create_automation_rule ¶

def create_automation_rule(
    self,
    *,
    config_overrides: Optional[SecurityHubClientConfig] = None,
    tags: Optional["capo_securityhub.types.tag_map.TagMap"] = None,
    rule_status: Optional["capo_securityhub.types.rule_status.RuleStatus"] = None,
    rule_order: Optional[
        "capo_securityhub.types.rule_order_value.RuleOrderValue"
    ] = None,
    rule_name: Optional[
        "capo_securityhub.types.non_empty_string.NonEmptyString"
    ] = None,
    description: Optional[
        "capo_securityhub.types.non_empty_string.NonEmptyString"
    ] = None,
    is_terminal: Optional["capo_securityhub.types.boolean.Boolean"] = None,
    criteria: Optional[
        "capo_securityhub.types.automation_rules_finding_filters.AutomationRulesFindingFilters"
    ] = None,
    actions: Optional["capo_securityhub.types.action_list.ActionList"] = None,
) -> "capo_securityhub.types.create_automation_rule_response.CreateAutomationRuleResponse":
    """<p> Creates an automation rule based on input parameters. </p>

    Args:
        tags: <p> User-defined tags associated with an automation rule. </p>
        rule_status: <p> Whether the rule is active after it is created. If this parameter is equal to <code>ENABLED</code>, Security Hub CSPM starts applying the rule to findings and finding updates after the rule is created. To change the value of this parameter after creating a rule, use <a href="https://docs.aws.amazon.com/securityhub/1.0/APIReference/API_BatchUpdateAutomationRules.html"> <code>BatchUpdateAutomationRules</code> </a>. </p>
        rule_order: <p>An integer ranging from 1 to 1000 that represents the order in which the rule action is applied to findings. Security Hub CSPM applies rules with lower values for this parameter first. </p>
        rule_name: <p> The name of the rule. </p>
        description: <p> A description of the rule. </p>
        is_terminal: <p>Specifies whether a rule is the last to be applied with respect to a finding that matches the rule criteria. This is useful when a finding matches the criteria for multiple rules, and each rule has different actions. If a rule is terminal, Security Hub CSPM applies the rule action to a finding that matches the rule criteria and doesn't evaluate other rules for the finding. By default, a rule isn't terminal. </p>
        criteria: <p> A set of ASFF finding field attributes and corresponding expected values that Security Hub CSPM uses to filter findings. If a rule is enabled and a finding matches the conditions specified in this parameter, Security Hub CSPM applies the rule action to the finding. </p>
        actions: <p> One or more actions to update finding fields if a finding matches the conditions specified in <code>Criteria</code>. </p>

    Raises:
        capo_securityhub.errors.access_denied_exception.AccessDeniedException: <p>You don't have permission to perform the action specified in the request.</p>
        capo_securityhub.errors.internal_exception.InternalException: <p>Internal server error.</p>
        capo_securityhub.errors.invalid_access_exception.InvalidAccessException: <p>The account doesn't have permission to perform this action.</p>
        capo_securityhub.errors.invalid_input_exception.InvalidInputException: <p>The request was rejected because you supplied an invalid or out-of-range value for an input parameter.</p>
        capo_securityhub.errors.limit_exceeded_exception.LimitExceededException: <p>The request was rejected because it attempted to create resources beyond the current Amazon Web Services account or throttling limits. The error code describes the limit exceeded.</p>
        capo_securityhub.errors.UnknownServiceError: The service returned an error code this client does not model.

    Examples:
        To create an automation rule
        The following example creates an automation rule.

        >>> client.create_automation_rule(tags={'important-resources-rule': 's3-bucket'}, rule_status='ENABLED', rule_order=1, rule_name='Elevate severity for important resources', description='Elevate finding severity to Critical for important resources', is_terminal=False, criteria={'ProductName': [{'Value': 'Security Hub', 'Comparison': 'EQUALS'}], 'ComplianceStatus': [{'Value': 'FAILED', 'Comparison': 'EQUALS'}], 'RecordState': [{'Value': 'ACTIVE', 'Comparison': 'EQUALS'}], 'WorkflowStatus': [{'Value': 'NEW', 'Comparison': 'EQUALS'}], 'ResourceId': [{'Value': 'arn:aws:s3:::examplebucket/developers/design_info.doc', 'Comparison': 'EQUALS'}]}, actions=[{'Type': 'FINDING_FIELDS_UPDATE', 'FindingFieldsUpdate': {'Severity': {'Label': 'CRITICAL'}, 'Note': {'Text': 'This is a critical S3 bucket, please look into this ASAP', 'UpdatedBy': 'test-user'}}}])
    """

    def _handler(
        req: "OperationRequest[capo_securityhub.types.create_automation_rule_request.CreateAutomationRuleRequest]",
    ) -> OperationResponse[
        "capo_securityhub.types.create_automation_rule_response.CreateAutomationRuleResponse"
    ]:
        import capo_securityhub._operations.security_hub_api_service.create_automation_rule

        output, http_response = (
            capo_securityhub._operations.security_hub_api_service.create_automation_rule.create_automation_rule(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("CreateAutomationRule")
    )
    input_: capo_securityhub.types.create_automation_rule_request.CreateAutomationRuleRequest = {}
    if tags is not None:
        input_["tags"] = tags
    if rule_status is not None:
        input_["rule_status"] = rule_status
    if rule_order is not None:
        input_["rule_order"] = rule_order
    if rule_name is not None:
        input_["rule_name"] = rule_name
    if description is not None:
        input_["description"] = description
    if is_terminal is not None:
        input_["is_terminal"] = is_terminal
    if criteria is not None:
        input_["criteria"] = criteria
    if actions is not None:
        input_["actions"] = actions

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output