organization_configurations

Creates, updates, deletes or gets an organization_configuration resource or lists organization_configurations in a region

Overview

Name	organization_configurations
Type	Resource
Description	The AWS::SecurityHub::OrganizationConfiguration resource represents the configuration of your organization in Security Hub. Only the Security Hub administrator account can create Organization Configuration resource in each region and can opt-in to Central Configuration only in the aggregation region of FindingAggregator.
Id	awscc.securityhub.organization_configurations

Fields

get (all properties)

Name	Datatype	Description
auto_enable	boolean	Whether to automatically enable Security Hub in new member accounts when they join the organization.
auto_enable_standards	string	Whether to automatically enable Security Hub default standards in new member accounts when they join the organization.
configuration_type	string	Indicates whether the organization uses local or central configuration.
status	string	Describes whether central configuration could be enabled as the ConfigurationType for the organization.
status_message	string	Provides an explanation if the value of Status is equal to FAILED when ConfigurationType is equal to CENTRAL.
member_account_limit_reached	boolean	Whether the maximum number of allowed member accounts are already associated with the Security Hub administrator account.
organization_configuration_identifier	string	The identifier of the OrganizationConfiguration being created and assigned as the unique identifier.
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
organization_configuration_identifier	string	The identifier of the OrganizationConfiguration being created and assigned as the unique identifier.
region	string	AWS region.

For more information, see AWS::SecurityHub::OrganizationConfiguration.

Methods

Name	Resource	Accessible by	Required Params
create_resource	organization_configurations	INSERT	AutoEnable, region
delete_resource	organization_configurations	DELETE	Identifier, region
update_resource	organization_configurations	UPDATE	Identifier, PatchDocument, region
list_resources	organization_configurations_list_only	SELECT	region
get_resource	organization_configurations	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual organization_configuration.

SELECT
  region,
  auto_enable,
  auto_enable_standards,
  configuration_type,
  status,
  status_message,
  member_account_limit_reached,
  organization_configuration_identifier
FROM awscc.securityhub.organization_configurations
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ organization_configuration_identifier }}';

list (identifiers only)

Lists all organization_configurations in a region.

SELECT
  region,
  organization_configuration_identifier
FROM awscc.securityhub.organization_configurations_list_only
WHERE
  region = 'us-east-1';

INSERT example

Use the following StackQL query and manifest file to create a new organization_configuration resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.securityhub.organization_configurations (
  AutoEnable,
  region
)
SELECT
  '{{ auto_enable }}',
  '{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.securityhub.organization_configurations (
  AutoEnable,
  AutoEnableStandards,
  ConfigurationType,
  region
)
SELECT
  '{{ auto_enable }}',
  '{{ auto_enable_standards }}',
  '{{ configuration_type }}',
  '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: organization_configuration
    props:
      - name: auto_enable
        value: '{{ auto_enable }}'
      - name: auto_enable_standards
        value: '{{ auto_enable_standards }}'
      - name: configuration_type
        value: '{{ configuration_type }}'

UPDATE example

Use the following StackQL query and manifest file to update a organization_configuration resource, using stack-deploy.

/*+ update */
UPDATE awscc.securityhub.organization_configurations
SET PatchDocument = string('{{ {
    "AutoEnable": auto_enable,
    "AutoEnableStandards": auto_enable_standards,
    "ConfigurationType": configuration_type
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ organization_configuration_identifier }}';

DELETE example

/*+ delete */
DELETE FROM awscc.securityhub.organization_configurations
WHERE
  Identifier = '{{ organization_configuration_identifier }}' AND
  region = 'us-east-1';

Permissions

To operate on the organization_configurations resource, the following permissions are required:

Create

securityhub:UpdateOrganizationConfiguration,
securityhub:DescribeOrganizationConfiguration,
organizations:DescribeOrganization

Read

securityhub:DescribeOrganizationConfiguration

Update

securityhub:UpdateOrganizationConfiguration,
securityhub:DescribeOrganizationConfiguration,
organizations:DescribeOrganization

Delete

securityhub:UpdateOrganizationConfiguration,
securityhub:DescribeOrganizationConfiguration,
securityhub:ListFindingAggregators,
organizations:DescribeOrganization

List

securityhub:DescribeOrganizationConfiguration