2.1 | PCI.AutoScaling.1 Auto scaling groups associated with a load balancer should use load balancer health checks | [[AutoScaling.1] Auto Scaling groups associated with a load balancer should use ELB health checks](autoscaling-controls.md#autoscaling-1) | | PCI DSS v3.2.1 | PCI.CloudTrail.1 CloudTrail logs should be encrypted at rest using AWS KMS CMKs | [[CloudTrail.2] CloudTrail should have encryption at-rest enabled](cloudtrail-controls.md#cloudtrail-2) | | PCI DSS v3.2.1 | PCI.CloudTrail.2 CloudTrail should be enabled | [[CloudTrail.3] At least one CloudTrail trail should be enabled](cloudtrail-controls.md#cloudtrail-3) | | PCI DSS v3.2.1 | PCI.CloudTrail.3 CloudTrail log file validation should be enabled | [[CloudTrail.4] CloudTrail log file validation should be enabled](cloudtrail-controls.md#cloudtrail-4) | | PCI DSS v3.2.1 | PCI.CloudTrail.4 CloudTrail trails should be integrated with Amazon CloudWatch Logs | [[CloudTrail.5] CloudTrail trails should be integrated with Amazon CloudWatch Logs](cloudtrail-controls.md#cloudtrail-5) | | PCI DSS v3.2.1 | PCI.CodeBuild.1 CodeBuild GitHub or Bitbucket source repository URLs should use OAuth | [[CodeBuild.1] CodeBuild Bitbucket source repository URLs should not contain sensitive credentials](codebuild-controls.md#codebuild-1) | | PCI DSS v3.2.1 | PCI.CodeBuild.2 CodeBuild project environment variables should not contain clear text credentials | [[CodeBuild.2] CodeBuild project environment variables should not contain clear text credentials](codebuild-controls.md#codebuild-2) | | PCI DSS v3.2.1 | PCI.Config.1 AWS Config should be enabled | [[Config.1] AWS Config should be enabled and use the service-linked role for resource recording](config-controls.md#config-1) | | PCI DSS v3.2.1 | PCI.CW.1 A log metric filter and alarm should exist for usage of the "root" user | [[CloudWatch.1] A log metric filter and alarm should exist for usage of the "root" user](cloudwatch-controls.md#cloudwatch-1) | | PCI DSS v3.2.1 | PCI.DMS.1 Database Migration Service replication instances should not be public | [[DMS.1] Database Migration Service replication instances should not be public](dms-controls.md#dms-1) | | PCI DSS v3.2.1 | PCI.EC2.1 EBS snapshots should not be publicly restorable | [[EC2.1] Amazon EBS snapshots should not be configured to be publicly restorable](ec2-controls.md#ec2-1) | | PCI DSS v3.2.1 | PCI.EC2.2 VPC default security group should prohibit inbound and outbound traffic | [[EC2.2] VPC default security groups should not allow inbound or outbound traffic](ec2-controls.md#ec2-2) | | PCI DSS v3.2.1 | PCI.EC2.4 Unused EC2 EIPs should be removed | [[EC2.12] Unused Amazon EC2 EIPs should be removed](ec2-controls.md#ec2-12) | | PCI DSS v3.2.1 | PCI.EC2.5 Security groups should not allow ingress from 0.0.0.0/0 to port 22 | [[EC2.13] Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 22](ec2-controls.md#ec2-13) | | PCI DSS v3.2.1 | PCI.EC2.6 VPC flow logging should be enabled in all VPCs | [[EC2.6] VPC flow logging should be enabled in all VPCs](ec2-controls.md#ec2-6) | | PCI DSS v3.2.1 | PCI.ELBv2.1 Application Load Balancer should be configured to redirect all HTTP requests to HTTPS | [[ELB.1] Application Load Balancer should be configured to redirect all HTTP requests to HTTPS](elb-controls.md#elb-1) | | PCI DSS v3.2.1 | PCI.ES.1 Elasticsearch domains should be in a VPC | [[ES.2] Elasticsearch domains should not be publicly accessible](es-controls.md#es-2) | | PCI DSS v3.2.1 | PCI.ES.2 Elasticsearch domains should have encryption at-rest enabled | [[ES.1] Elasticsearch domains should have encryption at-rest enabled](es-controls.md#es-1) | | PCI DSS v3.2.1 | PCI.GuardDuty.1 GuardDuty should be enabled | [[GuardDuty.1] GuardDuty should be enabled](guardduty-controls.md#guardduty-1) | | PCI DSS v3.2.1 | PCI.IAM.1 IAM root user access key should not exist | [[IAM.4] IAM root user access key should not exist](iam-controls.md#iam-4) | | PCI DSS v3.2.1 | PCI.IAM.2 IAM users should not have IAM policies attached | [[IAM.2] IAM users should not have IAM policies attached](iam-controls.md#iam-2) | | PCI DSS v3.2.1 | PCI.IAM.3 IAM policies should not allow full "\$1" administrative privileges | [[IAM.1] IAM policies should not allow full "\$1" administrative privileges](iam-controls.md#iam-1) | | PCI DSS v3.2.1 | PCI.IAM.4 Hardware MFA should be enabled for the root user | [[IAM.6] Hardware MFA should be enabled for the root user](iam-controls.md#iam-6) | | PCI DSS v3.2.1 | PCI.IAM.5 Virtual MFA should be enabled for the root user | [[IAM.9] MFA should be enabled for the root user](iam-controls.md#iam-9) | | PCI DSS v3.2.1 | PCI.IAM.6 MFA should be enabled for all IAM users | [[IAM.19] MFA should be enabled for all IAM users](iam-controls.md#iam-19) | | PCI DSS v3.2.1 | PCI.IAM.7 IAM user credentials should be disabled if not used within a pre-defined number days | [[IAM.8] Unused IAM user credentials should be removed](iam-controls.md#iam-8) | | PCI DSS v3.2.1 | PCI.IAM.8 Password policies for IAM users should have strong configurations | [[IAM.10] Password policies for IAM users should have strong configurations](iam-controls.md#iam-10) | | PCI DSS v3.2.1 | PCI.KMS.1 Customer master key (CMK) rotation should be enabled | [[KMS.4] AWS KMS key rotation should be enabled](kms-controls.md#kms-4) | | PCI DSS v3.2.1 | PCI.Lambda.1 Lambda functions should prohibit public access | [[Lambda.1] Lambda function policies should prohibit public access](lambda-controls.md#lambda-1) | | PCI DSS v3.2.1 | PCI.Lambda.2 Lambda functions should be in a VPC | [[Lambda.3] Lambda functions should be in a VPC](lambda-controls.md#lambda-3) | | PCI DSS v3.2.1 | PCI.Opensearch.1 OpenSearch domains should be in a VPC | [[Opensearch.2] OpenSearch domains should not be publicly accessible](opensearch-controls.md#opensearch-2) | | PCI DSS v3.2.1 | PCI.Opensearch.2 EBS snapshots should not be publicly restorable | [[Opensearch.1] OpenSearch domains should have encryption at rest enabled](opensearch-controls.md#opensearch-1) | | PCI DSS v3.2.1 | PCI.RDS.1 RDS snapshot should be private | [[RDS.1] RDS snapshot should be private](rds-controls.md#rds-1) | | PCI DSS v3.2.1 | PCI.RDS.2 RDS DB Instances should prohibit public access | [[RDS.2] RDS DB Instances should prohibit public access, as determined by the PubliclyAccessible configuration](rds-controls.md#rds-2) | | PCI DSS v3.2.1 | PCI.Redshift.1 Amazon Redshift clusters should prohibit public access | [[Redshift.1] Amazon Redshift clusters should prohibit public access](redshift-controls.md#redshift-1) | | PCI DSS v3.2.1 | PCI.S3.1 S3 buckets should prohibit public write access | [[S3.3] S3 general purpose buckets should block public write access](s3-controls.md#s3-3) | | PCI DSS v3.2.1 | PCI.S3.2 S3 buckets should prohibit public read access | [[S3.2] S3 general purpose buckets should block public read access](s3-controls.md#s3-2) | | PCI DSS v3.2.1 | PCI.S3.3 S3 buckets should have cross-region replication enabled | [[S3.7] S3 general purpose buckets should use cross-Region replication](s3-controls.md#s3-7) | | PCI DSS v3.2.1 | PCI.S3.5 S3 buckets should require requests to use Secure Socket Layer | [[S3.5] S3 general purpose buckets should require requests to use SSL](s3-controls.md#s3-5) | | PCI DSS v3.2.1 | PCI.S3.6 S3 Block Public Access setting should be enabled | [[S3.1] S3 general purpose buckets should have block public access settings enabled](s3-controls.md#s3-1) | | PCI DSS v3.2.1 | PCI.SageMaker.1 Amazon SageMaker notebook instances should not have direct internet access | [[SageMaker.1] Amazon SageMaker notebook instances should not have direct internet access](sagemaker-controls.md#sagemaker-1) | | PCI DSS v3.2.1 | PCI.SSM.1 EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation | [[SSM.2] Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation](ssm-controls.md#ssm-2) | | PCI DSS v3.2.1 | PCI.SSM.2 EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT | [[SSM.3] Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT](ssm-controls.md#ssm-3) | | PCI DSS v3.2.1 | PCI.SSM.3 EC2 instances should be managed by AWS Systems Manager | [[SSM.1] Amazon EC2 instances should be managed by AWS Systems Manager](ssm-controls.md#ssm-1) | ## Updating workflows for consolidation If your workflows don’t rely on the specific format of any fields in control findings, no action is required. If your workflows rely on the specific format of one or more fields in control findings, as noted in the preceding tables, you should update your workflows. For example, If you created an Amazon EventBridge rule that triggered an action for a specific control ID, such as invoking an AWS Lambda function if the control ID equals CIS 2.7, update the rule to use CloudTrail.2, which is the value for the `Compliance.SecurityControlId` field for that control. If you created [custom insights](securityhub-custom-insights.md) that use any of the fields or values that changed, update those insights to use the new fields or values. # Required top-level ASFF attributes The following top-level attributes in the AWS Security Finding Format (ASFF) are required for all findings in Security Hub CSPM. For more information about these attributes, see [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsSecurityFinding.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsSecurityFinding.html) in the *AWS Security Hub API Reference*. ## AwsAccountId The AWS account ID that the finding applies to. **Example** ``` "AwsAccountId": "111111111111" ``` ## CreatedAt Indicates when the potential security issue or event captured by a finding was created. **Example** ``` "CreatedAt": "2017-03-22T13:22:13.933Z" ``` ## Description A finding's description. This field can be nonspecific boilerplate text or details that are specific to the instance of the finding. For control findings that Security Hub CSPM generates, this field provides a description of the control. This field doesn't reference a standard if you turn on [consolidated control findings](controls-findings-create-update.md#consolidated-control-findings). **Example** ``` "Description": "This AWS control checks whether AWS Config is enabled in the current account and Region." ``` ## GeneratorId The identifier for the solution-specific component (a discrete unit of logic) that generated a finding. For control findings that Security Hub CSPM generates, this field doesn't reference a standard if you turn on [consolidated control findings](controls-findings-create-update.md#consolidated-control-findings). **Example** ``` "GeneratorId": "security-control/Config.1" ``` ## Id The product-specific identifier for a finding. For control findings that Security Hub CSPM generates, this field provides the Amazon Resource Name (ARN) of the finding. This field doesn't reference a standard if you turn on [consolidated control findings](controls-findings-create-update.md#consolidated-control-findings). **Example** ``` "Id": "arn:aws:securityhub:eu-central-1:123456789012:security-control/iam.9/finding/ab6d6a26-a156-48f0-9403-115983e5a956" ``` ## ProductArn The Amazon Resource Name (ARN) generated by Security Hub CSPM that uniquely identifies a third-party findings product after the product is registered with Security Hub CSPM. The format of this field is `arn:partition:securityhub:region:account-id:product/company-id/product-id`. + For AWS services that are integrated with Security Hub CSPM, the `company-id` must be "`aws`", and the `product-id` must be the AWS public service name. Because AWS products and services aren't associated with an account, the `account-id` section of the ARN is empty. AWS services that are not yet integrated with Security Hub CSPM are considered third-party products. + For public products, the `company-id` and `product-id` must be the ID values specified at the time of registration. + For private products, the `company-id` must be the account ID. The `product-id` must be the reserved word "default" or the ID that was specified at the time of registration. **Example** ``` // Private ARN "ProductArn": "arn:aws:securityhub:us-east-1:111111111111:product/111111111111/default" // Public ARN "ProductArn": "arn:aws:securityhub:us-west-2::product/aws/guardduty" "ProductArn": "arn:aws:securityhub:us-west-2:222222222222:product/generico/secure-pro" ``` ## Resources The `Resources` array of objects provides a set of resource data types that describe the AWS resources that the finding refers to. For details about the fields that a `Resources` object might contain, including which fields are required, see [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Resource.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Resource.html) in the *AWS Security Hub API Reference*. For examples of `Resources` objects for specific AWS services, see [Resources ASFF object](asff-resources.md). **Example** ``` "Resources": [ { "ApplicationArn": "arn:aws:resource-groups:us-west-2:123456789012:group/SampleApp/1234567890abcdef0", "ApplicationName": "SampleApp", "DataClassification": { "DetailedResultsLocation": "Path_to_Folder_Or_File", "Result": { "MimeType": "text/plain", "SizeClassified": 2966026, "AdditionalOccurrences": false, "Status": { "Code": "COMPLETE", "Reason": "Unsupportedfield" }, "SensitiveData": [ { "Category": "PERSONAL_INFORMATION", "Detections": [ { "Count": 34, "Type": "GE_PERSONAL_ID", "Occurrences": { "LineRanges": [ { "Start": 1, "End": 10, "StartColumn": 20 } ], "Pages": [], "Records": [], "Cells": [] } }, { "Count": 59, "Type": "EMAIL_ADDRESS", "Occurrences": { "Pages": [ { "PageNumber": 1, "OffsetRange": { "Start": 1, "End": 100, "StartColumn": 10 }, "LineRange": { "Start": 1, "End": 100, "StartColumn": 10 } } ] } }, { "Count": 2229, "Type": "URL", "Occurrences": { "LineRanges": [ { "Start": 1, "End": 13 } ] } }, { "Count": 13826, "Type": "NameDetection", "Occurrences": { "Records": [ { "RecordIndex": 1, "JsonPath": "$.ssn.value" } ] } }, { "Count": 32, "Type": "AddressDetection" } ], "TotalCount": 32 } ], "CustomDataIdentifiers": { "Detections": [ { "Arn": "1712be25e7c7f53c731fe464f1c869b8", "Name": "1712be25e7c7f53c731fe464f1c869b8", "Count": 2 } ], "TotalCount": 2 } } }, "Type": "AwsEc2Instance", "Id": "arn:aws:ec2:us-west-2:123456789012:instance/i-abcdef01234567890", "Partition": "aws", "Region": "us-west-2", "ResourceRole": "Target", "Tags": { "billingCode": "Lotus-1-2-3", "needsPatching": true }, "Details": { "IamInstanceProfileArn": "arn:aws:iam::123456789012:role/IamInstanceProfileArn", "ImageId": "ami-79fd7eee", "IpV4Addresses": ["1.1.1.1"], "IpV6Addresses": ["2001:db8:1234:1a2b::123"], "KeyName": "testkey", "LaunchedAt": "2018-09-29T01:25:54Z", "MetadataOptions": { "HttpEndpoint": "enabled", "HttpProtocolIpv6": "enabled", "HttpPutResponseHopLimit": 1, "HttpTokens": "optional", "InstanceMetadataTags": "disabled" } }, "NetworkInterfaces": [ { "NetworkInterfaceId": "eni-e5aa89a3" } ], "SubnetId": "PublicSubnet", "Type": "i3.xlarge", "VirtualizationType": "hvm", "VpcId": "TestVPCIpv6" } ] ``` ## SchemaVersion The schema version that a finding is formatted for. The value of this field must be one of the officially published versions identified by AWS. In the current release, the AWS Security Finding Format schema version is `2018-10-08`. **Example** ``` "SchemaVersion": "2018-10-08" ``` ## Severity Defines the importance of a finding. For details about this object, see [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Severity.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Severity.html) in the *AWS Security Hub API Reference*. `Severity` is both a top-level object in a finding and nested under the `FindingProviderFields` object. The value of the top-level `Severity` object for a finding should be updated only by using the [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateFindings.html) API. To provide severity information, finding providers should update the `Severity` object under `FindingProviderFields` when making a [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchImportFindings.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchImportFindings.html) API request.
 If a `BatchImportFindings` request for a new finding only provides `Label` or only provides `Normalized`, Security Hub CSPM automatically populates the value of the other field. 
The `Product` and `Original` fields may also be populated. If the top-level `Finding.Severity` object is present but `Finding.FindingProviderFields` is not present, Security Hub CSPM creates the `FindingProviderFields.Severity` object and copies the entire `Finding.Severity object` into it. This ensures that the original, provider-supplied details are retained within the `FindingProviderFields.Severity` structure, even if the top-level `Severity` object is overwritten. The finding severity does not consider the criticality of the involved assets or the underlying resource. Criticality is defined as the level of importance of the resources that are associated with the finding. For example, a resource that is associated with a mission critical application has higher criticality than one that is associated with nonproduction testing. To capture information about resource criticality, use the `Criticality` field. We recommend using the following guidance when translating findings' native severity scores to the value of `Severity.Label` in the ASFF. + `INFORMATIONAL` – This category may include a finding for a `PASSED`, `WARNING`, or `NOT AVAILABLE` check or a sensitive data identification. + `LOW` – Findings that could result in future compromises. For example, this category may include vulnerabilities, configuration weaknesses, and exposed passwords. + `MEDIUM` – Findings that indicate an active compromise, but no indication that an adversary completed their objectives. For example, this category may include malware activity, hacking activity, and unusual behavior detection. + `HIGH` or `CRITICAL` – Findings that indicate that an adversary completed their objectives, such as active data loss or compromise or a denial of service. **Example** ``` "Severity": { "Label": "CRITICAL", "Normalized": 90, "Original": "CRITICAL" } ``` ## Title A finding's title. This field can contain nonspecific boilerplate text or details that are specific to this instance of the finding. For control findings, this field provides the title of the control. This field doesn't reference a standard if you turn on [consolidated control findings](controls-findings-create-update.md#consolidated-control-findings). **Example** ``` "Title": "AWS Config should be enabled" ``` ## Types One or more finding types in the format of `namespace/category/classifier` that classify a finding. This field doesn't reference a standard if you turn on [consolidated control findings](controls-findings-create-update.md#consolidated-control-findings). `Types` should be updated only by using the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html) API. Finding providers who want to provide a value for `Types` should use the `Types` attribute under [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_FindingProviderFields.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_FindingProviderFields.html). In the following list, the top-level bullets are namespaces, the second-level bullets are categories, and the third-level bullets are classifiers. We recommend that finding providers use defined namespaces to help sort and group findings. The defined categories and classifiers may also be used, but are not required. Only the Software and Configuration Checks namespace has defined classifiers. You may define a partial path for namespace/category/classifier. For example, the following finding types are all valid: + TTPs + TTPs/Defense Evasion + TTPs/Defense Evasion/CloudTrailStopped The tactics, techniques, and procedures (TTPs) categories in the following list align to the [MITRE ATT&CK MatrixTM](https://attack.mitre.org/matrices/enterprise/). The Unusual Behaviors namespace reflects general unusual behavior, such as general statistical anomalies, and are not aligned with a specific TTP. However, you could classify a finding with both Unusual Behaviors and TTPs finding types. **List of namespaces, categories, and classifiers:** + Software and Configuration Checks + Vulnerabilities + CVE + AWS Security Best Practices + Network Reachability + Runtime Behavior Analysis + Industry and Regulatory Standards + AWS Foundational Security Best Practices + CIS Host Hardening Benchmarks + CIS AWS Foundations Benchmark + PCI-DSS + Cloud Security Alliance Controls + ISO 90001 Controls + ISO 27001 Controls + ISO 27017 Controls + ISO 27018 Controls + SOC 1 + SOC 2 + HIPAA Controls (USA) + NIST 800-53 Controls (USA) + NIST CSF Controls (USA) + IRAP Controls (Australia) + K-ISMS Controls (Korea) + MTCS Controls (Singapore) + FISC Controls (Japan) + My Number Act Controls (Japan) + ENS Controls (Spain) + Cyber Essentials Plus Controls (UK) + G-Cloud Controls (UK) + C5 Controls (Germany) + IT-Grundschutz Controls (Germany) + GDPR Controls (Europe) + TISAX Controls (Europe) + Patch Management + TTPs + Initial Access + Execution + Persistence + Privilege Escalation + Defense Evasion + Credential Access + Discovery + Lateral Movement + Collection + Command and Control + Effects + Data Exposure + Data Exfiltration + Data Destruction + Denial of Service + Resource Consumption + Unusual Behaviors + Application + Network Flow + IP address + User + VM + Container + Serverless + Process + Database + Data + Sensitive Data Identifications + PII + Passwords + Legal + Financial + Security + Business **Example** ``` "Types": [ "Software and Configuration Checks/Vulnerabilities/CVE" ] ``` ## UpdatedAt Indicates when the finding provider last updated the finding record. This timestamp reflects the time when the finding record was last or most recently updated. Consequently, it can differ from the `LastObservedAt` timestamp, which reflects when the event or vulnerability was last or most recently observed. When you update the finding record, you must update this timestamp to the current timestamp. Upon creation of a finding record, the `CreatedAt` and `UpdatedAt` timestamps must be the same. After an update to the finding record, the value of this field must be more recent than all of the previous values that it contained. Note that `UpdatedAt` cannot be updated by using the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html) operation. You can update it only by using [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html) operation. **Example** ``` "UpdatedAt": "2017-04-22T13:22:13.933Z" ``` # Optional top-level ASFF attributes The following top-level attributes in the AWS Security Finding Format (ASFF) are optional for findings in Security Hub CSPM. For more information about these attributes, see [AwsSecurityFinding](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsSecurityFinding.html) in the *AWS Security Hub API Reference*. ## Action The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Action.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Action.html) object provides details about an action that affects or was taken on a resource. **Example** ``` "Action": { "ActionType": "PORT_PROBE", "PortProbeAction": { "PortProbeDetails": [ { "LocalPortDetails": { "Port": 80, "PortName": "HTTP" }, "LocalIpDetails": { "IpAddressV4": "192.0.2.0" }, "RemoteIpDetails": { "Country": { "CountryName": "Example Country" }, "City": { "CityName": "Example City" }, "GeoLocation": { "Lon": 0, "Lat": 0 }, "Organization": { "AsnOrg": "ExampleASO", "Org": "ExampleOrg", "Isp": "ExampleISP", "Asn": 64496 } } } ], "Blocked": false } } ``` ## AwsAccountName The AWS account name that the finding applies to. **Example** ``` "AwsAccountName": "jane-doe-testaccount" ``` ## CompanyName The name of the company for the product that generated the finding. For control-based findings, the company is AWS. Security Hub CSPM populates this attribute automatically for each finding. You cannot update it using [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html) or [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html). The exception to this is when you use a custom integration. See [Integrating Security Hub CSPM with custom products](securityhub-custom-providers.md). When you use the Security Hub CSPM console to filter findings by company name, you use this attribute. When you use the Security Hub CSPM API to filter findings by company name, you use the `aws/securityhub/CompanyName` attribute under `ProductFields`. Security Hub CSPM does not synchronize those two attributes. **Example** ``` "CompanyName": "AWS" ``` ## Compliance The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Compliance.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Compliance.html) object typically provides details about a control finding, such as applicable standards and the status of the control check. **Example** ``` "Compliance": { "AssociatedStandards": [ {"StandardsId": "standards/aws-foundational-security-best-practices/v/1.0.0"}, {"StandardsId": "standards/service-managed-aws-control-tower/v/1.0.0"}, {"StandardsId": "standards/nist-800-53/v/5.0.0"} ], "RelatedRequirements": [ "NIST.800-53.r5 AC-4", "NIST.800-53.r5 AC-4(21)", "NIST.800-53.r5 SC-7", "NIST.800-53.r5 SC-7(11)", "NIST.800-53.r5 SC-7(16)", "NIST.800-53.r5 SC-7(21)", "NIST.800-53.r5 SC-7(4)", "NIST.800-53.r5 SC-7(5)" ], "SecurityControlId": "EC2.18", "SecurityControlParameters":[ { "Name": "authorizedTcpPorts", "Value": ["80", "443"] }, { "Name": "authorizedUdpPorts", "Value": ["427"] } ], "Status": "NOT_AVAILABLE", "StatusReasons": [ { "ReasonCode": "CONFIG_RETURNS_NOT_APPLICABLE", "Description": "This finding has a compliance status of NOT AVAILABLE because AWS Config sent Security Hub CSPM a finding with a compliance state of Not Applicable. The potential reasons for a Not Applicable finding from Config are that (1) a resource has been moved out of scope of the Config rule; (2) the Config rule has been deleted; (3) the resource has been deleted; or (4) the logic of the Config rule itself includes scenarios where Not Applicable is returned. The specific reason why Not Applicable is returned is not available in the Config rule evaluation." } ] } ``` ## Confidence The likelihood that a finding accurately identifies the behavior or issue that it was intended to identify. `Confidence` should only be updated using [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html). Finding providers who want to provide a value for `Confidence` should use the `Confidence` attribute under `FindingProviderFields`. See [Updating findings with FindingProviderFields](finding-update-batchimportfindings.md#batchimportfindings-findingproviderfields). `Confidence` is scored on a 0–100 basis using a ratio scale. 0 means 0 percent confidence, and 100 means 100 percent confidence. For example, a data exfiltration detection based on a statistical deviation of network traffic has low confidence because an actual exfiltration hasn't been verified. **Example** ``` "Confidence": 42 ``` ## Criticality The level of importance that is assigned to the resources that are associated with a finding. `Criticality` should only be updated by calling the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html) API operation. Don't update this object with [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html). Finding providers who want to provide a value for `Criticality` should use the `Criticality` attribute under `FindingProviderFields`. See [Updating findings with FindingProviderFields](finding-update-batchimportfindings.md#batchimportfindings-findingproviderfields). `Criticality` is scored on a 0–100 basis, using a ratio scale that supports only full integers. A score of 0 means that the underlying resources have no criticality, and a score of 100 is reserved for the most critical resources. For each resource, consider the following when assigning `Criticality`: + Does the affected resource contain sensitive data (for example, an S3 bucket with PII)? + Does the affected resource enable an adversary to deepen their access or extend their capabilities to carry out additional malicious activity (for example, a compromised sysadmin account)? + Is the resource a business-critical asset (for example, a key business system that if compromised could have significant revenue impact)? You can use the following guidelines: + A resource powering mission-critical systems or containing highly sensitive data can be scored in the 75–100 range. + A resource powering important (but not critical systems) or containing moderately important data can be scored in the 25–74 range. + A resource powering unimportant systems or containing nonsensitive data should be scored in the 0–24 range. **Example** ``` "Criticality": 99 ``` ## Detection The `Detection` object provides details about an attack sequence finding from Amazon GuardDuty Extended Threat Detection. GuardDuty generates an attack sequence finding when multiple events align to a potentially suspicious activity. To receive GuardDuty attack sequence findings in AWS Security Hub CSPM, you must have GuardDuty enabled in your account. For more information, see [Amazon GuardDuty Extended Threat Detection](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty-extended-threat-detection.html) in the *Amazon GuardDuty User Guide*. **Example** ``` "Detection": { "Sequence": { "Uid": "1111111111111-184ec3b9-cf8d-452d-9aad-f5bdb7afb010", "Actors": [{ "Id": "USER:AROA987654321EXAMPLE:i-b188560f:1234567891", "Session": { "Uid": "1234567891", "MfAStatus": "DISABLED", "CreatedTime": "1716916944000", "Issuer": "arn:aws:s3:::amzn-s3-demo-destination-bucket" }, "User": { "CredentialUid": "ASIAIOSFODNN7EXAMPLE", "Name": "ec2_instance_role_production", "Type": "AssumedRole", "Uid": "AROA987654321EXAMPLE:i-b188560f", "Account": { "Uid": "AccountId", "Name": "AccountName" } } }], "Endpoints": [{ "Id": "EndpointId", "Ip": "203.0.113.1", "Domain": "example.com", "Port": 4040, "Location": { "City": "New York", "Country": "US", "Lat": 40.7123, "Lon": -74.0068 }, "AutonomousSystem": { "Name": "AnyCompany", "Number": 64496 }, "Connection": { "Direction": "INBOUND" } }], "Signals": [{ "Id": "arn:aws:guardduty:us-east-1:123456789012:detector/d0bfe135ab8b4dd8c3eaae7df9900073/finding/535a382b1bcc44d6b219517a29058fb7", "Title": "Someone ran a penetration test tool on your account.", "ActorIds": ["USER:AROA987654321EXAMPLE:i-b188560f:1234567891"], "Count": 19, "FirstSeenAt": 1716916943000, "SignalIndicators": [ { "Key": "ATTACK_TACTIC", "Title": "Attack Tactic", "Values": [ "Impact" ] }, { "Key": "HIGH_RISK_API", "Title": "High Risk Api", "Values": [ "s3:DeleteObject" ] }, { "Key": "ATTACK_TECHNIQUE", "Title": "Attack Technique", "Values": [ "Data Destruction" ] }, ], "LastSeenAt": 1716916944000, "Name": "Test:IAMUser/KaliLinux", "ResourceIds": [ "arn:aws:s3:::amzn-s3-demo-destination-bucket" ], "Type": "FINDING" }], "SequenceIndicators": [ { "Key": "ATTACK_TACTIC", "Title": "Attack Tactic", "Values": [ "Discovery", "Exfiltration", "Impact" ] }, { "Key": "HIGH_RISK_API", "Title": "High Risk Api", "Values": [ "s3:DeleteObject", "s3:GetObject", "s3:ListBuckets" "s3:ListObjects" ] }, { "Key": "ATTACK_TECHNIQUE", "Title": "Attack Technique", "Values": [ "Cloud Service Discovery", "Data Destruction" ] } ] } } ``` ## FindingProviderFields `FindingProviderFields` includes the following attributes: + `Confidence` + `Criticality` + `RelatedFindings` + `Severity` + `Types` The preceding fields are nested under the `FindingProviderFields` object, but have analogues of the same name as top-level ASFF fields. When a new finding is sent to Security Hub CSPM by a finding provider, Security Hub CSPM populates the `FindingProviderFields` object automatically if it is empty based on the corresponding top-level fields. Finding providers can update `FindingProviderFields` by using the[https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html) operation of the Security Hub CSPM API. Finding providers cannot update this object with [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html). For details on how Security Hub CSPM handles updates from `BatchImportFindings` to `FindingProviderFields` and to the corresponding top-level attributes, see [Updating findings with FindingProviderFields](finding-update-batchimportfindings.md#batchimportfindings-findingproviderfields). Customers can update the top-level fields by using the `BatchUpdateFindings` operation. Customers can't update `FindingProviderFields`. **Example** ``` "FindingProviderFields": { "Confidence": 42, "Criticality": 99, "RelatedFindings":[ { "ProductArn": "arn:aws:securityhub:us-west-2::product/aws/guardduty", "Id": "123e4567-e89b-12d3-a456-426655440000" } ], "Severity": { "Label": "MEDIUM", "Original": "MEDIUM" }, "Types": [ "Software and Configuration Checks/Vulnerabilities/CVE" ] } ``` ## FirstObservedAt Indicates when the potential security issue or event captured by a finding was first observed. This timestamp specifies when the event or vulnerability was first observed. Consequently, it can differ from the `CreatedAt` timestamp, which reflects when this finding record was created. For control findings that Security Hub CSPM generates and updates, this timestamp can also indicate when the compliance status of a resource most recently changed. For other types of findings, this timestamp should be immutable between updates of the finding record, but can be updated if a more accurate timestamp is determined. **Example** ``` "FirstObservedAt": "2017-03-22T13:22:13.933Z" ``` ## LastObservedAt Indicates when the potential security issue or event captured by a finding was most recently observed by the security findings product. This timestamp specifies when the event or vulnerability was last or most recently observed. Consequently, it can differ from the `UpdatedAt` timestamp, which reflects when this finding record was last or most recently updated. You can provide this timestamp, but it isn't required upon first observation. If you populate this field upon first observation, the timestamp should be the same as the `FirstObservedAt` timestamp. You should update this field to reflect the last or most recently observed timestamp each time a finding is observed. **Example** ``` "LastObservedAt": "2017-03-23T13:22:13.933Z" ``` ## Malware The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Malware.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Malware.html) object provides a list of malware related to a finding. **Example** ``` "Malware": [ { "Name": "Stringler", "Type": "COIN_MINER", "Path": "/usr/sbin/stringler", "State": "OBSERVED" } ] ``` ## Network (Retired) The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Network.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Network.html) object provides network-related information about a finding. This object is retired. To provide this data, you can either map the data to a resource in `Resources`, or use the `Action` object. **Example** ``` "Network": { "Direction": "IN", "OpenPortRange": { "Begin": 443, "End": 443 }, "Protocol": "TCP", "SourceIpV4": "1.2.3.4", "SourceIpV6": "FE80:CD00:0000:0CDE:1257:0000:211E:729C", "SourcePort": "42", "SourceDomain": "example1.com", "SourceMac": "00:0d:83:b1:c0:8e", "DestinationIpV4": "2.3.4.5", "DestinationIpV6": "FE80:CD00:0000:0CDE:1257:0000:211E:729C", "DestinationPort": "80", "DestinationDomain": "example2.com" } ``` ## NetworkPath The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_NetworkPathComponent.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_NetworkPathComponent.html) object provides information about a network path that is related to a finding. Each entry in `NetworkPath` represents a component of the path. **Example** ``` "NetworkPath" : [ { "ComponentId": "abc-01a234bc56d8901ee", "ComponentType": "AWS::EC2::InternetGateway", "Egress": { "Destination": { "Address": [ "192.0.2.0/24" ], "PortRanges": [ { "Begin": 443, "End": 443 } ] }, "Protocol": "TCP", "Source": { "Address": ["203.0.113.0/24"] } }, "Ingress": { "Destination": { "Address": [ "198.51.100.0/24" ], "PortRanges": [ { "Begin": 443, "End": 443 } ] }, "Protocol": "TCP", "Source": { "Address": [ "203.0.113.0/24" ] } } } ] ``` ## Note The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Note.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Note.html) object specifies a user-defined note that you can add to a finding. A finding provider can provide an initial note for a finding, but cannot add notes after that. You can only update a note using [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html). **Example** ``` "Note": { "Text": "Don't forget to check under the mat.", "UpdatedBy": "jsmith", "UpdatedAt": "2018-08-31T00:15:09Z" } ``` ## PatchSummary The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_PatchSummary.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_PatchSummary.html) object provides a summary of the patch compliance status for an instance against a selected compliance standard. **Example** ``` "PatchSummary" : { "FailedCount" : 0, "Id" : "pb-123456789098", "InstalledCount" : 100, "InstalledOtherCount" : 1023, "InstalledPendingReboot" : 0, "InstalledRejectedCount" : 0, "MissingCount" : 100, "Operation" : "Install", "OperationEndTime" : "2018-09-27T23:39:31Z", "OperationStartTime" : "2018-09-27T23:37:31Z", "RebootOption" : "RebootIfNeeded" } ``` ## Process The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ProcessDetails.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ProcessDetails.html) object provides process-related details about a finding. Example: ``` "Process": { "LaunchedAt": "2018-09-27T22:37:31Z", "Name": "syslogd", "ParentPid": 56789, "Path": "/usr/sbin/syslogd", "Pid": 12345, "TerminatedAt": "2018-09-27T23:37:31Z" } ``` ## ProcessedAt Indicates when Security Hub CSPM received a finding and began to process it. This differs from `CreatedAt` and `UpdatedAt`, which are required timestamps that relate to the finding provider's interaction with the security issue and finding. The `ProcessedAt` timestamp indicates when Security Hub CSPM starts to process a finding. A finding appears in a user's account after processing is complete. ``` "ProcessedAt": "2023-03-23T13:22:13.933Z" ``` ## ProductFields A data type where security findings products can include additional solution-specific details that are not part of the defined AWS Security Finding Format. For findings generated by Security Hub CSPM controls, `ProductFields` includes information about the control. See [Generating and updating control findings](controls-findings-create-update.md). This field should not contain redundant data and must not contain data that conflicts with AWS Security Finding Format fields. The "`aws/`" prefix represents a reserved namespace for AWS products and services only and must not be submitted with findings from third-party integrations. Although not required, products should format field names as `company-id/product-id/field-name`, where the `company-id` and `product-id` match those supplied in the `ProductArn` of the finding. The fields referencing `Archival` are used when Security Hub CSPM archives an existing finding. For example, Security Hub CSPM archives existing findings when you disable a control or standard and when you turn [consolidated control findings](controls-findings-create-update.md#consolidated-control-findings) on or off. This field may also include information about the standard that includes the control that produced the finding. **Example** ``` "ProductFields": { "API", "DeleteTrail", "ArchivalReasons:0/Description": "The finding is in an ARCHIVED state because consolidated control findings has been turned on or off. This causes findings in the previous state to be archived when new findings are being generated.", "ArchivalReasons:0/ReasonCode": "CONSOLIDATED_CONTROL_FINDINGS_UPDATE", "aws/inspector/AssessmentTargetName": "My prod env", "aws/inspector/AssessmentTemplateName": "My daily CVE assessment", "aws/inspector/RulesPackageName": "Common Vulnerabilities and Exposures", "generico/secure-pro/Action.Type", "AWS_API_CALL", "generico/secure-pro/Count": "6", "Service_Name": "cloudtrail.amazonaws.com" } ``` ## ProductName Provides the name of the product that generated the finding. For control-based findings, the product name is Security Hub CSPM. Security Hub CSPM populates this attribute automatically for each finding. You cannot update it using [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html) or [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html). The exception to this is when you use a custom integration. See [Integrating Security Hub CSPM with custom products](securityhub-custom-providers.md). When you use the Security Hub CSPM console to filter findings by product name, you use this attribute. When you use the Security Hub CSPM API to filter findings by product name, you use the `aws/securityhub/ProductName` attribute under `ProductFields`. Security Hub CSPM does not synchronize those two attributes. ## RecordState Provides the record state of a finding. By default, when initially generated by a service, findings are considered `ACTIVE`. The `ARCHIVED` state indicates that a finding should be hidden from view. Archived findings are not deleted immediately. You can search, review, and report on them. Security Hub CSPM automatically archives control-based findings if the associated resource is deleted, the resource does not exist, or the control is disabled. `RecordState` is intended for finding providers, and can be updated only by using the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html) operation. You cannot update it by using the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html) operation. To track the status of your investigation into a finding, use [`Workflow`](#asff-workflow) instead of `RecordState`. If the record state changes from `ARCHIVED` to `ACTIVE`, and the workflow status of the finding is `NOTIFIED` or `RESOLVED`, Security Hub CSPM automatically changes the workflow status to `NEW`. **Example** ``` "RecordState": "ACTIVE" ``` ## Region Specifies the AWS Region from which the finding was generated. Security Hub CSPM populates this attribute automatically for each finding. You cannot update it using [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html) or [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html). **Example** ``` "Region": "us-west-2" ``` ## RelatedFindings Provides a list of findings that are related to the current finding. `RelatedFindings` should only be updated with the [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html) API operation. You should not update this object with [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html). For [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchImportFindings.html) requests, finding providers should use the `RelatedFindings` object under [`FindingProviderFields`](#asff-findingproviderfields). To view descriptions of `RelatedFindings` attributes, see [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_RelatedFinding.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_RelatedFinding.html) in the *AWS Security Hub API Reference*. **Example** ``` "RelatedFindings": [ { "ProductArn": "arn:aws:securityhub:us-west-2::product/aws/guardduty", "Id": "123e4567-e89b-12d3-a456-426655440000" }, { "ProductArn": "arn:aws:securityhub:us-west-2::product/aws/guardduty", "Id": "AcmeNerfHerder-111111111111-x189dx7824" } ] ``` ## RiskAssessment **Example** ``` "RiskAssessment": { "Posture": { "FindingTotal": 4, "Indicators": [ { "Type": "Reachability", "Findings": [ { "Id": "arn:aws:inspector2:us-east-2:123456789012:finding/1234567890abcdef0", "ProductArn": "arn:aws:securityhub:us-east-1::product/aws/inspector", "Title": "Finding title" }, { "Id": "arn:aws:inspector2:us-east-2:123456789012:finding/abcdef01234567890", "ProductArn": "arn:aws:securityhub:us-east-1::product/aws/inspector", "Title": "Finding title" } ] }, { "Type": "Vulnerability", "Findings": [ { "Id": "arn:aws:inspector2:us-east-2:123456789012:finding/021345abcdef6789", "ProductArn": "arn:aws:securityhub:us-east-1::product/aws/inspector", "Title": "Finding title" }, { "Id": "arn:aws:inspector2:us-east-2:123456789012:finding/021345ghijkl6789", "ProductArn": "arn:aws:securityhub:us-east-1::product/aws/inspector", "Title": "Finding title" } ] } ] } } ``` ## Remediation The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Remediation.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Remediation.html) object provides information about recommended remediation steps to address the finding. **Example** ``` "Remediation": { "Recommendation": { "Text": "For instructions on how to fix this issue, see the AWS Security Hub CSPM documentation for EC2.2.", "Url": "https://docs.aws.amazon.com/console/securityhub/EC2.2/remediation" } } ``` ## Sample Specifies whether the finding is a sample finding. ``` "Sample": true ``` ## SourceUrl The `SourceUrl` object provides a URL that links to a page about the current finding in the finding product. ``` "SourceUrl": "http://sourceurl.com" ``` ## ThreatIntelIndicators The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ThreatIntelIndicator.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ThreatIntelIndicator.html) object provides threat intelligence details that are related to a finding. **Example** ``` "ThreatIntelIndicators": [ { "Category": "BACKDOOR", "LastObservedAt": "2018-09-27T23:37:31Z", "Source": "Threat Intel Weekly", "SourceUrl": "http://threatintelweekly.org/backdoors/8888", "Type": "IPV4_ADDRESS", "Value": "8.8.8.8", } ] ``` ## Threats The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Threat.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Threat.html) object provides details about the threat detected by a finding. **Example** ``` "Threats": [{ "FilePaths": [{ "FileName": "b.txt", "FilePath": "/tmp/b.txt", "Hash": "sha256", "ResourceId": "arn:aws:ec2:us-west-2:123456789012:volume/vol-032f3bdd89aee112f" }], "ItemCount": 3, "Name": "Iot.linux.mirai.vwisi", "Severity": "HIGH" }] ``` ## UserDefinedFields Provides a list of name-value string pairs that are associated with the finding. These are custom, user-defined fields that are added to a finding. These fields can be generated automatically through your specific configuration. Finding providers should not use this field for data that the product generates. Instead, finding providers can use the `ProductFields` field for data that does not map to any standard AWS Security Finding Format field. These fields can only be updated using [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html). **Example** ``` "UserDefinedFields": { "reviewedByCio": "true", "comeBackToLater": "Check this again on Monday" } ``` ## VerificationState Provides the veracity of a finding. Findings products can provide a value of `UNKNOWN` for this field. A findings product should provide a value for this field if there is a meaningful analog in the findings product's system. This field is typically populated by a user determination or action after investigating a finding. A finding provider can provide an initial value for this attribute, but cannot update it after that. You can only update this attribute by using [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html). ``` "VerificationState": "Confirmed" ``` ## Vulnerabilities The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Vulnerability.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Vulnerability.html) object provides a list of vulnerabilities that are associated with a finding. **Example** ``` "Vulnerabilities" : [ { "CodeVulnerabilities": [{ "Cwes": [ "CWE-798", "CWE-799" ], "FilePath": { "EndLine": 421, "FileName": "package-lock.json", "FilePath": "package-lock.json", "StartLine": 420 }, "SourceArn":"arn:aws:lambda:us-east-1:123456789012:layer:AWS-AppConfig-Extension:114" }], "Cvss": [ { "BaseScore": 4.7, "BaseVector": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "Version": "V3" }, { "BaseScore": 4.7, "BaseVector": "AV:L/AC:M/Au:N/C:C/I:N/A:N", "Version": "V2" } ], "EpssScore": 0.015, "ExploitAvailable": "YES", "FixAvailable": "YES", "Id": "CVE-2020-12345", "LastKnownExploitAt": "2020-01-16T00:01:35Z", "ReferenceUrls":[ "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12418", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17563" ], "RelatedVulnerabilities": ["CVE-2020-12345"], "Vendor": { "Name": "Alas", "Url":"https://alas.aws.amazon.com/ALAS-2020-1337.html", "VendorCreatedAt":"2020-01-16T00:01:43Z", "VendorSeverity":"Medium", "VendorUpdatedAt":"2020-01-16T00:01:43Z" }, "VulnerablePackages": [ { "Architecture": "x86_64", "Epoch": "1", "FilePath": "/tmp", "FixedInVersion": "0.14.0", "Name": "openssl", "PackageManager": "OS", "Release": "16.amzn2.0.3", "Remediation": "Update aws-crt to 0.14.0", "SourceLayerArn": "arn:aws:lambda:us-west-2:123456789012:layer:id", "SourceLayerHash": "sha256:c1962c35b63a6ff6ce7df6e042ee82371a605ca9515569edec46ff14f926f001", "Version": "1.0.2k" } ] } ] ``` ## Workflow The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Workflow.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_Workflow.html) object provides information about the status of the investigation into a finding. This field is intended for customers to use with remediation, orchestration, and ticketing tools. It is not intended for finding providers. You can only update the `Workflow` field with [https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html](https://docs.aws.amazon.com//securityhub/1.0/APIReference/API_BatchUpdateFindings.html). Customers can also update it from the console. See [Setting the workflow status of findings in Security Hub CSPM](findings-workflow-status.md). **Example** ``` "Workflow": { "Status": "NEW" } ``` ## WorkflowState (Retired) This object is retired and has been replaced by the `Status` field of the `Workflow` object. This field provides the workflow state of a finding. Findings products can provide the value of `NEW` for this field. A findings product can provide a value for this field if there is a meaningful analog in the findings product's system. **Example** ``` "WorkflowState": "NEW" ``` # Resources ASFF object In the AWS Security Finding Format (ASFF), the `Resources` object provides information about the resources involved in a finding. It contains an array of up to 32 resource objects. To determine how resource names are formatted, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). For examples of each resource object, select a resource from the following list. **Topics** + [ # Resource attributes in the ASFF ](asff-resources-attributes.md) + [ # AwsAmazonMQ resources in ASFF ](asff-resourcedetails-awsamazonmq.md) + [ # AwsApiGateway resources in ASFF ](asff-resourcedetails-awsapigateway.md) + [ # AwsAppSync resources in ASFF ](asff-resourcedetails-awsappsync.md) + [ # AwsAthena resources in ASFF ](asff-resourcedetails-awsathena.md) + [ # AwsAutoScaling resources in ASFF ](asff-resourcedetails-awsautoscaling.md) + [ # AwsBackup resources in ASFF ](asff-resourcedetails-awsbackup.md) + [ # AwsCertificateManager resources in ASFF ](asff-resourcedetails-awscertificatemanager.md) + [ # AwsCloudFormation resources in ASFF ](asff-resourcedetails-awscloudformation.md) + [ # AwsCloudFront resources in ASFF ](asff-resourcedetails-awscloudfront.md) + [ # AwsCloudTrail resources in ASFF ](asff-resourcedetails-awscloudtrail.md) + [ # AwsCloudWatch resources in ASFF ](asff-resourcedetails-awscloudwatch.md) + [ # AwsCodeBuild resources in ASFF ](asff-resourcedetails-awscodebuild.md) + [ # AwsDms resources in ASFF ](asff-resourcedetails-awsdms.md) + [ # AwsDynamoDB resources in ASFF ](asff-resourcedetails-awsdynamodb.md) + [ # AwsEc2 resources in ASFF ](asff-resourcedetails-awsec2.md) + [ # AwsEcr resources in ASFF ](asff-resourcedetails-awsecr.md) + [ # AwsEcs resources in ASFF ](asff-resourcedetails-awsecs.md) + [ # AwsEfs resources in ASFF ](asff-resourcedetails-awsefs.md) + [ # AwsEks resources in ASFF ](asff-resourcedetails-awseks.md) + [ # AwsElasticBeanstalk resources in ASFF ](asff-resourcedetails-awselasticbeanstalk.md) + [ # AwsElasticSearch resources in ASFF ](asff-resourcedetails-awselasticsearch.md) + [ # AwsElb resources in ASFF ](asff-resourcedetails-awselb.md) + [ # AwsEventBridge resources in ASFF ](asff-resourcedetails-awsevent.md) + [ # AwsGuardDuty resources in ASFF ](asff-resourcedetails-awsguardduty.md) + [ # AwsIam resources in ASFF ](asff-resourcedetails-awsiam.md) + [ # AwsKinesis resources in ASFF ](asff-resourcedetails-awskinesis.md) + [ # AwsKms resources in ASFF ](asff-resourcedetails-awskms.md) + [ # AwsLambda ](asff-resourcedetails-awslambda.md) + [ # AwsMsk resources in ASFF ](asff-resourcedetails-awsmsk.md) + [ # AwsNetworkFirewall resources in ASFF ](asff-resourcedetails-awsnetworkfirewall.md) + [ # AwsOpenSearchService resources in ASFF ](asff-resourcedetails-awsopensearchservice.md) + [ # AwsRds resources in ASFF ](asff-resourcedetails-awsrds.md) + [ # AwsRedshift resources in ASFF ](asff-resourcedetails-awsredshift.md) + [ # AwsRoute53 resources in ASFF ](asff-resourcedetails-awsroute53.md) + [ # AwsS3 resources in ASFF ](asff-resourcedetails-awss3.md) + [ # AwsSageMaker resources in ASFF ](asff-resourcedetails-awssagemaker.md) + [ # AwsSecretsManager resources in ASFF ](asff-resourcedetails-awssecretsmanager.md) + [ # AwsSns resources in ASFF ](asff-resourcedetails-awssns.md) + [ # AwsSqs resources in ASFF ](asff-resourcedetails-awssqs.md) + [ # AwsSsm resources in ASFF ](asff-resourcedetails-awsssm.md) + [ # AwsStepFunctions resources in ASFF ](asff-resourcedetails-awsstepfunctions.md) + [ # AwsWaf resources in ASFF ](asff-resourcedetails-awswaf.md) + [ # AwsXray resources in ASFF ](asff-resourcedetails-awsxray.md) + [ # CodeRepository object in ASFF ](asff-resourcedetails-coderepository.md) + [ # Container object in ASFF ](asff-resourcedetails-container.md) + [ # Other object in ASFF ](asff-resourcedetails-other.md) # Resource attributes in the ASFF Here are descriptions and examples for the `Resources` object in the AWS Security Finding Format (ASFF). For more information about these fields, see [Resources](asff-required-attributes.md#Resources). ## ApplicationArn Identifies the Amazon Resource Name (ARN) of the application involved in the finding. **Example** ``` "ApplicationArn": "arn:aws:resource-groups:us-west-2:123456789012:group/SampleApp/1234567890abcdef0" ``` ## ApplicationName Identifies the name of the application involved in the finding. **Example** ``` "ApplicationName": "SampleApp" ``` ## DataClassification The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DataClassificationDetails.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_DataClassificationDetails.html) field provides information about sensitive data that was detected on the resource. **Example** ``` "DataClassification": { "DetailedResultsLocation": "Path_to_Folder_Or_File", "Result": { "MimeType": "text/plain", "SizeClassified": 2966026, "AdditionalOccurrences": false, "Status": { "Code": "COMPLETE", "Reason": "Unsupportedfield" }, "SensitiveData": [ { "Category": "PERSONAL_INFORMATION", "Detections": [ { "Count": 34, "Type": "GE_PERSONAL_ID", "Occurrences": { "LineRanges": [ { "Start": 1, "End": 10, "StartColumn": 20 } ], "Pages": [], "Records": [], "Cells": [] } }, { "Count": 59, "Type": "EMAIL_ADDRESS", "Occurrences": { "Pages": [ { "PageNumber": 1, "OffsetRange": { "Start": 1, "End": 100, "StartColumn": 10 }, "LineRange": { "Start": 1, "End": 100, "StartColumn": 10 } } ] } }, { "Count": 2229, "Type": "URL", "Occurrences": { "LineRanges": [ { "Start": 1, "End": 13 } ] } }, { "Count": 13826, "Type": "NameDetection", "Occurrences": { "Records": [ { "RecordIndex": 1, "JsonPath": "$.ssn.value" } ] } }, { "Count": 32, "Type": "AddressDetection" } ], "TotalCount": 32 } ], "CustomDataIdentifiers": { "Detections": [ { "Arn": "1712be25e7c7f53c731fe464f1c869b8", "Name": "1712be25e7c7f53c731fe464f1c869b8", "Count": 2, } ], "TotalCount": 2 } } } ``` ## Details The [https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ResourceDetails.html](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ResourceDetails.html) field provides additional information about a single resource using the appropriate objects. Each resource must be provided in a separate resource object in the `Resources` object. Note that if the finding size exceeds the maximum of 240 KB, then the `Details` object is removed from the finding. For control findings that use AWS Config rules, you can view the resource details on the AWS Config console. Security Hub CSPM provides a set of available resource details for its supported resource types. These details correspond to values of the `Type` object. Use the provided types whenever possible. For example, if the resource is an S3 bucket, then set the resource `Type` to `AwsS3Bucket` and provide the resource details in the [`AwsS3Bucket`](asff-resourcedetails-awss3.md#asff-resourcedetails-awss3bucket) object. The [`Other`](asff-resourcedetails-other.md) object allows you to provide custom fields and values. You use the `Other` object in the following cases: + The resource type (the value of the resource `Type`) does not have a corresponding details object. To provide details for the resource, you use the [`Other`](asff-resourcedetails-other.md) object. + The object for the resource type does not include all of the fields that you want to populate. In this case, use the details object for the resource type to populate the available fields. Use the `Other` object to populate the fields that are not in the type-specific object. + The resource type is not one of the provided types. In this case, set `Resource.Type` to `Other`, and use the `Other` object to populate the details. **Example** ``` "Details": { "AwsEc2Instance": { "IamInstanceProfileArn": "arn:aws:iam::123456789012:role/IamInstanceProfileArn", "ImageId": "ami-79fd7eee", "IpV4Addresses": ["1.1.1.1"], "IpV6Addresses": ["2001:db8:1234:1a2b::123"], "KeyName": "testkey", "LaunchedAt": "2018-09-29T01:25:54Z", "MetadataOptions": { "HttpEndpoint": "enabled", "HttpProtocolIpv6": "enabled", "HttpPutResponseHopLimit": 1, "HttpTokens": "optional", "InstanceMetadataTags": "disabled" }, "NetworkInterfaces": [ { "NetworkInterfaceId": "eni-e5aa89a3" } ], "SubnetId": "PublicSubnet", "Type": "i3.xlarge", "VirtualizationType": "hvm", "VpcId": "TestVPCIpv6" }, "AwsS3Bucket": { "OwnerId": "da4d66eac431652a4d44d490a00500bded52c97d235b7b4752f9f688566fe6de", "OwnerName": "acmes3bucketowner" }, "Other": { "LightPen": "blinky", "SerialNo": "1234abcd"} } ``` ## Id The identifier for the given resource type. For AWS resources that are identified by Amazon Resource Names (ARNs), this is the ARN. For AWS resources that lack ARNs, this is the identifier as defined by the AWS service that created the resource. For non-AWS resources, this is a unique identifier that is associated with the resource. **Example** ``` "Id": "arn:aws:s3:::amzn-s3-demo-bucket" ``` ## Partition The partition in which the resource is located. A partition is a group of AWS Regions. Each AWS account is scoped to one partition. The following partitions are supported: + `aws` – AWS Regions + `aws-cn` – China Regions + `aws-us-gov` – AWS GovCloud (US) Region **Example** ``` "Partition": "aws" ``` ## Region The code for the AWS Region where this resource is located. For a list of Region codes, see [Regional endpoints](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). **Example** ``` "Region": "us-west-2" ``` ## ResourceRole Identifies the role of the resource in the finding. A resource is either the target of the finding activity or the actor that performed the activity. **Example** ``` "ResourceRole": "target" ``` ## Tags This field provides tag key and value information for the resource involved in a finding. You can tag [resources that are supported](https://docs.aws.amazon.com/resourcegroupstagging/latest/APIReference/supported-services.html) by the `GetResources` operation of the AWS Resource Groups Tagging API. Security Hub CSPM calls this operation though the [service-linked role](using-service-linked-roles.md) and retrieves the resource tags if the AWS Security Finding Format (ASFF) `Resource.Id` field is populated with the AWS resource ARN. Invalid resource IDs are ignored. You can add resource tags to findings that Security Hub CSPM ingests, including findings from integrated AWS services and third-party products. Adding tags tells you the tags that were associated with a resource at the time the finding was processed. You can include the `Tags` attribute only for resources that have an associated tag. If a resource has no associated tag, don't include a `Tags` attribute in the finding. The inclusion of resource tags in findings eliminates the need to build data enrichment pipelines or manually enrich the metadata of security findings. You can also use tags to search or filter findings and insights and create [automation rules](automation-rules.md). For information about restrictions that apply to tags, see [ Tag naming limits and requirements](https://docs.aws.amazon.com/tag-editor/latest/userguide/tagging.html#tag-conventions). You can only provide tags that exist on an AWS resource in this field. To provide data that isn't defined in the AWS Security Finding Format, use the `Other` details subfield. **Example** ``` "Tags": { "billingCode": "Lotus-1-2-3", "needsPatching": "true" } ``` ## Type The type of resource that you are providing details for. Whenever possible, use one of the provided resource types, such as `AwsEc2Instance` or `AwsS3Bucket`. If the resource type does not match any of the provided resource types, then set the resource `Type` to `Other`, and use the `Other` details subfield to populate the details. Supported values are listed under [Resources](asff-resources.md). **Example** ``` "Type": "AwsS3Bucket" ``` # AwsAmazonMQ resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsAmazonMQ` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsAmazonMQBroker `AwsAmazonMQBroker` provides information about an Amazon MQ broker, which is a message broker environment running on Amazon MQ. The following example shows the ASFF for the `AwsAmazonMQBroker` object. To view descriptions of `AwsAmazonMQBroker` attributes, see [AwsAmazonMQBroker](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsAmazonMQBrokerDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsAmazonMQBroker": { "AutoMinorVersionUpgrade": true, "BrokerArn": "arn:aws:mq:us-east-1:123456789012:broker:TestBroker:b-a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", "BrokerId": "b-a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", "BrokerName": "TestBroker", "Configuration": { "Id": "c-a1b2c3d4-5678-90ab-cdef-EXAMPLE22222", "Revision": 1 }, "DeploymentMode": "ACTIVE_STANDBY_MULTI_AZ", "EncryptionOptions": { "UseAwsOwnedKey": true }, "EngineType": "ActiveMQ", "EngineVersion": "5.17.2", "HostInstanceType": "mq.t2.micro", "Logs": { "Audit": false, "AuditLogGroup": "/aws/amazonmq/broker/b-a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/audit", "General": false, "GeneralLogGroup": "/aws/amazonmq/broker/b-a1b2c3d4-5678-90ab-cdef-EXAMPLE11111/general" }, "MaintenanceWindowStartTime": { "DayOfWeek": "MONDAY", "TimeOfDay": "22:00", "TimeZone": "UTC" }, "PubliclyAccessible": true, "SecurityGroups": [ "sg-021345abcdef6789" ], "StorageType": "efs", "SubnetIds": [ "subnet-1234567890abcdef0", "subnet-abcdef01234567890" ], "Users": [ { "Username": "admin" } ] } ``` # AwsApiGateway resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsApiGateway` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsApiGatewayRestApi The `AwsApiGatewayRestApi` object contains information about a REST API in version 1 of Amazon API Gateway. The following is an example `AwsApiGatewayRestApi` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsApiGatewayRestApi` attributes, see [AwsApiGatewayRestApiDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsApiGatewayRestApiDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` AwsApiGatewayRestApi: { "Id": "exampleapi", "Name": "Security Hub", "Description": "AWS Security Hub", "CreatedDate": "2018-11-18T10:20:05-08:00", "Version": "2018-10-26", "BinaryMediaTypes" : ["-'*~1*'"], "MinimumCompressionSize": 1024, "ApiKeySource": "AWS_ACCOUNT_ID", "EndpointConfiguration": { "Types": [ "REGIONAL" ] } } ``` ## AwsApiGatewayStage The `AwsApiGatewayStage` object provides information about a version 1 Amazon API Gateway stage. The following is an example `AwsApiGatewayStage` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsApiGatewayStage` attributes, see [AwsApiGatewayStageDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsApiGatewayStageDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsApiGatewayStage": { "DeploymentId": "n7hlmf", "ClientCertificateId": "a1b2c3", "StageName": "Prod", "Description" : "Stage Description", "CacheClusterEnabled": false, "CacheClusterSize" : "1.6", "CacheClusterStatus": "NOT_AVAILABLE", "MethodSettings": [ { "MetricsEnabled": true, "LoggingLevel": "INFO", "DataTraceEnabled": false, "ThrottlingBurstLimit": 100, "ThrottlingRateLimit": 5.0, "CachingEnabled": false, "CacheTtlInSeconds": 300, "CacheDataEncrypted": false, "RequireAuthorizationForCacheControl": true, "UnauthorizedCacheControlHeaderStrategy": "SUCCEED_WITH_RESPONSE_HEADER", "HttpMethod": "POST", "ResourcePath": "/echo" } ], "Variables": {"test": "value"}, "DocumentationVersion": "2.0", "AccessLogSettings": { "Format": "{\"requestId\": \"$context.requestId\", \"extendedRequestId\": \"$context.extendedRequestId\", \"ownerAccountId\": \"$context.accountId\", \"requestAccountId\": \"$context.identity.accountId\", \"callerPrincipal\": \"$context.identity.caller\", \"httpMethod\": \"$context.httpMethod\", \"resourcePath\": \"$context.resourcePath\", \"status\": \"$context.status\", \"requestTime\": \"$context.requestTime\", \"responseLatencyMs\": \"$context.responseLatency\", \"errorMessage\": \"$context.error.message\", \"errorResponseType\": \"$context.error.responseType\", \"apiId\": \"$context.apiId\", \"awsEndpointRequestId\": \"$context.awsEndpointRequestId\", \"domainName\": \"$context.domainName\", \"stage\": \"$context.stage\", \"xrayTraceId\": \"$context.xrayTraceId\", \"sourceIp\": \"$context.identity.sourceIp\", \"user\": \"$context.identity.user\", \"userAgent\": \"$context.identity.userAgent\", \"userArn\": \"$context.identity.userArn\", \"integrationLatency\": \"$context.integrationLatency\", \"integrationStatus\": \"$context.integrationStatus\", \"authorizerIntegrationLatency\": \"$context.authorizer.integrationLatency\" }", "DestinationArn": "arn:aws:logs:us-west-2:111122223333:log-group:SecurityHubAPIAccessLog/Prod" }, "CanarySettings": { "PercentTraffic": 0.0, "DeploymentId": "ul73s8", "StageVariableOverrides" : [ "String" : "String" ], "UseStageCache": false }, "TracingEnabled": false, "CreatedDate": "2018-07-11T10:55:18-07:00", "LastUpdatedDate": "2020-08-26T11:51:04-07:00", "WebAclArn" : "arn:aws:waf-regional:us-west-2:111122223333:webacl/cb606bd8-5b0b-4f0b-830a-dd304e48a822" } ``` ## AwsApiGatewayV2Api The `AwsApiGatewayV2Api` object contains information about a version 2 API in Amazon API Gateway. The following is an example `AwsApiGatewayV2Api` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsApiGatewayV2Api` attributes, see [AwsApiGatewayV2ApiDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsApiGatewayV2ApiDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsApiGatewayV2Api": { "ApiEndpoint": "https://example.us-west-2.amazonaws.com", "ApiId": "a1b2c3d4", "ApiKeySelectionExpression": "$request.header.x-api-key", "CreatedDate": "2020-03-28T00:32:37Z", "Description": "ApiGatewayV2 Api", "Version": "string", "Name": "my-api", "ProtocolType": "HTTP", "RouteSelectionExpression": "$request.method $request.path", "CorsConfiguration": { "AllowOrigins": [ "*" ], "AllowCredentials": true, "ExposeHeaders": [ "string" ], "MaxAge": 3000, "AllowMethods": [ "GET", "PUT", "POST", "DELETE", "HEAD" ], "AllowHeaders": [ "*" ] } } ``` ## AwsApiGatewayV2Stage `AwsApiGatewayV2Stage` contains information about a version 2 stage for Amazon API Gateway. The following is an example `AwsApiGatewayV2Stage` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsApiGatewayV2Stage` attributes, see [AwsApiGatewayV2StageDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsApiGatewayV2StageDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsApiGatewayV2Stage": { "CreatedDate": "2020-04-08T00:36:05Z", "Description" : "ApiGatewayV2", "DefaultRouteSettings": { "DetailedMetricsEnabled": false, "LoggingLevel": "INFO", "DataTraceEnabled": true, "ThrottlingBurstLimit": 100, "ThrottlingRateLimit": 50 }, "DeploymentId": "x1zwyv", "LastUpdatedDate": "2020-04-08T00:36:13Z", "RouteSettings": { "DetailedMetricsEnabled": false, "LoggingLevel": "INFO", "DataTraceEnabled": true, "ThrottlingBurstLimit": 100, "ThrottlingRateLimit": 50 }, "StageName": "prod", "StageVariables": [ "function": "my-prod-function" ], "AccessLogSettings": { "Format": "{\"requestId\": \"$context.requestId\", \"extendedRequestId\": \"$context.extendedRequestId\", \"ownerAccountId\": \"$context.accountId\", \"requestAccountId\": \"$context.identity.accountId\", \"callerPrincipal\": \"$context.identity.caller\", \"httpMethod\": \"$context.httpMethod\", \"resourcePath\": \"$context.resourcePath\", \"status\": \"$context.status\", \"requestTime\": \"$context.requestTime\", \"responseLatencyMs\": \"$context.responseLatency\", \"errorMessage\": \"$context.error.message\", \"errorResponseType\": \"$context.error.responseType\", \"apiId\": \"$context.apiId\", \"awsEndpointRequestId\": \"$context.awsEndpointRequestId\", \"domainName\": \"$context.domainName\", \"stage\": \"$context.stage\", \"xrayTraceId\": \"$context.xrayTraceId\", \"sourceIp\": \"$context.identity.sourceIp\", \"user\": \"$context.identity.user\", \"userAgent\": \"$context.identity.userAgent\", \"userArn\": \"$context.identity.userArn\", \"integrationLatency\": \"$context.integrationLatency\", \"integrationStatus\": \"$context.integrationStatus\", \"authorizerIntegrationLatency\": \"$context.authorizer.integrationLatency\" }", "DestinationArn": "arn:aws:logs:us-west-2:111122223333:log-group:SecurityHubAPIAccessLog/Prod" }, "AutoDeploy": false, "LastDeploymentStatusMessage": "Message", "ApiGatewayManaged": true, } ``` # AwsAppSync resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsAppSync` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsAppSyncGraphQLApi `AwsAppSyncGraphQLApi` provides information about an AWS AppSync GraphQL API, which is a top-level construct for your application. The following example shows the ASFF for the `AwsAppSyncGraphQLApi` object. To view descriptions of `AwsAppSyncGraphQLApi` attributes, see [AwsAppSyncGraphQLApi](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsAppSyncGraphQLApiDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsAppSyncGraphQLApi": { "AdditionalAuthenticationProviders": [ { "AuthenticationType": "AWS_LAMBDA", "LambdaAuthorizerConfig": { "AuthorizerResultTtlInSeconds": 300, "AuthorizerUri": "arn:aws:lambda:us-east-1:123456789012:function:mylambdafunc" } }, { "AuthenticationType": "AWS_IAM" } ], "ApiId": "021345abcdef6789", "Arn": "arn:aws:appsync:eu-central-1:123456789012:apis/021345abcdef6789", "AuthenticationType": "API_KEY", "Id": "021345abcdef6789", "LogConfig": { "CloudWatchLogsRoleArn": "arn:aws:iam::123456789012:role/service-role/appsync-graphqlapi-logs-eu-central-1", "ExcludeVerboseContent": true, "FieldLogLevel": "ALL" }, "Name": "My AppSync App", "XrayEnabled": true, } ``` # AwsAthena resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsAthena` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsAthenaWorkGroup `AwsAthenaWorkGroup` provides information about an Amazon Athena workgroup. A workgroup helps you separate users, teams, applications, or workloads. It also helps you set limits on data processing and track costs. The following example shows the ASFF for the `AwsAthenaWorkGroup` object. To view descriptions of `AwsAthenaWorkGroup` attributes, see [AwsAthenaWorkGroup](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsAthenaWorkGroupDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsAthenaWorkGroup": { "Description": "My workgroup for prod workloads", "Name": "MyWorkgroup", "WorkgroupConfiguration" { "ResultConfiguration": { "EncryptionConfiguration": { "EncryptionOption": "SSE_KMS", "KmsKey": "arn:aws:kms:us-east-1:123456789012:key/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111" } } }, "State": "ENABLED" } ``` # AwsAutoScaling resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsAutoScaling` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsAutoScalingAutoScalingGroup The `AwsAutoScalingAutoScalingGroup` object provides details about an automatic scaling group. The following is an example `AwsAutoScalingAutoScalingGroup` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsAutoScalingAutoScalingGroup` attributes, see [AwsAutoScalingAutoScalingGroupDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsAutoScalingAutoScalingGroupDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsAutoScalingAutoScalingGroup": { "CreatedTime": "2017-10-17T14:47:11Z", "HealthCheckGracePeriod": 300, "HealthCheckType": "EC2", "LaunchConfigurationName": "mylaunchconf", "LoadBalancerNames": [], "LaunchTemplate": { "LaunchTemplateId": "string", "LaunchTemplateName": "string", "Version": "string" }, "MixedInstancesPolicy": { "InstancesDistribution": { "OnDemandAllocationStrategy": "prioritized", "OnDemandBaseCapacity": number, "OnDemandPercentageAboveBaseCapacity": number, "SpotAllocationStrategy": "lowest-price", "SpotInstancePools": number, "SpotMaxPrice": "string" }, "LaunchTemplate": { "LaunchTemplateSpecification": { "LaunchTemplateId": "string", "LaunchTemplateName": "string", "Version": "string" }, "CapacityRebalance": true, "Overrides": [ { "InstanceType": "string", "WeightedCapacity": "string" } ] } } } } ``` ## AwsAutoScalingLaunchConfiguration The `AwsAutoScalingLaunchConfiguration` object provides details about a launch configuration. The following is an example `AwsAutoScalingLaunchConfiguration` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsAutoScalingLaunchConfiguration` attributes, see [AwsAutoScalingLaunchConfigurationDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsAutoScalingLaunchConfigurationDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` AwsAutoScalingLaunchConfiguration: { "LaunchConfigurationName": "newtest", "ImageId": "ami-058a3739b02263842", "KeyName": "55hundredinstance", "SecurityGroups": [ "sg-01fce87ad6e019725" ], "ClassicLinkVpcSecurityGroups": [], "UserData": "...Base64-Encoded user data..." "InstanceType": "a1.metal", "KernelId": "", "RamdiskId": "ari-a51cf9cc", "BlockDeviceMappings": [ { "DeviceName": "/dev/sdh", "Ebs": { "VolumeSize": 30, "VolumeType": "gp2", "DeleteOnTermination": false, "Encrypted": true, "SnapshotId": "snap-ffaa1e69", "VirtualName": "ephemeral1" } }, { "DeviceName": "/dev/sdb", "NoDevice": true }, { "DeviceName": "/dev/sda1", "Ebs": { "SnapshotId": "snap-02420cd3d2dea1bc0", "VolumeSize": 8, "VolumeType": "gp2", "DeleteOnTermination": true, "Encrypted": false } }, { "DeviceName": "/dev/sdi", "Ebs": { "VolumeSize": 20, "VolumeType": "gp2", "DeleteOnTermination": false, "Encrypted": true } }, { "DeviceName": "/dev/sdc", "NoDevice": true } ], "InstanceMonitoring": { "Enabled": false }, "CreatedTime": 1620842933453, "EbsOptimized": false, "AssociatePublicIpAddress": true, "SpotPrice": "0.045" } ``` # AwsBackup resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsBackup` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsBackupBackupPlan The `AwsBackupBackupPlan` object provides information about an AWS Backup backup plan. An AWS Backup backup plan is a policy expression that defines when and how you want to back up your AWS resources. The following example shows the AWS Security Finding Format (ASFF) for the `AwsBackupBackupPlan` object. To view descriptions of `AwsBackupBackupPlan` attributes, see [AwsBackupBackupPlan](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsBackupBackupPlanDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsBackupBackupPlan": { "BackupPlan": { "AdvancedBackupSettings": [{ "BackupOptions": { "WindowsVSS":"enabled" }, "ResourceType":"EC2" }], "BackupPlanName": "test", "BackupPlanRule": [{ "CompletionWindowMinutes": 10080, "CopyActions": [{ "DestinationBackupVaultArn": "arn:aws:backup:us-east-1:858726136373:backup-vault:aws/efs/automatic-backup-vault", "Lifecycle": { "DeleteAfterDays": 365, "MoveToColdStorageAfterDays": 30 } }], "Lifecycle": { "DeleteAfterDays": 35 }, "RuleName": "DailyBackups", "ScheduleExpression": "cron(0 5 ? * * *)", "StartWindowMinutes": 480, "TargetBackupVault": "Default" }, { "CompletionWindowMinutes": 10080, "CopyActions": [{ "DestinationBackupVaultArn": "arn:aws:backup:us-east-1:858726136373:backup-vault:aws/efs/automatic-backup-vault", "Lifecycle": { "DeleteAfterDays": 365, "MoveToColdStorageAfterDays": 30 } }], "Lifecycle": { "DeleteAfterDays": 35 }, "RuleName": "Monthly", "ScheduleExpression": "cron(0 5 1 * ? *)", "StartWindowMinutes": 480, "TargetBackupVault": "Default" }] }, "BackupPlanArn": "arn:aws:backup:us-east-1:858726136373:backup-plan:b6d6b896-590d-4ee1-bf29-c5ccae63f4e7", "BackupPlanId": "b6d6b896-590d-4ee1-bf29-c5ccae63f4e7", "VersionId": "ZDVjNDIzMjItYTZiNS00NzczLTg4YzctNmExMWM2NjZhY2E1" } ``` ## AwsBackupBackupVault The `AwsBackupBackupVault` object provides information about an AWS Backup backup vault. A AWS Backup backup vault is a container that stores and organizes your backups. The following example shows the AWS Security Finding Format (ASFF) for the `AwsBackupBackupVault` object. To view descriptions of `AwsBackupBackupVault` attributes, see [AwsBackupBackupVault](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsBackupBackupVaultDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsBackupBackupVault": { "AccessPolicy": { "Statement": [{ "Action": [ "backup:DeleteBackupVault", "backup:DeleteBackupVaultAccessPolicy", "backup:DeleteRecoveryPoint", "backup:StartCopyJob", "backup:StartRestoreJob", "backup:UpdateRecoveryPointLifecycle" ], "Effect": "Deny", "Principal": { "AWS": "*" }, "Resource": "*" }], "Version": "2012-10-17" }, "BackupVaultArn": "arn:aws:backup:us-east-1:123456789012:backup-vault:aws/efs/automatic-backup-vault", "BackupVaultName": "aws/efs/automatic-backup-vault", "EncrytionKeyArn": "arn:aws:kms:us-east-1:444455556666:key/72ba68d4-5e43-40b0-ba38-838bf8d06ca0", "Notifications": { "BackupVaultEvents": ["BACKUP_JOB_STARTED", "BACKUP_JOB_COMPLETED", "COPY_JOB_STARTED"], "SNSTopicArn": "arn:aws:sns:us-west-2:111122223333:MyVaultTopic" } } ``` ## AwsBackupRecoveryPoint The `AwsBackupRecoveryPoint` object provides information about an AWS Backup backup, also referred to as a recovery point. An AWS Backup recovery point represents the content of a resource at a specified time. The following example shows the AWS Security Finding Format (ASFF) for the `AwsBackupRecoveryPoint` object. To view descriptions of `AwsBackupBackupVault` attributes, see [AwsBackupRecoveryPoint](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsBackupRecoveryPointDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsBackupRecoveryPoint": { "BackupSizeInBytes": 0, "BackupVaultName": "aws/efs/automatic-backup-vault", "BackupVaultArn": "arn:aws:backup:us-east-1:111122223333:backup-vault:aws/efs/automatic-backup-vault", "CalculatedLifecycle": { "DeleteAt": "2021-08-30T06:51:58.271Z", "MoveToColdStorageAt": "2020-08-10T06:51:58.271Z" }, "CompletionDate": "2021-07-26T07:21:40.361Z", "CreatedBy": { "BackupPlanArn": "arn:aws:backup:us-east-1:111122223333:backup-plan:aws/efs/73d922fb-9312-3a70-99c3-e69367f9fdad", "BackupPlanId": "aws/efs/73d922fb-9312-3a70-99c3-e69367f9fdad", "BackupPlanVersion": "ZGM4YzY5YjktMWYxNC00ZTBmLWE5MjYtZmU5OWNiZmM5ZjIz", "BackupRuleId": "2a600c2-42ad-4196-808e-084923ebfd25" }, "CreationDate": "2021-07-26T06:51:58.271Z", "EncryptionKeyArn": "arn:aws:kms:us-east-1:111122223333:key/72ba68d4-5e43-40b0-ba38-838bf8d06ca0", "IamRoleArn": "arn:aws:iam::111122223333:role/aws-service-role/backup.amazonaws.com/AWSServiceRoleForBackup", "IsEncrypted": true, "LastRestoreTime": "2021-07-26T06:51:58.271Z", "Lifecycle": { "DeleteAfterDays": 35, "MoveToColdStorageAfterDays": 15 }, "RecoveryPointArn": "arn:aws:backup:us-east-1:111122223333:recovery-point:151a59e4-f1d5-4587-a7fd-0774c6e91268", "ResourceArn": "arn:aws:elasticfilesystem:us-east-1:858726136373:file-system/fs-15bd31a1", "ResourceType": "EFS", "SourceBackupVaultArn": "arn:aws:backup:us-east-1:111122223333:backup-vault:aws/efs/automatic-backup-vault", "Status": "COMPLETED", "StatusMessage": "Failure message", "StorageClass": "WARM" } ``` # AwsCertificateManager resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsCertificateManager` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsCertificateManagerCertificate The `AwsCertificateManagerCertificate` object provides details about an AWS Certificate Manager (ACM) certificate. The following is an example `AwsCertificateManagerCertificate` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsCertificateManagerCertificate` attributes, see [AwsCertificateManagerCertificateDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsCertificateManagerCertificateDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsCertificateManagerCertificate": { "CertificateAuthorityArn": "arn:aws:acm:us-west-2:444455556666:certificate-authority/example", "CreatedAt": "2019-05-24T18:12:02.000Z", "DomainName": "example.amazondomains.com", "DomainValidationOptions": [ { "DomainName": "example.amazondomains.com", "ResourceRecord": { "Name": "_1bacb61828d3a1020c40a560ceed08f7.example.amazondomains.com", "Type": "CNAME", "Value": "_example.acm-validations.aws." }, "ValidationDomain": "example.amazondomains.com", "ValidationEmails": [sample_email@sample.com], "ValidationMethod": "DNS", "ValidationStatus": "SUCCESS" } ], "ExtendedKeyUsages": [ { "Name": "TLS_WEB_SERVER_AUTHENTICATION", "OId": "1.3.6.1.5.5.7.3.1" }, { "Name": "TLS_WEB_CLIENT_AUTHENTICATION", "OId": "1.3.6.1.5.5.7.3.2" } ], "FailureReason": "", "ImportedAt": "2018-08-17T00:13:00.000Z", "InUseBy": ["arn:aws:amazondomains:us-west-2:444455556666:loadbalancer/example"], "IssuedAt": "2020-04-26T00:41:17.000Z", "Issuer": "Amazon", "KeyAlgorithm": "RSA-1024", "KeyUsages": [ { "Name": "DIGITAL_SIGNATURE", }, { "Name": "KEY_ENCIPHERMENT", } ], "NotAfter": "2021-05-26T12:00:00.000Z", "NotBefore": "2020-04-26T00:00:00.000Z", "Options": { "CertificateTransparencyLoggingPreference": "ENABLED", } "RenewalEligibility": "ELIGIBLE", "RenewalSummary": { "DomainValidationOptions": [ { "DomainName": "example.amazondomains.com", "ResourceRecord": { "Name": "_1bacb61828d3a1020c40a560ceed08f7.example.amazondomains.com", "Type": "CNAME", "Value": "_example.acm-validations.aws.com", }, "ValidationDomain": "example.amazondomains.com", "ValidationEmails": ["sample_email@sample.com"], "ValidationMethod": "DNS", "ValidationStatus": "SUCCESS" } ], "RenewalStatus": "SUCCESS", "RenewalStatusReason": "", "UpdatedAt": "2020-04-26T00:41:35.000Z", }, "Serial": "02:ac:86:b6:07:2f:0a:61:0e:3a:ac:fd:d9:ab:17:1a", "SignatureAlgorithm": "SHA256WITHRSA", "Status": "ISSUED", "Subject": "CN=example.amazondomains.com", "SubjectAlternativeNames": ["example.amazondomains.com"], "Type": "AMAZON_ISSUED" } ``` # AwsCloudFormation resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsCloudFormation` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsCloudFormationStack The `AwsCloudFormationStack` object provides details about an AWS CloudFormation stack that is nested as a resource in a top-level template. The following example shows the AWS Security Finding Format (ASFF) for the `AwsCloudFormationStack` object. To view descriptions of `AwsCloudFormationStack` attributes, see [AwsCloudFormationStackDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsCloudFormationStackDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsCloudFormationStack": { "Capabilities": [ "CAPABILITY_IAM", "CAPABILITY_NAMED_IAM" ], "CreationTime": "2022-02-18T15:31:53.161Z", "Description": "AWS CloudFormation Sample", "DisableRollback": true, "DriftInformation": { "StackDriftStatus": "DRIFTED" }, "EnableTerminationProtection": false, "LastUpdatedTime": "2022-02-18T15:31:53.161Z", "NotificationArns": [ "arn:aws:sns:us-east-1:978084797471:sample-sns-cfn" ], "Outputs": [{ "Description": "URL for newly created LAMP stack", "OutputKey": "WebsiteUrl", "OutputValue": "http://ec2-44-193-18-241.compute-1.amazonaws.com" }], "RoleArn": "arn:aws:iam::012345678910:role/exampleRole", "StackId": "arn:aws:cloudformation:us-east-1:978084797471:stack/sample-stack/e5d9f7e0-90cf-11ec-88c6-12ac1f91724b", "StackName": "sample-stack", "StackStatus": "CREATE_COMPLETE", "StackStatusReason": "Success", "TimeoutInMinutes": 1 } ``` # AwsCloudFront resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsCloudFront` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsCloudFrontDistribution The `AwsCloudFrontDistribution` object provides details about a Amazon CloudFront distribution configuration. The following is an example `AwsCloudFrontDistribution` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsCloudFrontDistribution` attributes, see [AwsCloudFrontDistributionDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsCloudFrontDistributionDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsCloudFrontDistribution": { "CacheBehaviors": { "Items": [ { "ViewerProtocolPolicy": "https-only" } ] }, "DefaultCacheBehavior": { "ViewerProtocolPolicy": "https-only" }, "DefaultRootObject": "index.html", "DomainName": "d2wkuj2w9l34gt.cloudfront.net", "Etag": "E37HOT42DHPVYH", "LastModifiedTime": "2015-08-31T21:11:29.093Z", "Logging": { "Bucket": "myawslogbucket.s3.amazonaws.com", "Enabled": false, "IncludeCookies": false, "Prefix": "myawslog/" }, "OriginGroups": { "Items": [ { "FailoverCriteria": { "StatusCodes": { "Items": [ 200, 301, 404 ] "Quantity": 3 } } } ] }, "Origins": { "Items": [ { "CustomOriginConfig": { "HttpPort": 80, "HttpsPort": 443, "OriginKeepaliveTimeout": 60, "OriginProtocolPolicy": "match-viewer", "OriginReadTimeout": 30, "OriginSslProtocols": { "Items": ["SSLv3", "TLSv1"], "Quantity": 2 } } }, ] }, "DomainName": "amzn-s3-demo-bucket.s3.amazonaws.com", "Id": "my-origin", "OriginPath": "/production", "S3OriginConfig": { "OriginAccessIdentity": "origin-access-identity/cloudfront/E2YFS67H6VB6E4" } ] }, "Status": "Deployed", "ViewerCertificate": { "AcmCertificateArn": "arn:aws:acm::123456789012:AcmCertificateArn", "Certificate": "ASCAJRRE5XYF52TKRY5M4", "CertificateSource": "iam", "CloudFrontDefaultCertificate": true, "IamCertificateId": "ASCAJRRE5XYF52TKRY5M4", "MinimumProtocolVersion": "TLSv1.2_2021", "SslSupportMethod": "sni-only" }, "WebAclId": "waf-1234567890" } ``` # AwsCloudTrail resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsCloudTrail` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsCloudTrailTrail The `AwsCloudTrailTrail` object provides details about a AWS CloudTrail trail. The following is an example `AwsCloudTrailTrail` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsCloudTrailTrail` attributes, see [AwsCloudTrailTrailDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsCloudTrailTrailDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsCloudTrailTrail": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-west-2:123456789012:log-group:CloudTrail/regression:*", "CloudWatchLogsRoleArn": "arn:aws:iam::866482105055:role/CloudTrail_CloudWatchLogs", "HasCustomEventSelectors": true, "HomeRegion": "us-west-2", "IncludeGlobalServiceEvents": true, "IsMultiRegionTrail": true, "IsOrganizationTrail": false, "KmsKeyId": "kmsKeyId", "LogFileValidationEnabled": true, "Name": "regression-trail", "S3BucketName": "cloudtrail-bucket", "S3KeyPrefix": "s3KeyPrefix", "SnsTopicArn": "arn:aws:sns:us-east-2:123456789012:MyTopic", "SnsTopicName": "snsTopicName", "TrailArn": "arn:aws:cloudtrail:us-west-2:123456789012:trail" } ``` # AwsCloudWatch resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsCloudWatch` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsCloudWatchAlarm The `AwsCloudWatchAlarm` object provides details about Amazon CloudWatch alarms that watch a metric or perform an action when an alarm changes state. The following example shows the AWS Security Finding Format (ASFF) for the `AwsCloudWatchAlarm` object. To view descriptions of `AwsCloudWatchAlarm` attributes, see [AwsCloudWatchAlarmDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsCloudWatchAlarmDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsCloudWatchAlarm": { "ActionsEnabled": true, "AlarmActions": [ "arn:aws:automate:region:ec2:stop", "arn:aws:automate:region:ec2:terminate" ], "AlarmArn": "arn:aws:cloudwatch:us-west-2:012345678910:alarm:sampleAlarm", "AlarmConfigurationUpdatedTimestamp": "2022-02-18T15:31:53.161Z", "AlarmDescription": "Alarm Example", "AlarmName": "Example", "ComparisonOperator": "GreaterThanOrEqualToThreshold", "DatapointsToAlarm": 1, "Dimensions": [{ "Name": "InstanceId", "Value": "i-1234567890abcdef0" }], "EvaluateLowSampleCountPercentile": "evaluate", "EvaluationPeriods": 1, "ExtendedStatistic": "p99.9", "InsufficientDataActions": [ "arn:aws:automate:region:ec2:stop" ], "MetricName": "Sample Metric", "Namespace": "YourNamespace", "OkActions": [ "arn:aws:swf:region:account-id:action/actions/AWS_EC2.InstanceId.Stop/1.0" ], "Period": 1, "Statistic": "SampleCount", "Threshold": 12.3, "ThresholdMetricId": "t1", "TreatMissingData": "notBreaching", "Unit": "Kilobytes/Second" } ``` # AwsCodeBuild resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsCodeBuild` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsCodeBuildProject The `AwsCodeBuildProject` object provides information about an AWS CodeBuild project. The following is an example `AwsCodeBuildProject` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsCodeBuildProject` attributes, see [AwsCodeBuildProjectDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsCodeBuildProjectDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsCodeBuildProject": { "Artifacts": [ { "ArtifactIdentifier": "string", "EncryptionDisabled": boolean, "Location": "string", "Name": "string", "NamespaceType": "string", "OverrideArtifactName": boolean, "Packaging": "string", "Path": "string", "Type": "string" } ], "SecondaryArtifacts": [ { "ArtifactIdentifier": "string", "EncryptionDisabled": boolean, "Location": "string", "Name": "string", "NamespaceType": "string", "OverrideArtifactName": boolean, "Packaging": "string", "Path": "string", "Type": "string" } ], "EncryptionKey": "string", "Certificate": "string", "Environment": { "Certificate": "string", "EnvironmentVariables": [ { "Name": "string", "Type": "string", "Value": "string" } ], "ImagePullCredentialsType": "string", "PrivilegedMode": boolean, "RegistryCredential": { "Credential": "string", "CredentialProvider": "string" }, "Type": "string" }, "LogsConfig": { "CloudWatchLogs": { "GroupName": "string", "Status": "string", "StreamName": "string" }, "S3Logs": { "EncryptionDisabled": boolean, "Location": "string", "Status": "string" } }, "Name": "string", "ServiceRole": "string", "Source": { "Type": "string", "Location": "string", "GitCloneDepth": integer }, "VpcConfig": { "VpcId": "string", "Subnets": ["string"], "SecurityGroupIds": ["string"] } } ``` # AwsDms resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsDms` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsDmsEndpoint The `AwsDmsEndpoint` object provides information about an AWS Database Migration Service (AWS DMS) endpoint. An endpoint provides connection, data store type, and location information about your data store. The following example shows the AWS Security Finding Format (ASFF) for the `AwsDmsEndpoint` object. To view descriptions of `AwsDmsEndpoint` attributes, see [AwsDmsEndpointDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsDmsEndpointDeatils.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsDmsEndpoint": { "CertificateArn": "arn:aws:dms:us-east-1:123456789012:cert:EXAMPLEIGDURVZGVJQZDPWJ5A7F2YDJVSMTBWFI", "DatabaseName": "Test", "EndpointArn": "arn:aws:dms:us-east-1:123456789012:endpoint:EXAMPLEQB3CZY33F7XV253NAJVBNPK6MJQVFVQA", "EndpointIdentifier": "target-db", "EndpointType": "TARGET", "EngineName": "mariadb", "KmsKeyId": "arn:aws:kms:us-east-1:123456789012:key/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", "Port": 3306, "ServerName": "target-db.exampletafyu.us-east-1.rds.amazonaws.com", "SslMode": "verify-ca", "Username": "admin" } ``` ## AwsDmsReplicationInstance The `AwsDmsReplicationInstance` object provides information about an AWS Database Migration Service (AWS DMS) replication instance. DMS uses a replication instance to connect to your source data store, read the source data, and format the data for consumption by the target data store. The following example shows the AWS Security Finding Format (ASFF) for the `AwsDmsReplicationInstance` object. To view descriptions of `AwsDmsReplicationInstance` attributes, see [AwsDmsReplicationInstanceDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsDmsReplicationInstanceDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsDmsReplicationInstance": { "AllocatedStorage": 50, "AutoMinorVersionUpgrade": true, "AvailabilityZone": "us-east-1b", "EngineVersion": "3.5.1", "KmsKeyId": "arn:aws:kms:us-east-1:123456789012:key/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", "MultiAZ": false, "PreferredMaintenanceWindow": "wed:08:08-wed:08:38", "PubliclyAccessible": true, "ReplicationInstanceClass": "dms.c5.xlarge", "ReplicationInstanceIdentifier": "second-replication-instance", "ReplicationSubnetGroup": { "ReplicationSubnetGroupIdentifier": "default-vpc-2344f44f" }, "VpcSecurityGroups": [ { "VpcSecurityGroupId": "sg-003a34e205138138b" } ] } ``` ## AwsDmsReplicationTask The `AwsDmsReplicationTask` object provides information about an AWS Database Migration Service (AWS DMS) replication task. A replication task moves a set of data from the source endpoint to the target endpoint. The following example shows the AWS Security Finding Format (ASFF) for the `AwsDmsReplicationInstance` object. To view descriptions of `AwsDmsReplicationInstance` attributes, see [AwsDmsReplicationInstance](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsDmsReplicationTaskDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsDmsReplicationTask": { "CdcStartPosition": "2023-08-28T14:26:22", "Id": "arn:aws:dms:us-east-1:123456789012:task:YDYUOHZIXWKQSUCBMUCQCNY44SJW74VJNB5DFWQ", "MigrationType": "cdc", "ReplicationInstanceArn": "arn:aws:dms:us-east-1:123456789012:rep:T7V6RFDP23PYQWUL26N3PF5REKML4YOUGIMYJUI", "ReplicationTaskIdentifier": "test-task", "ReplicationTaskSettings": "{\"Logging\":{\"EnableLogging\":false,\"EnableLogContext\":false,\"LogComponents\":[{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"TRANSFORMATION\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"SOURCE_UNLOAD\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"IO\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"TARGET_LOAD\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"PERFORMANCE\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"SOURCE_CAPTURE\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"SORTER\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"REST_SERVER\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"VALIDATOR_EXT\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"TARGET_APPLY\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"TASK_MANAGER\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"TABLES_MANAGER\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"METADATA_MANAGER\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"FILE_FACTORY\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"COMMON\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"ADDONS\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"DATA_STRUCTURE\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"COMMUNICATION\"},{\"Severity\":\"LOGGER_SEVERITY_DEFAULT\",\"Id\":\"FILE_TRANSFER\"}],\"CloudWatchLogGroup\":null,\"CloudWatchLogStream\":null},\"StreamBufferSettings\":{\"StreamBufferCount\":3,\"CtrlStreamBufferSizeInMB\":5,\"StreamBufferSizeInMB\":8},\"ErrorBehavior\":{\"FailOnNoTablesCaptured\":true,\"ApplyErrorUpdatePolicy\":\"LOG_ERROR\",\"FailOnTransactionConsistencyBreached\":false,\"RecoverableErrorThrottlingMax\":1800,\"DataErrorEscalationPolicy\":\"SUSPEND_TABLE\",\"ApplyErrorEscalationCount\":0,\"RecoverableErrorStopRetryAfterThrottlingMax\":true,\"RecoverableErrorThrottling\":true,\"ApplyErrorFailOnTruncationDdl\":false,\"DataTruncationErrorPolicy\":\"LOG_ERROR\",\"ApplyErrorInsertPolicy\":\"LOG_ERROR\",\"EventErrorPolicy\":\"IGNORE\",\"ApplyErrorEscalationPolicy\":\"LOG_ERROR\",\"RecoverableErrorCount\":-1,\"DataErrorEscalationCount\":0,\"TableErrorEscalationPolicy\":\"STOP_TASK\",\"RecoverableErrorInterval\":5,\"ApplyErrorDeletePolicy\":\"IGNORE_RECORD\",\"TableErrorEscalationCount\":0,\"FullLoadIgnoreConflicts\":true,\"DataErrorPolicy\":\"LOG_ERROR\",\"TableErrorPolicy\":\"SUSPEND_TABLE\"},\"TTSettings\":{\"TTS3Settings\":null,\"TTRecordSettings\":null,\"EnableTT\":false},\"FullLoadSettings\":{\"CommitRate\":10000,\"StopTaskCachedChangesApplied\":false,\"StopTaskCachedChangesNotApplied\":false,\"MaxFullLoadSubTasks\":8,\"TransactionConsistencyTimeout\":600,\"CreatePkAfterFullLoad\":false,\"TargetTablePrepMode\":\"DO_NOTHING\"},\"TargetMetadata\":{\"ParallelApplyBufferSize\":0,\"ParallelApplyQueuesPerThread\":0,\"ParallelApplyThreads\":0,\"TargetSchema\":\"\",\"InlineLobMaxSize\":0,\"ParallelLoadQueuesPerThread\":0,\"SupportLobs\":true,\"LobChunkSize\":64,\"TaskRecoveryTableEnabled\":false,\"ParallelLoadThreads\":0,\"LobMaxSize\":0,\"BatchApplyEnabled\":false,\"FullLobMode\":true,\"LimitedSizeLobMode\":false,\"LoadMaxFileSize\":0,\"ParallelLoadBufferSize\":0},\"BeforeImageSettings\":null,\"ControlTablesSettings\":{\"historyTimeslotInMinutes\":5,\"HistoryTimeslotInMinutes\":5,\"StatusTableEnabled\":false,\"SuspendedTablesTableEnabled\":false,\"HistoryTableEnabled\":false,\"ControlSchema\":\"\",\"FullLoadExceptionTableEnabled\":false},\"LoopbackPreventionSettings\":null,\"CharacterSetSettings\":null,\"FailTaskWhenCleanTaskResourceFailed\":false,\"ChangeProcessingTuning\":{\"StatementCacheSize\":50,\"CommitTimeout\":1,\"BatchApplyPreserveTransaction\":true,\"BatchApplyTimeoutMin\":1,\"BatchSplitSize\":0,\"BatchApplyTimeoutMax\":30,\"MinTransactionSize\":1000,\"MemoryKeepTime\":60,\"BatchApplyMemoryLimit\":500,\"MemoryLimitTotal\":1024},\"ChangeProcessingDdlHandlingPolicy\":{\"HandleSourceTableDropped\":true,\"HandleSourceTableTruncated\":true,\"HandleSourceTableAltered\":true},\"PostProcessingRules\":null}", "SourceEndpointArn": "arn:aws:dms:us-east-1:123456789012:endpoint:TZPWV2VCXEGHYOKVKRNHAKJ4Q3RUXACNGFGYWRI", "TableMappings": "{\"rules\":[{\"rule-type\":\"selection\",\"rule-id\":\"969761702\",\"rule-name\":\"969761702\",\"object-locator\":{\"schema-name\":\"%table\",\"table-name\":\"%example\"},\"rule-action\":\"exclude\",\"filters\":[]}]}", "TargetEndpointArn": "arn:aws:dms:us-east-1:123456789012:endpoint:ABR8LBOQB3CZY33F7XV253NAJVBNPK6MJQVFVQA" } ``` # AwsDynamoDB resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsDynamoDB` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsDynamoDbTable The `AwsDynamoDbTable` object provides details about an Amazon DynamoDB table. The following is an example `AwsDynamoDbTable` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsDynamoDbTable` attributes, see [AwsDynamoDbTableDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsDynamoDbTableDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsDynamoDbTable": { "AttributeDefinitions": [ { "AttributeName": "attribute1", "AttributeType": "value 1" }, { "AttributeName": "attribute2", "AttributeType": "value 2" }, { "AttributeName": "attribute3", "AttributeType": "value 3" } ], "BillingModeSummary": { "BillingMode": "PAY_PER_REQUEST", "LastUpdateToPayPerRequestDateTime": "2019-12-03T15:23:10.323Z" }, "CreationDateTime": "2019-12-03T15:23:10.248Z", "DeletionProtectionEnabled": true, "GlobalSecondaryIndexes": [ { "Backfilling": false, "IndexArn": "arn:aws:dynamodb:us-west-2:111122223333:table/exampleTable/index/exampleIndex", "IndexName": "standardsControlArnIndex", "IndexSizeBytes": 1862513, "IndexStatus": "ACTIVE", "ItemCount": 20, "KeySchema": [ { "AttributeName": "City", "KeyType": "HASH" }, { "AttributeName": "Date", "KeyType": "RANGE" } ], "Projection": { "NonKeyAttributes": ["predictorName"], "ProjectionType": "ALL" }, "ProvisionedThroughput": { "LastIncreaseDateTime": "2019-03-14T13:21:00.399Z", "LastDecreaseDateTime": "2019-03-14T12:47:35.193Z", "NumberOfDecreasesToday": 0, "ReadCapacityUnits": 100, "WriteCapacityUnits": 50 }, } ], "GlobalTableVersion": "V1", "ItemCount": 2705, "KeySchema": [ { "AttributeName": "zipcode", "KeyType": "HASH" } ], "LatestStreamArn": "arn:aws:dynamodb:us-west-2:111122223333:table/exampleTable/stream/2019-12-03T23:23:10.248", "LatestStreamLabel": "2019-12-03T23:23:10.248", "LocalSecondaryIndexes": [ { "IndexArn": "arn:aws:dynamodb:us-east-1:111122223333:table/exampleGroup/index/exampleId", "IndexName": "CITY_DATE_INDEX_NAME", "KeySchema": [ { "AttributeName": "zipcode", "KeyType": "HASH" } ], "Projection": { "NonKeyAttributes": ["predictorName"], "ProjectionType": "ALL" }, } ], "ProvisionedThroughput": { "LastIncreaseDateTime": "2019-03-14T13:21:00.399Z", "LastDecreaseDateTime": "2019-03-14T12:47:35.193Z", "NumberOfDecreasesToday": 0, "ReadCapacityUnits": 100, "WriteCapacityUnits": 50 }, "Replicas": [ { "GlobalSecondaryIndexes":[ { "IndexName": "CITY_DATE_INDEX_NAME", "ProvisionedThroughputOverride": { "ReadCapacityUnits": 10 } } ], "KmsMasterKeyId" : "KmsKeyId" "ProvisionedThroughputOverride": { "ReadCapacityUnits": 10 }, "RegionName": "regionName", "ReplicaStatus": "CREATING", "ReplicaStatusDescription": "replicaStatusDescription" } ], "RestoreSummary" : { "SourceBackupArn": "arn:aws:dynamodb:us-west-2:111122223333:table/exampleTable/backup/backup1", "SourceTableArn": "arn:aws:dynamodb:us-west-2:111122223333:table/exampleTable", "RestoreDateTime": "2020-06-22T17:40:12.322Z", "RestoreInProgress": true }, "SseDescription": { "InaccessibleEncryptionDateTime": "2018-01-26T23:50:05.000Z", "Status": "ENABLED", "SseType": "KMS", "KmsMasterKeyArn": "arn:aws:kms:us-east-1:111122223333:key/key1" }, "StreamSpecification" : { "StreamEnabled": true, "StreamViewType": "NEW_IMAGE" }, "TableId": "example-table-id-1", "TableName": "example-table", "TableSizeBytes": 1862513, "TableStatus": "ACTIVE" } ``` # AwsEc2 resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsEc2` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsEc2ClientVpnEndpoint The `AwsEc2ClientVpnEndpoint` object provides information about an AWS Client VPN endpoint. A Client VPN endpoint is the resource that you create and configure to enable and manage client VPN sessions. It's the termination point for all client VPN sessions. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEc2ClientVpnEndpoint` object. To view descriptions of `AwsEc2ClientVpnEndpoint` attributes, see [AwsEc2ClientVpnEndpointDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2ClientVpnEndpointDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEc2ClientVpnEndpoint": { "AuthenticationOptions": [ { "MutualAuthentication": { "ClientRootCertificateChainArn": "arn:aws:acm:us-east-1:123456789012:certificate/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111" }, "Type": "certificate-authentication" } ], "ClientCidrBlock": "10.0.0.0/22", "ClientConnectOptions": { "Enabled": false }, "ClientLoginBannerOptions": { "Enabled": false }, "ClientVpnEndpointId": "cvpn-endpoint-00c5d11fc4729f2a5", "ConnectionLogOptions": { "Enabled": false }, "Description": "test", "DnsServer": ["10.0.0.0"], "ServerCertificateArn": "arn:aws:acm:us-east-1:123456789012:certificate/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", "SecurityGroupIdSet": [ "sg-0f7a177b82b443691" ], "SelfServicePortalUrl": "https://self-service.clientvpn.amazonaws.com/endpoints/cvpn-endpoint-00c5d11fc4729f2a5", "SessionTimeoutHours": 24, "SplitTunnel": false, "TransportProtocol": "udp", "VpcId": "vpc-1a2b3c4d5e6f1a2b3", "VpnPort": 443 } ``` ## AwsEc2Eip The `AwsEc2Eip` object provides information about an Elastic IP address. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEc2Eip` object. To view descriptions of `AwsEc2Eip` attributes, see [AwsEc2EipDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2EipDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEc2Eip": { "InstanceId": "instance1", "PublicIp": "192.0.2.04", "AllocationId": "eipalloc-example-id-1", "AssociationId": "eipassoc-example-id-1", "Domain": "vpc", "PublicIpv4Pool": "anycompany", "NetworkBorderGroup": "eu-central-1", "NetworkInterfaceId": "eni-example-id-1", "NetworkInterfaceOwnerId": "777788889999", "PrivateIpAddress": "192.0.2.03" } ``` ## AwsEc2Instance The `AwsEc2Instance` object provides details about an Amazon EC2 instance. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEc2Instance` object. To view descriptions of `AwsEc2Instance` attributes, see [AwsEc2InstanceDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2InstanceDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEc2Instance": { "IamInstanceProfileArn": "arn:aws:iam::123456789012:instance-profile/AdminRole", "ImageId": "ami-1234", "IpV4Addresses": [ "1.1.1.1" ], "IpV6Addresses": [ "2001:db8:1234:1a2b::123" ], "KeyName": "my_keypair", "LaunchedAt": "2018-05-08T16:46:19.000Z", "MetadataOptions": { "HttpEndpoint": "enabled", "HttpProtocolIpv6": "enabled", "HttpPutResponseHopLimit": 1, "HttpTokens": "optional", "InstanceMetadataTags": "disabled", }, "Monitoring": { "State": "disabled" }, "NetworkInterfaces": [ { "NetworkInterfaceId": "eni-e5aa89a3" } ], "SubnetId": "subnet-123", "Type": "i3.xlarge", "VpcId": "vpc-123" } ``` ## AwsEc2LaunchTemplate The `AwsEc2LaunchTemplate` object contains details about an Amazon Elastic Compute Cloud launch template that specifies instance configuration information. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEc2LaunchTemplate` object. To view descriptions of `AwsEc2LaunchTemplate` attributes, see [AwsEc2LaunchTemplateDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2LaunchTemplateDetals.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEc2LaunchTemplate": { "DefaultVersionNumber": "1", "ElasticGpuSpecifications": ["string"], "ElasticInferenceAccelerators": ["string"], "Id": "lt-0a16e9802800bdd85", "ImageId": "ami-0d5eff06f840b45e9", "LatestVersionNumber": "1", "LaunchTemplateData": { "BlockDeviceMappings": [{ "DeviceName": "/dev/xvda", "Ebs": { "DeleteonTermination": true, "Encrypted": true, "SnapshotId": "snap-01047646ec075f543", "VolumeSize": 8, "VolumeType:" "gp2" } }], "MetadataOptions": { "HttpTokens": "enabled", "HttpPutResponseHopLimit" : 1 }, "Monitoring": { "Enabled": true, "NetworkInterfaces": [{ "AssociatePublicIpAddress" : true, }], "LaunchTemplateName": "string", "LicenseSpecifications": ["string"], "SecurityGroupIds": ["sg-01fce87ad6e019725"], "SecurityGroups": ["string"], "TagSpecifications": ["string"] } ``` ## AwsEc2NetworkAcl The `AwsEc2NetworkAcl` object contains details about an Amazon EC2 network access control list (ACL). The following example shows the AWS Security Finding Format (ASFF) for the `AwsEc2NetworkAcl` object. To view descriptions of `AwsEc2NetworkAcl` attributes, see [AwsEc2NetworkAclDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2NetworkAclDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEc2NetworkAcl": { "IsDefault": false, "NetworkAclId": "acl-1234567890abcdef0", "OwnerId": "123456789012", "VpcId": "vpc-1234abcd", "Associations": [{ "NetworkAclAssociationId": "aclassoc-abcd1234", "NetworkAclId": "acl-021345abcdef6789", "SubnetId": "subnet-abcd1234" }], "Entries": [{ "CidrBlock": "10.24.34.0/23", "Egress": true, "IcmpTypeCode": { "Code": 10, "Type": 30 }, "Ipv6CidrBlock": "2001:DB8::/32", "PortRange": { "From": 20, "To": 40 }, "Protocol": "tcp", "RuleAction": "allow", "RuleNumber": 100 }] } ``` ## AwsEc2NetworkInterface The `AwsEc2NetworkInterface` object provides information about an Amazon EC2 network interface. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEc2NetworkInterface` object. To view descriptions of `AwsEc2NetworkInterface` attributes, see [AwsEc2NetworkInterfaceDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2NetworkInterfaceDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEc2NetworkInterface": { "Attachment": { "AttachTime": "2019-01-01T03:03:21Z", "AttachmentId": "eni-attach-43348162", "DeleteOnTermination": true, "DeviceIndex": 123, "InstanceId": "i-1234567890abcdef0", "InstanceOwnerId": "123456789012", "Status": 'ATTACHED' }, "SecurityGroups": [ { "GroupName": "my-security-group", "GroupId": "sg-903004f8" }, ], "NetworkInterfaceId": 'eni-686ea200', "SourceDestCheck": false } ``` ## AwsEc2RouteTable The `AwsEc2RouteTable` object provides information about an Amazon EC2 route table. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEc2RouteTable` object. To view descriptions of `AwsEc2RouteTable` attributes, see [AwsEc2RouteTableDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2RouteTableDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEc2RouteTable": { "AssociationSet": [{ "AssociationSet": { "State": "associated" }, "Main": true, "RouteTableAssociationId": "rtbassoc-08e706c45de9f7512", "RouteTableId": "rtb-0a59bde9cf2548e34", }], "PropogatingVgwSet": [], "RouteTableId": "rtb-0a59bde9cf2548e34", "RouteSet": [ { "DestinationCidrBlock": "10.24.34.0/23", "GatewayId": "local", "Origin": "CreateRouteTable", "State": "active" }, { "DestinationCidrBlock": "10.24.34.0/24", "GatewayId": "igw-0242c2d7d513fc5d3", "Origin": "CreateRoute", "State": "active" } ], "VpcId": "vpc-0c250a5c33f51d456" } ``` ## AwsEc2SecurityGroup The `AwsEc2SecurityGroup` object describes an Amazon EC2 security group. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEc2SecurityGroup` object. To view descriptions of `AwsEc2SecurityGroup` attributes, see [AwsEc2SecurityGroupDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2SecurityGroupDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEc2SecurityGroup": { "GroupName": "MySecurityGroup", "GroupId": "sg-903004f8", "OwnerId": "123456789012", "VpcId": "vpc-1a2b3c4d", "IpPermissions": [ { "IpProtocol": "-1", "IpRanges": [], "UserIdGroupPairs": [ { "UserId": "123456789012", "GroupId": "sg-903004f8" } ], "PrefixListIds": [ {"PrefixListId": "pl-63a5400a"} ] }, { "PrefixListIds": [], "FromPort": 22, "IpRanges": [ { "CidrIp": "203.0.113.0/24" } ], "ToPort": 22, "IpProtocol": "tcp", "UserIdGroupPairs": [] } ] } ``` ## AwsEc2Subnet The `AwsEc2Subnet` object provides information about a subnet in Amazon EC2. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEc2Subnet` object. To view descriptions of `AwsEc2Subnet` attributes, see [AwsEc2SubnetDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2SubnetDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` AwsEc2Subnet: { "AssignIpv6AddressOnCreation": false, "AvailabilityZone": "us-west-2c", "AvailabilityZoneId": "usw2-az3", "AvailableIpAddressCount": 8185, "CidrBlock": "10.0.0.0/24", "DefaultForAz": false, "MapPublicIpOnLaunch": false, "OwnerId": "123456789012", "State": "available", "SubnetArn": "arn:aws:ec2:us-west-2:123456789012:subnet/subnet-d5436c93", "SubnetId": "subnet-d5436c93", "VpcId": "vpc-153ade70", "Ipv6CidrBlockAssociationSet": [{ "AssociationId": "subnet-cidr-assoc-EXAMPLE", "Ipv6CidrBlock": "2001:DB8::/32", "CidrBlockState": "associated" }] } ``` ## AwsEc2TransitGateway The `AwsEc2TransitGateway` object provides details about an Amazon EC2 transit gateway that interconnects your virtual private clouds (VPCs) and on-premises networks. The following is an example `AwsEc2TransitGateway` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsEc2TransitGateway` attributes, see [AwsEc2TransitGatewayDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2TransitGatewayDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEc2TransitGateway": { "AmazonSideAsn": 65000, "AssociationDefaultRouteTableId": "tgw-rtb-099ba47cbbea837cc", "AutoAcceptSharedAttachments": "disable", "DefaultRouteTableAssociation": "enable", "DefaultRouteTablePropagation": "enable", "Description": "sample transit gateway", "DnsSupport": "enable", "Id": "tgw-042ae6bf7a5c126c3", "MulticastSupport": "disable", "PropagationDefaultRouteTableId": "tgw-rtb-099ba47cbbea837cc", "TransitGatewayCidrBlocks": ["10.0.0.0/16"], "VpnEcmpSupport": "enable" } ``` ## AwsEc2Volume The `AwsEc2Volume` object provides details about an Amazon EC2 volume. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEc2Volume` object. To view descriptions of `AwsEc2Volume` attributes, see [AwsEc2VolumeDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2VolumeDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEc2Volume": { "Attachments": [ { "AttachTime": "2017-10-17T14:47:11Z", "DeleteOnTermination": true, "InstanceId": "i-123abc456def789g", "Status": "attached" } ], "CreateTime": "2020-02-24T15:54:30Z", "Encrypted": true, "KmsKeyId": "arn:aws:kms:us-east-1:111122223333:key/wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", "Size": 80, "SnapshotId": "", "Status": "available" } ``` ## AwsEc2Vpc The `AwsEc2Vpc` object provides details about an Amazon EC2 VPC. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEc2Vpc` object. To view descriptions of `AwsEc2Vpc` attributes, see [AwsEc2VpcDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2VpcDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEc2Vpc": { "CidrBlockAssociationSet": [ { "AssociationId": "vpc-cidr-assoc-0dc4c852f52abda97", "CidrBlock": "192.0.2.0/24", "CidrBlockState": "associated" } ], "DhcpOptionsId": "dopt-4e42ce28", "Ipv6CidrBlockAssociationSet": [ { "AssociationId": "vpc-cidr-assoc-0dc4c852f52abda97", "CidrBlockState": "associated", "Ipv6CidrBlock": "192.0.2.0/24" } ], "State": "available" } ``` ## AwsEc2VpcEndpointService The `AwsEc2VpcEndpointService` object contains details about the service configuration for a VPC endpoint service. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEc2VpcEndpointService` object. To view descriptions of `AwsEc2VpcEndpointService` attributes, see [AwsEc2VpcEndpointServiceDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2VpcEndpointServiceDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEc2VpcEndpointService": { "ServiceType": [ { "ServiceType": "Interface" } ], "ServiceId": "vpce-svc-example1", "ServiceName": "com.amazonaws.vpce.us-east-1.vpce-svc-example1", "ServiceState": "Available", "AvailabilityZones": [ "us-east-1" ], "AcceptanceRequired": true, "ManagesVpcEndpoints": false, "NetworkLoadBalancerArns": [ "arn:aws:elasticloadbalancing:us-east-1:444455556666:loadbalancer/net/my-network-load-balancer/example1" ], "GatewayLoadBalancerArns": [], "BaseEndpointDnsNames": [ "vpce-svc-04eec859668b51c34.us-east-1.vpce.amazonaws.com" ], "PrivateDnsName": "my-private-dns" } ``` ## AwsEc2VpcPeeringConnection The `AwsEc2VpcPeeringConnection` object provides details about the networking connection between two VPCs. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEc2VpcPeeringConnection` object. To view descriptions of `AwsEc2VpcPeeringConnection` attributes, see [AwsEc2VpcPeeringConnectionDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEc2VpcPeeringConnectionDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEc2VpcPeeringConnection": { "AccepterVpcInfo": { "CidrBlock": "10.0.0.0/28", "CidrBlockSet": [{ "CidrBlock": "10.0.0.0/28" }], "Ipv6CidrBlockSet": [{ "Ipv6CidrBlock": "2002::1234:abcd:ffff:c0a8:101/64" }], "OwnerId": "012345678910", "PeeringOptions": { "AllowDnsResolutionFromRemoteVpc": true, "AllowEgressFromLocalClassicLinkToRemoteVpc": false, "AllowEgressFromLocalVpcToRemoteClassicLink": true }, "Region": "us-west-2", "VpcId": "vpc-i123456" }, "ExpirationTime": "2022-02-18T15:31:53.161Z", "RequesterVpcInfo": { "CidrBlock": "192.168.0.0/28", "CidrBlockSet": [{ "CidrBlock": "192.168.0.0/28" }], "Ipv6CidrBlockSet": [{ "Ipv6CidrBlock": "2002::1234:abcd:ffff:c0a8:101/64" }], "OwnerId": "012345678910", "PeeringOptions": { "AllowDnsResolutionFromRemoteVpc": true, "AllowEgressFromLocalClassicLinkToRemoteVpc": false, "AllowEgressFromLocalVpcToRemoteClassicLink": true }, "Region": "us-west-2", "VpcId": "vpc-i123456" }, "Status": { "Code": "initiating-request", "Message": "Active" }, "VpcPeeringConnectionId": "pcx-1a2b3c4d" } ``` # AwsEcr resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsEcr` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsEcrContainerImage The `AwsEcrContainerImage` object provides information about an Amazon ECR image. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEcrContainerImage` object. To view descriptions of `AwsEcrContainerImage` attributes, see [AwsEcrContainerImageDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEcrContainerImageDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEcrContainerImage": { "RegistryId": "123456789012", "RepositoryName": "repository-name", "Architecture": "amd64" "ImageDigest": "sha256:a568e5c7a953fbeaa2904ac83401f93e4a076972dc1bae527832f5349cd2fb10", "ImageTags": ["00000000-0000-0000-0000-000000000000"], "ImagePublishedAt": "2019-10-01T20:06:12Z" } ``` ## AwsEcrRepository The `AwsEcrRepository` object provides information about an Amazon Elastic Container Registry repository. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEcrRepository` object. To view descriptions of `AwsEcrRepository` attributes, see [AwsEcrRepositoryDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEcrRepositoryDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEcrRepository": { "LifecyclePolicy": { "RegistryId": "123456789012", }, "RepositoryName": "sample-repo", "Arn": "arn:aws:ecr:us-west-2:111122223333:repository/sample-repo", "ImageScanningConfiguration": { "ScanOnPush": true }, "ImageTagMutability": "IMMUTABLE" } ``` # AwsEcs resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsEcs` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsEcsCluster The `AwsEcsCluster` object provides details about an Amazon Elastic Container Service cluster. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEcsCluster` object. To view descriptions of `AwsEcsCluster` attributes, see [AwsEcsClusterDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEcsClusterDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEcsCluster": { "CapacityProviders": [], "ClusterSettings": [ { "Name": "containerInsights", "Value": "enabled" } ], "Configuration": { "ExecuteCommandConfiguration": { "KmsKeyId": "kmsKeyId", "LogConfiguration": { "CloudWatchEncryptionEnabled": true, "CloudWatchLogGroupName": "cloudWatchLogGroupName", "S3BucketName": "s3BucketName", "S3EncryptionEnabled": true, "S3KeyPrefix": "s3KeyPrefix" }, "Logging": "DEFAULT" } } "DefaultCapacityProviderStrategy": [ { "Base": 0, "CapacityProvider": "capacityProvider", "Weight": 1 } ] } ``` ## AwsEcsContainer The `AwsEcsContainer` object contains details about an Amazon ECS container. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEcsContainer` object. To view descriptions of `AwsEcsContainer` attributes, see [AwsEcsContainerDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEcsContainerDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEcsContainer": { "Image": "1111111/knotejs@sha256:356131c9fef111111111111115f4ed8de5f9dce4dc3bd34bg21846588a3", "MountPoints": [{ "ContainerPath": "/mnt/etc", "SourceVolume": "vol-03909e9" }], "Name": "knote", "Privileged": true } ``` ## AwsEcsService The `AwsEcsService` object provides details about a service within an Amazon ECS cluster. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEcsService` object. To view descriptions of `AwsEcsService` attributes, see [AwsEcsServiceDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEcsServiceDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEcsService": { "CapacityProviderStrategy": [ { "Base": 12, "CapacityProvider": "", "Weight": "" } ], "Cluster": "arn:aws:ecs:us-east-1:111122223333:cluster/example-ecs-cluster", "DeploymentConfiguration": { "DeploymentCircuitBreaker": { "Enable": false, "Rollback": false }, "MaximumPercent": 200, "MinimumHealthyPercent": 100 }, "DeploymentController": "", "DesiredCount": 1, "EnableEcsManagedTags": false, "EnableExecuteCommand": false, "HealthCheckGracePeriodSeconds": 1, "LaunchType": "FARGATE", "LoadBalancers": [ { "ContainerName": "", "ContainerPort": 23, "LoadBalancerName": "", "TargetGroupArn": "" } ], "Name": "sample-app-service", "NetworkConfiguration": { "AwsVpcConfiguration": { "Subnets": [ "Subnet-example1", "Subnet-example2" ], "SecurityGroups": [ "Sg-0ce48e9a6e5b457f5" ], "AssignPublicIp": "ENABLED" } }, "PlacementConstraints": [ { "Expression": "", "Type": "" } ], "PlacementStrategies": [ { "Field": "", "Type": "" } ], "PlatformVersion": "LATEST", "PropagateTags": "", "Role": "arn:aws:iam::111122223333:role/aws-servicerole/ecs.amazonaws.com/ServiceRoleForECS", "SchedulingStrategy": "REPLICA", "ServiceName": "sample-app-service", "ServiceArn": "arn:aws:ecs:us-east-1:111122223333:service/example-ecs-cluster/sample-app-service", "ServiceRegistries": [ { "ContainerName": "", "ContainerPort": 1212, "Port": 1221, "RegistryArn": "" } ], "TaskDefinition": "arn:aws:ecs:us-east-1:111122223333:task-definition/example-taskdef:1" } ``` ## AwsEcsTask The `AwsEcsTask` object provides details about an Amazon ECS task. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEcsTask` object. To view descriptions of `AwsEcsTask` attributes, see [AwsEcsTask](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEcsTaskDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEcsTask": { "ClusterArn": "arn:aws:ecs:us-west-2:123456789012:task/MyCluster/1234567890123456789", "CreatedAt": "1557134011644", "Group": "service:fargate-service", "StartedAt": "1557134011644", "StartedBy": "ecs-svc/1234567890123456789", "TaskDefinitionArn": "arn:aws:ecs:us-west-2:123456789012:task-definition/sample-fargate:2", "Version": 3, "Volumes": [{ "Name": "string", "Host": { "SourcePath": "string" } }], "Containers": { "Image": "1111111/knotejs@sha256:356131c9fef111111111111115f4ed8de5f9dce4dc3bd34bg21846588a3", "MountPoints": [{ "ContainerPath": "/mnt/etc", "SourceVolume": "vol-03909e9" }], "Name": "knote", "Privileged": true } } ``` ## AwsEcsTaskDefinition The `AwsEcsTaskDefinition` object contains details about a task definition. A task definition describes the container and volume definitions of an Amazon Elastic Container Service task. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEcsTaskDefinition` object. To view descriptions of `AwsEcsTaskDefinition` attributes, see [AwsEcsTaskDefinitionDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEcsTaskDefinitionDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEcsTaskDefinition": { "ContainerDefinitions": [ { "Command": ['ruby', 'hi.rb'], "Cpu":128, "Essential": true, "HealthCheck": { "Command": ["CMD-SHELL", "curl -f http://localhost/ || exit 1"], "Interval": 10, "Retries": 3, "StartPeriod": 5, "Timeout": 20 }, "Image": "tongueroo/sinatra:latest", "Interactive": true, "Links": [], "LogConfiguration": { "LogDriver": "awslogs", "Options": { "awslogs-group": "/ecs/sinatra-hi", "awslogs-region": "ap-southeast-1", "awslogs-stream-prefix": "ecs" }, "SecretOptions": [] }, "MemoryReservation": 128, "Name": "web", "PortMappings": [ { "ContainerPort": 4567, "HostPort":4567, "Protocol": "tcp" } ], "Privileged": true, "StartTimeout": 10, "StopTimeout": 100, } ], "Family": "sinatra-hi", "NetworkMode": "host", "RequiresCompatibilities": ["EC2"], "Status": "ACTIVE", "TaskRoleArn": "arn:aws:iam::111122223333:role/ecsTaskExecutionRole", } ``` # AwsEfs resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsEfs` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsEfsAccessPoint The `AwsEfsAccessPoint` object provides details about files stored in Amazon Elastic File System. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEfsAccessPoint` object. To view descriptions of `AwsEfsAccessPoint` attributes, see [AwsEfsAccessPointDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEfsAccessPointDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEfsAccessPoint": { "AccessPointId": "fsap-05c4c0e79ba0b118a", "Arn": "arn:aws:elasticfilesystem:us-east-1:863155670886:access-point/fsap-05c4c0e79ba0b118a", "ClientToken": "AccessPointCompliant-ASk06ZZSXsEp", "FileSystemId": "fs-0f8137f731cb32146", "PosixUser": { "Gid": "1000", "SecondaryGids": ["0", "4294967295"], "Uid": "1234" }, "RootDirectory": { "CreationInfo": { "OwnerGid": "1000", "OwnerUid": "1234", "Permissions": "777" }, "Path": "/tmp/example" } } ``` # AwsEks resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsEks` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsEksCluster The `AwsEksCluster` object provides details about an Amazon EKS cluster. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEksCluster` object. To view descriptions of `AwsEksCluster` attributes, see [AwsEksClusterDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEksClusterDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` { "AwsEksCluster": { "Name": "example", "Arn": "arn:aws:eks:us-west-2:222222222222:cluster/example", "CreatedAt": 1565804921.901, "Version": "1.12", "RoleArn": "arn:aws:iam::222222222222:role/example-cluster-ServiceRole-1XWBQWYSFRE2Q", "ResourcesVpcConfig": { "EndpointPublicAccess": false, "SubnetIds": [ "subnet-021345abcdef6789", "subnet-abcdef01234567890", "subnet-1234567890abcdef0" ], "SecurityGroupIds": [ "sg-abcdef01234567890" ] }, "Logging": { "ClusterLogging": [ { "Types": [ "api", "audit", "authenticator", "controllerManager", "scheduler" ], "Enabled": true } ] }, "Status": "CREATING", "CertificateAuthorityData": {}, } } ``` # AwsElasticBeanstalk resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsElasticBeanstalk` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsElasticBeanstalkEnvironment The `AwsElasticBeanstalkEnvironment` object contains details about an AWS Elastic Beanstalk environment. The following example shows the AWS Security Finding Format (ASFF) for the `AwsElasticBeanstalkEnvironment` object. To view descriptions of `AwsElasticBeanstalkEnvironment` attributes, see [AwsElasticBeanstalkEnvironmentDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsElasticBeanstalkEnvironmentDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsElasticBeanstalkEnvironment": { "ApplicationName": "MyApplication", "Cname": "myexampleapp-env.devo-2.elasticbeanstalk-internal.com", "DateCreated": "2021-04-30T01:38:01.090Z", "DateUpdated": "2021-04-30T01:38:01.090Z", "Description": "Example description of my awesome application", "EndpointUrl": "eb-dv-e-p-AWSEBLoa-abcdef01234567890-021345abcdef6789.us-east-1.elb.amazonaws.com", "EnvironmentArn": "arn:aws:elasticbeanstalk:us-east-1:123456789012:environment/MyApplication/myapplication-env", "EnvironmentId": "e-abcd1234", "EnvironmentLinks": [ { "EnvironmentName": "myexampleapp-env", "LinkName": "myapplicationLink" } ], "EnvironmentName": "myapplication-env", "OptionSettings": [ { "Namespace": "aws:elasticbeanstalk:command", "OptionName": "BatchSize", "Value": "100" }, { "Namespace": "aws:elasticbeanstalk:command", "OptionName": "Timeout", "Value": "600" }, { "Namespace": "aws:elasticbeanstalk:command", "OptionName": "BatchSizeType", "Value": "Percentage" }, { "Namespace": "aws:elasticbeanstalk:command", "OptionName": "IgnoreHealthCheck", "Value": "false" }, { "Namespace": "aws:elasticbeanstalk:application", "OptionName": "Application Healthcheck URL", "Value": "TCP:80" } ], "PlatformArn": "arn:aws:elasticbeanstalk:us-east-1::platform/Tomcat 8 with Java 8 running on 64bit Amazon Linux/2.7.7", "SolutionStackName": "64bit Amazon Linux 2017.09 v2.7.7 running Tomcat 8 Java 8", "Status": "Ready", "Tier": { "Name": "WebServer" "Type": "Standard" "Version": "1.0" }, "VersionLabel": "Sample Application" } ``` # AwsElasticSearch resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsElasticSearch` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsElasticSearchDomain The `AwsElasticSearchDomain` object provides details about an Amazon OpenSearch Service domain. The following example shows the AWS Security Finding Format (ASFF) for the `AwsElasticSearchDomain` object. To view descriptions of `AwsElasticSearchDomain` attributes, see [AwsElasticSearchDomainDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsElasticsearchDomainDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsElasticSearchDomain": { "AccessPolicies": "string", "DomainStatus": { "DomainId": "string", "DomainName": "string", "Endpoint": "string", "Endpoints": { "string": "string" } }, "DomainEndpointOptions": { "EnforceHTTPS": boolean, "TLSSecurityPolicy": "string" }, "ElasticsearchClusterConfig": { "DedicatedMasterCount": number, "DedicatedMasterEnabled": boolean, "DedicatedMasterType": "string", "InstanceCount": number, "InstanceType": "string", "ZoneAwarenessConfig": { "AvailabilityZoneCount": number }, "ZoneAwarenessEnabled": boolean }, "ElasticsearchVersion": "string", "EncryptionAtRestOptions": { "Enabled": boolean, "KmsKeyId": "string" }, "LogPublishingOptions": { "AuditLogs": { "CloudWatchLogsLogGroupArn": "string", "Enabled": boolean }, "IndexSlowLogs": { "CloudWatchLogsLogGroupArn": "string", "Enabled": boolean }, "SearchSlowLogs": { "CloudWatchLogsLogGroupArn": "string", "Enabled": boolean } }, "NodeToNodeEncryptionOptions": { "Enabled": boolean }, "ServiceSoftwareOptions": { "AutomatedUpdateDate": "string", "Cancellable": boolean, "CurrentVersion": "string", "Description": "string", "NewVersion": "string", "UpdateAvailable": boolean, "UpdateStatus": "string" }, "VPCOptions": { "AvailabilityZones": [ "string" ], "SecurityGroupIds": [ "string" ], "SubnetIds": [ "string" ], "VPCId": "string" } } ``` # AwsElb resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsElb` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsElbLoadBalancer The `AwsElbLoadBalancer` object contains details about a Classic Load Balancer. The following example shows the AWS Security Finding Format (ASFF) for the `AwsElbLoadBalancer` object. To view descriptions of `AwsElbLoadBalancer` attributes, see [AwsElbLoadBalancerDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsElbLoadBalancerDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsElbLoadBalancer": { "AvailabilityZones": ["us-west-2a"], "BackendServerDescriptions": [ { "InstancePort": 80, "PolicyNames": ["doc-example-policy"] } ], "CanonicalHostedZoneName": "Z3DZXE0EXAMPLE", "CanonicalHostedZoneNameID": "my-load-balancer-444455556666.us-west-2.elb.amazonaws.com", "CreatedTime": "2020-08-03T19:22:44.637Z", "DnsName": "my-load-balancer-444455556666.us-west-2.elb.amazonaws.com", "HealthCheck": { "HealthyThreshold": 2, "Interval": 30, "Target": "HTTP:80/png", "Timeout": 3, "UnhealthyThreshold": 2 }, "Instances": [ { "InstanceId": "i-example" } ], "ListenerDescriptions": [ { "Listener": { "InstancePort": 443, "InstanceProtocol": "HTTPS", "LoadBalancerPort": 443, "Protocol": "HTTPS", "SslCertificateId": "arn:aws:iam::444455556666:server-certificate/my-server-cert" }, "PolicyNames": ["ELBSecurityPolicy-TLS-1-2-2017-01"] } ], "LoadBalancerAttributes": { "AccessLog": { "EmitInterval": 60, "Enabled": true, "S3BucketName": "amzn-s3-demo-bucket", "S3BucketPrefix": "doc-example-prefix" }, "ConnectionDraining": { "Enabled": false, "Timeout": 300 }, "ConnectionSettings": { "IdleTimeout": 30 }, "CrossZoneLoadBalancing": { "Enabled": true }, "AdditionalAttributes": [{ "Key": "elb.http.desyncmitigationmode", "Value": "strictest" }] }, "LoadBalancerName": "example-load-balancer", "Policies": { "AppCookieStickinessPolicies": [ { "CookieName": "", "PolicyName": "" } ], "LbCookieStickinessPolicies": [ { "CookieExpirationPeriod": 60, "PolicyName": "my-example-cookie-policy" } ], "OtherPolicies": [ "my-PublicKey-policy", "my-authentication-policy", "my-SSLNegotiation-policy", "my-ProxyProtocol-policy", "ELBSecurityPolicy-2015-03" ] }, "Scheme": "internet-facing", "SecurityGroups": ["sg-example"], "SourceSecurityGroup": { "GroupName": "my-elb-example-group", "OwnerAlias": "444455556666" }, "Subnets": ["subnet-example"], "VpcId": "vpc-a01106c2" } ``` ## AwsElbv2LoadBalancer The `AwsElbv2LoadBalancer` object provides information about a load balancer. The following example shows the AWS Security Finding Format (ASFF) for the `AwsElbv2LoadBalancer` object. To view descriptions of `AwsElbv2LoadBalancer` attributes, see [AwsElbv2LoadBalancerDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsElbv2LoadBalancerDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsElbv2LoadBalancer": { "AvailabilityZones": { "SubnetId": "string", "ZoneName": "string" }, "CanonicalHostedZoneId": "string", "CreatedTime": "string", "DNSName": "string", "IpAddressType": "string", "LoadBalancerAttributes": [ { "Key": "string", "Value": "string" } ], "Scheme": "string", "SecurityGroups": [ "string" ], "State": { "Code": "string", "Reason": "string" }, "Type": "string", "VpcId": "string" } ``` # AwsEventBridge resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsEventBridge` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsEventSchemasRegistry The `AwsEventSchemasRegistry` object provides information about an Amazon EventBridge schema registry. A schema defines the structure of events that are sent to EventBridge. Schema registries are containers that collect and logically group your schemas. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEventSchemasRegistry` object. To view descriptions of `AwsEventSchemasRegistry` attributes, see [AwsEventSchemasRegistry](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEventSchemasRegistryDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEventSchemasRegistry": { "Description": "This is an example event schema registry.", "RegistryArn": "arn:aws:schemas:us-east-1:123456789012:registry/schema-registry", "RegistryName": "schema-registry" } ``` ## AwsEventsEndpoint The `AwsEventsEndpoint` object provides information about an Amazon EventBridge global endpoint. The endpoint can improve your application’s availability by making it Regional-fault tolerant. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEventsEndpoint` object. To view descriptions of `AwsEventsEndpoint` attributes, see [AwsEventsEndpointDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEventsEndpointDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEventsEndpoint": { "Arn": "arn:aws:events:us-east-1:123456789012:endpoint/my-endpoint", "Description": "This is a sample endpoint.", "EndpointId": "04k1exajoy.veo", "EndpointUrl": "https://04k1exajoy.veo.endpoint.events.amazonaws.com", "EventBuses": [ { "EventBusArn": "arn:aws:events:us-east-1:123456789012:event-bus/default" }, { "EventBusArn": "arn:aws:events:us-east-2:123456789012:event-bus/default" } ], "Name": "my-endpoint", "ReplicationConfig": { "State": "ENABLED" }, "RoleArn": "arn:aws:iam::123456789012:role/service-role/Amazon_EventBridge_Invoke_Event_Bus_1258925394", "RoutingConfig": { "FailoverConfig": { "Primary": { "HealthCheck": "arn:aws:route53:::healthcheck/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111" }, "Secondary": { "Route": "us-east-2" } } }, "State": "ACTIVE" } ``` ## AwsEventsEventbus The `AwsEventsEventbus` object provides information about an Amazon EventBridge global endpoint. The endpoint can improve your application’s availability by making it Regional-fault tolerant. The following example shows the AWS Security Finding Format (ASFF) for the `AwsEventsEventbus` object. To view descriptions of `AwsEventsEventbus` attributes, see [AwsEventsEventbusDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsEventsEventbusDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsEventsEventbus": "Arn": "arn:aws:events:us-east-1:123456789012:event-bus/my-event-bus", "Name": "my-event-bus", "Policy": "{\"Version\":\"2012-10-17\", \"Statement\":[{\"Sid\":\"AllowAllAccountsFromOrganizationToPutEvents\",\"Effect\":\"Allow\",\"Principal\":\"*\",\"Action\":\"events:PutEvents\",\"Resource\":\"arn:aws:events:us-east-1:123456789012:event-bus/my-event-bus\",\"Condition\":{\"StringEquals\":{\"aws:PrincipalOrgID\":\"o-ki7yjtkjv5\"}}},{\"Sid\":\"AllowAccountToManageRulesTheyCreated\",\"Effect\":\"Allow\",\"Principal\":{\"AWS\":\"arn:aws:iam::123456789012:root\"},\"Action\":[\"events:PutRule\",\"events:PutTargets\",\"events:DeleteRule\",\"events:RemoveTargets\",\"events:DisableRule\",\"events:EnableRule\",\"events:TagResource\",\"events:UntagResource\",\"events:DescribeRule\",\"events:ListTargetsByRule\",\"events:ListTagsForResource\"],\"Resource\":\"arn:aws:events:us-east-1:123456789012:rule/my-event-bus\",\"Condition\":{\"StringEqualsIfExists\":{\"events:creatorAccount\":\"123456789012\"}}}]}" ``` # AwsGuardDuty resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsGuardDuty` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsGuardDutyDetector The `AwsGuardDutyDetector` object provides information about an Amazon GuardDuty detector. A detector is an object that represents the GuardDuty service. A detector is required for GuardDuty to become operational. The following example shows the AWS Security Finding Format (ASFF) for the `AwsGuardDutyDetector` object. To view descriptions of `AwsGuardDutyDetector` attributes, see [AwsGuardDutyDetector](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsGuardDutyDetectorDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsGuardDutyDetector": { "FindingPublishingFrequency": "SIX_HOURS", "ServiceRole": "arn:aws:iam::123456789012:role/aws-service-role/guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDuty", "Status": "ENABLED", "DataSources": { "CloudTrail": { "Status": "ENABLED" }, "DnsLogs": { "Status": "ENABLED" }, "FlowLogs": { "Status": "ENABLED" }, "S3Logs": { "Status": "ENABLED" }, "Kubernetes": { "AuditLogs": { "Status": "ENABLED" } }, "MalwareProtection": { "ScanEc2InstanceWithFindings": { "EbsVolumes": { "Status": "ENABLED" } }, "ServiceRole": "arn:aws:iam::123456789012:role/aws-service-role/malware-protection.guardduty.amazonaws.com/AWSServiceRoleForAmazonGuardDutyMalwareProtection" } } } ``` # AwsIam resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsIam` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsIamAccessKey The `AwsIamAccessKey` object contains details about an IAM access key that is related to a finding. The following example shows the AWS Security Finding Format (ASFF) for the `AwsIamAccessKey` object. To view descriptions of `AwsIamAccessKey` attributes, see [AwsIamAccessKeyDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsIamAccessKeyDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsIamAccessKey": { "AccessKeyId": "string", "AccountId": "string", "CreatedAt": "string", "PrincipalId": "string", "PrincipalName": "string", "PrincipalType": "string", "SessionContext": { "Attributes": { "CreationDate": "string", "MfaAuthenticated": boolean }, "SessionIssuer": { "AccountId": "string", "Arn": "string", "PrincipalId": "string", "Type": "string", "UserName": "string" } }, "Status": "string" } ``` ## AwsIamGroup The `AwsIamGroup` object contains details about an IAM group. The following example shows the AWS Security Finding Format (ASFF) for the `AwsIamGroup` object. To view descriptions of `AwsIamGroup` attributes, see [AwsIamGroupDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsIamGroupDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsIamGroup": { "AttachedManagedPolicies": [ { "PolicyArn": "arn:aws:iam::aws:policy/ExampleManagedAccess", "PolicyName": "ExampleManagedAccess", } ], "CreateDate": "2020-04-28T14:08:37.000Z", "GroupId": "AGPA4TPS3VLP7QEXAMPLE", "GroupName": "Example_User_Group", "GroupPolicyList": [ { "PolicyName": "ExampleGroupPolicy" } ], "Path": "/" } ``` ## AwsIamPolicy The `AwsIamPolicy` object represents an IAM permissions policy. The following example shows the AWS Security Finding Format (ASFF) for the `AwsIamPolicy` object. To view descriptions of `AwsIamPolicy` attributes, see [AwsIamPolicyDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsIamPolicyDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsIamPolicy": { "AttachmentCount": 1, "CreateDate": "2017-09-14T08:17:29.000Z", "DefaultVersionId": "v1", "Description": "Example IAM policy", "IsAttachable": true, "Path": "/", "PermissionsBoundaryUsageCount": 5, "PolicyId": "ANPAJ2UCCR6DPCEXAMPLE", "PolicyName": "EXAMPLE-MANAGED-POLICY", "PolicyVersionList": [ { "VersionId": "v1", "IsDefaultVersion": true, "CreateDate": "2017-09-14T08:17:29.000Z" } ], "UpdateDate": "2017-09-14T08:17:29.000Z" } ``` ## AwsIamRole The `AwsIamRole` object contains information about an IAM role, including all of the role's policies. The following example shows the AWS Security Finding Format (ASFF) for the `AwsIamRole` object. To view descriptions of `AwsIamRole` attributes, see [AwsIamRoleDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsIamRoleDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsIamRole": { "AssumeRolePolicyDocument": "{'Version': '2012-10-17', 'Statement': [{'Effect': 'Allow','Action': 'sts:AssumeRole'}]}", "AttachedManagedPolicies": [ { "PolicyArn": "arn:aws:iam::aws:policy/ExamplePolicy1", "PolicyName": "Example policy 1" }, { "PolicyArn": "arn:aws:iam::444455556666:policy/ExamplePolicy2", "PolicyName": "Example policy 2" } ], "CreateDate": "2020-03-14T07:19:14.000Z", "InstanceProfileList": [ { "Arn": "arn:aws:iam::333333333333:ExampleProfile", "CreateDate": "2020-03-11T00:02:27Z", "InstanceProfileId": "AIPAIXEU4NUHUPEXAMPLE", "InstanceProfileName": "ExampleInstanceProfile", "Path": "/", "Roles": [ { "Arn": "arn:aws:iam::444455556666:role/example-role", "AssumeRolePolicyDocument": "", "CreateDate": "2020-03-11T00:02:27Z", "Path": "/", "RoleId": "AROAJ52OTH4H7LEXAMPLE", "RoleName": "example-role", } ] } ], "MaxSessionDuration": 3600, "Path": "/", "PermissionsBoundary": { "PermissionsBoundaryArn": "arn:aws:iam::aws:policy/AdministratorAccess", "PermissionsBoundaryType": "PermissionsBoundaryPolicy" }, "RoleId": "AROA4TPS3VLEXAMPLE", "RoleName": "BONESBootstrapHydra-OverbridgeOpsFunctionsLambda", "RolePolicyList": [ { "PolicyName": "Example role policy" } ] } ``` ## AwsIamUser The `AwsIamUser` object provides information about a user. The following example shows the AWS Security Finding Format (ASFF) for the `AwsIamUser` object. To view descriptions of `AwsIamUser` attributes, see [AwsIamUserDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsIamUserDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsIamUser": { "AttachedManagedPolicies": [ { "PolicyName": "ExamplePolicy", "PolicyArn": "arn:aws:iam::aws:policy/ExampleAccess" } ], "CreateDate": "2018-01-26T23:50:05.000Z", "GroupList": [], "Path": "/", "PermissionsBoundary" : { "PermissionsBoundaryArn" : "arn:aws:iam::aws:policy/AdministratorAccess", "PermissionsBoundaryType" : "PermissionsBoundaryPolicy" }, "UserId": "AIDACKCEVSQ6C2EXAMPLE", "UserName": "ExampleUser", "UserPolicyList": [ { "PolicyName": "InstancePolicy" } ] } ``` # AwsKinesis resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsKinesis` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsKinesisStream The `AwsKinesisStream` object provides details about Amazon Kinesis Data Streams. The following example shows the AWS Security Finding Format (ASFF) for the `AwsKinesisStream` object. To view descriptions of `AwsKinesisStream` attributes, see [AwsKinesisStreamDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsKinesisStreamDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsKinesisStream": { "Name": "test-vir-kinesis-stream", "Arn": "arn:aws:kinesis:us-east-1:293279581038:stream/test-vir-kinesis-stream", "RetentionPeriodHours": 24, "ShardCount": 2, "StreamEncryption": { "EncryptionType": "KMS", "KeyId": "arn:aws:kms:us-east-1:293279581038:key/849cf029-4143-4c59-91f8-ea76007247eb" } } ``` # AwsKms resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsKms` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsKmsKey The `AwsKmsKey` object provides details about an AWS KMS key. The following example shows the AWS Security Finding Format (ASFF) for the `AwsKmsKey` object. To view descriptions of `AwsKmsKey` attributes, see [AwsKmsKeyDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsKmsKeyDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsKmsKey": { "AWSAccountId": "string", "CreationDate": "string", "Description": "string", "KeyId": "string", "KeyManager": "string", "KeyRotationStatus": boolean, "KeyState": "string", "Origin": "string" } ``` # AwsLambda The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsLambda` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsLambdaFunction The `AwsLambdaFunction` object provides details about a Lambda function's configuration. The following example shows the AWS Security Finding Format (ASFF) for the `AwsLambdaFunction` object. To view descriptions of `AwsLambdaFunction` attributes, see [AwsLambdaFunctionDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsLambdaFunctionDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsLambdaFunction": { "Architectures": [ "x86_64" ], "Code": { "S3Bucket": "amzn-s3-demo-bucket", "S3Key": "samplekey", "S3ObjectVersion": "2", "ZipFile": "myzip.zip" }, "CodeSha256": "1111111111111abcdef", "DeadLetterConfig": { "TargetArn": "arn:aws:lambda:us-east-2:123456789012:queue:myqueue:2" }, "Environment": { "Variables": { "Stage": "foobar" }, "Error": { "ErrorCode": "Sample-error-code", "Message": "Caller principal is a manager." } }, "FunctionName": "CheckOut", "Handler": "main.py:lambda_handler", "KmsKeyArn": "arn:aws:kms:us-west-2:123456789012:key/mykey", "LastModified": "2001-09-11T09:00:00Z", "Layers": { "Arn": "arn:aws:lambda:us-east-2:123456789012:layer:my-layer:3", "CodeSize": 169 }, "PackageType": "Zip", "RevisionId": "23", "Role": "arn:aws:iam::123456789012:role/Accounting-Role", "Runtime": "go1.7", "Timeout": 15, "TracingConfig": { "Mode": "Active" }, "Version": "$LATEST$", "VpcConfig": { "SecurityGroupIds": ["sg-085912345678492fb", "sg-08591234567bdgdc"], "SubnetIds": ["subnet-071f712345678e7c8", "subnet-07fd123456788a036"] }, "MasterArn": "arn:aws:lambda:us-east-2:123456789012:\$LATEST", "MemorySize": 2048 } ``` ## AwsLambdaLayerVersion The `AwsLambdaLayerVersion` object provides details about a Lambda layer version. The following example shows the AWS Security Finding Format (ASFF) for the `AwsLambdaLayerVersion` object. To view descriptions of `AwsLambdaLayerVersion` attributes, see [AwsLambdaLayerVersionDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsLambdaLayerVersionDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsLambdaLayerVersion": { "Version": 2, "CompatibleRuntimes": [ "java8" ], "CreatedDate": "2019-10-09T22:02:00.274+0000" } ``` # AwsMsk resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsMsk` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsMskCluster The `AwsMskCluster` object provides information about an Amazon Managed Streaming for Apache Kafka (Amazon MSK) cluster. The following example shows the AWS Security Finding Format (ASFF) for the `AwsMskCluster` object. To view descriptions of `AwsMskCluster` attributes, see [AwsMskClusterDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsMskClusterDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsMskCluster": { "ClusterInfo": { "ClientAuthentication": { "Sasl": { "Scram": { "Enabled": true }, "Iam": { "Enabled": true } }, "Tls": { "CertificateAuthorityArnList": [], "Enabled": false }, "Unauthenticated": { "Enabled": false } }, "ClusterName": "my-cluster", "CurrentVersion": "K2PWKAKR8XB7XF", "EncryptionInfo": { "EncryptionAtRest": { "DataVolumeKMSKeyId": "arn:aws:kms:us-east-1:123456789012:key/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111" }, "EncryptionInTransit": { "ClientBroker": "TLS", "InCluster": true } }, "EnhancedMonitoring": "PER_TOPIC_PER_BROKER", "NumberOfBrokerNodes": 3 } } ``` # AwsNetworkFirewall resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsNetworkFirewall` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsNetworkFirewallFirewall The `AwsNetworkFirewallFirewall` object contains details about an AWS Network Firewall firewall. The following example shows the AWS Security Finding Format (ASFF) for the `AwsNetworkFirewallFirewall` object. To view descriptions of `AwsNetworkFirewallFirewall` attributes, see [AwsNetworkFirewallFirewallDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsNetworkFirewallFirewallDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsNetworkFirewallFirewall": { "DeleteProtection": false, "FirewallArn": "arn:aws:network-firewall:us-east-1:024665936331:firewall/testfirewall", "FirewallPolicyArn": "arn:aws:network-firewall:us-east-1:444455556666:firewall-policy/InitialFirewall", "FirewallId": "dea7d8e9-ae38-4a8a-b022-672a830a99fa", "FirewallName": "testfirewall", "FirewallPolicyChangeProtection": false, "SubnetChangeProtection": false, "SubnetMappings": [ { "SubnetId": "subnet-0183481095e588cdc" }, { "SubnetId": "subnet-01f518fad1b1c90b0" } ], "VpcId": "vpc-40e83c38" } ``` ## AwsNetworkFirewallFirewallPolicy The `AwsNetworkFirewallFirewallPolicy` object provides details about a firewall policy. A firewall policy defines the behavior of a network firewall. The following example shows the AWS Security Finding Format (ASFF) for the `AwsNetworkFirewallFirewallPolicy` object. To view descriptions of `AwsNetworkFirewallFirewallPolicy` attributes, see [AwsNetworkFirewallFirewallPolicyDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsNetworkFirewallFirewallPolicyDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsNetworkFirewallFirewallPolicy": { "FirewallPolicy": { "StatefulRuleGroupReferences": [ { "ResourceArn": "arn:aws:network-firewall:us-east-1:444455556666:stateful-rulegroup/PatchesOnly" } ], "StatelessDefaultActions": [ "aws:forward_to_sfe" ], "StatelessFragmentDefaultActions": [ "aws:forward_to_sfe" ], "StatelessRuleGroupReferences": [ { "Priority": 1, "ResourceArn": "arn:aws:network-firewall:us-east-1:444455556666:stateless-rulegroup/Stateless-1" } ] }, "FirewallPolicyArn": "arn:aws:network-firewall:us-east-1:444455556666:firewall-policy/InitialFirewall", "FirewallPolicyId": "9ceeda22-6050-4048-a0ca-50ce47f0cc65", "FirewallPolicyName": "InitialFirewall", "Description": "Initial firewall" } ``` ## AwsNetworkFirewallRuleGroup The `AwsNetworkFirewallRuleGroup` object provides details about an AWS Network Firewall rule group. Rule groups are used to inspect and control network traffic. Stateless rule groups apply to individual packets. Stateful rule groups apply to packets in the context of their traffic flow. Rule groups are referenced in firewall policies. The following examples show the AWS Security Finding Format (ASFF) for the `AwsNetworkFirewallRuleGroup` object. To view descriptions of `AwsNetworkFirewallRuleGroup` attributes, see [AwsNetworkFirewallRuleGroupDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsNetworkFirewallRuleGroupDetails.html) in the *AWS Security Hub API Reference*. **Example – stateless rule group** ``` "AwsNetworkFirewallRuleGroup": { "Capacity": 600, "RuleGroupArn": "arn:aws:network-firewall:us-east-1:444455556666:stateless-rulegroup/Stateless-1", "RuleGroupId": "fb13c4df-b6da-4c1e-91ec-84b7a5487493", "RuleGroupName": "Stateless-1" "Description": "Example of a stateless rule group", "Type": "STATELESS", "RuleGroup": { "RulesSource": { "StatelessRulesAndCustomActions": { "CustomActions": [], "StatelessRules": [ { "Priority": 1, "RuleDefinition": { "Actions": [ "aws:pass" ], "MatchAttributes": { "DestinationPorts": [ { "FromPort": 443, "ToPort": 443 } ], "Destinations": [ { "AddressDefinition": "192.0.2.0/24" } ], "Protocols": [ 6 ], "SourcePorts": [ { "FromPort": 0, "ToPort": 65535 } ], "Sources": [ { "AddressDefinition": "198.51.100.0/24" } ] } } } ] } } } } ``` **Example – stateful rule group** ``` "AwsNetworkFirewallRuleGroup": { "Capacity": 100, "RuleGroupArn": "arn:aws:network-firewall:us-east-1:444455556666:stateful-rulegroup/tupletest", "RuleGroupId": "38b71c12-da80-4643-a6c5-03337f8933e0", "RuleGroupName": "ExampleRuleGroup", "Description": "Example of a stateful rule group", "Type": "STATEFUL", "RuleGroup": { "RuleSource": { "StatefulRules": [ { "Action": "PASS", "Header": { "Destination": "Any", "DestinationPort": "443", "Direction": "ANY", "Protocol": "TCP", "Source": "Any", "SourcePort": "Any" }, "RuleOptions": [ { "Keyword": "sid:1" } ] } ] } } } ``` The following is a list of valid value examples for `AwsNetworkFirewallRuleGroup` attributes: + `Action` Valid values: `PASS` \$1 `DROP` \$1 `ALERT` + `Protocol` Valid values: `IP` \$1 `TCP` \$1 `UDP` \$1 `ICMP` \$1 `HTTP` \$1 `FTP` \$1 `TLS` \$1 `SMB` \$1 `DNS` \$1 `DCERPC` \$1 `SSH` \$1 `SMTP` \$1 `IMAP` \$1 `MSN` \$1 `KRB5` \$1 `IKEV2` \$1 `TFTP` \$1 `NTP` \$1 `DHCP` + `Flags` Valid values: `FIN` \$1 `SYN` \$1 `RST` \$1 `PSH` \$1 `ACK` \$1 `URG` \$1 `ECE` \$1 `CWR` + `Masks` Valid values: `FIN` \$1 `SYN` \$1 `RST` \$1 `PSH` \$1 `ACK` \$1 `URG` \$1 `ECE` \$1 `CWR` # AwsOpenSearchService resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsOpenSearchService` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsOpenSearchServiceDomain The `AwsOpenSearchServiceDomain` object contains information about an Amazon OpenSearch Service domain. The following example shows the AWS Security Finding Format (ASFF) for the `AwsOpenSearchServiceDomain` object. To view descriptions of `AwsOpenSearchServiceDomain` attributes, see [AwsOpenSearchServiceDomainDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsOpenSearchServiceDomainDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsOpenSearchServiceDomain": { "AccessPolicies": "IAM_Id", "AdvancedSecurityOptions": { "Enabled": true, "InternalUserDatabaseEnabled": true, "MasterUserOptions": { "MasterUserArn": "arn:aws:iam::123456789012:user/third-master-use", "MasterUserName": "third-master-use", "MasterUserPassword": "some-password" } }, "Arn": "arn:aws:Opensearch:us-east-1:111122223333:somedomain", "ClusterConfig": { "InstanceType": "c5.large.search", "InstanceCount": 1, "DedicatedMasterEnabled": true, "ZoneAwarenessEnabled": false, "ZoneAwarenessConfig": { "AvailabilityZoneCount": 2 }, "DedicatedMasterType": "c5.large.search", "DedicatedMasterCount": 3, "WarmEnabled": true, "WarmCount": 3, "WarmType": "ultrawarm1.large.search" }, "DomainEndpoint": "https://es-2021-06-23t17-04-qowmgghud5vofgb5e4wmi.eu-central-1.es.amazonaws.com", "DomainEndpointOptions": { "EnforceHTTPS": false, "TLSSecurityPolicy": "Policy-Min-TLS-1-0-2019-07", "CustomEndpointCertificateArn": "arn:aws:acm:us-east-1:111122223333:certificate/bda1bff1-79c0-49d0-abe6-50a15a7477d4", "CustomEndpointEnabled": true, "CustomEndpoint": "example.com" }, "DomainEndpoints": { "vpc": "vpc-endpoint-h2dsd34efgyghrtguk5gt6j2foh4.us-east-1.es.amazonaws.com" }, "DomainName": "my-domain", "EncryptionAtRestOptions": { "Enabled": false, "KmsKeyId": "1a2a3a4-1a2a-3a4a-5a6a-1a2a3a4a5a6a" }, "EngineVersion": "7.1", "Id": "123456789012", "LogPublishingOptions": { "IndexSlowLogs": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:111122223333:log-group:/aws/aes/domains/es-index-slow-logs", "Enabled": true }, "SearchSlowLogs": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:111122223333:log-group:/aws/aes/domains/es-slow-logs", "Enabled": true }, "AuditLogs": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:111122223333:log-group:/aws/aes/domains/es-slow-logs", "Enabled": true } }, "NodeToNodeEncryptionOptions": { "Enabled": true }, "ServiceSoftwareOptions": { "AutomatedUpdateDate": "2022-04-28T14:08:37.000Z", "Cancellable": false, "CurrentVersion": "R20210331", "Description": "There is no software update available for this domain.", "NewVersion": "OpenSearch_1.0", "UpdateAvailable": false, "UpdateStatus": "COMPLETED", "OptionalDeployment": false }, "VpcOptions": { "SecurityGroupIds": [ "sg-2a3a4a5a" ], "SubnetIds": [ "subnet-1a2a3a4a" ], } } ``` # AwsRds resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsRds` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsRdsDbCluster The `AwsRdsDbCluster` object provides details about an Amazon RDS database cluster. The following example shows the AWS Security Finding Format (ASFF) for the `AwsRdsDbCluster` object. To view descriptions of `AwsRdsDbCluster` attributes, see [AwsRdsDbClusterDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsRdsDbClusterDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsRdsDbCluster": { "ActivityStreamStatus": "stopped", "AllocatedStorage": 1, "AssociatedRoles": [ { "RoleArn": "arn:aws:iam::777788889999:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS", "Status": "PENDING" } ], "AutoMinorVersionUpgrade": true, "AvailabilityZones": [ "us-east-1a", "us-east-1c", "us-east-1e" ], "BackupRetentionPeriod": 1, "ClusterCreateTime": "2020-06-22T17:40:12.322Z", "CopyTagsToSnapshot": true, "CrossAccountClone": false, "CustomEndpoints": [], "DatabaseName": "Sample name", "DbClusterIdentifier": "database-3", "DbClusterMembers": [ { "DbClusterParameterGroupStatus": "in-sync", "DbInstanceIdentifier": "database-3-instance-1", "IsClusterWriter": true, "PromotionTier": 1, } ], "DbClusterOptionGroupMemberships": [], "DbClusterParameterGroup": "cluster-parameter-group", "DbClusterResourceId": "cluster-example", "DbSubnetGroup": "subnet-group", "DeletionProtection": false, "DomainMemberships": [], "Status": "modifying", "EnabledCloudwatchLogsExports": [ "audit", "error", "general", "slowquery" ], "Endpoint": "database-3.cluster-example.us-east-1.rds.amazonaws.com", "Engine": "aurora-mysql", "EngineMode": "provisioned", "EngineVersion": "5.7.mysql_aurora.2.03.4", "HostedZoneId": "ZONE1", "HttpEndpointEnabled": false, "IamDatabaseAuthenticationEnabled": false, "KmsKeyId": "arn:aws:kms:us-east-1:777788889999:key/key1", "MasterUsername": "admin", "MultiAz": false, "Port": 3306, "PreferredBackupWindow": "04:52-05:22", "PreferredMaintenanceWindow": "sun:09:32-sun:10:02", "ReaderEndpoint": "database-3.cluster-ro-example.us-east-1.rds.amazonaws.com", "ReadReplicaIdentifiers": [], "Status": "Modifying", "StorageEncrypted": true, "VpcSecurityGroups": [ { "Status": "active", "VpcSecurityGroupId": "sg-example-1" } ], } ``` ## AwsRdsDbClusterSnapshot The `AwsRdsDbClusterSnapshot` object contains information about an Amazon RDS DB cluster snapshot. The following example shows the AWS Security Finding Format (ASFF) for the `AwsRdsDbClusterSnapshot` object. To view descriptions of `AwsRdsDbClusterSnapshot` attributes, see [AwsRdsDbClusterSnapshotDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsRdsDbClusterSnapshotDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsRdsDbClusterSnapshot": { "AllocatedStorage": 0, "AvailabilityZones": [ "us-east-1a", "us-east-1d", "us-east-1e" ], "ClusterCreateTime": "2020-06-12T13:23:15.577Z", "DbClusterIdentifier": "database-2", "DbClusterSnapshotAttributes": [{ "AttributeName": "restore", "AttributeValues": ["123456789012"] }], "DbClusterSnapshotIdentifier": "rds:database-2-2020-06-23-03-52", "Engine": "aurora", "EngineVersion": "5.6.10a", "IamDatabaseAuthenticationEnabled": false, "KmsKeyId": "arn:aws:kms:us-east-1:777788889999:key/key1", "LicenseModel": "aurora", "MasterUsername": "admin", "PercentProgress": 100, "Port": 0, "SnapshotCreateTime": "2020-06-22T17:40:12.322Z", "SnapshotType": "automated", "Status": "available", "StorageEncrypted": true, "VpcId": "vpc-faf7e380" } ``` ## AwsRdsDbInstance The `AwsRdsDbInstance` object provides details about an Amazon RDS DB instance. The following example shows the AWS Security Finding Format (ASFF) for the `AwsRdsDbInstance` object. To view descriptions of `AwsRdsDbInstance` attributes, see [AwsRdsDbInstanceDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsRdsDbInstanceDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsRdsDbInstance": { "AllocatedStorage": 20, "AssociatedRoles": [], "AutoMinorVersionUpgrade": true, "AvailabilityZone": "us-east-1d", "BackupRetentionPeriod": 7, "CaCertificateIdentifier": "certificate1", "CharacterSetName": "", "CopyTagsToSnapshot": true, "DbClusterIdentifier": "", "DbInstanceArn": "arn:aws:rds:us-east-1:111122223333:db:database-1", "DbInstanceClass": "db.t2.micro", "DbInstanceIdentifier": "database-1", "DbInstancePort": 0, "DbInstanceStatus": "available", "DbiResourceId": "db-EXAMPLE123", "DbName": "", "DbParameterGroups": [ { "DbParameterGroupName": "default.mysql5.7", "ParameterApplyStatus": "in-sync" } ], "DbSecurityGroups": [], "DbSubnetGroup": { "DbSubnetGroupName": "my-group-123abc", "DbSubnetGroupDescription": "My subnet group", "VpcId": "vpc-example1", "SubnetGroupStatus": "Complete", "Subnets": [ { "SubnetIdentifier": "subnet-123abc", "SubnetAvailabilityZone": { "Name": "us-east-1d" }, "SubnetStatus": "Active" }, { "SubnetIdentifier": "subnet-456def", "SubnetAvailabilityZone": { "Name": "us-east-1c" }, "SubnetStatus": "Active" } ], "DbSubnetGroupArn": "" }, "DeletionProtection": false, "DomainMemberships": [], "EnabledCloudWatchLogsExports": [], "Endpoint": { "address": "database-1.example.us-east-1.rds.amazonaws.com", "port": 3306, "hostedZoneId": "ZONEID1" }, "Engine": "mysql", "EngineVersion": "5.7.22", "EnhancedMonitoringResourceArn": "arn:aws:logs:us-east-1:111122223333:log-group:Example:log-stream:db-EXAMPLE1", "IamDatabaseAuthenticationEnabled": false, "InstanceCreateTime": "2020-06-22T17:40:12.322Z", "Iops": "", "KmsKeyId": "", "LatestRestorableTime": "2020-06-24T05:50:00.000Z", "LicenseModel": "general-public-license", "ListenerEndpoint": "", "MasterUsername": "admin", "MaxAllocatedStorage": 1000, "MonitoringInterval": 60, "MonitoringRoleArn": "arn:aws:iam::111122223333:role/rds-monitoring-role", "MultiAz": false, "OptionGroupMemberships": [ { "OptionGroupName": "default:mysql-5-7", "Status": "in-sync" } ], "PreferredBackupWindow": "03:57-04:27", "PreferredMaintenanceWindow": "thu:10:13-thu:10:43", "PendingModifiedValues": { "DbInstanceClass": "", "AllocatedStorage": "", "MasterUserPassword": "", "Port": "", "BackupRetentionPeriod": "", "MultiAZ": "", "EngineVersion": "", "LicenseModel": "", "Iops": "", "DbInstanceIdentifier": "", "StorageType": "", "CaCertificateIdentifier": "", "DbSubnetGroupName": "", "PendingCloudWatchLogsExports": "", "ProcessorFeatures": [] }, "PerformanceInsightsEnabled": false, "PerformanceInsightsKmsKeyId": "", "PerformanceInsightsRetentionPeriod": "", "ProcessorFeatures": [], "PromotionTier": "", "PubliclyAccessible": false, "ReadReplicaDBClusterIdentifiers": [], "ReadReplicaDBInstanceIdentifiers": [], "ReadReplicaSourceDBInstanceIdentifier": "", "SecondaryAvailabilityZone": "", "StatusInfos": [], "StorageEncrypted": false, "StorageType": "gp2", "TdeCredentialArn": "", "Timezone": "", "VpcSecurityGroups": [ { "VpcSecurityGroupId": "sg-example1", "Status": "active" } ] } ``` ## AwsRdsDbSecurityGroup The `AwsRdsDbSecurityGroup` object contains information about an Amazon Relational Database Service The following example shows the AWS Security Finding Format (ASFF) for the `AwsRdsDbSecurityGroup` object. To view descriptions of `AwsRdsDbSecurityGroup` attributes, see [AwsRdsDbSecurityGroupDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsRdsDbSecurityGroupDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsRdsDbSecurityGroup": { "DbSecurityGroupArn": "arn:aws:rds:us-west-1:111122223333:secgrp:default", "DbSecurityGroupDescription": "default", "DbSecurityGroupName": "mysecgroup", "Ec2SecurityGroups": [ { "Ec2SecurityGroupuId": "myec2group", "Ec2SecurityGroupName": "default", "Ec2SecurityGroupOwnerId": "987654321021", "Status": "authorizing" } ], "IpRanges": [ { "Cidrip": "0.0.0.0/0", "Status": "authorizing" } ], "OwnerId": "123456789012", "VpcId": "vpc-1234567f" } ``` ## AwsRdsDbSnapshot The `AwsRdsDbSnapshot` object contains details about an Amazon RDS DB cluster snapshot. The following example shows the AWS Security Finding Format (ASFF) for the `AwsRdsDbSnapshot` object. To view descriptions of `AwsRdsDbSnapshot` attributes, see [AwsRdsDbSnapshotDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsRdsDbSnapshotDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsRdsDbSnapshot": { "DbSnapshotIdentifier": "rds:database-1-2020-06-22-17-41", "DbInstanceIdentifier": "database-1", "SnapshotCreateTime": "2020-06-22T17:41:29.967Z", "Engine": "mysql", "AllocatedStorage": 20, "Status": "available", "Port": 3306, "AvailabilityZone": "us-east-1d", "VpcId": "vpc-example1", "InstanceCreateTime": "2020-06-22T17:40:12.322Z", "MasterUsername": "admin", "EngineVersion": "5.7.22", "LicenseModel": "general-public-license", "SnapshotType": "automated", "Iops": null, "OptionGroupName": "default:mysql-5-7", "PercentProgress": 100, "SourceRegion": null, "SourceDbSnapshotIdentifier": "", "StorageType": "gp2", "TdeCredentialArn": "", "Encrypted": false, "KmsKeyId": "", "Timezone": "", "IamDatabaseAuthenticationEnabled": false, "ProcessorFeatures": [], "DbiResourceId": "db-resourceexample1" } ``` ## AwsRdsEventSubscription The `AwsRdsEventSubscription` contains details about an RDS event notification subscription. The subscription allows RDS to post events to an SNS topic. The following example shows the AWS Security Finding Format (ASFF) for the `AwsRdsEventSubscription` object. To view descriptions of `AwsRdsEventSubscription` attributes, see [AwsRdsEventSubscriptionDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsRdsEventSubscriptionDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsRdsEventSubscription": { "CustSubscriptionId": "myawsuser-secgrp", "CustomerAwsId": "111111111111", "Enabled": true, "EventCategoriesList": [ "configuration change", "failure" ], "EventSubscriptionArn": "arn:aws:rds:us-east-1:111111111111:es:my-instance-events", "SnsTopicArn": "arn:aws:sns:us-east-1:111111111111:myawsuser-RDS", "SourceIdsList": [ "si-sample", "mysqldb-rr" ], "SourceType": "db-security-group", "Status": "creating", "SubscriptionCreationTime": "2021-06-27T01:38:01.090Z" } ``` # AwsRedshift resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsRedshift` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsRedshiftCluster The `AwsRedshiftCluster` object contains details about an Amazon Redshift cluster. The following example shows the AWS Security Finding Format (ASFF) for the `AwsRedshiftCluster` object. To view descriptions of `AwsRedshiftCluster` attributes, see [AwsRedshiftClusterDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsRedshiftClusterDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsRedshiftCluster": { "AllowVersionUpgrade": true, "AutomatedSnapshotRetentionPeriod": 1, "AvailabilityZone": "us-west-2d", "ClusterAvailabilityStatus": "Unavailable", "ClusterCreateTime": "2020-08-03T19:22:44.637Z", "ClusterIdentifier": "redshift-cluster-1", "ClusterNodes": [ { "NodeRole": "LEADER", "PrivateIPAddress": "192.0.2.108", "PublicIPAddress": "198.51.100.29" }, { "NodeRole": "COMPUTE-0", "PrivateIPAddress": "192.0.2.22", "PublicIPAddress": "198.51.100.63" }, { "NodeRole": "COMPUTE-1", "PrivateIPAddress": "192.0.2.224", "PublicIPAddress": "198.51.100.226" } ], "ClusterParameterGroups": [ { "ClusterParameterStatusList": [ { "ParameterName": "max_concurrency_scaling_clusters", "ParameterApplyStatus": "in-sync", "ParameterApplyErrorDescription": "parameterApplyErrorDescription" }, { "ParameterName": "enable_user_activity_logging", "ParameterApplyStatus": "in-sync", "ParameterApplyErrorDescription": "parameterApplyErrorDescription" }, { "ParameterName": "auto_analyze", "ParameterApplyStatus": "in-sync", "ParameterApplyErrorDescription": "parameterApplyErrorDescription" }, { "ParameterName": "query_group", "ParameterApplyStatus": "in-sync", "ParameterApplyErrorDescription": "parameterApplyErrorDescription" }, { "ParameterName": "datestyle", "ParameterApplyStatus": "in-sync", "ParameterApplyErrorDescription": "parameterApplyErrorDescription" }, { "ParameterName": "extra_float_digits", "ParameterApplyStatus": "in-sync", "ParameterApplyErrorDescription": "parameterApplyErrorDescription" }, { "ParameterName": "search_path", "ParameterApplyStatus": "in-sync", "ParameterApplyErrorDescription": "parameterApplyErrorDescription" }, { "ParameterName": "statement_timeout", "ParameterApplyStatus": "in-sync", "ParameterApplyErrorDescription": "parameterApplyErrorDescription" }, { "ParameterName": "wlm_json_configuration", "ParameterApplyStatus": "in-sync", "ParameterApplyErrorDescription": "parameterApplyErrorDescription" }, { "ParameterName": "require_ssl", "ParameterApplyStatus": "in-sync", "ParameterApplyErrorDescription": "parameterApplyErrorDescription" }, { "ParameterName": "use_fips_ssl", "ParameterApplyStatus": "in-sync", "ParameterApplyErrorDescription": "parameterApplyErrorDescription" } ], "ParameterApplyStatus": "in-sync", "ParameterGroupName": "temp" } ], "ClusterPublicKey": "JalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY Amazon-Redshift", "ClusterRevisionNumber": 17498, "ClusterSecurityGroups": [ { "ClusterSecurityGroupName": "default", "Status": "active" } ], "ClusterSnapshotCopyStatus": { "DestinationRegion": "us-west-2", "ManualSnapshotRetentionPeriod": -1, "RetentionPeriod": 1, "SnapshotCopyGrantName": "snapshotCopyGrantName" }, "ClusterStatus": "available", "ClusterSubnetGroupName": "default", "ClusterVersion": "1.0", "DBName": "dev", "DeferredMaintenanceWindows": [ { "DeferMaintenanceEndTime": "2020-10-07T20:34:01.000Z", "DeferMaintenanceIdentifier": "deferMaintenanceIdentifier", "DeferMaintenanceStartTime": "2020-09-07T20:34:01.000Z" } ], "ElasticIpStatus": { "ElasticIp": "203.0.113.29", "Status": "active" }, "ElasticResizeNumberOfNodeOptions": "4", "Encrypted": false, "Endpoint": { "Address": "redshift-cluster-1.example.us-west-2.redshift.amazonaws.com", "Port": 5439 }, "EnhancedVpcRouting": false, "ExpectedNextSnapshotScheduleTime": "2020-10-13T20:34:01.000Z", "ExpectedNextSnapshotScheduleTimeStatus": "OnTrack", "HsmStatus": { "HsmClientCertificateIdentifier": "hsmClientCertificateIdentifier", "HsmConfigurationIdentifier": "hsmConfigurationIdentifier", "Status": "applying" }, "IamRoles": [ { "ApplyStatus": "in-sync", "IamRoleArn": "arn:aws:iam::111122223333:role/RedshiftCopyUnload" } ], "KmsKeyId": "kmsKeyId", "LoggingStatus": { "BucketName": "amzn-s3-demo-bucket", "LastFailureMessage": "test message", "LastFailureTime": "2020-08-09T13:00:00.000Z", "LastSuccessfulDeliveryTime": "2020-08-08T13:00:00.000Z", "LoggingEnabled": true, "S3KeyPrefix": "/" }, "MaintenanceTrackName": "current", "ManualSnapshotRetentionPeriod": -1, "MasterUsername": "awsuser", "NextMaintenanceWindowStartTime": "2020-08-09T13:00:00.000Z", "NodeType": "dc2.large", "NumberOfNodes": 2, "PendingActions": [], "PendingModifiedValues": { "AutomatedSnapshotRetentionPeriod": 0, "ClusterIdentifier": "clusterIdentifier", "ClusterType": "clusterType", "ClusterVersion": "clusterVersion", "EncryptionType": "None", "EnhancedVpcRouting": false, "MaintenanceTrackName": "maintenanceTrackName", "MasterUserPassword": "masterUserPassword", "NodeType": "dc2.large", "NumberOfNodes": 1, "PubliclyAccessible": true }, "PreferredMaintenanceWindow": "sun:13:00-sun:13:30", "PubliclyAccessible": true, "ResizeInfo": { "AllowCancelResize": true, "ResizeType": "ClassicResize" }, "RestoreStatus": { "CurrentRestoreRateInMegaBytesPerSecond": 15, "ElapsedTimeInSeconds": 120, "EstimatedTimeToCompletionInSeconds": 100, "ProgressInMegaBytes": 10, "SnapshotSizeInMegaBytes": 1500, "Status": "restoring" }, "SnapshotScheduleIdentifier": "snapshotScheduleIdentifier", "SnapshotScheduleState": "ACTIVE", "VpcId": "vpc-example", "VpcSecurityGroups": [ { "Status": "active", "VpcSecurityGroupId": "sg-example" } ] } ``` # AwsRoute53 resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsRoute53` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsRoute53HostedZone The `AwsRoute53HostedZone` object provides information about an Amazon Route 53 hosted zone, including the four name servers assigned to the hosted zone. A hosted zone represents a collection of records that can be managed together, belonging to a single parent domain name. The following example shows the AWS Security Finding Format (ASFF) for the `AwsRoute53HostedZone` object. To view descriptions of `AwsRoute53HostedZone` attributes, see [AwsRoute53HostedZoneDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsRoute53HostedZoneDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsRoute53HostedZone": { "HostedZone": { "Id": "Z06419652JEMGO9TA2XKL", "Name": "asff.testing", "Config": { "Comment": "This is an example comment." } }, "NameServers": [ "ns-470.awsdns-32.net", "ns-1220.awsdns-12.org", "ns-205.awsdns-13.com", "ns-1960.awsdns-51.co.uk" ], "QueryLoggingConfig": { "CloudWatchLogsLogGroupArn": { "CloudWatchLogsLogGroupArn": "arn:aws:logs:us-east-1:123456789012:log-group:asfftesting:*", "Id": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", "HostedZoneId": "Z00932193AF5H180PPNZD" } }, "Vpcs": [ { "Id": "vpc-05d7c6e36bc03ea76", "Region": "us-east-1" } ] } ``` # AwsS3 resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsS3` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsS3AccessPoint `AwsS3AccessPoint` provides information about an Amazon S3 access point. S3 access points are named network endpoints that are attached to S3 buckets that you can use to perform S3 object operations. The following example shows the AWS Security Finding Format (ASFF) for the `AwsS3AccessPoint` object. To view descriptions of `AwsS3AccessPoint` attributes, see [AwsS3AccessPointDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsS3AccessPointDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsS3AccessPoint": { "AccessPointArn": "arn:aws:s3:us-east-1:123456789012:accesspoint/asff-access-point", "Alias": "asff-access-point-hrzrlukc5m36ft7okagglf3gmwluquse1b-s3alias", "Bucket": "amzn-s3-demo-bucket", "BucketAccountId": "123456789012", "Name": "asff-access-point", "NetworkOrigin": "VPC", "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true }, "VpcConfiguration": { "VpcId": "vpc-1a2b3c4d5e6f1a2b3" } } ``` ## AwsS3AccountPublicAccessBlock `AwsS3AccountPublicAccessBlock` provides information about the Amazon S3 Public Access Block configuration for accounts. The following example shows the AWS Security Finding Format (ASFF) for the `AwsS3AccountPublicAccessBlock` object. To view descriptions of `AwsS3AccountPublicAccessBlock` attributes, see [AwsS3AccountPublicAccessBlockDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsS3AccountPublicAccessBlockDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsS3AccountPublicAccessBlock": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": false, "RestrictPublicBuckets": true } ``` ## AwsS3Bucket The `AwsS3Bucket` object provides details about an Amazon S3 bucket. The following example shows the AWS Security Finding Format (ASFF) for the `AwsS3Bucket` object. To view descriptions of `AwsS3Bucket` attributes, see [AwsS3BucketDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsS3BucketDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsS3Bucket": { "AccessControlList": "{\"grantSet\":null,\"grantList\":[{\"grantee\":{\"id\":\"4df55416215956920d9d056aa8b99803a294ea221222bb668b55a8c6bca81094\",\"displayName\":null},\"permission\":\"FullControl\"},{\"grantee\":\"AllUsers\",\"permission\":\"ReadAcp\"},{\"grantee\":\"AuthenticatedUsers\",\"permission\":\"ReadAcp\"}",, "BucketLifecycleConfiguration": { "Rules": [ { "AbortIncompleteMultipartUpload": { "DaysAfterInitiation": 5 }, "ExpirationDate": "2021-11-10T00:00:00.000Z", "ExpirationInDays": 365, "ExpiredObjectDeleteMarker": false, "Filter": { "Predicate": { "Operands": [ { "Prefix": "tmp/", "Type": "LifecyclePrefixPredicate" }, { "Tag": { "Key": "ArchiveAge", "Value": "9m" }, "Type": "LifecycleTagPredicate" } ], "Type": "LifecycleAndOperator" } }, "ID": "Move rotated logs to Glacier", "NoncurrentVersionExpirationInDays": -1, "NoncurrentVersionTransitions": [ { "Days": 2, "StorageClass": "GLACIER" } ], "Prefix": "rotated/", "Status": "Enabled", "Transitions": [ { "Date": "2020-11-10T00:00:00.000Z", "Days": 100, "StorageClass": "GLACIER" } ] } ] }, "BucketLoggingConfiguration": { "DestinationBucketName": "s3serversideloggingbucket-123456789012", "LogFilePrefix": "buckettestreadwrite23435/" }, "BucketName": "amzn-s3-demo-bucket", "BucketNotificationConfiguration": { "Configurations": [{ "Destination": "arn:aws:lambda:us-east-1:123456789012:function:s3_public_write", "Events": [ "s3:ObjectCreated:Put" ], "Filter": { "S3KeyFilter": { "FilterRules": [ { "Name": "AffS3BucketNotificationConfigurationS3KeyFilterRuleName.PREFIX", "Value": "pre" }, { "Name": "AffS3BucketNotificationConfigurationS3KeyFilterRuleName.SUFFIX", "Value": "suf" }, ] } }, "Type": "LambdaConfiguration" }] }, "BucketVersioningConfiguration": { "IsMfaDeleteEnabled": true, "Status": "Off" }, "BucketWebsiteConfiguration": { "ErrorDocument": "error.html", "IndexDocumentSuffix": "index.html", "RedirectAllRequestsTo": { "HostName": "example.com", "Protocol": "http" }, "RoutingRules": [{ "Condition": { "HttpErrorCodeReturnedEquals": "Redirected", "KeyPrefixEquals": "index" }, "Redirect": { "HostName": "example.com", "HttpRedirectCode": "401", "Protocol": "HTTP", "ReplaceKeyPrefixWith": "string", "ReplaceKeyWith": "string" } }] }, "CreatedAt": "2007-11-30T01:46:56.000Z", "ObjectLockConfiguration": { "ObjectLockEnabled": "Enabled", "Rule": { "DefaultRetention": { "Days": null, "Mode": "GOVERNANCE", "Years": 12 }, }, }, "OwnerId": "AIDACKCEVSQ6C2EXAMPLE", "OwnerName": "s3bucketowner", "PublicAccessBlockConfiguration": { "BlockPublicAcls": true, "BlockPublicPolicy": true, "IgnorePublicAcls": true, "RestrictPublicBuckets": true, }, "ServerSideEncryptionConfiguration": { "Rules": [ { "ApplyServerSideEncryptionByDefault": { "SSEAlgorithm": "AES256", "KMSMasterKeyID": "12345678-abcd-abcd-abcd-123456789012" } } ] } } ``` ## AwsS3Object The `AwsS3Object` object provides information about an Amazon S3 object. The following example shows the AWS Security Finding Format (ASFF) for the `AwsS3Object` object. To view descriptions of `AwsS3Object` attributes, see [AwsS3ObjectDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsS3ObjectDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsS3Object": { "ContentType": "text/html", "ETag": "\"30a6ec7e1a9ad79c203d05a589c8b400\"", "LastModified": "2012-04-23T18:25:43.511Z", "ServerSideEncryption": "aws:kms", "SSEKMSKeyId": "arn:aws:kms:us-west-2:123456789012:key/4dff8393-e225-4793-a9a0-608ec069e5a7", "VersionId": "ws31OurgOOjH_HHllIxPE35P.MELYaYh" } ``` # AwsSageMaker resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsSageMaker` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsSageMakerNotebookInstance The `AwsSageMakerNotebookInstance` object provides information about a Amazon SageMaker AI notebook instance, which is a machine learning compute instance running the Jupyter Notebook App. The following example shows the AWS Security Finding Format (ASFF) for the `AwsSageMakerNotebookInstance` object. To view descriptions of `AwsSageMakerNotebookInstance` attributes, see [AwsSageMakerNotebookInstanceDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsSageMakerNotebookInstanceDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsSageMakerNotebookInstance": { "DirectInternetAccess": "Disabled", "InstanceMetadataServiceConfiguration": { "MinimumInstanceMetadataServiceVersion": "1", }, "InstanceType": "ml.t2.medium", "LastModifiedTime": "2022-09-09 22:48:32.012000+00:00", "NetworkInterfaceId": "eni-06c09ac2541a1bed3", "NotebookInstanceArn": "arn:aws:sagemaker:us-east-1:001098605940:notebook-instance/sagemakernotebookinstancerootaccessdisabledcomplia-8myjcyofzixm", "NotebookInstanceName": "SagemakerNotebookInstanceRootAccessDisabledComplia-8MYjcyofZiXm", "NotebookInstanceStatus": "InService", "PlatformIdentifier": "notebook-al1-v1", "RoleArn": "arn:aws:iam::001098605940:role/sechub-SageMaker-1-scenar-SageMakerCustomExecution-1R0X32HGC38IW", "RootAccess": "Disabled", "SecurityGroups": [ "sg-06b347359ab068745" ], "SubnetId": "subnet-02c0deea5fa64578e", "Url": "sagemakernotebookinstancerootaccessdisabledcomplia-8myjcyofzixm.notebook.us-east-1.sagemaker.aws", "VolumeSizeInGB": 5 } ``` # AwsSecretsManager resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsSecretsManager` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsSecretsManagerSecret The `AwsSecretsManagerSecret` object provides details about a Secrets Manager secret. The following example shows the AWS Security Finding Format (ASFF) for the `AwsSecretsManagerSecret` object. To view descriptions of `AwsSecretsManagerSecret` attributes, see [AwsSecretsManagerSecretDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsSecretsManagerSecretDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsSecretsManagerSecret": { "RotationRules": { "AutomaticallyAfterDays": 30 }, "RotationOccurredWithinFrequency": true, "KmsKeyId": "kmsKeyId", "RotationEnabled": true, "RotationLambdaArn": "arn:aws:lambda:us-west-2:777788889999:function:MyTestRotationLambda", "Deleted": false, "Name": "MyTestDatabaseSecret", "Description": "My test database secret" } ``` # AwsSns resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsSns` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsSnsTopic The `AwsSnsTopic` object contains details about an Amazon Simple Notification Service topic. The following example shows the AWS Security Finding Format (ASFF) for the `AwsSnsTopic` object. To view descriptions of `AwsSnsTopic` attributes, see [AwsSnsTopicDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsSnsTopicDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsSnsTopic": { "ApplicationSuccessFeedbackRoleArn": "arn:aws:iam::123456789012:role/ApplicationSuccessFeedbackRoleArn", "FirehoseFailureFeedbackRoleArn": "arn:aws:iam::123456789012:role/FirehoseFailureFeedbackRoleArn", "FirehoseSuccessFeedbackRoleArn": "arn:aws:iam::123456789012:role/FirehoseSuccessFeedbackRoleArn", "HttpFailureFeedbackRoleArn": "arn:aws:iam::123456789012:role/HttpFailureFeedbackRoleArn", "HttpSuccessFeedbackRoleArn": "arn:aws:iam::123456789012:role/HttpSuccessFeedbackRoleArn", "KmsMasterKeyId": "alias/ExampleAlias", "Owner": "123456789012", "SqsFailureFeedbackRoleArn": "arn:aws:iam::123456789012:role/SqsFailureFeedbackRoleArn", "SqsSuccessFeedbackRoleArn": "arn:aws:iam::123456789012:role/SqsSuccessFeedbackRoleArn", "Subscription": { "Endpoint": "http://sampleendpoint.com", "Protocol": "http" }, "TopicName": "SampleTopic" } ``` # AwsSqs resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsSqs` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsSqsQueue The `AwsSqsQueue` object contains information about an Amazon Simple Queue Service queue. The following example shows the AWS Security Finding Format (ASFF) for the `AwsSqsQueue` object. To view descriptions of `AwsSqsQueue` attributes, see [AwsSqsQueueDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsSqsQueueDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsSqsQueue": { "DeadLetterTargetArn": "arn:aws:sqs:us-west-2:123456789012:queue/target", "KmsDataKeyReusePeriodSeconds": 60,, "KmsMasterKeyId": "1234abcd-12ab-34cd-56ef-1234567890ab", "QueueName": "sample-queue" } ``` # AwsSsm resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsSsm` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsSsmPatchCompliance The `AwsSsmPatchCompliance` object provides information about the state of a patch on an instance based on the patch baseline that was used to patch the instance. The following example shows the AWS Security Finding Format (ASFF) for the `AwsSsmPatchCompliance` object. To view descriptions of `AwsSsmPatchCompliance` attributes, see [AwsSsmPatchComplianceDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsSsmPatchComplianceDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsSsmPatchCompliance": { "Patch": { "ComplianceSummary": { "ComplianceType": "Patch", "CompliantCriticalCount": 0, "CompliantHighCount": 0, "CompliantInformationalCount": 0, "CompliantLowCount": 0, "CompliantMediumCount": 0, "CompliantUnspecifiedCount": 461, "ExecutionType": "Command", "NonCompliantCriticalCount": 0, "NonCompliantHighCount": 0, "NonCompliantInformationalCount": 0, "NonCompliantLowCount": 0, "NonCompliantMediumCount": 0, "NonCompliantUnspecifiedCount": 0, "OverallSeverity": "UNSPECIFIED", "PatchBaselineId": "pb-0c5b2769ef7cbe587", "PatchGroup": "ExamplePatchGroup", "Status": "COMPLIANT" } } } ``` # AwsStepFunctions resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsStepFunctions` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsStepFunctionStateMachine The `AwsStepFunctionStateMachine` object provides information about an AWS Step Functions state machine, which is a workflow consisting of a series of event-driven steps. The following example shows the AWS Security Finding Format (ASFF) for the `AwsStepFunctionStateMachine` object. To view descriptions of `AwsStepFunctionStateMachine` attributes, see [AwsStepFunctionStateMachine](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsStepFunctionStateMachineDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsStepFunctionStateMachine": { "StateMachineArn": "arn:aws:states:us-east-1:123456789012:stateMachine:StepFunctionsLogDisableNonCompliantResource-fQLujTeXvwsb", "Name": "StepFunctionsLogDisableNonCompliantResource-fQLujTeXvwsb", "Status": "ACTIVE", "RoleArn": "arn:aws:iam::123456789012:role/teststepfunc-StatesExecutionRole-1PNM71RVO1UKT", "Type": "STANDARD", "LoggingConfiguration": { "Level": "OFF", "IncludeExecutionData": false }, "TracingConfiguration": { "Enabled": false } } ``` # AwsWaf resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsWaf` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsWafRateBasedRule The `AwsWafRateBasedRule` object contains details about an AWS WAF rate-based rule for global resources. An AWS WAF rate-based rule provides settings to indicate when to allow, block, or count a request. Rate-based rules include the number of requests that arrive over a specified period of time. The following example shows the AWS Security Finding Format (ASFF) for the `AwsWafRateBasedRule` object. To view descriptions of `AwsWafRateBasedRule` attributes, see [AwsWafRateBasedRuleDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsWafRateBasedRuleDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsWafRateBasedRule":{ "MatchPredicates" : [{ "DataId" : "391b7a7e-5f00-40d2-b114-3f27ceacbbb0", "Negated" : "True", "Type" : "IPMatch" , }], "MetricName" : "MetricName", "Name" : "Test", "RateKey" : "IP", "RateLimit" : 235000, "RuleId" : "5dfb4085-f103-4ec6-b39a-d4a0dae5f47f" } ``` ## AwsWafRegionalRateBasedRule The `AwsWafRegionalRateBasedRule` object contains details about a rate-based rule for Regional resources. A rate-based rule provides settings to indicate when to allow, block, or count a request. Rate-based rules include the number of requests that arrive over a specified period of time. The following example shows the AWS Security Finding Format (ASFF) for the `AwsWafRegionalRateBasedRule` object. To view descriptions of `AwsWafRegionalRateBasedRule` attributes, see [AwsWafRegionalRateBasedRuleDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsWafRegionalRateBasedRuleDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsWafRegionalRateBasedRule":{ "MatchPredicates" : [{ "DataId" : "391b7a7e-5f00-40d2-b114-3f27ceacbbb0", "Negated" : "True", "Type" : "IPMatch" , }], "MetricName" : "MetricName", "Name" : "Test", "RateKey" : "IP", "RateLimit" : 235000, "RuleId" : "5dfb4085-f103-4ec6-b39a-d4a0dae5f47f" } ``` ## AwsWafRegionalRule The `AwsWafRegionalRule` object provides details about an AWS WAF Regional rule . This rule identifies the web requests that you want to allow, block, or count. The following example shows the AWS Security Finding Format (ASFF) for the `AwsWafRegionalRule` object. To view descriptions of `AwsWafRegionalRule` attributes, see [AwsWafRegionalRuleDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsWafRegionalRuleDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsWafRegionalRule": { "MetricName": "SampleWAF_Rule__Metric_1", "Name": "bb-waf-regional-rule-not-empty-conditions-compliant", "RuleId": "8f651760-24fa-40a6-a9ed-4b60f1de95fe", "PredicateList": [{ "DataId": "127d9346-e607-4e93-9286-c1296fb5445a", "Negated": false, "Type": "GeoMatch" }] } ``` ## AwsWafRegionalRuleGroup The `AwsWafRegionalRuleGroup` object provides details about an AWS WAF Regional rule group. A rule group is a collection of predefined rules that you add to a web access control list (web ACL). The following example shows the AWS Security Finding Format (ASFF) for the `AwsWafRegionalRuleGroup` object. To view descriptions of `AwsWafRegionalRuleGroup` attributes, see [AwsWafRegionalRuleGroupDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsWafRegionalRuleGroupDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsWafRegionalRuleGroup": { "MetricName": "SampleWAF_Metric_1", "Name": "bb-WAFClassicRuleGroupWithRuleCompliant", "RuleGroupId": "2012ca6d-e66d-4d9b-b766-bfb03ad77cfb", "Rules": [{ "Action": { "Type": "ALLOW" } }], "Priority": 1, "RuleId": "cdd225da-32cf-4773-8dc5-3bca3ed9c19c", "Type": "REGULAR" } ``` ## AwsWafRegionalWebAcl `AwsWafRegionalWebAcl` provides details about an AWS WAF Regional web access control list (web ACL). A web ACL contains the rules that identify the requests that you want to allow, block, or count. The following is an example `AwsWafRegionalWebAcl` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsApiGatewayV2Stage` attributes, see [AwsWafRegionalWebAclDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsWafRegionalWebAclDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsWafRegionalWebAcl": { "DefaultAction": "ALLOW", "MetricName" : "web-regional-webacl-metric-1", "Name": "WebACL_123", "RulesList": [ { "Action": { "Type": "Block" }, "Priority": 3, "RuleId": "24445857-852b-4d47-bd9c-61f05e4d223c", "Type": "REGULAR", "ExcludedRules": [ { "ExclusionType": "Exclusion", "RuleId": "Rule_id_1" } ], "OverrideAction": { "Type": "OVERRIDE" } } ], "WebAclId": "443c76f4-2e72-4c89-a2ee-389d501c1f67" } ``` ## AwsWafRule `AwsWafRule` provides information about an AWS WAF rule. An AWS WAF rule identifies the web requests that you want to allow, block, or count. The following is an example `AwsWafRule` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsApiGatewayV2Stage` attributes, see [AwsWafRuleDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsWafRuleDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsWafRule": { "MetricName": "AwsWafRule_Metric_1", "Name": "AwsWafRule_Name_1", "PredicateList": [{ "DataId": "cdd225da-32cf-4773-1dc2-3bca3ed9c19c", "Negated": false, "Type": "GeoMatch" }], "RuleId": "8f651760-24fa-40a6-a9ed-4b60f1de953e" } ``` ## AwsWafRuleGroup `AwsWafRuleGroup` provides information about an AWS WAF rule group. An AWS WAF rule group is a collection of predefined rules that you add to a web access control list (web ACL). The following is an example `AwsWafRuleGroup` finding in the AWS Security Finding Format (ASFF). To view descriptions of `AwsApiGatewayV2Stage` attributes, see [AwsWafRuleGroupDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsWafRuleGroupDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsWafRuleGroup": { "MetricName": "SampleWAF_Metric_1", "Name": "bb-WAFRuleGroupWithRuleCompliant", "RuleGroupId": "2012ca6d-e66d-4d9b-b766-bfb03ad77cfb", "Rules": [{ "Action": { "Type": "ALLOW", }, "Priority": 1, "RuleId": "cdd225da-32cf-4773-8dc5-3bca3ed9c19c", "Type": "REGULAR" }] } ``` ## AwsWafv2RuleGroup The `AwsWafv2RuleGroup` object provides details about an AWS WAFV2 rule group. The following example shows the AWS Security Finding Format (ASFF) for the `AwsWafv2RuleGroup` object. To view descriptions of `AwsWafv2RuleGroup` attributes, see [AwsWafv2RuleGroupDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsWafv2RuleGroupDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsWafv2RuleGroup": { "Arn": "arn:aws:wafv2:us-east-1:123456789012:global/rulegroup/wafv2rulegroupasff/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", "Capacity": 1000, "Description": "Resource for ASFF", "Id": "a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", "Name": "wafv2rulegroupasff", "Rules": [{ "Action": { "Allow": { "CustomRequestHandling": { "InsertHeaders": [ { "Name": "AllowActionHeader1Name", "Value": "AllowActionHeader1Value" }, { "Name": "AllowActionHeader2Name", "Value": "AllowActionHeader2Value" } ] } }, "Name": "RuleOne", "Priority": 1, "VisibilityConfig": { "CloudWatchMetricsEnabled": true, "MetricName": "rulegroupasff", "SampledRequestsEnabled": false } }], "VisibilityConfig": { "CloudWatchMetricsEnabled": true, "MetricName": "rulegroupasff", "SampledRequestsEnabled": false } } ``` ## AwsWafWebAcl The `AwsWafWebAcl` object provides details about an AWS WAF web ACL. The following example shows the AWS Security Finding Format (ASFF) for the `AwsWafWebAcl` object. To view descriptions of `AwsWafWebAcl` attributes, see [AwsWafWebAclDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsWafWebAclDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsWafWebAcl": { "DefaultAction": "ALLOW", "Name": "MyWafAcl", "Rules": [ { "Action": { "Type": "ALLOW" }, "ExcludedRules": [ { "RuleId": "5432a230-0113-5b83-bbb2-89375c5bfa98" } ], "OverrideAction": { "Type": "NONE" }, "Priority": 1, "RuleId": "5432a230-0113-5b83-bbb2-89375c5bfa98", "Type": "REGULAR" } ], "WebAclId": "waf-1234567890" } ``` ## AwsWafv2WebAcl The `AwsWafv2WebAcl` object provides details about an AWS WAFV2 web ACL. The following example shows the AWS Security Finding Format (ASFF) for the `AwsWafv2WebAcl` object. To view descriptions of `AwsWafv2WebAcl` attributes, see [AwsWafv2WebAclDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsWafv2WebAclDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsWafv2WebAcl": { "Arn": "arn:aws:wafv2:us-east-1:123456789012:regional/webacl/WebACL-RoaD4QexqSxG/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111", "Capacity": 1326, "CaptchaConfig": { "ImmunityTimeProperty": { "ImmunityTime": 500 } }, "DefaultAction": { "Block": {} }, "Description": "Web ACL for JsonBody testing", "ManagedbyFirewallManager": false, "Name": "WebACL-RoaD4QexqSxG", "Rules": [{ "Action": { "RuleAction": { "Block": {} } }, "Name": "TestJsonBodyRule", "Priority": 1, "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "JsonBodyMatchMetric" } }], "VisibilityConfig": { "SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "TestingJsonBodyMetric" } } ``` # AwsXray resources in ASFF The following are examples of the AWS Security Finding Format (ASFF) syntax for `AwsXray` resources. AWS Security Hub CSPM normalizes findings from various sources into ASFF. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). ## AwsXrayEncryptionConfig The `AwsXrayEncryptionConfig` object contains information about the encryption configuration for AWS X-Ray. The following example shows the AWS Security Finding Format (ASFF) for the `AwsXrayEncryptionConfig` object. To view descriptions of `AwsXrayEncryptionConfig` attributes, see [AwsXrayEncryptionConfigDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_AwsXrayEncryptionConfigDetails.html) in the *AWS Security Hub API Reference*. **Example** ``` "AwsXRayEncryptionConfig":{ "KeyId": "arn:aws:kms:us-east-2:222222222222:key/example-key", "Status": "UPDATING", "Type":"KMS" } ``` # CodeRepository object in ASFF The `CodeRepository` object provides information about an external code repository that you connected to AWS resources and configured Amazon Inspector to scan for vulnerabilities. The following example shows the AWS Security Finding Format (ASFF) syntax for the `CodeRepository` object. To view descriptions of `CodeRepository` attributes, see [CodeRepositoryDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_CodeRepositoryDetails.html) in the *AWS Security Hub API Reference*. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). **Example** ``` "CodeRepository": { "ProviderType": "GITLAB_SELF_MANAGED", "ProjectName": "projectName", "CodeSecurityIntegrationArn": "arn:aws:inspector2:us-east-1:123456789012:codesecurity-integration/00000000-0000-0000-0000-000000000000" } ``` # Container object in ASFF The following example shows the AWS Security Finding Format (ASFF) syntax for the `Container` object. To view descriptions of `Container` attributes, see [ContainerDetails](https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_ContainerDetails.html) in the *AWS Security Hub API Reference*. For background information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). **Example** ``` "Container": { "ContainerRuntime": "docker", "ImageId": "image12", "ImageName": "1111111/knotejs@sha256:372131c9fef111111111111115f4ed3ea5f9dce4dc3bd34ce21846588a3", "LaunchedAt": "2018-09-29T01:25:54Z", "Name": "knote", "Privileged": true, "VolumeMounts": [{ "Name": "vol-03909e9", "MountPath": "/mnt/etc" }] } ``` # Other object in ASFF In the AWS Security Finding Format (ASFF), the `Other` object specifies custom fields and values. For more information about ASFF, see [AWS Security Finding Format (ASFF)](securityhub-findings-format.md). By using the `Other` object, you can specify custom fields and values for a resource. You can use the `Other` object for the following cases: + The resource type does not have a corresponding `Details` object. To specify details for a resource, use the `Other` object. + The `Details` object for the resource type does not include all the attributes that you want to specify. In this case, use the `Details` object for the resource type to specify available attributes. Use the `Other` object to specify attributes that are not in the type-specific `Details` object. + The resource type is not one of the provided types. In this case, set `Resource.Type` to `Other` and use the `Other` object to specify the details. **Type:** Map of up to 50 key-value pairs Each key-value pair must meet the following requirements. + The key must contain fewer than 128 characters. + The value must contain fewer than 1,024 characters.