2026/11/13 - AWS SecurityHub - 6 updated api methods
Changes New DISABLED status for Security Hub CSPM Central Configuration.
{'ConfigurationPolicyAssociations': {'AssociationStatus': {'DISABLED'}}}
Returns associations between an Security Hub CSPM configuration and a batch of target accounts, organizational units, or the root. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region. A configuration can refer to a configuration policy or to a self-managed configuration.
See also: AWS API Documentation
Request Syntax
client.batch_get_configuration_policy_associations(
ConfigurationPolicyAssociationIdentifiers=[
{
'Target': {
'AccountId': 'string',
'OrganizationalUnitId': 'string',
'RootId': 'string'
}
},
]
)
list
[REQUIRED]
Specifies one or more target account IDs, organizational unit (OU) IDs, or the root ID to retrieve associations for.
(dict) --
Provides details about the association between an Security Hub CSPM configuration and a target account, organizational unit, or the root. An association can exist between a target and a configuration policy, or between a target and self-managed behavior.
Target (dict) --
The target account, organizational unit, or the root.
AccountId (string) --
The Amazon Web Services account ID of the target account.
OrganizationalUnitId (string) --
The organizational unit ID of the target organizational unit.
RootId (string) --
The ID of the organization root.
dict
Response Syntax
{
'ConfigurationPolicyAssociations': [
{
'ConfigurationPolicyId': 'string',
'TargetId': 'string',
'TargetType': 'ACCOUNT'|'ORGANIZATIONAL_UNIT'|'ROOT',
'AssociationType': 'INHERITED'|'APPLIED',
'UpdatedAt': datetime(2015, 1, 1),
'AssociationStatus': 'PENDING'|'SUCCESS'|'FAILED'|'DISABLED',
'AssociationStatusMessage': 'string'
},
],
'UnprocessedConfigurationPolicyAssociations': [
{
'ConfigurationPolicyAssociationIdentifiers': {
'Target': {
'AccountId': 'string',
'OrganizationalUnitId': 'string',
'RootId': 'string'
}
},
'ErrorCode': 'string',
'ErrorReason': 'string'
},
]
}
Response Structure
(dict) --
ConfigurationPolicyAssociations (list) --
Describes associations for the target accounts, OUs, or the root.
(dict) --
An object that contains the details of a configuration policy association that’s returned in a ListConfigurationPolicyAssociations request.
ConfigurationPolicyId (string) --
The universally unique identifier (UUID) of the configuration policy.
TargetId (string) --
The identifier of the target account, organizational unit, or the root.
TargetType (string) --
Specifies whether the target is an Amazon Web Services account, organizational unit, or the root.
AssociationType (string) --
Indicates whether the association between the specified target and the configuration was directly applied by the Security Hub CSPM delegated administrator or inherited from a parent.
UpdatedAt (datetime) --
The date and time, in UTC and ISO 8601 format, that the configuration policy association was last updated.
AssociationStatus (string) --
The current status of the association between the specified target and the configuration. Possible values are:
PENDING - The association is in progress.
SUCCESS - The association succeeded.
FAILED - The association failed. For details, see AssociationStatusMessage.
DISABLED - Central configuration is disabled because the organization is managed by Security Hub CSPM policies in Organizations.
AssociationStatusMessage (string) --
The explanation for a FAILED value for AssociationStatus.
UnprocessedConfigurationPolicyAssociations (list) --
An array of configuration policy associations, one for each configuration policy association identifier, that was specified in the request but couldn’t be processed due to an error.
(dict) --
An array of configuration policy associations, one for each configuration policy association identifier, that was specified in a BatchGetConfigurationPolicyAssociations request but couldn’t be processed due to an error.
ConfigurationPolicyAssociationIdentifiers (dict) --
Configuration policy association identifiers that were specified in a BatchGetConfigurationPolicyAssociations request but couldn’t be processed due to an error.
Target (dict) --
The target account, organizational unit, or the root.
AccountId (string) --
The Amazon Web Services account ID of the target account.
OrganizationalUnitId (string) --
The organizational unit ID of the target organizational unit.
RootId (string) --
The ID of the organization root.
ErrorCode (string) --
An HTTP status code that identifies why the configuration policy association failed.
ErrorReason (string) --
A string that identifies why the configuration policy association failed.
{'OrganizationConfiguration': {'Status': {'DISABLED'}}}
Returns information about the way your organization is configured in Security Hub CSPM. Only the Security Hub CSPM administrator account can invoke this operation.
See also: AWS API Documentation
Request Syntax
client.describe_organization_configuration()
dict
Response Syntax
{
'AutoEnable': True|False,
'MemberAccountLimitReached': True|False,
'AutoEnableStandards': 'NONE'|'DEFAULT',
'OrganizationConfiguration': {
'ConfigurationType': 'CENTRAL'|'LOCAL',
'Status': 'PENDING'|'ENABLED'|'FAILED'|'DISABLED',
'StatusMessage': 'string'
}
}
Response Structure
(dict) --
AutoEnable (boolean) --
Whether to automatically enable Security Hub CSPM in new member accounts when they join the organization.
If set to true, then Security Hub CSPM is automatically enabled in new accounts. If set to false, then Security Hub CSPM isn't enabled in new accounts automatically. The default value is false.
If the ConfigurationType of your organization is set to CENTRAL, then this field is set to false and can't be changed in the home Region and linked Regions. However, in that case, the delegated administrator can create a configuration policy in which Security Hub CSPM is enabled and associate the policy with new organization accounts.
MemberAccountLimitReached (boolean) --
Whether the maximum number of allowed member accounts are already associated with the Security Hub CSPM administrator account.
AutoEnableStandards (string) --
Whether to automatically enable Security Hub CSPM default standards in new member accounts when they join the organization.
If equal to DEFAULT, then Security Hub CSPM default standards are automatically enabled for new member accounts. If equal to NONE, then default standards are not automatically enabled for new member accounts. The default value of this parameter is equal to DEFAULT.
If the ConfigurationType of your organization is set to CENTRAL, then this field is set to NONE and can't be changed in the home Region and linked Regions. However, in that case, the delegated administrator can create a configuration policy in which specific security standards are enabled and associate the policy with new organization accounts.
OrganizationConfiguration (dict) --
Provides information about the way an organization is configured in Security Hub CSPM.
ConfigurationType (string) --
Indicates whether the organization uses local or central configuration.
If you use local configuration, the Security Hub CSPM delegated administrator can set AutoEnable to true and AutoEnableStandards to DEFAULT. This automatically enables Security Hub CSPM and default security standards in new organization accounts. These new account settings must be set separately in each Amazon Web Services Region, and settings may be different in each Region.
If you use central configuration, the delegated administrator can create configuration policies. Configuration policies can be used to configure Security Hub CSPM, security standards, and security controls in multiple accounts and Regions. If you want new organization accounts to use a specific configuration, you can create a configuration policy and associate it with the root or specific organizational units (OUs). New accounts will inherit the policy from the root or their assigned OU.
Status (string) --
Describes whether central configuration could be enabled as the ConfigurationType for the organization. If your ConfigurationType is local configuration, then the value of Status is always ENABLED.
If the value of Status is DISABLED, central configuration is disabled because the organization is managed by Security Hub CSPM policies in Organizations.
StatusMessage (string) --
Provides an explanation if the value of Status is equal to FAILED when ConfigurationType is equal to CENTRAL.
{'AssociationStatus': {'DISABLED'}}
Returns the association between a configuration and a target account, organizational unit, or the root. The configuration can be a configuration policy or self-managed behavior. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.
See also: AWS API Documentation
Request Syntax
client.get_configuration_policy_association(
Target={
'AccountId': 'string',
'OrganizationalUnitId': 'string',
'RootId': 'string'
}
)
dict
[REQUIRED]
The target account ID, organizational unit ID, or the root ID to retrieve the association for.
AccountId (string) --
The Amazon Web Services account ID of the target account.
OrganizationalUnitId (string) --
The organizational unit ID of the target organizational unit.
RootId (string) --
The ID of the organization root.
dict
Response Syntax
{
'ConfigurationPolicyId': 'string',
'TargetId': 'string',
'TargetType': 'ACCOUNT'|'ORGANIZATIONAL_UNIT'|'ROOT',
'AssociationType': 'INHERITED'|'APPLIED',
'UpdatedAt': datetime(2015, 1, 1),
'AssociationStatus': 'PENDING'|'SUCCESS'|'FAILED'|'DISABLED',
'AssociationStatusMessage': 'string'
}
Response Structure
(dict) --
ConfigurationPolicyId (string) --
The universally unique identifier (UUID) of a configuration policy. For self-managed behavior, the value is SELF_MANAGED_SECURITY_HUB.
TargetId (string) --
The target account ID, organizational unit ID, or the root ID for which the association is retrieved.
TargetType (string) --
Specifies whether the target is an Amazon Web Services account, organizational unit, or the organization root.
AssociationType (string) --
Indicates whether the association between the specified target and the configuration was directly applied by the Security Hub CSPM delegated administrator or inherited from a parent.
UpdatedAt (datetime) --
The date and time, in UTC and ISO 8601 format, that the configuration policy association was last updated.
AssociationStatus (string) --
The current status of the association between the specified target and the configuration. Possible values are:
PENDING - The association is in progress.
SUCCESS - The association succeeded.
FAILED - The association failed. For details, see AssociationStatusMessage.
DISABLED - Central configuration is disabled because the organization is managed by Security Hub CSPM policies in Organizations.
AssociationStatusMessage (string) --
The explanation for a FAILED value for AssociationStatus.
{'Filters': {'AssociationStatus': {'DISABLED'}}}
Response {'ConfigurationPolicyAssociationSummaries': {'AssociationStatus': {'DISABLED'}}}
Provides information about the associations for your configuration policies and self-managed behavior. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.
See also: AWS API Documentation
Request Syntax
client.list_configuration_policy_associations(
NextToken='string',
MaxResults=123,
Filters={
'ConfigurationPolicyId': 'string',
'AssociationType': 'INHERITED'|'APPLIED',
'AssociationStatus': 'PENDING'|'SUCCESS'|'FAILED'|'DISABLED'
}
)
string
The NextToken value that's returned from a previous paginated ListConfigurationPolicyAssociations request where MaxResults was used but the results exceeded the value of that parameter. Pagination continues from the end of the previous response that returned the NextToken value. This value is null when there are no more results to return.
integer
The maximum number of results that's returned by ListConfigurationPolicies in each page of the response. When this parameter is used, ListConfigurationPolicyAssociations returns the specified number of results in a single page and a NextToken response element. You can see the remaining results of the initial request by sending another ListConfigurationPolicyAssociations request with the returned NextToken value. A valid range for MaxResults is between 1 and 100.
dict
Options for filtering the ListConfigurationPolicyAssociations response. You can filter by the Amazon Resource Name (ARN) or universally unique identifier (UUID) of a configuration, AssociationType, or AssociationStatus.
ConfigurationPolicyId (string) --
The ARN or UUID of the configuration policy.
AssociationType (string) --
Indicates whether the association between a target and a configuration was directly applied by the Security Hub CSPM delegated administrator or inherited from a parent.
AssociationStatus (string) --
The current status of the association between a target and a configuration policy. Possible values are PENDING, SUCCESS, FAILED, and DISABLED. The value is DISABLED when central configuration is disabled because the organization is managed by Security Hub CSPM policies in Organizations.
dict
Response Syntax
{
'ConfigurationPolicyAssociationSummaries': [
{
'ConfigurationPolicyId': 'string',
'TargetId': 'string',
'TargetType': 'ACCOUNT'|'ORGANIZATIONAL_UNIT'|'ROOT',
'AssociationType': 'INHERITED'|'APPLIED',
'UpdatedAt': datetime(2015, 1, 1),
'AssociationStatus': 'PENDING'|'SUCCESS'|'FAILED'|'DISABLED',
'AssociationStatusMessage': 'string'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
ConfigurationPolicyAssociationSummaries (list) --
An object that contains the details of each configuration policy association that’s returned in a ListConfigurationPolicyAssociations request.
(dict) --
An object that contains the details of a configuration policy association that’s returned in a ListConfigurationPolicyAssociations request.
ConfigurationPolicyId (string) --
The universally unique identifier (UUID) of the configuration policy.
TargetId (string) --
The identifier of the target account, organizational unit, or the root.
TargetType (string) --
Specifies whether the target is an Amazon Web Services account, organizational unit, or the root.
AssociationType (string) --
Indicates whether the association between the specified target and the configuration was directly applied by the Security Hub CSPM delegated administrator or inherited from a parent.
UpdatedAt (datetime) --
The date and time, in UTC and ISO 8601 format, that the configuration policy association was last updated.
AssociationStatus (string) --
The current status of the association between the specified target and the configuration. Possible values are:
PENDING - The association is in progress.
SUCCESS - The association succeeded.
FAILED - The association failed. For details, see AssociationStatusMessage.
DISABLED - Central configuration is disabled because the organization is managed by Security Hub CSPM policies in Organizations.
AssociationStatusMessage (string) --
The explanation for a FAILED value for AssociationStatus.
NextToken (string) --
The NextToken value to include in the next ListConfigurationPolicyAssociations request. When the results of a ListConfigurationPolicyAssociations request exceed MaxResults, this value can be used to retrieve the next page of results. This value is null when there are no more results to return.
{'AssociationStatus': {'DISABLED'}}
Associates a target account, organizational unit, or the root with a specified configuration. The target can be associated with a configuration policy or self-managed behavior. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.
See also: AWS API Documentation
Request Syntax
client.start_configuration_policy_association(
ConfigurationPolicyIdentifier='string',
Target={
'AccountId': 'string',
'OrganizationalUnitId': 'string',
'RootId': 'string'
}
)
string
[REQUIRED]
The Amazon Resource Name (ARN) of a configuration policy, the universally unique identifier (UUID) of a configuration policy, or a value of SELF_MANAGED_SECURITY_HUB for a self-managed configuration.
dict
[REQUIRED]
The identifier of the target account, organizational unit, or the root to associate with the specified configuration.
AccountId (string) --
The Amazon Web Services account ID of the target account.
OrganizationalUnitId (string) --
The organizational unit ID of the target organizational unit.
RootId (string) --
The ID of the organization root.
dict
Response Syntax
{
'ConfigurationPolicyId': 'string',
'TargetId': 'string',
'TargetType': 'ACCOUNT'|'ORGANIZATIONAL_UNIT'|'ROOT',
'AssociationType': 'INHERITED'|'APPLIED',
'UpdatedAt': datetime(2015, 1, 1),
'AssociationStatus': 'PENDING'|'SUCCESS'|'FAILED'|'DISABLED',
'AssociationStatusMessage': 'string'
}
Response Structure
(dict) --
ConfigurationPolicyId (string) --
The UUID of the configuration policy.
TargetId (string) --
The identifier of the target account, organizational unit, or the organization root with which the configuration is associated.
TargetType (string) --
Indicates whether the target is an Amazon Web Services account, organizational unit, or the organization root.
AssociationType (string) --
Indicates whether the association between the specified target and the configuration was directly applied by the Security Hub CSPM delegated administrator or inherited from a parent.
UpdatedAt (datetime) --
The date and time, in UTC and ISO 8601 format, that the configuration policy association was last updated.
AssociationStatus (string) --
The current status of the association between the specified target and the configuration. Possible values are:
PENDING - The association is in progress.
SUCCESS - The association succeeded.
FAILED - The association failed. For details, see AssociationStatusMessage.
DISABLED - Central configuration is disabled because the organization is managed by Security Hub CSPM policies in Organizations.
AssociationStatusMessage (string) --
An explanation for a FAILED value for AssociationStatus.
{'OrganizationConfiguration': {'Status': {'DISABLED'}}}
Updates the configuration of your organization in Security Hub CSPM. Only the Security Hub CSPM administrator account can invoke this operation.
See also: AWS API Documentation
Request Syntax
client.update_organization_configuration(
AutoEnable=True|False,
AutoEnableStandards='NONE'|'DEFAULT',
OrganizationConfiguration={
'ConfigurationType': 'CENTRAL'|'LOCAL',
'Status': 'PENDING'|'ENABLED'|'FAILED'|'DISABLED',
'StatusMessage': 'string'
}
)
boolean
[REQUIRED]
Whether to automatically enable Security Hub CSPM in new member accounts when they join the organization.
If set to true, then Security Hub CSPM is automatically enabled in new accounts. If set to false, then Security Hub CSPM isn't enabled in new accounts automatically. The default value is false.
If the ConfigurationType of your organization is set to CENTRAL, then this field is set to false and can't be changed in the home Region and linked Regions. However, in that case, the delegated administrator can create a configuration policy in which Security Hub CSPM is enabled and associate the policy with new organization accounts.
string
Whether to automatically enable Security Hub CSPM default standards in new member accounts when they join the organization.
The default value of this parameter is equal to DEFAULT.
If equal to DEFAULT, then Security Hub CSPM default standards are automatically enabled for new member accounts. If equal to NONE, then default standards are not automatically enabled for new member accounts.
If the ConfigurationType of your organization is set to CENTRAL, then this field is set to NONE and can't be changed in the home Region and linked Regions. However, in that case, the delegated administrator can create a configuration policy in which specific security standards are enabled and associate the policy with new organization accounts.
dict
Provides information about the way an organization is configured in Security Hub CSPM.
ConfigurationType (string) --
Indicates whether the organization uses local or central configuration.
If you use local configuration, the Security Hub CSPM delegated administrator can set AutoEnable to true and AutoEnableStandards to DEFAULT. This automatically enables Security Hub CSPM and default security standards in new organization accounts. These new account settings must be set separately in each Amazon Web Services Region, and settings may be different in each Region.
If you use central configuration, the delegated administrator can create configuration policies. Configuration policies can be used to configure Security Hub CSPM, security standards, and security controls in multiple accounts and Regions. If you want new organization accounts to use a specific configuration, you can create a configuration policy and associate it with the root or specific organizational units (OUs). New accounts will inherit the policy from the root or their assigned OU.
Status (string) --
Describes whether central configuration could be enabled as the ConfigurationType for the organization. If your ConfigurationType is local configuration, then the value of Status is always ENABLED.
If the value of Status is DISABLED, central configuration is disabled because the organization is managed by Security Hub CSPM policies in Organizations.
StatusMessage (string) --
Provides an explanation if the value of Status is equal to FAILED when ConfigurationType is equal to CENTRAL.
dict
Response Syntax
{}
Response Structure
(dict) --