AutomationRuleV2 class

Manages a Security Hub V2 Automation Rule, which automatically updates or takes action on findings that match specified criteria.

> NOTE: Automation rules must be created in the aggregation (home) region. A Security Hub V2 Aggregator (aws.securityhub.AggregatorV2) must exist before creating automation rules.

Example Usage

Basic

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.securityhub.AccountV2("example", {});
const exampleAggregatorV2 = new aws.securityhub.AggregatorV2("example", {regionLinkingMode: "ALL_REGIONS"}, {
    dependsOn: [example],
});
const exampleAutomationRuleV2 = new aws.securityhub.AutomationRuleV2("example", {
    criteria: {
        ocsfFindingCriteriaJson: JSON.stringify({
            CompositeFilters: [{
                StringFilters: [{
                    FieldName: "metadata.product.name",
                    Filter: {
                        Comparison: "EQUALS",
                        Value: "GuardDuty",
                    },
                }],
            }],
            CompositeOperator: "AND",
        }),
    },
    action: {
        findingFieldsUpdate: {
            severityId: 99,
            statusId: 3,
            comment: "Low severity GuardDuty finding suppressed",
        },
        type: "FINDING_FIELDS_UPDATE",
    },
    ruleName: "suppress-guardduty-low",
    description: "Suppress low severity GuardDuty findings",
    ruleOrder: 100,
    ruleStatus: "ENABLED",
}, {
    dependsOn: [exampleAggregatorV2],
});

import pulumi
import json
import pulumi_aws as aws

example = aws.securityhub.AccountV2("example")
example_aggregator_v2 = aws.securityhub.AggregatorV2("example", region_linking_mode="ALL_REGIONS",
opts = pulumi.ResourceOptions(depends_on=[example]))
example_automation_rule_v2 = aws.securityhub.AutomationRuleV2("example",
    criteria={
        "ocsf_finding_criteria_json": json.dumps({
            "CompositeFilters": [{
                "StringFilters": [{
                    "FieldName": "metadata.product.name",
                    "Filter": {
                        "Comparison": "EQUALS",
                        "Value": "GuardDuty",
                    },
                }],
            }],
            "CompositeOperator": "AND",
        }),
    },
    action={
        "finding_fields_update": {
            "severity_id": 99,
            "status_id": 3,
            "comment": "Low severity GuardDuty finding suppressed",
        },
        "type": "FINDING_FIELDS_UPDATE",
    },
    rule_name="suppress-guardduty-low",
    description="Suppress low severity GuardDuty findings",
    rule_order=float(100),
    rule_status="ENABLED",
    opts = pulumi.ResourceOptions(depends_on=[example_aggregator_v2]))

using System.Collections.Generic;
using System.Linq;
using System.Text.Json;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() =>
{
    var example = new Aws.SecurityHub.AccountV2("example");

    var exampleAggregatorV2 = new Aws.SecurityHub.AggregatorV2("example", new()
    {
        RegionLinkingMode = "ALL_REGIONS",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            example,
        },
    });

    var exampleAutomationRuleV2 = new Aws.SecurityHub.AutomationRuleV2("example", new()
    {
        Criteria = new Aws.SecurityHub.Inputs.AutomationRuleV2CriteriaArgs
        {
            OcsfFindingCriteriaJson = JsonSerializer.Serialize(new Dictionary<string, object?>
            {
                ["CompositeFilters"] = new[]
                {
                    new Dictionary<string, object?>
                    {
                        ["StringFilters"] = new[]
                        {
                            new Dictionary<string, object?>
                            {
                                ["FieldName"] = "metadata.product.name",
                                ["Filter"] = new Dictionary<string, object?>
                                {
                                    ["Comparison"] = "EQUALS",
                                    ["Value"] = "GuardDuty",
                                },
                            },
                        },
                    },
                },
                ["CompositeOperator"] = "AND",
            }),
        },
        Action = new Aws.SecurityHub.Inputs.AutomationRuleV2ActionArgs
        {
            FindingFieldsUpdate = new Aws.SecurityHub.Inputs.AutomationRuleV2ActionFindingFieldsUpdateArgs
            {
                SeverityId = 99,
                StatusId = 3,
                Comment = "Low severity GuardDuty finding suppressed",
            },
            Type = "FINDING_FIELDS_UPDATE",
        },
        RuleName = "suppress-guardduty-low",
        Description = "Suppress low severity GuardDuty findings",
        RuleOrder = 100,
        RuleStatus = "ENABLED",
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            exampleAggregatorV2,
        },
    });

});

package main

import (
	"encoding/json"

	"github.com/pulumi/pulumi-aws/sdk/v7/go/aws/securityhub"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		example, err := securityhub.NewAccountV2(ctx, "example", nil)
		if err != nil {
			return err
		}
		exampleAggregatorV2, err := securityhub.NewAggregatorV2(ctx, "example", &securityhub.AggregatorV2Args{
			RegionLinkingMode: pulumi.String("ALL_REGIONS"),
		}, pulumi.DependsOn([]pulumi.Resource{
			example,
		}))
		if err != nil {
			return err
		}
		tmpJSON0, err := json.Marshal(map[string]interface{}{
			"CompositeFilters": []map[string][]map[string]interface{}{
				map[string][]map[string]interface{}{
					"StringFilters": []map[string]interface{}{
						map[string]interface{}{
							"FieldName": "metadata.product.name",
							"Filter": map[string]string{
								"Comparison": "EQUALS",
								"Value":      "GuardDuty",
							},
						},
					},
				},
			},
			"CompositeOperator": "AND",
		})
		if err != nil {
			return err
		}
		json0 := string(tmpJSON0)
		_, err = securityhub.NewAutomationRuleV2(ctx, "example", &securityhub.AutomationRuleV2Args{
			Criteria: &securityhub.AutomationRuleV2CriteriaArgs{
				OcsfFindingCriteriaJson: pulumi.String(json0),
			},
			Action: &securityhub.AutomationRuleV2ActionArgs{
				FindingFieldsUpdate: &securityhub.AutomationRuleV2ActionFindingFieldsUpdateArgs{
					SeverityId: pulumi.Int(99),
					StatusId:   pulumi.Int(3),
					Comment:    pulumi.String("Low severity GuardDuty finding suppressed"),
				},
				Type: pulumi.String("FINDING_FIELDS_UPDATE"),
			},
			RuleName:    pulumi.String("suppress-guardduty-low"),
			Description: pulumi.String("Suppress low severity GuardDuty findings"),
			RuleOrder:   pulumi.Float64(100),
			RuleStatus:  pulumi.String("ENABLED"),
		}, pulumi.DependsOn([]pulumi.Resource{
			exampleAggregatorV2,
		}))
		if err != nil {
			return err
		}
		return nil
	})
}

pulumi {
  required_providers {
    aws = {
      source = "pulumi/aws"
    }
  }
}

resource "aws_securityhub_accountv2" "example" {
}
resource "aws_securityhub_aggregatorv2" "example" {
  depends_on          = [aws_securityhub_accountv2.example]
  region_linking_mode = "ALL_REGIONS"
}
resource "aws_securityhub_automationrulev2" "example" {
  depends_on = [aws_securityhub_aggregatorv2.example]
  criteria = {
    ocsf_finding_criteria_json = jsonencode({
      "CompositeFilters" = [{
        "StringFilters" = [{
          "FieldName" = "metadata.product.name"
          "Filter" = {
            "Comparison" = "EQUALS"
            "Value"      = "GuardDuty"
          }
        }]
      }]
      "CompositeOperator" = "AND"
    })
  }
  action = {
    finding_fields_update = {
      severity_id = 99
      status_id   = 3
      comment     = "Low severity GuardDuty finding suppressed"
    }
    type = "FINDING_FIELDS_UPDATE"
  }
  rule_name   = "suppress-guardduty-low"
  description = "Suppress low severity GuardDuty findings"
  rule_order  = 100
  rule_status = "ENABLED"
}

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.securityhub.AccountV2;
import com.pulumi.aws.securityhub.AggregatorV2;
import com.pulumi.aws.securityhub.AggregatorV2Args;
import com.pulumi.aws.securityhub.AutomationRuleV2;
import com.pulumi.aws.securityhub.AutomationRuleV2Args;
import com.pulumi.aws.securityhub.inputs.AutomationRuleV2CriteriaArgs;
import com.pulumi.aws.securityhub.inputs.AutomationRuleV2ActionArgs;
import com.pulumi.aws.securityhub.inputs.AutomationRuleV2ActionFindingFieldsUpdateArgs;
import static com.pulumi.codegen.internal.Serialization.*;
import com.pulumi.resources.CustomResourceOptions;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new AccountV2("example");

        var exampleAggregatorV2 = new AggregatorV2("exampleAggregatorV2", AggregatorV2Args.builder()
            .regionLinkingMode("ALL_REGIONS")
            .build(), CustomResourceOptions.builder()
                .dependsOn(example)
                .build());

        var exampleAutomationRuleV2 = new AutomationRuleV2("exampleAutomationRuleV2", AutomationRuleV2Args.builder()
            .criteria(AutomationRuleV2CriteriaArgs.builder()
                .ocsfFindingCriteriaJson(serializeJson(
                    jsonObject(
                        jsonProperty("CompositeFilters", jsonArray(jsonObject(
                            jsonProperty("StringFilters", jsonArray(jsonObject(
                                jsonProperty("FieldName", "metadata.product.name"),
                                jsonProperty("Filter", jsonObject(
                                    jsonProperty("Comparison", "EQUALS"),
                                    jsonProperty("Value", "GuardDuty")
                                ))
                            )))
                        ))),
                        jsonProperty("CompositeOperator", "AND")
                    )))
                .build())
            .action(AutomationRuleV2ActionArgs.builder()
                .findingFieldsUpdate(AutomationRuleV2ActionFindingFieldsUpdateArgs.builder()
                    .severityId(99)
                    .statusId(3)
                    .comment("Low severity GuardDuty finding suppressed")
                    .build())
                .type("FINDING_FIELDS_UPDATE")
                .build())
            .ruleName("suppress-guardduty-low")
            .description("Suppress low severity GuardDuty findings")
            .ruleOrder(100.0)
            .ruleStatus("ENABLED")
            .build(), CustomResourceOptions.builder()
                .dependsOn(exampleAggregatorV2)
                .build());

    }
}

resources:
  example:
    type: aws:securityhub:AccountV2
  exampleAggregatorV2:
    type: aws:securityhub:AggregatorV2
    name: example
    properties:
      regionLinkingMode: ALL_REGIONS
    options:
      dependsOn:
        - ${example}
  exampleAutomationRuleV2:
    type: aws:securityhub:AutomationRuleV2
    name: example
    properties:
      criteria:
        ocsfFindingCriteriaJson:
          fn::toJSON:
            CompositeFilters:
              - StringFilters:
                  - FieldName: metadata.product.name
                    Filter:
                      Comparison: EQUALS
                      Value: GuardDuty
            CompositeOperator: AND
      action:
        findingFieldsUpdate:
          severityId: 99
          statusId: 3
          comment: Low severity GuardDuty finding suppressed
        type: FINDING_FIELDS_UPDATE
      ruleName: suppress-guardduty-low
      description: Suppress low severity GuardDuty findings
      ruleOrder: 100
      ruleStatus: ENABLED
    options:
      dependsOn:
        - ${exampleAggregatorV2}

Import

Identity Schema

Required

arn (String) ARN of the Security Hub V2 automation rule.

Using pulumi import, import Security Hub V2 automation rules using arn. For example:

$ pulumi import aws:securityhub/automationRuleV2:AutomationRuleV2 example arn:aws:securityhub:us-east-1:123456789012:automation-rulev2/3efb04f4-e19e-4458-a698-62364ab7b1a7

Constructors

AutomationRuleV2(String name, {AutomationRuleV2Args? args, CustomResourceOptions? options}): Creates a new AutomationRuleV2. name The Pulumi resource name. args Arguments used to configure this AutomationRuleV2. The set of arguments for AutomationRuleV2. options Resource options controlling this resource's behavior.
AutomationRuleV2.reference(String urn): Creates a typed reference to an existing AutomationRuleV2 resource.

Properties

action ↔ Output<AutomationRuleV2Action>: Actions to take when the rule matches. Maximum of 1 action block. See action below.
latefinal
arn ↔ Output<String>: latefinal
childResources → Set<Resource>: finalinherited
completionSources ↔ Map<String, IOutputCompletionSource>: latefinalinherited
criteria ↔ Output<AutomationRuleV2Criteria>: Filtering type and configuration of the automation rule. See criteria below.
latefinal
description ↔ Output<String>: A description of the automation rule.
latefinal
hashCode → int: The hash code for this object.
no setterinherited
id ↔ Output<String>: getter/setter pairinherited
isCustom → bool: Returns whether this resource is provider-managed.
no setterinherited
isProtected → bool: Returns whether this resource is protected from deletion.
no setterinherited
isRemote → bool: Whether this resource is registered as remote.
no setterinherited
isResourceReference → bool: Whether this instance represents a resource value returned over RPC.
finalinherited
region ↔ Output<String>: Region where this resource will be managed. Defaults to the Region set in the provider configuration.
latefinal
resourceTransforms → List<ResourceTransform>: Inherited/explicit async transforms.
no setterinherited
ruleId ↔ Output<String>: ID of the automation rule.
latefinal
ruleName ↔ Output<String>: The name of the automation rule.
latefinal
ruleOrder ↔ Output<double>: The priority of the rule. Lower values indicate higher priority.
latefinal
ruleStatus ↔ Output<String>: The status of the rule. Valid values: ENABLED, DISABLED. Defaults to ENABLED.
latefinal
runtimeType → Type: A representation of the runtime type of the object.
no setterinherited
tags ↔ Output<Map<String, String>?>: Map of tags to assign to the resource. If configured with a provider defaultTags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
latefinal
tagsAll ↔ Output<Map<String, String>>: Map of tags assigned to the resource, including those inherited from the provider defaultTags configuration block.
latefinal
transformations → List<ResourceTransformation>: Inherited/explicit legacy transformations.
no setterinherited
urn ↔ Output<String>: latefinalinherited

Methods

failId(Object error) → void: Completes this resource ID with an error when registration fails.
inherited
failOutputs(Object error) → void: Completes all output properties with error.
inherited
failUrn(Object error) → void: Completes this resource URN with an error when registration fails.
inherited
getProvider(String moduleMember) → ProviderResource?: Returns provider for moduleMember's package, if configured.
inherited
getResourceName() → String: Returns this resource's logical name.
inherited
getResourceType() → String: Returns this resource's Pulumi type token.
inherited
noSuchMethod(Invocation invocation) → dynamic: Invoked when a nonexistent method or property is accessed.
inherited
registerOutput<T>(String propertyName, {Object? decoder(Object?)?, bool isSecret = false}) → Output<T>: Registers a dynamic output property for this resource.
inherited
resolveId(String? value, {required bool isKnown}) → void: Resolves the provider-assigned ID for this resource.
inherited
resolveOutputs(Struct outputs) → void: Resolves all output properties from a monitor response payload.
inherited
resolveUrn(String value) → void: Resolves this resource's URN once assigned by the engine.
inherited
serializeProperties(Map<String, dynamic> properties) → Future<Struct>: Serializes resource properties for RPC transmission.
inherited
toString() → String: A string representation of this object.
inherited

Operators

operator ==(Object other) → bool: The equality operator.
inherited

Static Methods

get(String name, Input<String> id, {AutomationRuleV2State? state, CustomResourceOptions? options}) → AutomationRuleV2: Gets an existing AutomationRuleV2 resource's state with the given name and id.