create_configuration_policy ¶

def create_configuration_policy(
    self,
    *,
    config_overrides: Optional[SecurityHubClientConfig] = None,
    name: Optional["capo_securityhub.types.non_empty_string.NonEmptyString"] = None,
    description: Optional[
        "capo_securityhub.types.non_empty_string.NonEmptyString"
    ] = None,
    configuration_policy: Optional["capo_securityhub.types.policy.Policy"] = None,
    tags: Optional["capo_securityhub.types.tag_map.TagMap"] = None,
) -> "capo_securityhub.types.create_configuration_policy_response.CreateConfigurationPolicyResponse":
    """<p> Creates a configuration policy with the defined configuration. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region. </p>

    Args:
        name: <p> The name of the configuration policy. Alphanumeric characters and the following ASCII characters are permitted: <code>-, ., !, *, /</code>. </p>
        description: <p> The description of the configuration policy. </p>
        configuration_policy: <p> An object that defines how Security Hub CSPM is configured. It includes whether Security Hub CSPM is enabled or disabled, a list of enabled security standards, a list of enabled or disabled security controls, and a list of custom parameter values for specified controls. If you provide a list of security controls that are enabled in the configuration policy, Security Hub CSPM disables all other controls (including newly released controls). If you provide a list of security controls that are disabled in the configuration policy, Security Hub CSPM enables all other controls (including newly released controls). </p>
        tags: <p> User-defined tags associated with a configuration policy. For more information, see <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/tagging-resources.html">Tagging Security Hub CSPM resources</a> in the <i>Security Hub CSPM user guide</i>. </p>

    Raises:
        capo_securityhub.errors.access_denied_exception.AccessDeniedException: <p>You don't have permission to perform the action specified in the request.</p>
        capo_securityhub.errors.internal_exception.InternalException: <p>Internal server error.</p>
        capo_securityhub.errors.invalid_access_exception.InvalidAccessException: <p>The account doesn't have permission to perform this action.</p>
        capo_securityhub.errors.invalid_input_exception.InvalidInputException: <p>The request was rejected because you supplied an invalid or out-of-range value for an input parameter.</p>
        capo_securityhub.errors.limit_exceeded_exception.LimitExceededException: <p>The request was rejected because it attempted to create resources beyond the current Amazon Web Services account or throttling limits. The error code describes the limit exceeded.</p>
        capo_securityhub.errors.resource_conflict_exception.ResourceConflictException: <p>The resource specified in the request conflicts with an existing resource.</p>
        capo_securityhub.errors.UnknownServiceError: The service returned an error code this client does not model.

    Examples:
        To create a configuration policy
        This operation creates a configuration policy in Security Hub.

        >>> client.create_configuration_policy(name='TestConfigurationPolicy', description='Configuration policy for testing FSBP and CIS', configuration_policy={'SecurityHub': {'ServiceEnabled': True, 'EnabledStandardIdentifiers': ['arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0', 'arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0'], 'SecurityControlsConfiguration': {'DisabledSecurityControlIdentifiers': ['CloudWatch.1'], 'SecurityControlCustomParameters': [{'SecurityControlId': 'ACM.1', 'Parameters': {'daysToExpiration': {'ValueType': 'CUSTOM', 'Value': {'Integer': 14}}}}]}}})
    """

    def _handler(
        req: "OperationRequest[capo_securityhub.types.create_configuration_policy_request.CreateConfigurationPolicyRequest]",
    ) -> OperationResponse[
        "capo_securityhub.types.create_configuration_policy_response.CreateConfigurationPolicyResponse"
    ]:
        import capo_securityhub._operations.security_hub_api_service.create_configuration_policy

        output, http_response = (
            capo_securityhub._operations.security_hub_api_service.create_configuration_policy.create_configuration_policy(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("CreateConfigurationPolicy")
    )
    input_: capo_securityhub.types.create_configuration_policy_request.CreateConfigurationPolicyRequest = {}
    if name is not None:
        input_["name"] = name
    if description is not None:
        input_["description"] = description
    if configuration_policy is not None:
        input_["configuration_policy"] = configuration_policy
    if tags is not None:
        input_["tags"] = tags

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output