organization_configurations

Creates, updates, deletes or gets an organization_configuration resource or lists organization_configurations in a region

Overview

Name	organization_configurations
Type	Resource
Description	The AWS::SecurityHub::OrganizationConfiguration resource represents the configuration of your organization in Security Hub. Only the Security Hub administrator account can create Organization Configuration resource in each region and can opt-in to Central Configuration only in the aggregation region of FindingAggregator.
Id	aws.securityhub.organization_configurations

Fields

Name	Datatype	Description
auto_enable	boolean	Whether to automatically enable Security Hub in new member accounts when they join the organization.
auto_enable_standards	string	Whether to automatically enable Security Hub default standards in new member accounts when they join the organization.
configuration_type	string	Indicates whether the organization uses local or central configuration.
status	string	Describes whether central configuration could be enabled as the ConfigurationType for the organization.
status_message	string	Provides an explanation if the value of Status is equal to FAILED when ConfigurationType is equal to CENTRAL.
member_account_limit_reached	boolean	Whether the maximum number of allowed member accounts are already associated with the Security Hub administrator account.
organization_configuration_identifier	string	The identifier of the OrganizationConfiguration being created and assigned as the unique identifier.
region	string	AWS region.

Methods

Name	Accessible by	Required Params
create_resource	INSERT	AutoEnable, region
delete_resource	DELETE	data__Identifier, region
update_resource	UPDATE	data__Identifier, data__PatchDocument, region
list_resources	SELECT	region
get_resource	SELECT	data__Identifier, region

SELECT examples

Gets all organization_configurations in a region.

SELECT
region,
auto_enable,
auto_enable_standards,
configuration_type,
status,
status_message,
member_account_limit_reached,
organization_configuration_identifier
FROM aws.securityhub.organization_configurations
WHERE region = 'us-east-1';

Gets all properties from an individual organization_configuration.

SELECT
region,
auto_enable,
auto_enable_standards,
configuration_type,
status,
status_message,
member_account_limit_reached,
organization_configuration_identifier
FROM aws.securityhub.organization_configurations
WHERE region = 'us-east-1' AND data__Identifier = '<OrganizationConfigurationIdentifier>';

INSERT example

Use the following StackQL query and manifest file to create a new organization_configuration resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO aws.securityhub.organization_configurations (
 AutoEnable,
 region
)
SELECT 
'{{ AutoEnable }}',
'{{ region }}';

All Properties

/*+ create */
INSERT INTO aws.securityhub.organization_configurations (
 AutoEnable,
 AutoEnableStandards,
 ConfigurationType,
 region
)
SELECT 
 '{{ AutoEnable }}',
 '{{ AutoEnableStandards }}',
 '{{ ConfigurationType }}',
 '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: organization_configuration
    props:
      - name: AutoEnable
        value: '{{ AutoEnable }}'
      - name: AutoEnableStandards
        value: '{{ AutoEnableStandards }}'
      - name: ConfigurationType
        value: '{{ ConfigurationType }}'

DELETE example

/*+ delete */
DELETE FROM aws.securityhub.organization_configurations
WHERE data__Identifier = '<OrganizationConfigurationIdentifier>'
AND region = 'us-east-1';

Permissions

To operate on the organization_configurations resource, the following permissions are required:

Create

securityhub:UpdateOrganizationConfiguration,
securityhub:DescribeOrganizationConfiguration,
organizations:DescribeOrganization

Read

securityhub:DescribeOrganizationConfiguration

Update

securityhub:UpdateOrganizationConfiguration,
securityhub:DescribeOrganizationConfiguration,
organizations:DescribeOrganization

Delete

securityhub:UpdateOrganizationConfiguration,
securityhub:DescribeOrganizationConfiguration,
securityhub:ListFindingAggregators,
organizations:DescribeOrganization

List

securityhub:DescribeOrganizationConfiguration