Security Hub

16 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

SecurityHubAccount # GA

SecurityHubAccount is the Schema for managing the Security Hub account subscription in a region.

kubectl get securityhubaccounts · example on GitHub

Example

# SecurityHubAccount — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubaccount
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubAccount
metadata:
  name: example-securityhubaccount
  namespace: default
spec:
  controlFindingGenerator: SECURITY_CONTROL
  enableDefaultStandards: true
  providerRef:
    name: example-securityhubaccount
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`controlFindingGenerator`	enum	—	ControlFindingGenerator specifies whether a control check generates a single consolidated finding (SECURITY_CONTROL) or per-standard findings (STANDARD_CONTROL). Allowed: `SECURITY_CONTROL, STANDARD_CONTROL`
`enableDefaultStandards`	boolean	—	EnableDefaultStandards enables the standards Security Hub designates as automatically enabled.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—	Tags to add to the hub resource when enabling Security Hub.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`hubArn`	string	—	HubARN is the ARN of the Hub resource.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`subscribedAt`	string	—	SubscribedAt is when Security Hub was enabled in the account.

SecurityHubAggregatorV2 # CLOUD CONTROL · AWS::SecurityHub::AggregatorV2 ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: account-wide finding aggregation. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. SecurityHubAggregatorV2 manages AWS::SecurityHub::AggregatorV2 through the AWS Cloud Control API.

kubectl get securityhubaggregatorv2s · example on GitHub

Example

# SecurityHubAggregatorV2 — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubaggregatorv2
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubAggregatorV2
metadata:
  name: example-securityhubaggregatorv2
  namespace: default
spec:
  linkedRegions:
  - example
  providerRef:
    name: example-securityhubaggregatorv2
    region: us-east-1
  regionLinkingMode: SPECIFIED_REGIONS
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`linkedRegions`	array<string>	yes	The list of included Regions
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`regionLinkingMode`	enum	yes	Indicates to link a list of included Regions Allowed: `SPECIFIED_REGIONS`
`tags`	map<string>	—

Status

Field	Type	Required	Description
`aggregationRegion`	string	—	The aggregation Region of the AggregatorV2 Read-only: reported by AWS after creation.
`aggregatorV2Arn`	string	—	The ARN of the AggregatorV2 being created and assigned as the unique identifier Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

SecurityHubAutomationRule # CLOUD CONTROL · AWS::SecurityHub::AutomationRule

SecurityHubAutomationRule manages AWS::SecurityHub::AutomationRule through the AWS Cloud Control API.

kubectl get securityhubautomationrules · example on GitHub

Example

# SecurityHubAutomationRule — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubautomationrule
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubAutomationRule
metadata:
  name: example-securityhubautomationrule
  namespace: default
spec:
  actions:
  - findingFieldsUpdate:
      confidence: 1
      criticality: 1
      relatedFindings:
      - productArn: arn:aws:iam::123456789012:role/example-role
      types:
      - example
      verificationState: UNKNOWN
    type: FINDING_FIELDS_UPDATE
  criteria:
    awsAccountId:
    - comparison: EQUALS
      value: example
    companyName:
    - comparison: EQUALS
      value: example
    complianceAssociatedStandardsId:
    - comparison: EQUALS
      value: example
    complianceSecurityControlId:
    - comparison: EQUALS
      value: example
    complianceStatus:
    - comparison: EQUALS
      value: example
    confidence:
    - eq: 1
      gte: 1
      lte: 1
    createdAt:
    - end: example
      start: example
    criticality:
    - eq: 1
      gte: 1
      lte: 1
    description:
    - comparison: EQUALS
      value: example
    firstObservedAt:
    - end: example
      start: example
    generatorId:
    - comparison: EQUALS
      value: example
    id:
    - comparison: EQUALS
      value: example
    lastObservedAt:
    - end: example
      start: example
    noteText:
    - comparison: EQUALS
      value: example
    noteUpdatedAt:
    - end: example
      start: example
    noteUpdatedBy:
    - comparison: EQUALS
      value: example
    productArn:
    - comparison: EQUALS
      value: example
    productName:
    - comparison: EQUALS
      value: example
    recordState:
    - comparison: EQUALS
      value: example
    relatedFindingsId:
    - comparison: EQUALS
      value: example
    relatedFindingsProductArn:
    - comparison: EQUALS
      value: example
    resourceDetailsOther:
    - comparison: EQUALS
      key: example
      value: example
    resourceId:
    - comparison: EQUALS
      value: example
    resourcePartition:
    - comparison: EQUALS
      value: example
    resourceRegion:
    - comparison: EQUALS
      value: example
    resourceTags:
    - comparison: EQUALS
      key: example
      value: example
    resourceType:
    - comparison: EQUALS
      value: example
    severityLabel:
    - comparison: EQUALS
      value: example
    sourceUrl:
    - comparison: EQUALS
      value: example
    title:
    - comparison: EQUALS
      value: example
    type:
    - comparison: EQUALS
      value: example
    updatedAt:
    - end: example
      start: example
    userDefinedFields:
    - comparison: EQUALS
      key: example
      value: example
    verificationState:
    - comparison: EQUALS
      value: example
    workflowStatus:
    - comparison: EQUALS
      value: example
  description: Managed by konfig-konector
  isTerminal: false
  providerRef:
    name: example-securityhubautomationrule
    region: us-east-1
  ruleName: example-securityhubautomationrule
  ruleOrder: 1
  ruleStatus: ENABLED
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`actions`	array<object>	yes	One or more actions to update finding fields if a finding matches the conditions specified in ``Criteria``.
`actions[].findingFieldsUpdate`	object	yes	Specifies that the automation rule action is an update to a finding field.
`actions[].findingFieldsUpdate.confidence`	integer	—	The rule action updates the ``Confidence`` field of a finding.
`actions[].findingFieldsUpdate.criticality`	integer	—	The rule action updates the ``Criticality`` field of a finding.
`actions[].findingFieldsUpdate.note`	object	—	The rule action will update the ``Note`` field of a finding.
`actions[].findingFieldsUpdate.note.text`	string	yes	The updated note text.
`actions[].findingFieldsUpdate.note.updatedBy`	object	yes	The principal that updated the note.
`actions[].findingFieldsUpdate.relatedFindings`	array<object>	—	The rule action will update the ``RelatedFindings`` field of a finding.
`actions[].findingFieldsUpdate.relatedFindings[].id`	object	yes	The product-generated identifier for a related finding.
`actions[].findingFieldsUpdate.relatedFindings[].productArn`	string	yes	The Amazon Resource Name (ARN) for the product that generated a related finding.
`actions[].findingFieldsUpdate.severity`	object	—	The rule action will update the ``Severity`` field of a finding.
`actions[].findingFieldsUpdate.severity.label`	enum	—	The severity value of the finding. Allowed: `INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL`
`actions[].findingFieldsUpdate.severity.normalized`	integer	—	The normalized severity for the finding.
`actions[].findingFieldsUpdate.severity.product`	number	—	The native severity as defined by the AWS service or integrated partner product that generated the finding.
`actions[].findingFieldsUpdate.types`	array<string>	—	The rule action updates the ``Types`` field of a finding.
`actions[].findingFieldsUpdate.userDefinedFields`	map<string>	—	The rule action updates the ``UserDefinedFields`` field of a finding.
`actions[].findingFieldsUpdate.verificationState`	enum	—	The rule action updates the ``VerificationState`` field of a finding. Allowed: `UNKNOWN, TRUE_POSITIVE, FALSE_POSITIVE, BENIGN_POSITIVE`
`actions[].findingFieldsUpdate.workflow`	object	—	The rule action will update the ``Workflow`` field of a finding.
`actions[].findingFieldsUpdate.workflow.status`	enum	yes	The status of the investigation into the finding. Allowed: `NEW, NOTIFIED, RESOLVED, SUPPRESSED`
`actions[].type`	enum	yes	Specifies the type of action that Security Hub CSPM takes when a finding matches the defined criteria of a rule. Allowed: `FINDING_FIELDS_UPDATE`
`criteria`	object	yes	A set of [Security Finding Format (ASFF)](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html) finding field attributes and corresponding expected values that ASH uses to filter findings.
`criteria.awsAccountId`	array<object>	—	The AWS-account ID in which a finding was generated.
`criteria.awsAccountId[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.awsAccountId[].value`	string	yes	The string filter value.
`criteria.companyName`	array<object>	—	The name of the company for the product that generated the finding.
`criteria.companyName[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.companyName[].value`	string	yes	The string filter value.
`criteria.complianceAssociatedStandardsId`	array<object>	—	The unique identifier of a standard in which a control is enabled.
`criteria.complianceAssociatedStandardsId[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.complianceAssociatedStandardsId[].value`	string	yes	The string filter value.
`criteria.complianceSecurityControlId`	array<object>	—	The security control ID for which a finding was generated.
`criteria.complianceSecurityControlId[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.complianceSecurityControlId[].value`	string	yes	The string filter value.
`criteria.complianceStatus`	array<object>	—	The result of a security check.
`criteria.complianceStatus[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.complianceStatus[].value`	string	yes	The string filter value.
`criteria.confidence`	array<object>	—	The likelihood that a finding accurately identifies the behavior or issue that it was intended to identify.
`criteria.confidence[].eq`	number	—	The equal-to condition to be applied to a single field when querying for findings.
`criteria.confidence[].gte`	number	—	The greater-than-equal condition to be applied to a single field when querying for findings.
`criteria.confidence[].lte`	number	—	The less-than-equal condition to be applied to a single field when querying for findings.
`criteria.createdAt`	array<object>	—	A timestamp that indicates when this finding record was created.
`criteria.createdAt[].dateRange`	object	—	A date range for the date filter.
`criteria.createdAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`criteria.createdAt[].dateRange.value`	number	yes	A date range value for the date filter.
`criteria.createdAt[].end`	string	—	A timestamp that provides the end date for the date filter.
`criteria.createdAt[].start`	string	—	A timestamp that provides the start date for the date filter.
`criteria.criticality`	array<object>	—	The level of importance that is assigned to the resources that are associated with a finding.
`criteria.criticality[].eq`	number	—	The equal-to condition to be applied to a single field when querying for findings.
`criteria.criticality[].gte`	number	—	The greater-than-equal condition to be applied to a single field when querying for findings.
`criteria.criticality[].lte`	number	—	The less-than-equal condition to be applied to a single field when querying for findings.
`criteria.description`	array<object>	—	A finding's description.
`criteria.description[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.description[].value`	string	yes	The string filter value.
`criteria.firstObservedAt`	array<object>	—	A timestamp that indicates when the potential security issue captured by a finding was first observed by the security findings product.
`criteria.firstObservedAt[].dateRange`	object	—	A date range for the date filter.
`criteria.firstObservedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`criteria.firstObservedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`criteria.firstObservedAt[].end`	string	—	A timestamp that provides the end date for the date filter.
`criteria.firstObservedAt[].start`	string	—	A timestamp that provides the start date for the date filter.
`criteria.generatorId`	array<object>	—	The identifier for the solution-specific component that generated a finding.
`criteria.generatorId[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.generatorId[].value`	string	yes	The string filter value.
`criteria.id`	array<object>	—	The product-specific identifier for a finding.
`criteria.id[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.id[].value`	string	yes	The string filter value.
`criteria.lastObservedAt`	array<object>	—	A timestamp that indicates when the security findings provider most recently observed a change in the resource that is involved in the finding.
`criteria.lastObservedAt[].dateRange`	object	—	A date range for the date filter.
`criteria.lastObservedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`criteria.lastObservedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`criteria.lastObservedAt[].end`	string	—	A timestamp that provides the end date for the date filter.
`criteria.lastObservedAt[].start`	string	—	A timestamp that provides the start date for the date filter.
`criteria.noteText`	array<object>	—	The text of a user-defined note that's added to a finding.
`criteria.noteText[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.noteText[].value`	string	yes	The string filter value.
`criteria.noteUpdatedAt`	array<object>	—	The timestamp of when the note was updated.
`criteria.noteUpdatedAt[].dateRange`	object	—	A date range for the date filter.
`criteria.noteUpdatedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`criteria.noteUpdatedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`criteria.noteUpdatedAt[].end`	string	—	A timestamp that provides the end date for the date filter.
`criteria.noteUpdatedAt[].start`	string	—	A timestamp that provides the start date for the date filter.
`criteria.noteUpdatedBy`	array<object>	—	The principal that created a note.
`criteria.noteUpdatedBy[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.noteUpdatedBy[].value`	string	yes	The string filter value.
`criteria.productArn`	array<object>	—	The Amazon Resource Name (ARN) for a third-party product that generated a finding in Security Hub CSPM.
`criteria.productArn[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.productArn[].value`	string	yes	The string filter value.
`criteria.productName`	array<object>	—	Provides the name of the product that generated the finding.
`criteria.productName[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.productName[].value`	string	yes	The string filter value.
`criteria.recordState`	array<object>	—	Provides the current state of a finding.
`criteria.recordState[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.recordState[].value`	string	yes	The string filter value.
`criteria.relatedFindingsId`	array<object>	—	The product-generated identifier for a related finding.
`criteria.relatedFindingsId[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.relatedFindingsId[].value`	string	yes	The string filter value.
`criteria.relatedFindingsProductArn`	array<object>	—	The ARN for the product that generated a related finding.
`criteria.relatedFindingsProductArn[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.relatedFindingsProductArn[].value`	string	yes	The string filter value.
`criteria.resourceDetailsOther`	array<object>	—	Custom fields and values about the resource that a finding pertains to.
`criteria.resourceDetailsOther[].comparison`	enum	yes	The condition to apply to the key value when filtering Security Hub CSPM findings with a map filter. Allowed: `EQUALS, NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.resourceDetailsOther[].key`	string	yes	The key of the map filter.
`criteria.resourceDetailsOther[].value`	string	yes	The value for the key in the map filter.
`criteria.resourceId`	array<object>	—	The identifier for the given resource type.
`criteria.resourceId[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.resourceId[].value`	string	yes	The string filter value.
`criteria.resourcePartition`	array<object>	—	The partition in which the resource that the finding pertains to is located.
`criteria.resourcePartition[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.resourcePartition[].value`	string	yes	The string filter value.
`criteria.resourceRegion`	array<object>	—	The AWS-Region where the resource that a finding pertains to is located.
`criteria.resourceRegion[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.resourceRegion[].value`	string	yes	The string filter value.
`criteria.resourceTags`	array<object>	—	A list of AWS tags associated with a resource at the time the finding was processed.
`criteria.resourceTags[].comparison`	enum	yes	The condition to apply to the key value when filtering Security Hub CSPM findings with a map filter. Allowed: `EQUALS, NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.resourceTags[].key`	string	yes	The key of the map filter.
`criteria.resourceTags[].value`	string	yes	The value for the key in the map filter.
`criteria.resourceType`	array<object>	—	A finding's title.
`criteria.resourceType[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.resourceType[].value`	string	yes	The string filter value.
`criteria.severityLabel`	array<object>	—	The severity value of the finding.
`criteria.severityLabel[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.severityLabel[].value`	string	yes	The string filter value.
`criteria.sourceUrl`	array<object>	—	Provides a URL that links to a page about the current finding in the finding product.
`criteria.sourceUrl[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.sourceUrl[].value`	string	yes	The string filter value.
`criteria.title`	array<object>	—	A finding's title.
`criteria.title[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.title[].value`	string	yes	The string filter value.
`criteria.type`	array<object>	—	One or more finding types in the format of namespace/category/classifier that classify a finding.
`criteria.type[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.type[].value`	string	yes	The string filter value.
`criteria.updatedAt`	array<object>	—	A timestamp that indicates when the finding record was most recently updated.
`criteria.updatedAt[].dateRange`	object	—	A date range for the date filter.
`criteria.updatedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`criteria.updatedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`criteria.updatedAt[].end`	string	—	A timestamp that provides the end date for the date filter.
`criteria.updatedAt[].start`	string	—	A timestamp that provides the start date for the date filter.
`criteria.userDefinedFields`	array<object>	—	A list of user-defined name and value string pairs added to a finding.
`criteria.userDefinedFields[].comparison`	enum	yes	The condition to apply to the key value when filtering Security Hub CSPM findings with a map filter. Allowed: `EQUALS, NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.userDefinedFields[].key`	string	yes	The key of the map filter.
`criteria.userDefinedFields[].value`	string	yes	The value for the key in the map filter.
`criteria.verificationState`	array<object>	—	Provides the veracity of a finding.
`criteria.verificationState[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.verificationState[].value`	string	yes	The string filter value.
`criteria.workflowStatus`	array<object>	—	Provides information about the status of the investigation into a finding.
`criteria.workflowStatus[].comparison`	enum	yes	The condition to apply to a string value when filtering Security Hub CSPM findings. Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS, NOT_CONTAINS`
`criteria.workflowStatus[].value`	string	yes	The string filter value.
`description`	string	yes	A description of the rule.
`isTerminal`	boolean	—	Specifies whether a rule is the last to be applied with respect to a finding that matches the rule criteria.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`ruleName`	string	yes	The name of the rule.
`ruleOrder`	integer	yes	An integer ranging from 1 to 1000 that represents the order in which the rule action is applied to findings.
`ruleStatus`	enum	—	Whether the rule is active after it is created. Allowed: `ENABLED, DISABLED`
`tags`	map<string>	—	User-defined tags associated with an automation rule.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Read-only: reported by AWS after creation.
`createdBy`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`ruleArn`	string	—	Read-only: reported by AWS after creation.
`updatedAt`	string	—	Read-only: reported by AWS after creation.

SecurityHubAutomationRuleV2 # CLOUD CONTROL · AWS::SecurityHub::AutomationRuleV2

SecurityHubAutomationRuleV2 manages AWS::SecurityHub::AutomationRuleV2 through the AWS Cloud Control API.

kubectl get securityhubautomationrulev2s · example on GitHub

Example

# SecurityHubAutomationRuleV2 — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubautomationrulev2
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubAutomationRuleV2
metadata:
  name: example-securityhubautomationrulev2
  namespace: default
spec:
  actions:
  - externalIntegrationConfiguration:
      connectorArn: arn:aws:iam::123456789012:role/example-role
    findingFieldsUpdate:
      comment: Managed by konfig-konector
      severityId: 1
      statusId: 1
    type: FINDING_FIELDS_UPDATE
  criteria:
    ocsfFindingCriteria:
      compositeFilters:
      - booleanFilters:
        - fieldName: compliance.assessments.meets_criteria
          filter:
            value: false
        dateFilters:
        - fieldName: finding_info.created_time_dt
          filter:
            end: example
            start: example
        mapFilters:
        - fieldName: resources.tags
          filter:
            comparison: EQUALS
            key: example
            value: example
        numberFilters:
        - fieldName: activity_id
          filter:
            eq: 1
            gte: 1
            lte: 1
        operator: AND
        stringFilters:
        - fieldName: activity_name
          filter:
            comparison: EQUALS
            value: example
      compositeOperator: AND
  description: Managed by konfig-konector
  providerRef:
    name: example-securityhubautomationrulev2
    region: us-east-1
  ruleName: example-securityhubautomationrulev2
  ruleOrder: 1
  ruleStatus: ENABLED
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`actions`	array<object>	yes	A list of actions to be performed when the rule criteria is met
`actions[].externalIntegrationConfiguration`	object	—	SecurityHubAutomationRuleV2ExternalIntegrationConfiguration is a nested property type of AWS::SecurityHub::AutomationRuleV2.
`actions[].externalIntegrationConfiguration.connectorArn`	string	—	The ARN of the connector that establishes the integration
`actions[].findingFieldsUpdate`	object	—	SecurityHubAutomationRuleV2AutomationRulesFindingFieldsUpdateV2 is a nested property type of AWS::SecurityHub::AutomationRuleV2.
`actions[].findingFieldsUpdate.comment`	string	—	Notes or contextual information for findings that are modified by the automation rule
`actions[].findingFieldsUpdate.severityId`	integer	—	The severity level to be assigned to findings that match the automation rule criteria
`actions[].findingFieldsUpdate.statusId`	integer	—	The status to be applied to findings that match automation rule criteria
`actions[].type`	enum	yes	The category of action to be executed by the automation rule Allowed: `FINDING_FIELDS_UPDATE, EXTERNAL_INTEGRATION`
`criteria`	object	yes	SecurityHubAutomationRuleV2Criteria is a nested property type of AWS::SecurityHub::AutomationRuleV2.
`criteria.ocsfFindingCriteria`	object	—	SecurityHubAutomationRuleV2OcsfFindingFilters is a nested property type of AWS::SecurityHub::AutomationRuleV2.
`criteria.ocsfFindingCriteria.compositeFilters`	array<object>	—	Enables the creation of complex filtering conditions by combining filter
`criteria.ocsfFindingCriteria.compositeFilters[].booleanFilters`	array<object>	—	Enables filtering based on boolean field values
`criteria.ocsfFindingCriteria.compositeFilters[].booleanFilters[].fieldName`	enum	yes	The name of the field Allowed: `compliance.assessments.meets_criteria, vulnerabilities.is_exploit_available, vulnerabilities.is_fix_available`
`criteria.ocsfFindingCriteria.compositeFilters[].booleanFilters[].filter`	object	yes	SecurityHubAutomationRuleV2BooleanFilter is a nested property type of AWS::SecurityHub::AutomationRuleV2.
`criteria.ocsfFindingCriteria.compositeFilters[].booleanFilters[].filter.value`	boolean	yes	The value of the boolean
`criteria.ocsfFindingCriteria.compositeFilters[].dateFilters`	array<object>	—	Enables filtering based on date and timestamp fields
`criteria.ocsfFindingCriteria.compositeFilters[].dateFilters[].fieldName`	enum	yes	The name of the field Allowed: `finding_info.created_time_dt, finding_info.first_seen_time_dt, finding_info.last_seen_time_dt, finding_info.modified_time_dt`
`criteria.ocsfFindingCriteria.compositeFilters[].dateFilters[].filter`	object	yes	SecurityHubAutomationRuleV2DateFilter is a nested property type of AWS::SecurityHub::AutomationRuleV2.
`criteria.ocsfFindingCriteria.compositeFilters[].dateFilters[].filter.dateRange`	object	—	SecurityHubAutomationRuleV2DateRange is a nested property type of AWS::SecurityHub::AutomationRuleV2.
`criteria.ocsfFindingCriteria.compositeFilters[].dateFilters[].filter.end`	string	—
`criteria.ocsfFindingCriteria.compositeFilters[].dateFilters[].filter.start`	string	—
`criteria.ocsfFindingCriteria.compositeFilters[].mapFilters`	array<object>	—	Enables filtering based on map field value
`criteria.ocsfFindingCriteria.compositeFilters[].mapFilters[].fieldName`	enum	yes	The name of the field Allowed: `resources.tags`
`criteria.ocsfFindingCriteria.compositeFilters[].mapFilters[].filter`	object	yes	SecurityHubAutomationRuleV2MapFilter is a nested property type of AWS::SecurityHub::AutomationRuleV2.
`criteria.ocsfFindingCriteria.compositeFilters[].mapFilters[].filter.comparison`	enum	yes	The condition to apply to the key value when filtering findings with a map filter Allowed: `EQUALS, NOT_EQUALS`
`criteria.ocsfFindingCriteria.compositeFilters[].mapFilters[].filter.key`	string	yes	The key of the map filter
`criteria.ocsfFindingCriteria.compositeFilters[].mapFilters[].filter.value`	string	yes	The value for the key in the map filter
`criteria.ocsfFindingCriteria.compositeFilters[].numberFilters`	array<object>	—	Enables filtering based on numerical field values
`criteria.ocsfFindingCriteria.compositeFilters[].numberFilters[].fieldName`	enum	yes	The name of the field Allowed: `activity_id, compliance.status_id, confidence_score, finding_info.related_events_count, vendor_attributes.severity_id`
`criteria.ocsfFindingCriteria.compositeFilters[].numberFilters[].filter`	object	yes	SecurityHubAutomationRuleV2NumberFilter is a nested property type of AWS::SecurityHub::AutomationRuleV2.
`criteria.ocsfFindingCriteria.compositeFilters[].numberFilters[].filter.eq`	number	—	The equal-to condition to be applied to a single field when querying for findings
`criteria.ocsfFindingCriteria.compositeFilters[].numberFilters[].filter.gte`	number	—	The greater-than-equal condition to be applied to a single field when querying for findings
`criteria.ocsfFindingCriteria.compositeFilters[].numberFilters[].filter.lte`	number	—	The less-than-equal condition to be applied to a single field when querying for findings
`criteria.ocsfFindingCriteria.compositeFilters[].operator`	enum	—	Allowed: `AND, OR`
`criteria.ocsfFindingCriteria.compositeFilters[].stringFilters`	array<object>	—	Enables filtering based on string field values
`criteria.ocsfFindingCriteria.compositeFilters[].stringFilters[].fieldName`	enum	yes	Allowed: `activity_name, cloud.account.name, cloud.account.uid, cloud.provider, cloud.region, compliance.assessments.category, compliance.assessments.name, compliance.control…`
`criteria.ocsfFindingCriteria.compositeFilters[].stringFilters[].filter`	object	yes	SecurityHubAutomationRuleV2StringFilter is a nested property type of AWS::SecurityHub::AutomationRuleV2.
`criteria.ocsfFindingCriteria.compositeFilters[].stringFilters[].filter.comparison`	enum	yes	The condition to apply to a string value when filtering findings Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS, CONTAINS`
`criteria.ocsfFindingCriteria.compositeFilters[].stringFilters[].filter.value`	string	yes	The string filter value
`criteria.ocsfFindingCriteria.compositeOperator`	enum	—	Allowed: `AND, OR`
`description`	string	yes	A description of the automation rule
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`ruleName`	string	yes	The name of the automation rule
`ruleOrder`	number	yes	The value for the rule priority
`ruleStatus`	enum	—	The status of the automation rule Allowed: `ENABLED, DISABLED`
`tags`	map<string>	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`ruleArn`	string	—	The ARN of the automation rule Read-only: reported by AWS after creation.
`ruleId`	string	—	The ID of the automation rule Read-only: reported by AWS after creation.
`updatedAt`	string	—	Read-only: reported by AWS after creation.

SecurityHubConfigurationPolicy # CLOUD CONTROL · AWS::SecurityHub::ConfigurationPolicy

SecurityHubConfigurationPolicy manages AWS::SecurityHub::ConfigurationPolicy through the AWS Cloud Control API.

kubectl get securityhubconfigurationpolicies · example on GitHub

Example

# SecurityHubConfigurationPolicy — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubconfigurationpolicy
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubConfigurationPolicy
metadata:
  name: example-securityhubconfigurationpolicy
  namespace: default
spec:
  configurationPolicy:
    securityHub:
      enabledStandardIdentifiers:
      - example
      securityControlsConfiguration:
        disabledSecurityControlIdentifiers:
        - example
        enabledSecurityControlIdentifiers:
        - example
      serviceEnabled: true
  description: Managed by konfig-konector
  name: example-securityhubconfigurationpolicy
  providerRef:
    name: example-securityhubconfigurationpolicy
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`configurationPolicy`	object	yes	SecurityHubConfigurationPolicyPolicy is a nested property type of AWS::SecurityHub::ConfigurationPolicy.
`configurationPolicy.securityHub`	object	—	SecurityHubConfigurationPolicySecurityHubPolicy is a nested property type of AWS::SecurityHub::ConfigurationPolicy.
`configurationPolicy.securityHub.enabledStandardIdentifiers`	array<string>	—	A list that defines which security standards are enabled in the configuration policy.
`configurationPolicy.securityHub.securityControlsConfiguration`	object	—	SecurityHubConfigurationPolicySecurityControlsConfiguration is a nested property type of AWS::SecurityHub::ConfigurationPolicy.
`configurationPolicy.securityHub.securityControlsConfiguration.disabledSecurityControlIdentifiers`	array<string>	—	A list of security controls that are disabled in the configuration policy
`configurationPolicy.securityHub.securityControlsConfiguration.enabledSecurityControlIdentifiers`	array<string>	—	A list of security controls that are enabled in the configuration policy.
`configurationPolicy.securityHub.securityControlsConfiguration.securityControlCustomParameters`	array<object>	—	A list of security controls and control parameter values that are included in a configuration policy.
`configurationPolicy.securityHub.securityControlsConfiguration.securityControlCustomParameters[].parameters`	map<string>	—	An object that specifies parameter values for a control in a configuration policy.
`configurationPolicy.securityHub.securityControlsConfiguration.securityControlCustomParameters[].securityControlId`	string	—	The ID of the security control.
`configurationPolicy.securityHub.serviceEnabled`	boolean	—	Indicates whether Security Hub is enabled in the policy.
`description`	string	—	The description of the configuration policy.
`name`	string	yes	The name of the configuration policy.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the configuration policy.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The date and time, in UTC and ISO 8601 format.
`id`	string	—	The universally unique identifier (UUID) of the configuration policy.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`serviceEnabled`	boolean	—	Indicates whether the service that the configuration policy applies to is enabled in the policy.
`updatedAt`	string	—	The date and time, in UTC and ISO 8601 format.

SecurityHubConnector # CLOUD CONTROL · AWS::SecurityHub::Connector

SecurityHubConnector manages AWS::SecurityHub::Connector through the AWS Cloud Control API.

kubectl get securityhubconnectors · example on GitHub

Example

# SecurityHubConnector — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubconnector
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubConnector
metadata:
  name: example-securityhubconnector
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-securityhubconnector
  provider:
    azure:
      awsConfigConnectorArn: arn:aws:iam::123456789012:role/example-role
      azureRegions:
      - example
      scopeConfiguration:
        scopeType: TENANT
        scopeValues:
        - example
  providerRef:
    name: example-securityhubconnector
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`description`	string	—	The description of the connector.
`name`	string	yes	The name of the connector.
`provider`	object	yes	SecurityHubConnectorProvider is a nested property type of AWS::SecurityHub::Connector.
`provider.azure`	object	yes	SecurityHubConnectorAzureProviderConfiguration is a nested property type of AWS::SecurityHub::Connector.
`provider.azure.awsConfigConnectorArn`	string	yes	The ARN of the multi-cloud configuration connector used to establish the connection to Azure.
`provider.azure.azureRegions`	array<string>	yes	The list of Azure regions to monitor.
`provider.azure.scopeConfiguration`	object	yes	The scope configuration that defines which Azure resources are monitored.
`provider.azure.scopeConfiguration.scopeType`	enum	yes	The type of scope. Allowed: `TENANT, SUBSCRIPTION`
`provider.azure.scopeConfiguration.scopeValues`	array<string>	—	The list of scope values, such as subscription IDs, when the scope type is ``subscription``.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`connectorArn`	string	—	Read-only: reported by AWS after creation.
`connectorId`	string	—	Read-only: reported by AWS after creation.
`connectorStatus`	string	—	Read-only: reported by AWS after creation.
`createdAt`	string	—	Read-only: reported by AWS after creation.
`createdBy`	string	—	Read-only: reported by AWS after creation.
`enablementStatus`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`issues`	array<object>	—	Read-only: reported by AWS after creation.
`issues[].code`	string	yes	The error code that identifies the type of health issue.
`issues[].message`	string	yes	A human-readable message that describes the health issue.
`lastCheckedAt`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`lastUpdatedAt`	string	—	Read-only: reported by AWS after creation.
`message`	string	—	Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

SecurityHubConnectorV2 # CLOUD CONTROL · AWS::SecurityHub::ConnectorV2

SecurityHubConnectorV2 manages AWS::SecurityHub::ConnectorV2 through the AWS Cloud Control API.

kubectl get securityhubconnectorv2s · example on GitHub

Example

# SecurityHubConnectorV2 — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubconnectorv2
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubConnectorV2
metadata:
  name: example-securityhubconnectorv2
  namespace: default
spec:
  description: Managed by konfig-konector
  kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  name: example-securityhubconnectorv2
  providerRef:
    name: example-securityhubconnectorv2
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`description`	string	—	A description of the connector
`kmsKeyArn`	string	—	The ARN of KMS key used for the connector Create-only in AWS: changing it requires replacing the resource.
`name`	string	yes	The name of the connector Create-only in AWS: changing it requires replacing the resource.
`provider`	object	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`connectorArn`	string	—	The ARN of the connector Read-only: reported by AWS after creation.
`connectorId`	string	—	The ID of the connector Read-only: reported by AWS after creation.
`connectorStatus`	string	—	The status of the connector Read-only: reported by AWS after creation.
`createdAt`	string	—	Read-only: reported by AWS after creation.
`enablementStatus`	string	—	The enablement status of the connector Read-only: reported by AWS after creation.
`enablementStatusReason`	string	—	The reason for the enablement status of the connector Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`issues`	array<object>	—	The list of health issues associated with the connector Read-only: reported by AWS after creation.
`issues[].code`	string	yes	The code identifying the type of health issue
`issues[].message`	string	yes	The message describing the health issue
`lastCheckedAt`	string	—	Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`lastUpdatedAt`	string	—	Read-only: reported by AWS after creation.
`message`	string	—	The message of the connector status change Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

SecurityHubDelegatedAdmin # CLOUD CONTROL · AWS::SecurityHub::DelegatedAdmin ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: organization-wide delegated administrator. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. SecurityHubDelegatedAdmin manages AWS::SecurityHub::DelegatedAdmin through the AWS Cloud Control API.

kubectl get securityhubdelegatedadmins · example on GitHub

Example

# SecurityHubDelegatedAdmin — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubdelegatedadmin
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubDelegatedAdmin
metadata:
  name: example-securityhubdelegatedadmin
  namespace: default
spec:
  adminAccountId: '123456789012'
  providerRef:
    name: example-securityhubdelegatedadmin
    region: us-east-1

Spec

Field	Type	Required	Description
`adminAccountId`	string	yes	The AWS-account identifier of the account to designate as the Security Hub CSPM administrator account.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`delegatedAdminIdentifier`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Read-only: reported by AWS after creation. Allowed: `ENABLED, DISABLE_IN_PROGRESS`

SecurityHubFindingAggregator # CLOUD CONTROL · AWS::SecurityHub::FindingAggregator ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: account-wide finding aggregation. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. SecurityHubFindingAggregator manages AWS::SecurityHub::FindingAggregator through the AWS Cloud Control API.

kubectl get securityhubfindingaggregators · example on GitHub

Example

# SecurityHubFindingAggregator — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubfindingaggregator
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubFindingAggregator
metadata:
  name: example-securityhubfindingaggregator
  namespace: default
spec:
  providerRef:
    name: example-securityhubfindingaggregator
    region: us-east-1
  regionLinkingMode: ALL_REGIONS
  regions:
  - example

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`regionLinkingMode`	enum	yes	Indicates whether to aggregate findings from all of the available Regions in the current partition. Allowed: `ALL_REGIONS, ALL_REGIONS_EXCEPT_SPECIFIED, SPECIFIED_REGIONS`
`regions`	array<string>	—	If ``RegionLinkingMode`` is ``ALL_REGIONS_EXCEPT_SPECIFIED``, then this is a space-separated list of Regions that do not aggregate findings to the aggregation Region.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`findingAggregationRegion`	string	—	Read-only: reported by AWS after creation.
`findingAggregatorArn`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

SecurityHubHubV2 # CLOUD CONTROL · AWS::SecurityHub::HubV2 ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: account-wide Security Hub enablement. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. SecurityHubHubV2 manages AWS::SecurityHub::HubV2 through the AWS Cloud Control API.

kubectl get securityhubhubv2s · example on GitHub

Example

# SecurityHubHubV2 — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubhubv2
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubHubV2
metadata:
  name: example-securityhubhubv2
  namespace: default
spec:
  providerRef:
    name: example-securityhubhubv2
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`hubV2Arn`	string	—	The Amazon Resource Name of the Security Hub V2 resource.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`subscribedAt`	string	—	Read-only: reported by AWS after creation.

SecurityHubInsight # CLOUD CONTROL · AWS::SecurityHub::Insight

SecurityHubInsight manages AWS::SecurityHub::Insight through the AWS Cloud Control API.

kubectl get securityhubinsights · example on GitHub

Example

# SecurityHubInsight — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubinsight
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubInsight
metadata:
  name: example-securityhubinsight
  namespace: default
spec:
  filters:
    awsAccountId:
    - comparison: EQUALS
      value: example
    awsAccountName:
    - comparison: EQUALS
      value: example
    companyName:
    - comparison: EQUALS
      value: example
    complianceAssociatedStandardsId:
    - comparison: EQUALS
      value: example
    complianceSecurityControlId:
    - comparison: EQUALS
      value: example
    complianceSecurityControlParametersName:
    - comparison: EQUALS
      value: example
    complianceSecurityControlParametersValue:
    - comparison: EQUALS
      value: example
    complianceStatus:
    - comparison: EQUALS
      value: example
    confidence:
    - eq: 1
      gte: 1
      lte: 1
    createdAt:
    - end: example
      start: example
    criticality:
    - eq: 1
      gte: 1
      lte: 1
    description:
    - comparison: EQUALS
      value: example
    findingProviderFieldsConfidence:
    - eq: 1
      gte: 1
      lte: 1
    findingProviderFieldsCriticality:
    - eq: 1
      gte: 1
      lte: 1
    findingProviderFieldsRelatedFindingsId:
    - comparison: EQUALS
      value: example
    findingProviderFieldsRelatedFindingsProductArn:
    - comparison: EQUALS
      value: example
    findingProviderFieldsSeverityLabel:
    - comparison: EQUALS
      value: example
    findingProviderFieldsSeverityOriginal:
    - comparison: EQUALS
      value: example
    findingProviderFieldsTypes:
    - comparison: EQUALS
      value: example
    firstObservedAt:
    - end: example
      start: example
    generatorId:
    - comparison: EQUALS
      value: example
    id:
    - comparison: EQUALS
      value: example
    keyword:
    - value: example
    lastObservedAt:
    - end: example
      start: example
    malwareName:
    - comparison: EQUALS
      value: example
    malwarePath:
    - comparison: EQUALS
      value: example
    malwareState:
    - comparison: EQUALS
      value: example
    malwareType:
    - comparison: EQUALS
      value: example
    networkDestinationDomain:
    - comparison: EQUALS
      value: example
    networkDestinationIpV4:
    - cidr: 10.0.0.0/16
    networkDestinationIpV6:
    - cidr: 10.0.0.0/16
    networkDestinationPort:
    - eq: 1
      gte: 1
      lte: 1
    networkDirection:
    - comparison: EQUALS
      value: example
    networkProtocol:
    - comparison: EQUALS
      value: example
    networkSourceDomain:
    - comparison: EQUALS
      value: example
    networkSourceIpV4:
    - cidr: 10.0.0.0/16
    networkSourceIpV6:
    - cidr: 10.0.0.0/16
    networkSourceMac:
    - comparison: EQUALS
      value: example
    networkSourcePort:
    - eq: 1
      gte: 1
      lte: 1
    noteText:
    - comparison: EQUALS
      value: example
    noteUpdatedAt:
    - end: example
      start: example
    noteUpdatedBy:
    - comparison: EQUALS
      value: example
    processLaunchedAt:
    - end: example
      start: example
    processName:
    - comparison: EQUALS
      value: example
    processParentPid:
    - eq: 1
      gte: 1
      lte: 1
    processPath:
    - comparison: EQUALS
      value: example
    processPid:
    - eq: 1
      gte: 1
      lte: 1
    processTerminatedAt:
    - end: example
      start: example
    productArn:
    - comparison: EQUALS
      value: example
    productFields:
    - comparison: EQUALS
      key: example
      value: example
    productName:
    - comparison: EQUALS
      value: example
    recommendationText:
    - comparison: EQUALS
      value: example
    recordState:
    - comparison: EQUALS
      value: example
    region:
    - comparison: EQUALS
      value: example
    relatedFindingsId:
    - comparison: EQUALS
      value: example
    relatedFindingsProductArn:
    - comparison: EQUALS
      value: example
    resourceApplicationArn:
    - comparison: EQUALS
      value: example
    resourceApplicationName:
    - comparison: EQUALS
      value: example
    resourceAwsEc2InstanceIamInstanceProfileArn:
    - comparison: EQUALS
      value: example
    resourceAwsEc2InstanceImageId:
    - comparison: EQUALS
      value: example
    resourceAwsEc2InstanceIpV4Addresses:
    - cidr: 10.0.0.0/16
    resourceAwsEc2InstanceIpV6Addresses:
    - cidr: 10.0.0.0/16
    resourceAwsEc2InstanceKeyName:
    - comparison: EQUALS
      value: example
    resourceAwsEc2InstanceLaunchedAt:
    - end: example
      start: example
    resourceAwsEc2InstanceSubnetId:
    - comparison: EQUALS
      value: example
    resourceAwsEc2InstanceType:
    - comparison: EQUALS
      value: example
    resourceAwsEc2InstanceVpcId:
    - comparison: EQUALS
      value: example
    resourceAwsIamAccessKeyCreatedAt:
    - end: example
      start: example
    resourceAwsIamAccessKeyPrincipalName:
    - comparison: EQUALS
      value: example
    resourceAwsIamAccessKeyStatus:
    - comparison: EQUALS
      value: example
    resourceAwsIamAccessKeyUserName:
    - comparison: EQUALS
      value: example
    resourceAwsIamUserUserName:
    - comparison: EQUALS
      value: example
    resourceAwsS3BucketOwnerId:
    - comparison: EQUALS
      value: example
    resourceAwsS3BucketOwnerName:
    - comparison: EQUALS
      value: example
    resourceContainerImageId:
    - comparison: EQUALS
      value: example
    resourceContainerImageName:
    - comparison: EQUALS
      value: example
    resourceContainerLaunchedAt:
    - end: example
      start: example
    resourceContainerName:
    - comparison: EQUALS
      value: example
    resourceDetailsOther:
    - comparison: EQUALS
      key: example
      value: example
    resourceId:
    - comparison: EQUALS
      value: example
    resourcePartition:
    - comparison: EQUALS
      value: example
    resourceRegion:
    - comparison: EQUALS
      value: example
    resourceTags:
    - comparison: EQUALS
      key: example
      value: example
    resourceType:
    - comparison: EQUALS
      value: example
    sample:
    - value: false
    severityLabel:
    - comparison: EQUALS
      value: example
    severityNormalized:
    - eq: 1
      gte: 1
      lte: 1
    severityProduct:
    - eq: 1
      gte: 1
      lte: 1
    sourceUrl:
    - comparison: EQUALS
      value: example
    threatIntelIndicatorCategory:
    - comparison: EQUALS
      value: example
    threatIntelIndicatorLastObservedAt:
    - end: example
      start: example
    threatIntelIndicatorSource:
    - comparison: EQUALS
      value: example
    threatIntelIndicatorSourceUrl:
    - comparison: EQUALS
      value: example
    threatIntelIndicatorType:
    - comparison: EQUALS
      value: example
    threatIntelIndicatorValue:
    - comparison: EQUALS
      value: example
    title:
    - comparison: EQUALS
      value: example
    type:
    - comparison: EQUALS
      value: example
    updatedAt:
    - end: example
      start: example
    userDefinedFields:
    - comparison: EQUALS
      key: example
      value: example
    verificationState:
    - comparison: EQUALS
      value: example
    vulnerabilitiesExploitAvailable:
    - comparison: EQUALS
      value: example
    vulnerabilitiesFixAvailable:
    - comparison: EQUALS
      value: example
    workflowState:
    - comparison: EQUALS
      value: example
    workflowStatus:
    - comparison: EQUALS
      value: example
  groupByAttribute: example
  name: example-securityhubinsight
  providerRef:
    name: example-securityhubinsight
    region: us-east-1

Spec

Field	Type	Required	Description
`filters`	object	yes	One or more attributes used to filter the findings included in the insight
`filters.awsAccountId`	array<object>	—	The AWS account ID in which a finding is generated.
`filters.awsAccountId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.awsAccountId[].value`	string	yes
`filters.awsAccountName`	array<object>	—	The name of the AWS account in which a finding is generated.
`filters.awsAccountName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.awsAccountName[].value`	string	yes
`filters.companyName`	array<object>	—	The name of the findings provider (company) that owns the solution (product) that generates findings.
`filters.companyName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.companyName[].value`	string	yes
`filters.complianceAssociatedStandardsId`	array<object>	—	The unique identifier of a standard in which a control is enabled.
`filters.complianceAssociatedStandardsId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.complianceAssociatedStandardsId[].value`	string	yes
`filters.complianceSecurityControlId`	array<object>	—	The unique identifier of a control across standards.
`filters.complianceSecurityControlId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.complianceSecurityControlId[].value`	string	yes
`filters.complianceSecurityControlParametersName`	array<object>	—	The name of a security control parameter.
`filters.complianceSecurityControlParametersName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.complianceSecurityControlParametersName[].value`	string	yes
`filters.complianceSecurityControlParametersValue`	array<object>	—	The current value of a security control parameter.
`filters.complianceSecurityControlParametersValue[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.complianceSecurityControlParametersValue[].value`	string	yes
`filters.complianceStatus`	array<object>	—	Exclusive to findings that are generated as the result of a check run against a specific rule in a supported standard.
`filters.complianceStatus[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.complianceStatus[].value`	string	yes
`filters.confidence`	array<object>	—	A finding's confidence.
`filters.confidence[].eq`	number	—	The equal-to condition to be applied to a single field when querying for findings.
`filters.confidence[].gte`	number	—	The greater-than-equal condition to be applied to a single field when querying for findings.
`filters.confidence[].lte`	number	—	The less-than-equal condition to be applied to a single field when querying for findings.
`filters.createdAt`	array<object>	—	An ISO8601-formatted timestamp that indicates when the security findings provider captured the potential security issue that a finding captured.
`filters.createdAt[].dateRange`	object	—	SecurityHubInsightDateRange is a nested property type of AWS::SecurityHub::Insight.
`filters.createdAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`filters.createdAt[].dateRange.value`	number	yes	A date range value for the date filter.
`filters.createdAt[].end`	string	—
`filters.createdAt[].start`	string	—
`filters.criticality`	array<object>	—	The level of importance assigned to the resources associated with the finding.
`filters.criticality[].eq`	number	—	The equal-to condition to be applied to a single field when querying for findings.
`filters.criticality[].gte`	number	—	The greater-than-equal condition to be applied to a single field when querying for findings.
`filters.criticality[].lte`	number	—	The less-than-equal condition to be applied to a single field when querying for findings.
`filters.description`	array<object>	—	A finding's description.
`filters.description[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.description[].value`	string	yes
`filters.findingProviderFieldsConfidence`	array<object>	—	The finding provider value for the finding confidence.
`filters.findingProviderFieldsConfidence[].eq`	number	—	The equal-to condition to be applied to a single field when querying for findings.
`filters.findingProviderFieldsConfidence[].gte`	number	—	The greater-than-equal condition to be applied to a single field when querying for findings.
`filters.findingProviderFieldsConfidence[].lte`	number	—	The less-than-equal condition to be applied to a single field when querying for findings.
`filters.findingProviderFieldsCriticality`	array<object>	—	The finding provider value for the level of importance assigned to the resources associated with the findings.
`filters.findingProviderFieldsCriticality[].eq`	number	—	The equal-to condition to be applied to a single field when querying for findings.
`filters.findingProviderFieldsCriticality[].gte`	number	—	The greater-than-equal condition to be applied to a single field when querying for findings.
`filters.findingProviderFieldsCriticality[].lte`	number	—	The less-than-equal condition to be applied to a single field when querying for findings.
`filters.findingProviderFieldsRelatedFindingsId`	array<object>	—	The finding identifier of a related finding that is identified by the finding provider.
`filters.findingProviderFieldsRelatedFindingsId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.findingProviderFieldsRelatedFindingsId[].value`	string	yes
`filters.findingProviderFieldsRelatedFindingsProductArn`	array<object>	—	The ARN of the solution that generated a related finding that is identified by the finding provider.
`filters.findingProviderFieldsRelatedFindingsProductArn[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.findingProviderFieldsRelatedFindingsProductArn[].value`	string	yes
`filters.findingProviderFieldsSeverityLabel`	array<object>	—	The finding provider value for the severity label.
`filters.findingProviderFieldsSeverityLabel[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.findingProviderFieldsSeverityLabel[].value`	string	yes
`filters.findingProviderFieldsSeverityOriginal`	array<object>	—	The finding provider's original value for the severity.
`filters.findingProviderFieldsSeverityOriginal[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.findingProviderFieldsSeverityOriginal[].value`	string	yes
`filters.findingProviderFieldsTypes`	array<object>	—	One or more finding types that the finding provider assigned to the finding.
`filters.findingProviderFieldsTypes[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.findingProviderFieldsTypes[].value`	string	yes
`filters.firstObservedAt`	array<object>	—	An ISO8601-formatted timestamp that indicates when the security findings provider first observed the potential security issue that a finding captured.
`filters.firstObservedAt[].dateRange`	object	—	SecurityHubInsightDateRange is a nested property type of AWS::SecurityHub::Insight.
`filters.firstObservedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`filters.firstObservedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`filters.firstObservedAt[].end`	string	—
`filters.firstObservedAt[].start`	string	—
`filters.generatorId`	array<object>	—	The identifier for the solution-specific component (a discrete unit of logic) that generated a finding.
`filters.generatorId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.generatorId[].value`	string	yes
`filters.id`	array<object>	—	The security findings provider-specific identifier for a finding.
`filters.id[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.id[].value`	string	yes
`filters.keyword`	array<object>	—	A keyword for a finding.
`filters.keyword[].value`	string	yes	A value for the keyword.
`filters.lastObservedAt`	array<object>	—	An ISO8601-formatted timestamp that indicates when the security findings provider most recently observed the potential security issue that a finding captured.
`filters.lastObservedAt[].dateRange`	object	—	SecurityHubInsightDateRange is a nested property type of AWS::SecurityHub::Insight.
`filters.lastObservedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`filters.lastObservedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`filters.lastObservedAt[].end`	string	—
`filters.lastObservedAt[].start`	string	—
`filters.malwareName`	array<object>	—	The name of the malware that was observed.
`filters.malwareName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.malwareName[].value`	string	yes
`filters.malwarePath`	array<object>	—	The filesystem path of the malware that was observed.
`filters.malwarePath[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.malwarePath[].value`	string	yes
`filters.malwareState`	array<object>	—	The state of the malware that was observed.
`filters.malwareState[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.malwareState[].value`	string	yes
`filters.malwareType`	array<object>	—	The type of the malware that was observed.
`filters.malwareType[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.malwareType[].value`	string	yes
`filters.networkDestinationDomain`	array<object>	—	The destination domain of network-related information about a finding.
`filters.networkDestinationDomain[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.networkDestinationDomain[].value`	string	yes
`filters.networkDestinationIpV4`	array<object>	—	The destination IPv4 address of network-related information about a finding.
`filters.networkDestinationIpV4[].cidr`	string	yes	A finding's CIDR value.
`filters.networkDestinationIpV6`	array<object>	—	The destination IPv6 address of network-related information about a finding.
`filters.networkDestinationIpV6[].cidr`	string	yes	A finding's CIDR value.
`filters.networkDestinationPort`	array<object>	—	The destination port of network-related information about a finding.
`filters.networkDestinationPort[].eq`	number	—	The equal-to condition to be applied to a single field when querying for findings.
`filters.networkDestinationPort[].gte`	number	—	The greater-than-equal condition to be applied to a single field when querying for findings.
`filters.networkDestinationPort[].lte`	number	—	The less-than-equal condition to be applied to a single field when querying for findings.
`filters.networkDirection`	array<object>	—	Indicates the direction of network traffic associated with a finding.
`filters.networkDirection[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.networkDirection[].value`	string	yes
`filters.networkProtocol`	array<object>	—	The protocol of network-related information about a finding.
`filters.networkProtocol[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.networkProtocol[].value`	string	yes
`filters.networkSourceDomain`	array<object>	—	The source domain of network-related information about a finding.
`filters.networkSourceDomain[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.networkSourceDomain[].value`	string	yes
`filters.networkSourceIpV4`	array<object>	—	The source IPv4 address of network-related information about a finding.
`filters.networkSourceIpV4[].cidr`	string	yes	A finding's CIDR value.
`filters.networkSourceIpV6`	array<object>	—	The source IPv6 address of network-related information about a finding.
`filters.networkSourceIpV6[].cidr`	string	yes	A finding's CIDR value.
`filters.networkSourceMac`	array<object>	—	The source media access control (MAC) address of network-related information about a finding.
`filters.networkSourceMac[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.networkSourceMac[].value`	string	yes
`filters.networkSourcePort`	array<object>	—	The source port of network-related information about a finding.
`filters.networkSourcePort[].eq`	number	—	The equal-to condition to be applied to a single field when querying for findings.
`filters.networkSourcePort[].gte`	number	—	The greater-than-equal condition to be applied to a single field when querying for findings.
`filters.networkSourcePort[].lte`	number	—	The less-than-equal condition to be applied to a single field when querying for findings.
`filters.noteText`	array<object>	—	The text of a note.
`filters.noteText[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.noteText[].value`	string	yes
`filters.noteUpdatedAt`	array<object>	—	The timestamp of when the note was updated.
`filters.noteUpdatedAt[].dateRange`	object	—	SecurityHubInsightDateRange is a nested property type of AWS::SecurityHub::Insight.
`filters.noteUpdatedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`filters.noteUpdatedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`filters.noteUpdatedAt[].end`	string	—
`filters.noteUpdatedAt[].start`	string	—
`filters.noteUpdatedBy`	array<object>	—	The principal that created a note.
`filters.noteUpdatedBy[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.noteUpdatedBy[].value`	string	yes
`filters.processLaunchedAt`	array<object>	—	A timestamp that identifies when the process was launched.
`filters.processLaunchedAt[].dateRange`	object	—	SecurityHubInsightDateRange is a nested property type of AWS::SecurityHub::Insight.
`filters.processLaunchedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`filters.processLaunchedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`filters.processLaunchedAt[].end`	string	—
`filters.processLaunchedAt[].start`	string	—
`filters.processName`	array<object>	—	The name of the process.
`filters.processName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.processName[].value`	string	yes
`filters.processParentPid`	array<object>	—	The parent process ID.
`filters.processParentPid[].eq`	number	—	The equal-to condition to be applied to a single field when querying for findings.
`filters.processParentPid[].gte`	number	—	The greater-than-equal condition to be applied to a single field when querying for findings.
`filters.processParentPid[].lte`	number	—	The less-than-equal condition to be applied to a single field when querying for findings.
`filters.processPath`	array<object>	—	The path to the process executable.
`filters.processPath[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.processPath[].value`	string	yes
`filters.processPid`	array<object>	—	The process ID.
`filters.processPid[].eq`	number	—	The equal-to condition to be applied to a single field when querying for findings.
`filters.processPid[].gte`	number	—	The greater-than-equal condition to be applied to a single field when querying for findings.
`filters.processPid[].lte`	number	—	The less-than-equal condition to be applied to a single field when querying for findings.
`filters.processTerminatedAt`	array<object>	—	A timestamp that identifies when the process was terminated.
`filters.processTerminatedAt[].dateRange`	object	—	SecurityHubInsightDateRange is a nested property type of AWS::SecurityHub::Insight.
`filters.processTerminatedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`filters.processTerminatedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`filters.processTerminatedAt[].end`	string	—
`filters.processTerminatedAt[].start`	string	—
`filters.productArn`	array<object>	—	The ARN generated by Security Hub that uniquely identifies a third-party company (security findings provider) after this provider's product (solution that generates findings) is registered with Security Hub.
`filters.productArn[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.productArn[].value`	string	yes
`filters.productFields`	array<object>	—	A data type where security findings providers can include additional solution-specific details that aren't part of the defined AwsSecurityFinding format.
`filters.productFields[].comparison`	enum	yes	The condition to apply to the key value when filtering Security Hub findings with a map filter. Allowed: `EQUALS, NOT_EQUALS`
`filters.productFields[].key`	string	yes
`filters.productFields[].value`	string	yes
`filters.productName`	array<object>	—	The name of the solution (product) that generates findings.
`filters.productName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.productName[].value`	string	yes
`filters.recommendationText`	array<object>	—	The recommendation of what to do about the issue described in a finding.
`filters.recommendationText[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.recommendationText[].value`	string	yes
`filters.recordState`	array<object>	—	The updated record state for the finding.
`filters.recordState[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.recordState[].value`	string	yes
`filters.region`	array<object>	—	The Region from which the finding was generated.
`filters.region[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.region[].value`	string	yes
`filters.relatedFindingsId`	array<object>	—	The solution-generated identifier for a related finding.
`filters.relatedFindingsId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.relatedFindingsId[].value`	string	yes
`filters.relatedFindingsProductArn`	array<object>	—	The ARN of the solution that generated a related finding.
`filters.relatedFindingsProductArn[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.relatedFindingsProductArn[].value`	string	yes
`filters.resourceApplicationArn`	array<object>	—	The ARN of the application that is related to a finding.
`filters.resourceApplicationArn[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceApplicationArn[].value`	string	yes
`filters.resourceApplicationName`	array<object>	—	The name of the application that is related to a finding.
`filters.resourceApplicationName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceApplicationName[].value`	string	yes
`filters.resourceAwsEc2InstanceIamInstanceProfileArn`	array<object>	—	The IAM profile ARN of the instance.
`filters.resourceAwsEc2InstanceIamInstanceProfileArn[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceAwsEc2InstanceIamInstanceProfileArn[].value`	string	yes
`filters.resourceAwsEc2InstanceImageId`	array<object>	—	The Amazon Machine Image (AMI) ID of the instance.
`filters.resourceAwsEc2InstanceImageId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceAwsEc2InstanceImageId[].value`	string	yes
`filters.resourceAwsEc2InstanceIpV4Addresses`	array<object>	—	The IPv4 addresses associated with the instance.
`filters.resourceAwsEc2InstanceIpV4Addresses[].cidr`	string	yes	A finding's CIDR value.
`filters.resourceAwsEc2InstanceIpV6Addresses`	array<object>	—	The IPv6 addresses associated with the instance.
`filters.resourceAwsEc2InstanceIpV6Addresses[].cidr`	string	yes	A finding's CIDR value.
`filters.resourceAwsEc2InstanceKeyName`	array<object>	—	The key name associated with the instance.
`filters.resourceAwsEc2InstanceKeyName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceAwsEc2InstanceKeyName[].value`	string	yes
`filters.resourceAwsEc2InstanceLaunchedAt`	array<object>	—	The date and time the instance was launched.
`filters.resourceAwsEc2InstanceLaunchedAt[].dateRange`	object	—	SecurityHubInsightDateRange is a nested property type of AWS::SecurityHub::Insight.
`filters.resourceAwsEc2InstanceLaunchedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`filters.resourceAwsEc2InstanceLaunchedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`filters.resourceAwsEc2InstanceLaunchedAt[].end`	string	—
`filters.resourceAwsEc2InstanceLaunchedAt[].start`	string	—
`filters.resourceAwsEc2InstanceSubnetId`	array<object>	—	The identifier of the subnet that the instance was launched in.
`filters.resourceAwsEc2InstanceSubnetId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceAwsEc2InstanceSubnetId[].value`	string	yes
`filters.resourceAwsEc2InstanceType`	array<object>	—	The instance type of the instance.
`filters.resourceAwsEc2InstanceType[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceAwsEc2InstanceType[].value`	string	yes
`filters.resourceAwsEc2InstanceVpcId`	array<object>	—	The identifier of the VPC that the instance was launched in.
`filters.resourceAwsEc2InstanceVpcId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceAwsEc2InstanceVpcId[].value`	string	yes
`filters.resourceAwsIamAccessKeyCreatedAt`	array<object>	—	The creation date/time of the IAM access key related to a finding.
`filters.resourceAwsIamAccessKeyCreatedAt[].dateRange`	object	—	SecurityHubInsightDateRange is a nested property type of AWS::SecurityHub::Insight.
`filters.resourceAwsIamAccessKeyCreatedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`filters.resourceAwsIamAccessKeyCreatedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`filters.resourceAwsIamAccessKeyCreatedAt[].end`	string	—
`filters.resourceAwsIamAccessKeyCreatedAt[].start`	string	—
`filters.resourceAwsIamAccessKeyPrincipalName`	array<object>	—	The name of the principal that is associated with an IAM access key.
`filters.resourceAwsIamAccessKeyPrincipalName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceAwsIamAccessKeyPrincipalName[].value`	string	yes
`filters.resourceAwsIamAccessKeyStatus`	array<object>	—	The status of the IAM access key related to a finding.
`filters.resourceAwsIamAccessKeyStatus[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceAwsIamAccessKeyStatus[].value`	string	yes
`filters.resourceAwsIamAccessKeyUserName`	array<object>	—	The user associated with the IAM access key related to a finding.
`filters.resourceAwsIamAccessKeyUserName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceAwsIamAccessKeyUserName[].value`	string	yes
`filters.resourceAwsIamUserUserName`	array<object>	—	The name of an IAM user.
`filters.resourceAwsIamUserUserName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceAwsIamUserUserName[].value`	string	yes
`filters.resourceAwsS3BucketOwnerId`	array<object>	—	The canonical user ID of the owner of the S3 bucket.
`filters.resourceAwsS3BucketOwnerId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceAwsS3BucketOwnerId[].value`	string	yes
`filters.resourceAwsS3BucketOwnerName`	array<object>	—	The display name of the owner of the S3 bucket.
`filters.resourceAwsS3BucketOwnerName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceAwsS3BucketOwnerName[].value`	string	yes
`filters.resourceContainerImageId`	array<object>	—	The identifier of the image related to a finding.
`filters.resourceContainerImageId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceContainerImageId[].value`	string	yes
`filters.resourceContainerImageName`	array<object>	—	The name of the image related to a finding.
`filters.resourceContainerImageName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceContainerImageName[].value`	string	yes
`filters.resourceContainerLaunchedAt`	array<object>	—	A timestamp that identifies when the container was started.
`filters.resourceContainerLaunchedAt[].dateRange`	object	—	SecurityHubInsightDateRange is a nested property type of AWS::SecurityHub::Insight.
`filters.resourceContainerLaunchedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`filters.resourceContainerLaunchedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`filters.resourceContainerLaunchedAt[].end`	string	—
`filters.resourceContainerLaunchedAt[].start`	string	—
`filters.resourceContainerName`	array<object>	—	The name of the container related to a finding.
`filters.resourceContainerName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceContainerName[].value`	string	yes
`filters.resourceDetailsOther`	array<object>	—	The details of a resource that doesn't have a specific subfield for the resource type defined.
`filters.resourceDetailsOther[].comparison`	enum	yes	The condition to apply to the key value when filtering Security Hub findings with a map filter. Allowed: `EQUALS, NOT_EQUALS`
`filters.resourceDetailsOther[].key`	string	yes
`filters.resourceDetailsOther[].value`	string	yes
`filters.resourceId`	array<object>	—	The canonical identifier for the given resource type.
`filters.resourceId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceId[].value`	string	yes
`filters.resourcePartition`	array<object>	—	The canonical AWS partition name that the Region is assigned to.
`filters.resourcePartition[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourcePartition[].value`	string	yes
`filters.resourceRegion`	array<object>	—	The canonical AWS external Region name where this resource is located.
`filters.resourceRegion[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceRegion[].value`	string	yes
`filters.resourceTags`	array<object>	—	A list of AWS tags associated with a resource at the time the finding was processed.
`filters.resourceTags[].comparison`	enum	yes	The condition to apply to the key value when filtering Security Hub findings with a map filter. Allowed: `EQUALS, NOT_EQUALS`
`filters.resourceTags[].key`	string	yes
`filters.resourceTags[].value`	string	yes
`filters.resourceType`	array<object>	—	Specifies the type of the resource that details are provided for.
`filters.resourceType[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.resourceType[].value`	string	yes
`filters.sample`	array<object>	—	Indicates whether or not sample findings are included in the filter results.
`filters.sample[].value`	boolean	yes	The value of the boolean.
`filters.severityLabel`	array<object>	—	The label of a finding's severity.
`filters.severityLabel[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.severityLabel[].value`	string	yes
`filters.severityNormalized`	array<object>	—	The normalized severity of a finding.
`filters.severityNormalized[].eq`	number	—	The equal-to condition to be applied to a single field when querying for findings.
`filters.severityNormalized[].gte`	number	—	The greater-than-equal condition to be applied to a single field when querying for findings.
`filters.severityNormalized[].lte`	number	—	The less-than-equal condition to be applied to a single field when querying for findings.
`filters.severityProduct`	array<object>	—	The native severity as defined by the security findings provider's solution that generated the finding.
`filters.severityProduct[].eq`	number	—	The equal-to condition to be applied to a single field when querying for findings.
`filters.severityProduct[].gte`	number	—	The greater-than-equal condition to be applied to a single field when querying for findings.
`filters.severityProduct[].lte`	number	—	The less-than-equal condition to be applied to a single field when querying for findings.
`filters.sourceUrl`	array<object>	—	A URL that links to a page about the current finding in the security findings provider's solution.
`filters.sourceUrl[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.sourceUrl[].value`	string	yes
`filters.threatIntelIndicatorCategory`	array<object>	—	The category of a threat intelligence indicator.
`filters.threatIntelIndicatorCategory[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.threatIntelIndicatorCategory[].value`	string	yes
`filters.threatIntelIndicatorLastObservedAt`	array<object>	—	A timestamp that identifies the last observation of a threat intelligence indicator.
`filters.threatIntelIndicatorLastObservedAt[].dateRange`	object	—	SecurityHubInsightDateRange is a nested property type of AWS::SecurityHub::Insight.
`filters.threatIntelIndicatorLastObservedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`filters.threatIntelIndicatorLastObservedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`filters.threatIntelIndicatorLastObservedAt[].end`	string	—
`filters.threatIntelIndicatorLastObservedAt[].start`	string	—
`filters.threatIntelIndicatorSource`	array<object>	—	The source of the threat intelligence.
`filters.threatIntelIndicatorSource[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.threatIntelIndicatorSource[].value`	string	yes
`filters.threatIntelIndicatorSourceUrl`	array<object>	—	The URL for more details from the source of the threat intelligence.
`filters.threatIntelIndicatorSourceUrl[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.threatIntelIndicatorSourceUrl[].value`	string	yes
`filters.threatIntelIndicatorType`	array<object>	—	The type of a threat intelligence indicator.
`filters.threatIntelIndicatorType[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.threatIntelIndicatorType[].value`	string	yes
`filters.threatIntelIndicatorValue`	array<object>	—	The value of a threat intelligence indicator.
`filters.threatIntelIndicatorValue[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.threatIntelIndicatorValue[].value`	string	yes
`filters.title`	array<object>	—	A finding's title.
`filters.title[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.title[].value`	string	yes
`filters.type`	array<object>	—	A finding type in the format of namespace/category/classifier that classifies a finding.
`filters.type[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.type[].value`	string	yes
`filters.updatedAt`	array<object>	—	An ISO8601-formatted timestamp that indicates when the security findings provider last updated the finding record.
`filters.updatedAt[].dateRange`	object	—	SecurityHubInsightDateRange is a nested property type of AWS::SecurityHub::Insight.
`filters.updatedAt[].dateRange.unit`	enum	yes	A date range unit for the date filter. Allowed: `DAYS`
`filters.updatedAt[].dateRange.value`	number	yes	A date range value for the date filter.
`filters.updatedAt[].end`	string	—
`filters.updatedAt[].start`	string	—
`filters.userDefinedFields`	array<object>	—	A list of name/value string pairs associated with the finding.
`filters.userDefinedFields[].comparison`	enum	yes	The condition to apply to the key value when filtering Security Hub findings with a map filter. Allowed: `EQUALS, NOT_EQUALS`
`filters.userDefinedFields[].key`	string	yes
`filters.userDefinedFields[].value`	string	yes
`filters.verificationState`	array<object>	—	The veracity of a finding.
`filters.verificationState[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.verificationState[].value`	string	yes
`filters.vulnerabilitiesExploitAvailable`	array<object>	—	Indicates whether a software vulnerability in your environment has a known exploit.
`filters.vulnerabilitiesExploitAvailable[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.vulnerabilitiesExploitAvailable[].value`	string	yes
`filters.vulnerabilitiesFixAvailable`	array<object>	—	Indicates whether a vulnerability is fixed in a newer version of the affected software packages.
`filters.vulnerabilitiesFixAvailable[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.vulnerabilitiesFixAvailable[].value`	string	yes
`filters.workflowState`	array<object>	—	The workflow state of a finding.
`filters.workflowState[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.workflowState[].value`	string	yes
`filters.workflowStatus`	array<object>	—	The status of the investigation into a finding.
`filters.workflowStatus[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS, PREFIX_NOT_EQUALS`
`filters.workflowStatus[].value`	string	yes
`groupByAttribute`	string	yes	The grouping attribute for the insight's findings
`name`	string	yes	The name of a Security Hub insight
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`insightArn`	string	—	The ARN of a Security Hub insight Read-only: reported by AWS after creation.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

SecurityHubOrganizationConfiguration # CLOUD CONTROL · AWS::SecurityHub::OrganizationConfiguration ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: organization-wide Security Hub configuration. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. SecurityHubOrganizationConfiguration manages AWS::SecurityHub::OrganizationConfiguration through the AWS Cloud Control API.

kubectl get securityhuborganizationconfigurations · example on GitHub

Example

# SecurityHubOrganizationConfiguration — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhuborganizationconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubOrganizationConfiguration
metadata:
  name: example-securityhuborganizationconfiguration
  namespace: default
spec:
  autoEnable: true
  autoEnableStandards: DEFAULT
  configurationType: CENTRAL
  providerRef:
    name: example-securityhuborganizationconfiguration
    region: us-east-1

Spec

Field	Type	Required	Description
`autoEnable`	boolean	yes	Whether to automatically enable Security Hub in new member accounts when they join the organization.
`autoEnableStandards`	enum	—	Whether to automatically enable Security Hub default standards in new member accounts when they join the organization. Allowed: `DEFAULT, NONE`
`configurationType`	enum	—	Indicates whether the organization uses local or central configuration. Allowed: `CENTRAL, LOCAL`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`memberAccountLimitReached`	boolean	—	Whether the maximum number of allowed member accounts are already associated with the Security Hub administrator account.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`organizationConfigurationIdentifier`	string	—	The identifier of the OrganizationConfiguration being created and assigned as the unique identifier.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Describes whether central configuration could be enabled as the ConfigurationType for the organization. Allowed: `PENDING, ENABLED, FAILED`
`statusMessage`	string	—	Provides an explanation if the value of Status is equal to FAILED when ConfigurationType is equal to CENTRAL.

SecurityHubPolicyAssociation # CLOUD CONTROL · AWS::SecurityHub::PolicyAssociation

SecurityHubPolicyAssociation manages AWS::SecurityHub::PolicyAssociation through the AWS Cloud Control API.

kubectl get securityhubpolicyassociations · example on GitHub

Example

# SecurityHubPolicyAssociation — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubpolicyassociation
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubPolicyAssociation
metadata:
  name: example-securityhubpolicyassociation
  namespace: default
spec:
  configurationPolicyId: example-id
  providerRef:
    name: example-securityhubpolicyassociation
    region: us-east-1
  targetId: example-id
  targetType: ACCOUNT

Spec

Field	Type	Required	Description
`configurationPolicyId`	string	yes	The universally unique identifier (UUID) of the configuration policy or a value of SELF_MANAGED_SECURITY_HUB for a self-managed configuration
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`targetId`	string	yes	The identifier of the target account, organizational unit, or the root Create-only in AWS: changing it requires replacing the resource.
`targetType`	enum	yes	Indicates whether the target is an AWS account, organizational unit, or the organization root Create-only in AWS: changing it requires replacing the resource. Allowed: `ACCOUNT, ORGANIZATIONAL_UNIT, ROOT`

Status

Field	Type	Required	Description
`associationIdentifier`	string	—	A unique identifier to indicates if the target has an association Read-only: reported by AWS after creation.
`associationStatus`	enum	—	The current status of the association between the specified target and the configuration Read-only: reported by AWS after creation. Allowed: `SUCCESS, PENDING, FAILED, DISABLED`
`associationStatusMessage`	string	—	An explanation for a FAILED value for AssociationStatus Read-only: reported by AWS after creation.
`associationType`	enum	—	Indicates whether the association between the specified target and the configuration was directly applied by the Security Hub delegated administrator or inherited from a parent Read-only: reported by AWS after creation. Allowed: `APPLIED, INHERITED`
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`updatedAt`	string	—	The date and time, in UTC and ISO 8601 format, that the configuration policy association was last updated Read-only: reported by AWS after creation.

SecurityHubProductSubscription # CLOUD CONTROL · AWS::SecurityHub::ProductSubscription

SecurityHubProductSubscription manages AWS::SecurityHub::ProductSubscription through the AWS Cloud Control API.

kubectl get securityhubproductsubscriptions · example on GitHub

Example

# SecurityHubProductSubscription — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubproductsubscription
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubProductSubscription
metadata:
  name: example-securityhubproductsubscription
  namespace: default
spec:
  productArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-securityhubproductsubscription
    region: us-east-1

Spec

Field	Type	Required	Description
`productArn`	string	yes	The generic ARN of the product being subscribed to Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`productSubscriptionArn`	string	—	The ARN of the product subscription for the account Read-only: reported by AWS after creation.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

SecurityHubSecurityControl # CLOUD CONTROL · AWS::SecurityHub::SecurityControl

SecurityHubSecurityControl manages AWS::SecurityHub::SecurityControl through the AWS Cloud Control API.

kubectl get securityhubsecuritycontrols · example on GitHub

Example

# SecurityHubSecurityControl — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubsecuritycontrol
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubSecurityControl
metadata:
  name: example-securityhubsecuritycontrol
  namespace: default
spec:
  lastUpdateReason: example
  parameters: {}
  providerRef:
    name: example-securityhubsecuritycontrol
    region: us-east-1
  securityControlArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`lastUpdateReason`	string	—	The most recent reason for updating the customizable properties of a security control.
`parameters`	map<string>	yes	An object that identifies the name of a control parameter, its current value, and whether it has been customized.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`securityControlArn`	string	—	The Amazon Resource Name (ARN) for a security control across standards, such as `arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1`.
`securityControlId`	string	—	The unique identifier of a security control across standards.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

SecurityHubStandard # GA

SecurityHubStandard is the Schema for managing Security Hub standards subscriptions.

kubectl get securityhubstandards · example on GitHub

Example

# SecurityHubStandard — Security Hub
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/securityhub.html#securityhubstandard
apiVersion: aws.konfig.io/v1alpha1
kind: SecurityHubStandard
metadata:
  name: example-securityhubstandard
  namespace: default
spec:
  providerRef:
    name: example-securityhubstandard
    region: us-east-1
  standardsArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`standardsArn`	string	yes	StandardsARN is the ARN of the standard to enable (see DescribeStandards), e.g.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`standardsStatus`	string	—	StandardsStatus is the subscription status reported by AWS (PENDING, READY, INCOMPLETE, DELETING, FAILED).
`subscriptionArn`	string	—	SubscriptionARN is the ARN of the standards subscription.