Returns a list of security standards controls.
For each control, the results include information about whether it is currently enabled, the severity, and a link to remediation information.
get/standards/controls/{StandardsSubscriptionArn}
Path parameters
StandardsSubscriptionArnstring required
The ARN of a resource that represents your subscription to a supported standard. To get the subscription ARNs of the standards you have enabled, use the <code>GetEnabledStandards</code> operation.
Query parameters
NextTokenstring
<p>The token that is required for pagination. On your first call to the <code>DescribeStandardsControls</code> operation, set the value of this parameter to <code>NULL</code>.</p> <p>For subsequent calls to the operation, to continue listing data, set the value of this parameter to the value returned from the previous response.</p>
MaxResultsinteger
The maximum number of security standard controls to return.
Response
Success
Example response
{
"Controls": [
{
"ControlId": "PCI.AutoScaling.1",
"ControlStatus": "ENABLED",
"ControlStatusUpdatedAt": "2020-05-15T18:49:04.473000+00:00",
"Description": "This AWS control checks whether your Auto Scaling groups that are associated with a load balancer are using Elastic Load Balancing health checks.",
"RelatedRequirements": [
"PCI DSS 2.2"
],
"RemediationUrl": "https://docs.aws.amazon.com/console/securityhub/PCI.AutoScaling.1/remediation",
"SeverityRating": "LOW",
"StandardsControlArn": "arn:aws:securityhub:us-west-1:123456789012:control/pci-dss/v/3.2.1/PCI.AutoScaling.1",
"Title": "Auto scaling groups associated with a load balancer should use health checks"
},
{
"ControlId": "PCI.CW.1",
"ControlStatus": "ENABLED",
"ControlStatusUpdatedAt": "2020-05-15T18:49:04.498000+00:00",
"Description": "This control checks for the CloudWatch metric filters using the following pattern { $.userIdentity.type = \"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType != \"AwsServiceEvent\" } It checks that the log group name is configured for use with active multi-region CloudTrail, that there is at least one Event Selector for a Trail with IncludeManagementEvents set to true and ReadWriteType set to All, and that there is at least one active subscriber to an SNS topic associated with the alarm.",
"RelatedRequirements": [
"PCI DSS 7.2.1"
],
"RemediationUrl": "https://docs.aws.amazon.com/console/securityhub/PCI.CW.1/remediation",
"SeverityRating": "MEDIUM",
"StandardsControlArn": "arn:aws:securityhub:us-west-1:123456789012:control/pci-dss/v/3.2.1/PCI.CW.1",
"Title": "A log metric filter and alarm should exist for usage of the \"root\" user"
}
],
"NextToken": "U2FsdGVkX1+eNkPoZHVl11ip5HUYQPWSWZGmftcmJiHL8JoKEsCDuaKayiPDyLK+LiTkShveoOdvfxXCkOBaGhohIXhsIedN+LSjQV/l7kfCfJcq4PziNC1N9xe9aq2pjlLVZnznTfSImrodT5bRNHe4fELCQq/z+5ka+5Lzmc11axcwTd5lKgQyQqmUVoeriHZhyIiBgWKf7oNYdBVG8OEortVWvSkoUTt+B2ThcnC7l43kI0UNxlkZ6sc64AsW"
}