start_export_job_v2 ¶

def start_export_job_v2(
    self,
    *,
    config_overrides: Optional[SecurityHubClientConfig] = None,
    name: Optional["capo_securityhub.types.export_name.ExportName"] = None,
    destination: Optional[
        "capo_securityhub.types.export_destination.ExportDestination"
    ] = None,
    output_configuration: Optional[
        "capo_securityhub.types.export_output.ExportOutput"
    ] = None,
    scopes: Optional["capo_securityhub.types.export_scopes.ExportScopes"] = None,
    client_token: Optional[
        "capo_securityhub.types.client_token.ClientToken"
    ] = None,
) -> "capo_securityhub.types.start_export_job_v2_response.StartExportJobV2Response":
    """<p>Starts an ad hoc export job that writes Security Hub findings to an Amazon Simple Storage Service (Amazon S3) bucket that you own. Because the export runs asynchronously, this operation returns only the <code>ExportJobId</code> of the new job; it doesn't wait for the export to finish. Use <code>GetExportJobV2</code> to poll the job, and <code>ListExportJobsV2</code> to view the export jobs in your account.</p> <p>Security Hub allows only one export job in the <code>RUNNING</code> state per account at a time. If an export job is already running, this operation returns a <code>ServiceQuotaExceededException</code>. Wait for the running job to finish, or cancel it with <code>CancelExportJobV2</code>, before you start a new one.</p> <p>Specify the destination bucket and Amazon Web Services Key Management Service (Amazon Web Services KMS) key in the <code>Destination</code> parameter, and the output format (<code>CSV</code> or <code>OCSF_JSON</code>), optional filters, and field selection in the <code>OutputConfiguration</code> parameter. Before you call this operation, you must grant Security Hub permission to write to your bucket and use your Amazon Web Services KMS key by adding the bucket policy and key policy statements shown in the Examples section.</p> <p>Two identities use your Amazon Web Services KMS key, and each needs its own permission. Security Hub uses the key when it writes the export objects to your bucket. The IAM principal that calls <code>StartExportJobV2</code> must also have <code>kms:GenerateDataKey</code> and <code>kms:Decrypt</code> permissions on the key. The Examples section shows both grants.</p> <p>A delegated administrator can use the optional <code>Scopes</code> parameter to export findings for specific organizations or organizational units (OUs).</p> <p>To make the request idempotent, provide a <code>ClientToken</code>. If you retry a <code>StartExportJobV2</code> request with the same <code>ClientToken</code> and the same request parameters, Security Hub returns the <code>ExportJobId</code> of the original job instead of starting a new one. If you reuse a <code>ClientToken</code> with different request parameters, this operation returns a <code>ConflictException</code>.</p>

    Args:
        name: <p>An optional, user-provided name for the export job that helps you identify it in <code>ListExportJobsV2</code> results. The value can be 1–256 characters. Alphanumeric characters, spaces, and the following ASCII characters are permitted: <code>. _ , : ( ) / + -</code>.</p>
        destination: <p>The destination that Security Hub writes the export to. You must specify exactly one destination type. Currently, the only supported type is Amazon S3.</p>
        output_configuration: <p>Specifies what data to export and how to format it. You must specify exactly one output type. Currently, the only supported type is <code>Findings</code>.</p>
        scopes: <p>Limits the export to findings from specific organizational units (OUs) or from the delegated administrator's organization. Only the delegated administrator account can use this parameter; other accounts that specify it receive an <code>AccessDeniedException</code>.</p> <p>This parameter is optional. If you omit it, the delegated administrator exports findings from all accounts across the entire organization, and other accounts export only their own findings.</p> <p>You can specify up to 10 entries in <code>Scopes.AwsOrganizations</code>. If you specify multiple entries, Security Hub combines them using OR logic.</p>
        client_token: <p>A unique identifier used to ensure idempotency.</p>

    Raises:
        capo_securityhub.errors.access_denied_exception.AccessDeniedException: <p>You don't have permission to perform the action specified in the request.</p>
        capo_securityhub.errors.conflict_exception.ConflictException: <p>The request causes conflict with the current state of the service resource.</p>
        capo_securityhub.errors.internal_server_exception.InternalServerException: <p> The request has failed due to an internal failure of the service. </p>
        capo_securityhub.errors.organizational_unit_not_found_exception.OrganizationalUnitNotFoundException: <p>The request failed because one or more organizational units specified in the request don't exist within the caller's organization.</p>
        capo_securityhub.errors.organization_not_found_exception.OrganizationNotFoundException: <p>The request failed because one or more organizations specified in the request don't exist or don't belong to the caller's organization.</p>
        capo_securityhub.errors.service_quota_exceeded_exception.ServiceQuotaExceededException: <p>The request was rejected because it would exceed the service quota limit.</p>
        capo_securityhub.errors.throttling_exception.ThrottlingException: <p> The limit on the number of requests per second was exceeded. </p>
        capo_securityhub.errors.validation_exception.ValidationException: <p>The request has failed validation because it's missing required fields or has invalid inputs.</p>
        capo_securityhub.errors.UnknownServiceError: The service returned an error code this client does not model.

    Examples:
        Example – Starting a CSV export of critical findings
        The following example starts an export that writes selected fields of new, critical findings to an Amazon S3 bucket in CSV format.

        >>> client.start_export_job_v2(name='quarterly-critical-findings', destination={'S3': {'BucketArn': 'arn:aws:s3:::amzn-s3-demo-bucket', 'KmsKeyArn': 'arn:aws:kms:aa-example-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab', 'ObjectPrefix': 'security-hub-exports/2026-Q1'}}, output_configuration={'Findings': {'Format': 'CSV', 'SelectedFields': ['finding_info.title', 'severity', 'status', 'cloud.account.uid', 'resources.uid'], 'Filters': {'CompositeOperator': 'AND', 'CompositeFilters': [{'Operator': 'AND', 'StringFilters': [{'FieldName': 'severity', 'Filter': {'Value': 'Critical', 'Comparison': 'EQUALS'}}, {'FieldName': 'status', 'Filter': {'Value': 'New', 'Comparison': 'EQUALS'}}]}]}}}, client_token='b3d1f9a2-1c4e-4b9a-9f2e-EXAMPLE11111')
        Example – Starting an OCSF JSON export scoped to an organizational unit
        The following example, run by a delegated administrator, starts an export of the last 30 days of findings for a specific organizational unit (OU) in OCSF JSON format.

        >>> client.start_export_job_v2(destination={'S3': {'BucketArn': 'arn:aws:s3:::amzn-s3-demo-bucket', 'KmsKeyArn': 'arn:aws:kms:aa-example-1:111122223333:key/1234abcd-12ab-34cd-56ef-1234567890ab'}}, output_configuration={'Findings': {'Format': 'OCSF_JSON', 'Filters': {'CompositeOperator': 'AND', 'CompositeFilters': [{'Operator': 'AND', 'DateFilters': [{'FieldName': 'finding_info.last_seen_time_dt', 'Filter': {'DateRange': {'Value': 30, 'Unit': 'DAYS', 'Comparison': 'WITHIN'}}}]}]}}}, scopes={'AwsOrganizations': [{'OrganizationalUnitId': 'ou-1234-a1b2c3d4'}]})
    """

    def _handler(
        req: "OperationRequest[capo_securityhub.types.start_export_job_v2_request.StartExportJobV2Request]",
    ) -> OperationResponse[
        "capo_securityhub.types.start_export_job_v2_response.StartExportJobV2Response"
    ]:
        import capo_securityhub._operations.security_hub_api_service.start_export_job_v2

        output, http_response = (
            capo_securityhub._operations.security_hub_api_service.start_export_job_v2.start_export_job_v2(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("StartExportJobV2")
    )
    input_: capo_securityhub.types.start_export_job_v2_request.StartExportJobV2Request = {}
    if name is not None:
        input_["name"] = name
    if destination is not None:
        input_["destination"] = destination
    if output_configuration is not None:
        input_["output_configuration"] = output_configuration
    if scopes is not None:
        input_["scopes"] = scopes
    if client_token is None:
        client_token = str(uuid.uuid4())
    input_["client_token"] = client_token

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output