AWS.SecurityHub reference

AcceptAdministratorInvitation

Source: src/AWS/SecurityHub/AcceptAdministratorInvitation.ts

Runtime binding for securityhub:AcceptAdministratorInvitation.

Accepts an invitation to become a member of a Security Hub administrator account. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.AcceptAdministratorInvitationHttp).

AcceptAdministratorInvitation: Members & Organization

// init — account-level binding, no resource argument
const acceptAdministratorInvitation = yield* AWS.SecurityHub.AcceptAdministratorInvitation();

// runtime
yield* acceptAdministratorInvitation({
  AdministratorId: adminAccountId,
  InvitationId: invitationId,
});

ActionTarget

Source: src/AWS/SecurityHub/ActionTarget.ts

A Security Hub custom action target. Selecting the custom action on findings or insights in the console publishes a Security Hub Findings - Custom Action event to EventBridge, which a Function can consume via consumeCustomActions.

ActionTarget: Creating a Custom Action

Send Findings to a Triage Function

const action = yield* AWS.SecurityHub.ActionTarget("Escalate", {
  name: "Escalate",
  description: "Escalate the selected findings to on-call",
});

Consume Custom Action Events

yield* AWS.SecurityHub.consumeCustomActions(
  { actionArns: [action.actionTargetArn] },
  (events) =>
    Stream.runForEach(events, (event) =>
      Effect.log(event.detail.findings),
    ),
);

AutomationRule

Source: src/AWS/SecurityHub/AutomationRule.ts

A Security Hub automation rule — automatically updates findings that match its criteria (suppress, change severity, add notes) as they are ingested.

AutomationRule: Automating Finding Triage

Suppress Informational Findings

const rule = yield* AWS.SecurityHub.AutomationRule("SuppressInfo", {
  description: "Suppress informational findings",
  ruleOrder: 1,
  criteria: {
    SeverityLabel: [{ Value: "INFORMATIONAL", Comparison: "EQUALS" }],
  },
  actions: [{
    Type: "FINDING_FIELDS_UPDATE",
    FindingFieldsUpdate: { Workflow: { Status: "SUPPRESSED" } },
  }],
});

Escalate Production Findings

const rule = yield* AWS.SecurityHub.AutomationRule("EscalateProd", {
  description: "Raise severity of findings on production resources",
  ruleOrder: 2,
  isTerminal: true,
  criteria: {
    ResourceTags: [{ Key: "env", Value: "prod", Comparison: "EQUALS" }],
  },
  actions: [{
    Type: "FINDING_FIELDS_UPDATE",
    FindingFieldsUpdate: { Severity: { Label: "CRITICAL" } },
  }],
});

BatchDisableStandards

Source: src/AWS/SecurityHub/BatchDisableStandards.ts

Runtime binding for securityhub:BatchDisableStandards.

Disables (unsubscribes the account from) one or more security standards. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.BatchDisableStandardsHttp).

BatchDisableStandards: Standards & Controls

// init — account-level binding, no resource argument
const batchDisableStandards = yield* AWS.SecurityHub.BatchDisableStandards();

// runtime
yield* batchDisableStandards({
  StandardsSubscriptionArns: [subscriptionArn],
});

BatchEnableStandards

Source: src/AWS/SecurityHub/BatchEnableStandards.ts

Runtime binding for securityhub:BatchEnableStandards.

Enables (subscribes the account to) one or more security standards. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.BatchEnableStandardsHttp).

BatchEnableStandards: Standards & Controls

// init — account-level binding, no resource argument
const batchEnableStandards = yield* AWS.SecurityHub.BatchEnableStandards();

// runtime
yield* batchEnableStandards({
  StandardsSubscriptionRequests: [{ StandardsArn: standardsArn }],
});

BatchGetAutomationRules

Source: src/AWS/SecurityHub/BatchGetAutomationRules.ts

Runtime binding for securityhub:BatchGetAutomationRules.

Returns the full configuration of a batch of automation rules by ARN. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.BatchGetAutomationRulesHttp).

BatchGetAutomationRules: Custom Actions, Automation Rules & Aggregation

// init — account-level binding, no resource argument
const batchGetAutomationRules = yield* AWS.SecurityHub.BatchGetAutomationRules();

// runtime
const { Rules } = yield* batchGetAutomationRules({
  AutomationRulesArns: [rule.ruleArn],
});

BatchGetSecurityControls

Source: src/AWS/SecurityHub/BatchGetSecurityControls.ts

Runtime binding for securityhub:BatchGetSecurityControls.

Returns detailed definitions for a batch of security controls by id or ARN. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.BatchGetSecurityControlsHttp).

BatchGetSecurityControls: Standards & Controls

// init — account-level binding, no resource argument
const batchGetSecurityControls = yield* AWS.SecurityHub.BatchGetSecurityControls();

// runtime
const { SecurityControls } = yield* batchGetSecurityControls({
  SecurityControlIds: ["IAM.1", "S3.1"],
});

BatchGetStandardsControlAssociations

Source: src/AWS/SecurityHub/BatchGetStandardsControlAssociations.ts

Runtime binding for securityhub:BatchGetStandardsControlAssociations.

Returns the enablement status of a batch of controls within specific standards. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.BatchGetStandardsControlAssociationsHttp).

BatchGetStandardsControlAssociations: Standards & Controls

// init — account-level binding, no resource argument
const batchGetStandardsControlAssociations = yield* AWS.SecurityHub.BatchGetStandardsControlAssociations();

// runtime
const { StandardsControlAssociationDetails } =
  yield* batchGetStandardsControlAssociations({
    StandardsControlAssociationIds: [
      { SecurityControlId: "IAM.1", StandardsArn: standardsArn },
    ],
  });

BatchImportFindings

Source: src/AWS/SecurityHub/BatchImportFindings.ts

Runtime binding for securityhub:BatchImportFindings.

Imports findings in AWS Security Finding Format (ASFF) from a custom integration into Security Hub. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.BatchImportFindingsHttp).

BatchImportFindings: Working with Findings

// init — account-level binding, no resource argument
const batchImportFindings = yield* AWS.SecurityHub.BatchImportFindings();

// runtime
const { SuccessCount } = yield* batchImportFindings({
  Findings: [myAsffFinding],
});

BatchUpdateFindings

Source: src/AWS/SecurityHub/BatchUpdateFindings.ts

Runtime binding for securityhub:BatchUpdateFindings.

Updates workflow status, severity, notes, and other customer-editable fields on one or more findings. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.BatchUpdateFindingsHttp).

BatchUpdateFindings: Working with Findings

// init — account-level binding, no resource argument
const batchUpdateFindings = yield* AWS.SecurityHub.BatchUpdateFindings();

// runtime
yield* batchUpdateFindings({
  FindingIdentifiers: [{ Id: findingId, ProductArn: productArn }],
  Workflow: { Status: "RESOLVED" },
});

BatchUpdateStandardsControlAssociations

Source: src/AWS/SecurityHub/BatchUpdateStandardsControlAssociations.ts

Runtime binding for securityhub:BatchUpdateStandardsControlAssociations.

Enables or disables a batch of controls within specific standards. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.BatchUpdateStandardsControlAssociationsHttp).

BatchUpdateStandardsControlAssociations: Standards & Controls

// init — account-level binding, no resource argument
const batchUpdateStandardsControlAssociations = yield* AWS.SecurityHub.BatchUpdateStandardsControlAssociations();

// runtime
yield* batchUpdateStandardsControlAssociations({
  StandardsControlAssociationUpdates: [{
    SecurityControlId: "IAM.1",
    StandardsArn: standardsArn,
    AssociationStatus: "DISABLED",
    UpdatedReason: "handled by SSO",
  }],
});

CreateMembers

Source: src/AWS/SecurityHub/CreateMembers.ts

Runtime binding for securityhub:CreateMembers.

Creates member associations between this administrator account and the specified accounts. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.CreateMembersHttp).

CreateMembers: Members & Organization

// init — account-level binding, no resource argument
const createMembers = yield* AWS.SecurityHub.CreateMembers();

// runtime
const { UnprocessedAccounts } = yield* createMembers({
  AccountDetails: [{ AccountId: "111122223333" }],
});

DeclineInvitations

Source: src/AWS/SecurityHub/DeclineInvitations.ts

Runtime binding for securityhub:DeclineInvitations.

Declines Security Hub membership invitations from the specified accounts. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.DeclineInvitationsHttp).

DeclineInvitations: Members & Organization

// init — account-level binding, no resource argument
const declineInvitations = yield* AWS.SecurityHub.DeclineInvitations();

// runtime
yield* declineInvitations({ AccountIds: ["111122223333"] });

DeleteInvitations

Source: src/AWS/SecurityHub/DeleteInvitations.ts

Runtime binding for securityhub:DeleteInvitations.

Deletes Security Hub membership invitations from the specified accounts. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.DeleteInvitationsHttp).

DeleteInvitations: Members & Organization

// init — account-level binding, no resource argument
const deleteInvitations = yield* AWS.SecurityHub.DeleteInvitations();

// runtime
yield* deleteInvitations({ AccountIds: ["111122223333"] });

DeleteMembers

Source: src/AWS/SecurityHub/DeleteMembers.ts

Runtime binding for securityhub:DeleteMembers.

Deletes the member associations for the specified accounts. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.DeleteMembersHttp).

DeleteMembers: Members & Organization

// init — account-level binding, no resource argument
const deleteMembers = yield* AWS.SecurityHub.DeleteMembers();

// runtime
yield* deleteMembers({ AccountIds: ["111122223333"] });

DescribeActionTargets

Source: src/AWS/SecurityHub/DescribeActionTargets.ts

Runtime binding for securityhub:DescribeActionTargets.

Lists the custom action targets defined in the account. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.DescribeActionTargetsHttp).

DescribeActionTargets: Custom Actions, Automation Rules & Aggregation

// init — account-level binding, no resource argument
const describeActionTargets = yield* AWS.SecurityHub.DescribeActionTargets();

// runtime
const { ActionTargets } = yield* describeActionTargets();

DescribeOrganizationConfiguration

Source: src/AWS/SecurityHub/DescribeOrganizationConfiguration.ts

Runtime binding for securityhub:DescribeOrganizationConfiguration.

Returns how Security Hub is configured across the organization (auto-enable, central configuration). Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.DescribeOrganizationConfigurationHttp).

DescribeOrganizationConfiguration: Members & Organization

// init — account-level binding, no resource argument
const describeOrganizationConfiguration = yield* AWS.SecurityHub.DescribeOrganizationConfiguration();

// runtime
const { AutoEnable } = yield* describeOrganizationConfiguration();

DescribeProducts

Source: src/AWS/SecurityHub/DescribeProducts.ts

Runtime binding for securityhub:DescribeProducts.

Lists the product integrations available in Security Hub (AWS services and partner products). Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.DescribeProductsHttp).

DescribeProducts: Product Integrations

// init — account-level binding, no resource argument
const describeProducts = yield* AWS.SecurityHub.DescribeProducts();

// runtime
const { Products } = yield* describeProducts({ MaxResults: 10 });

DescribeStandards

Source: src/AWS/SecurityHub/DescribeStandards.ts

Runtime binding for securityhub:DescribeStandards.

Lists the security standards available in Security Hub. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.DescribeStandardsHttp).

DescribeStandards: Standards & Controls

// init — account-level binding, no resource argument
const describeStandards = yield* AWS.SecurityHub.DescribeStandards();

// runtime
const { Standards } = yield* describeStandards();

DescribeStandardsControls

Source: src/AWS/SecurityHub/DescribeStandardsControls.ts

Runtime binding for securityhub:DescribeStandardsControls.

Lists the controls of an enabled standard with their current status. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.DescribeStandardsControlsHttp).

DescribeStandardsControls: Standards & Controls

// init — account-level binding, no resource argument
const describeStandardsControls = yield* AWS.SecurityHub.DescribeStandardsControls();

// runtime
const { Controls } = yield* describeStandardsControls({
  StandardsSubscriptionArn: subscriptionArn,
});

DisableImportFindingsForProduct

Source: src/AWS/SecurityHub/DisableImportFindingsForProduct.ts

Runtime binding for securityhub:DisableImportFindingsForProduct.

Disables a product integration so its findings no longer flow into Security Hub. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.DisableImportFindingsForProductHttp).

DisableImportFindingsForProduct: Product Integrations

// init — account-level binding, no resource argument
const disableImportFindingsForProduct = yield* AWS.SecurityHub.DisableImportFindingsForProduct();

// runtime
yield* disableImportFindingsForProduct({
  ProductSubscriptionArn: subscriptionArn,
});

DisableOrganizationAdminAccount

Source: src/AWS/SecurityHub/DisableOrganizationAdminAccount.ts

Runtime binding for securityhub:DisableOrganizationAdminAccount.

Removes an organization account’s delegated Security Hub administrator status. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.DisableOrganizationAdminAccountHttp).

DisableOrganizationAdminAccount: Members & Organization

// init — account-level binding, no resource argument
const disableOrganizationAdminAccount = yield* AWS.SecurityHub.DisableOrganizationAdminAccount();

// runtime
yield* disableOrganizationAdminAccount({ AdminAccountId: "111122223333" });

DisassociateFromAdministratorAccount

Source: src/AWS/SecurityHub/DisassociateFromAdministratorAccount.ts

Runtime binding for securityhub:DisassociateFromAdministratorAccount.

Disassociates this member account from its Security Hub administrator account. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.DisassociateFromAdministratorAccountHttp).

DisassociateFromAdministratorAccount: Members & Organization

// init — account-level binding, no resource argument
const disassociateFromAdministratorAccount = yield* AWS.SecurityHub.DisassociateFromAdministratorAccount();

// runtime
yield* disassociateFromAdministratorAccount();

DisassociateMembers

Source: src/AWS/SecurityHub/DisassociateMembers.ts

Runtime binding for securityhub:DisassociateMembers.

Disassociates the specified member accounts from this administrator account. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.DisassociateMembersHttp).

DisassociateMembers: Members & Organization

// init — account-level binding, no resource argument
const disassociateMembers = yield* AWS.SecurityHub.DisassociateMembers();

// runtime
yield* disassociateMembers({ AccountIds: ["111122223333"] });

EnableImportFindingsForProduct

Source: src/AWS/SecurityHub/EnableImportFindingsForProduct.ts

Runtime binding for securityhub:EnableImportFindingsForProduct.

Enables a product integration so its findings flow into Security Hub. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.EnableImportFindingsForProductHttp).

EnableImportFindingsForProduct: Product Integrations

// init — account-level binding, no resource argument
const enableImportFindingsForProduct = yield* AWS.SecurityHub.EnableImportFindingsForProduct();

// runtime
const { ProductSubscriptionArn } = yield* enableImportFindingsForProduct({
  ProductArn: productArn,
});

EnableOrganizationAdminAccount

Source: src/AWS/SecurityHub/EnableOrganizationAdminAccount.ts

Runtime binding for securityhub:EnableOrganizationAdminAccount.

Designates an organization account as the delegated Security Hub administrator. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.EnableOrganizationAdminAccountHttp).

EnableOrganizationAdminAccount: Members & Organization

// init — account-level binding, no resource argument
const enableOrganizationAdminAccount = yield* AWS.SecurityHub.EnableOrganizationAdminAccount();

// runtime
yield* enableOrganizationAdminAccount({ AdminAccountId: "111122223333" });

FindingAggregator

Source: src/AWS/SecurityHub/FindingAggregator.ts

The Security Hub cross-Region finding aggregator — replicates findings from linked Regions into the home Region. Only one aggregator can exist per account, so this is a singleton: adopting a pre-existing aggregator that Alchemy did not create requires --adopt.

FindingAggregator: Aggregating Findings Across Regions

Aggregate from All Regions

const aggregator = yield* AWS.SecurityHub.FindingAggregator("Aggregator", {
  regionLinkingMode: "ALL_REGIONS",
});

Aggregate from Specific Regions

const aggregator = yield* AWS.SecurityHub.FindingAggregator("Aggregator", {
  regionLinkingMode: "SPECIFIED_REGIONS",
  regions: ["us-east-1", "eu-west-1"],
});

GetAdministratorAccount

Source: src/AWS/SecurityHub/GetAdministratorAccount.ts

Runtime binding for securityhub:GetAdministratorAccount.

Returns the details of the Security Hub administrator account for this member account, if any. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.GetAdministratorAccountHttp).

GetAdministratorAccount: Members & Organization

// init — account-level binding, no resource argument
const getAdministratorAccount = yield* AWS.SecurityHub.GetAdministratorAccount();

// runtime
const { Administrator } = yield* getAdministratorAccount();

GetEnabledStandards

Source: src/AWS/SecurityHub/GetEnabledStandards.ts

Runtime binding for securityhub:GetEnabledStandards.

Lists the standards subscriptions currently enabled in the account. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.GetEnabledStandardsHttp).

GetEnabledStandards: Standards & Controls

// init — account-level binding, no resource argument
const getEnabledStandards = yield* AWS.SecurityHub.GetEnabledStandards();

// runtime
const { StandardsSubscriptions } = yield* getEnabledStandards();

GetFindingHistory

Source: src/AWS/SecurityHub/GetFindingHistory.ts

Runtime binding for securityhub:GetFindingHistory.

Returns the history of a finding for up to 90 days — every update Security Hub or a provider applied to it. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.GetFindingHistoryHttp).

GetFindingHistory: Working with Findings

// init — account-level binding, no resource argument
const getFindingHistory = yield* AWS.SecurityHub.GetFindingHistory();

// runtime
const { Records } = yield* getFindingHistory({
  FindingIdentifier: { Id: findingId, ProductArn: productArn },
});

GetFindings

Source: src/AWS/SecurityHub/GetFindings.ts

Runtime binding for securityhub:GetFindings.

Returns findings that match the specified filter criteria. With cross-Region aggregation enabled, the home Region returns matching findings from all linked Regions. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.GetFindingsHttp).

GetFindings: Working with Findings

// init — account-level binding, no resource argument
const getFindings = yield* AWS.SecurityHub.GetFindings();

// runtime
const { Findings } = yield* getFindings({
  Filters: { SeverityLabel: [{ Value: "HIGH", Comparison: "EQUALS" }] },
  MaxResults: 25,
});

GetInsightResults

Source: src/AWS/SecurityHub/GetInsightResults.ts

Runtime binding for securityhub:GetInsightResults.

Returns the aggregated results of a Security Hub insight, grouped by the insight’s group-by attribute. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.GetInsightResultsHttp).

GetInsightResults: Working with Insights

// init — account-level binding, no resource argument
const getInsightResults = yield* AWS.SecurityHub.GetInsightResults();

// runtime
const { InsightResults } = yield* getInsightResults({
  InsightArn: insight.insightArn,
});

GetInsights

Source: src/AWS/SecurityHub/GetInsights.ts

Runtime binding for securityhub:GetInsights.

Lists and describes Security Hub insights (saved, grouped finding queries). Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.GetInsightsHttp).

GetInsights: Working with Insights

// init — account-level binding, no resource argument
const getInsights = yield* AWS.SecurityHub.GetInsights();

// runtime
const { Insights } = yield* getInsights();

GetInvitationsCount

Source: src/AWS/SecurityHub/GetInvitationsCount.ts

Runtime binding for securityhub:GetInvitationsCount.

Returns the count of membership invitations received by this account (excluding accepted ones). Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.GetInvitationsCountHttp).

GetInvitationsCount: Members & Organization

// init — account-level binding, no resource argument
const getInvitationsCount = yield* AWS.SecurityHub.GetInvitationsCount();

// runtime
const { InvitationsCount } = yield* getInvitationsCount();

GetMembers

Source: src/AWS/SecurityHub/GetMembers.ts

Runtime binding for securityhub:GetMembers.

Returns the member details for the specified accounts. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.GetMembersHttp).

GetMembers: Members & Organization

// init — account-level binding, no resource argument
const getMembers = yield* AWS.SecurityHub.GetMembers();

// runtime
const { Members } = yield* getMembers({ AccountIds: ["111122223333"] });

GetSecurityControlDefinition

Source: src/AWS/SecurityHub/GetSecurityControlDefinition.ts

Runtime binding for securityhub:GetSecurityControlDefinition.

Returns the definition (title, description, parameters, severity) of a single security control. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.GetSecurityControlDefinitionHttp).

GetSecurityControlDefinition: Standards & Controls

// init — account-level binding, no resource argument
const getSecurityControlDefinition = yield* AWS.SecurityHub.GetSecurityControlDefinition();

// runtime
const { SecurityControlDefinition } = yield* getSecurityControlDefinition({
  SecurityControlId: "IAM.1",
});

Hub

Source: src/AWS/SecurityHub/Hub.ts

The Security Hub Hub — the account/region singleton that enables AWS Security Hub. Only one Hub can exist per region, so this is a capture-and-restore singleton: adopting a pre-existing Hub that Alchemy did not create requires --adopt.

Hub: Enabling Security Hub

Enable with default standards

const hub = yield* SecurityHub.Hub("Hub", {});

Enable without default standards, auto-enable controls

const hub = yield* SecurityHub.Hub("Hub", {
  enableDefaultStandards: false,
  autoEnableControls: true,
  controlFindingGenerator: "SECURITY_CONTROL",
  tags: { team: "security" },
});

Insight

Source: src/AWS/SecurityHub/Insight.ts

A Security Hub custom insight — a saved finding query grouped by an attribute. Read its aggregated results at runtime with the GetInsightResults binding.

Insight: Creating an Insight

Critical Findings by Resource

const insight = yield* AWS.SecurityHub.Insight("CriticalByResource", {
  filters: {
    SeverityLabel: [{ Value: "CRITICAL", Comparison: "EQUALS" }],
    RecordState: [{ Value: "ACTIVE", Comparison: "EQUALS" }],
  },
  groupByAttribute: "ResourceId",
});

Read Insight Results at Runtime

const getInsightResults = yield* AWS.SecurityHub.GetInsightResults();
const { InsightResults } = yield* getInsightResults({
  InsightArn: insight.insightArn,
});

InviteMembers

Source: src/AWS/SecurityHub/InviteMembers.ts

Runtime binding for securityhub:InviteMembers.

Invites the specified accounts to associate with this account as Security Hub members. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.InviteMembersHttp).

InviteMembers: Members & Organization

// init — account-level binding, no resource argument
const inviteMembers = yield* AWS.SecurityHub.InviteMembers();

// runtime
yield* inviteMembers({ AccountIds: ["111122223333"] });

ListAutomationRules

Source: src/AWS/SecurityHub/ListAutomationRules.ts

Runtime binding for securityhub:ListAutomationRules.

Lists the automation rules defined in the account. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.ListAutomationRulesHttp).

ListAutomationRules: Custom Actions, Automation Rules & Aggregation

// init — account-level binding, no resource argument
const listAutomationRules = yield* AWS.SecurityHub.ListAutomationRules();

// runtime
const { AutomationRulesMetadata } = yield* listAutomationRules();

ListEnabledProductsForImport

Source: src/AWS/SecurityHub/ListEnabledProductsForImport.ts

Runtime binding for securityhub:ListEnabledProductsForImport.

Lists the product integrations currently enabled to import findings into Security Hub. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.ListEnabledProductsForImportHttp).

ListEnabledProductsForImport: Product Integrations

// init — account-level binding, no resource argument
const listEnabledProductsForImport = yield* AWS.SecurityHub.ListEnabledProductsForImport();

// runtime
const { ProductSubscriptions } = yield* listEnabledProductsForImport();

ListFindingAggregators

Source: src/AWS/SecurityHub/ListFindingAggregators.ts

Runtime binding for securityhub:ListFindingAggregators.

Lists the cross-Region finding aggregators configured in the account. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.ListFindingAggregatorsHttp).

ListFindingAggregators: Custom Actions, Automation Rules & Aggregation

// init — account-level binding, no resource argument
const listFindingAggregators = yield* AWS.SecurityHub.ListFindingAggregators();

// runtime
const { FindingAggregators } = yield* listFindingAggregators();

ListInvitations

Source: src/AWS/SecurityHub/ListInvitations.ts

Runtime binding for securityhub:ListInvitations.

Lists the Security Hub membership invitations received by this account. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.ListInvitationsHttp).

ListInvitations: Members & Organization

// init — account-level binding, no resource argument
const listInvitations = yield* AWS.SecurityHub.ListInvitations();

// runtime
const { Invitations } = yield* listInvitations();

ListMembers

Source: src/AWS/SecurityHub/ListMembers.ts

Runtime binding for securityhub:ListMembers.

Lists the member accounts associated with this administrator account. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.ListMembersHttp).

ListMembers: Members & Organization

// init — account-level binding, no resource argument
const listMembers = yield* AWS.SecurityHub.ListMembers();

// runtime
const { Members } = yield* listMembers();

ListOrganizationAdminAccounts

Source: src/AWS/SecurityHub/ListOrganizationAdminAccounts.ts

Runtime binding for securityhub:ListOrganizationAdminAccounts.

Lists the organization’s delegated Security Hub administrator accounts. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.ListOrganizationAdminAccountsHttp).

ListOrganizationAdminAccounts: Members & Organization

// init — account-level binding, no resource argument
const listOrganizationAdminAccounts = yield* AWS.SecurityHub.ListOrganizationAdminAccounts();

// runtime
const { AdminAccounts } = yield* listOrganizationAdminAccounts();

ListSecurityControlDefinitions

Source: src/AWS/SecurityHub/ListSecurityControlDefinitions.ts

Runtime binding for securityhub:ListSecurityControlDefinitions.

Lists all security control definitions, optionally restricted to one standard. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.ListSecurityControlDefinitionsHttp).

ListSecurityControlDefinitions: Standards & Controls

// init — account-level binding, no resource argument
const listSecurityControlDefinitions = yield* AWS.SecurityHub.ListSecurityControlDefinitions();

// runtime
const { SecurityControlDefinitions } = yield* listSecurityControlDefinitions();

ListStandardsControlAssociations

Source: src/AWS/SecurityHub/ListStandardsControlAssociations.ts

Runtime binding for securityhub:ListStandardsControlAssociations.

Lists, for one security control, every standard it belongs to and its enablement status there. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.ListStandardsControlAssociationsHttp).

ListStandardsControlAssociations: Standards & Controls

// init — account-level binding, no resource argument
const listStandardsControlAssociations = yield* AWS.SecurityHub.ListStandardsControlAssociations();

// runtime
const { StandardsControlAssociationSummaries } =
  yield* listStandardsControlAssociations({ SecurityControlId: "IAM.1" });

UpdateOrganizationConfiguration

Source: src/AWS/SecurityHub/UpdateOrganizationConfiguration.ts

Runtime binding for securityhub:UpdateOrganizationConfiguration.

Updates how Security Hub is configured across the organization (auto-enable, central configuration). Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.UpdateOrganizationConfigurationHttp).

UpdateOrganizationConfiguration: Members & Organization

// init — account-level binding, no resource argument
const updateOrganizationConfiguration = yield* AWS.SecurityHub.UpdateOrganizationConfiguration();

// runtime
yield* updateOrganizationConfiguration({ AutoEnable: true });

UpdateSecurityControl

Source: src/AWS/SecurityHub/UpdateSecurityControl.ts

Runtime binding for securityhub:UpdateSecurityControl.

Updates the customizable parameters of a security control. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.UpdateSecurityControlHttp).

UpdateSecurityControl: Standards & Controls

// init — account-level binding, no resource argument
const updateSecurityControl = yield* AWS.SecurityHub.UpdateSecurityControl();

// runtime
yield* updateSecurityControl({
  SecurityControlId: "ACM.1",
  Parameters: { daysToExpiration: { ValueType: "CUSTOM", Value: { Integer: 15 } } },
});

UpdateStandardsControl

Source: src/AWS/SecurityHub/UpdateStandardsControl.ts

Runtime binding for securityhub:UpdateStandardsControl.

Enables or disables an individual control within an enabled standard. Account-level operation — invoked with the caller’s request as-is. Provide the implementation with Effect.provide(AWS.SecurityHub.UpdateStandardsControlHttp).

UpdateStandardsControl: Standards & Controls

// init — account-level binding, no resource argument
const updateStandardsControl = yield* AWS.SecurityHub.UpdateStandardsControl();

// runtime
yield* updateStandardsControl({
  StandardsControlArn: controlArn,
  ControlStatus: "DISABLED",
  DisabledReason: "not applicable to this workload",
});