Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. AWS Cloud Control
  3. API Docs
  4. securityhub
  5. SecurityControl

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.26.0 published on Wednesday, Mar 12, 2025 by Pulumi
pulumi/pulumi-aws-native

aws-native.securityhub.SecurityControl

Explore with Pulumi AI

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.26.0 published on Wednesday, Mar 12, 2025 by Pulumi
pulumi/pulumi-aws-native

A security control in Security Hub describes a security best practice related to a specific resource.

Create SecurityControl Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new SecurityControl(name: string, args: SecurityControlArgs, opts?: CustomResourceOptions);
@overload
def SecurityControl(resource_name: str,
                    args: SecurityControlArgs,
                    opts: Optional[ResourceOptions] = None)

@overload
def SecurityControl(resource_name: str,
                    opts: Optional[ResourceOptions] = None,
                    parameters: Optional[Mapping[str, SecurityControlParameterConfigurationArgs]] = None,
                    last_update_reason: Optional[str] = None,
                    security_control_arn: Optional[str] = None,
                    security_control_id: Optional[str] = None)
func NewSecurityControl(ctx *Context, name string, args SecurityControlArgs, opts ...ResourceOption) (*SecurityControl, error)
public SecurityControl(string name, SecurityControlArgs args, CustomResourceOptions? opts = null)
public SecurityControl(String name, SecurityControlArgs args)
public SecurityControl(String name, SecurityControlArgs args, CustomResourceOptions options)

type: aws-native:securityhub:SecurityControl
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args This property is required. SecurityControlArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args This property is required. SecurityControlArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args This property is required. SecurityControlArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args This property is required. SecurityControlArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. SecurityControlArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

SecurityControl Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The SecurityControl resource accepts the following input properties:

Parameters This property is required. Dictionary<string, Pulumi.AwsNative.SecurityHub.Inputs.SecurityControlParameterConfigurationArgs>
An object that identifies the name of a control parameter, its current value, and whether it has been customized.
LastUpdateReason string
The most recent reason for updating the customizable properties of a security control. This differs from the UpdateReason field of the BatchUpdateStandardsControlAssociations API, which tracks the reason for updating the enablement status of a control. This field accepts alphanumeric characters in addition to white spaces, dashes, and underscores.
SecurityControlArn string
The Amazon Resource Name (ARN) for a security control across standards, such as arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1. This parameter doesn't mention a specific standard.
SecurityControlId string
The unique identifier of a security control across standards. Values for this field typically consist of an AWS service name and a number, such as APIGateway.3.
Parameters This property is required. map[string]SecurityControlParameterConfigurationArgs
An object that identifies the name of a control parameter, its current value, and whether it has been customized.
LastUpdateReason string
The most recent reason for updating the customizable properties of a security control. This differs from the UpdateReason field of the BatchUpdateStandardsControlAssociations API, which tracks the reason for updating the enablement status of a control. This field accepts alphanumeric characters in addition to white spaces, dashes, and underscores.
SecurityControlArn string
The Amazon Resource Name (ARN) for a security control across standards, such as arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1. This parameter doesn't mention a specific standard.
SecurityControlId string
The unique identifier of a security control across standards. Values for this field typically consist of an AWS service name and a number, such as APIGateway.3.
parameters This property is required. Map<String,SecurityControlParameterConfigurationArgs>
An object that identifies the name of a control parameter, its current value, and whether it has been customized.
lastUpdateReason String
The most recent reason for updating the customizable properties of a security control. This differs from the UpdateReason field of the BatchUpdateStandardsControlAssociations API, which tracks the reason for updating the enablement status of a control. This field accepts alphanumeric characters in addition to white spaces, dashes, and underscores.
securityControlArn String
The Amazon Resource Name (ARN) for a security control across standards, such as arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1. This parameter doesn't mention a specific standard.
securityControlId String
The unique identifier of a security control across standards. Values for this field typically consist of an AWS service name and a number, such as APIGateway.3.
parameters This property is required. {[key: string]: SecurityControlParameterConfigurationArgs}
An object that identifies the name of a control parameter, its current value, and whether it has been customized.
lastUpdateReason string
The most recent reason for updating the customizable properties of a security control. This differs from the UpdateReason field of the BatchUpdateStandardsControlAssociations API, which tracks the reason for updating the enablement status of a control. This field accepts alphanumeric characters in addition to white spaces, dashes, and underscores.
securityControlArn string
The Amazon Resource Name (ARN) for a security control across standards, such as arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1. This parameter doesn't mention a specific standard.
securityControlId string
The unique identifier of a security control across standards. Values for this field typically consist of an AWS service name and a number, such as APIGateway.3.
parameters This property is required. Mapping[str, SecurityControlParameterConfigurationArgs]
An object that identifies the name of a control parameter, its current value, and whether it has been customized.
last_update_reason str
The most recent reason for updating the customizable properties of a security control. This differs from the UpdateReason field of the BatchUpdateStandardsControlAssociations API, which tracks the reason for updating the enablement status of a control. This field accepts alphanumeric characters in addition to white spaces, dashes, and underscores.
security_control_arn str
The Amazon Resource Name (ARN) for a security control across standards, such as arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1. This parameter doesn't mention a specific standard.
security_control_id str
The unique identifier of a security control across standards. Values for this field typically consist of an AWS service name and a number, such as APIGateway.3.
parameters This property is required. Map<Property Map>
An object that identifies the name of a control parameter, its current value, and whether it has been customized.
lastUpdateReason String
The most recent reason for updating the customizable properties of a security control. This differs from the UpdateReason field of the BatchUpdateStandardsControlAssociations API, which tracks the reason for updating the enablement status of a control. This field accepts alphanumeric characters in addition to white spaces, dashes, and underscores.
securityControlArn String
The Amazon Resource Name (ARN) for a security control across standards, such as arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1. This parameter doesn't mention a specific standard.
securityControlId String
The unique identifier of a security control across standards. Values for this field typically consist of an AWS service name and a number, such as APIGateway.3.

Outputs

All input properties are implicitly available as output properties. Additionally, the SecurityControl resource produces the following output properties:

Id string
The provider-assigned unique ID for this managed resource.
Id string
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.
id string
The provider-assigned unique ID for this managed resource.
id str
The provider-assigned unique ID for this managed resource.
id String
The provider-assigned unique ID for this managed resource.

Supporting Types

SecurityControlParameterConfiguration
, SecurityControlParameterConfigurationArgs

ValueType This property is required. Pulumi.AwsNative.SecurityHub.SecurityControlParameterConfigurationValueType

Identifies whether a control parameter uses a custom user-defined value or subscribes to the default AWS Security Hub behavior.

When ValueType is set equal to DEFAULT , the default behavior can be a specific Security Hub default value, or the default behavior can be to ignore a specific parameter. When ValueType is set equal to DEFAULT , Security Hub ignores user-provided input for the Value field.

When ValueType is set equal to CUSTOM , the Value field can't be empty.

Value Pulumi.AwsNative.SecurityHub.Inputs.SecurityControlParameterValue
The current value of a control parameter.
ValueType This property is required. SecurityControlParameterConfigurationValueType

Identifies whether a control parameter uses a custom user-defined value or subscribes to the default AWS Security Hub behavior.

When ValueType is set equal to DEFAULT , the default behavior can be a specific Security Hub default value, or the default behavior can be to ignore a specific parameter. When ValueType is set equal to DEFAULT , Security Hub ignores user-provided input for the Value field.

When ValueType is set equal to CUSTOM , the Value field can't be empty.

Value SecurityControlParameterValue
The current value of a control parameter.
valueType This property is required. SecurityControlParameterConfigurationValueType

Identifies whether a control parameter uses a custom user-defined value or subscribes to the default AWS Security Hub behavior.

When ValueType is set equal to DEFAULT , the default behavior can be a specific Security Hub default value, or the default behavior can be to ignore a specific parameter. When ValueType is set equal to DEFAULT , Security Hub ignores user-provided input for the Value field.

When ValueType is set equal to CUSTOM , the Value field can't be empty.

value SecurityControlParameterValue
The current value of a control parameter.
valueType This property is required. SecurityControlParameterConfigurationValueType

Identifies whether a control parameter uses a custom user-defined value or subscribes to the default AWS Security Hub behavior.

When ValueType is set equal to DEFAULT , the default behavior can be a specific Security Hub default value, or the default behavior can be to ignore a specific parameter. When ValueType is set equal to DEFAULT , Security Hub ignores user-provided input for the Value field.

When ValueType is set equal to CUSTOM , the Value field can't be empty.

value SecurityControlParameterValue
The current value of a control parameter.
value_type This property is required. SecurityControlParameterConfigurationValueType

Identifies whether a control parameter uses a custom user-defined value or subscribes to the default AWS Security Hub behavior.

When ValueType is set equal to DEFAULT , the default behavior can be a specific Security Hub default value, or the default behavior can be to ignore a specific parameter. When ValueType is set equal to DEFAULT , Security Hub ignores user-provided input for the Value field.

When ValueType is set equal to CUSTOM , the Value field can't be empty.

value SecurityControlParameterValue
The current value of a control parameter.
valueType This property is required. "DEFAULT" | "CUSTOM"

Identifies whether a control parameter uses a custom user-defined value or subscribes to the default AWS Security Hub behavior.

When ValueType is set equal to DEFAULT , the default behavior can be a specific Security Hub default value, or the default behavior can be to ignore a specific parameter. When ValueType is set equal to DEFAULT , Security Hub ignores user-provided input for the Value field.

When ValueType is set equal to CUSTOM , the Value field can't be empty.

value Property Map
The current value of a control parameter.

SecurityControlParameterConfigurationValueType
, SecurityControlParameterConfigurationValueTypeArgs

Default
DEFAULT
Custom
CUSTOM
SecurityControlParameterConfigurationValueTypeDefault
DEFAULT
SecurityControlParameterConfigurationValueTypeCustom
CUSTOM
Default
DEFAULT
Custom
CUSTOM
Default
DEFAULT
Custom
CUSTOM
DEFAULT
DEFAULT
CUSTOM
CUSTOM
"DEFAULT"
DEFAULT
"CUSTOM"
CUSTOM

SecurityControlParameterValue
, SecurityControlParameterValueArgs

Boolean bool
A control parameter that is a boolean.
Double double
A control parameter that is a double.
Enum string
A control parameter that is a enum.
EnumList List<string>
A control parameter that is a list of enums.
Integer int
A control parameter that is a integer.
IntegerList List<int>
A control parameter that is a list of integers.
String string
A control parameter that is a string.
StringList List<string>
A control parameter that is a list of strings.
Boolean bool
A control parameter that is a boolean.
Double float64
A control parameter that is a double.
Enum string
A control parameter that is a enum.
EnumList []string
A control parameter that is a list of enums.
Integer int
A control parameter that is a integer.
IntegerList []int
A control parameter that is a list of integers.
String string
A control parameter that is a string.
StringList []string
A control parameter that is a list of strings.
boolean_ Boolean
A control parameter that is a boolean.
double_ Double
A control parameter that is a double.
enumList List<String>
A control parameter that is a list of enums.
enum_ String
A control parameter that is a enum.
integer Integer
A control parameter that is a integer.
integerList List<Integer>
A control parameter that is a list of integers.
string String
A control parameter that is a string.
stringList List<String>
A control parameter that is a list of strings.
boolean boolean
A control parameter that is a boolean.
double number
A control parameter that is a double.
enum string
A control parameter that is a enum.
enumList string[]
A control parameter that is a list of enums.
integer number
A control parameter that is a integer.
integerList number[]
A control parameter that is a list of integers.
string string
A control parameter that is a string.
stringList string[]
A control parameter that is a list of strings.
boolean bool
A control parameter that is a boolean.
double float
A control parameter that is a double.
enum str
A control parameter that is a enum.
enum_list Sequence[str]
A control parameter that is a list of enums.
integer int
A control parameter that is a integer.
integer_list Sequence[int]
A control parameter that is a list of integers.
string str
A control parameter that is a string.
string_list Sequence[str]
A control parameter that is a list of strings.
boolean Boolean
A control parameter that is a boolean.
double Number
A control parameter that is a double.
enum String
A control parameter that is a enum.
enumList List<String>
A control parameter that is a list of enums.
integer Number
A control parameter that is a integer.
integerList List<Number>
A control parameter that is a list of integers.
string String
A control parameter that is a string.
stringList List<String>
A control parameter that is a list of strings.

Package Details

Repository
AWS Native pulumi/pulumi-aws-native
License
Apache-2.0

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.26.0 published on Wednesday, Mar 12, 2025 by Pulumi
pulumi/pulumi-aws-native