update_configuration_policy ¶

def update_configuration_policy(
    self,
    identifier: "capo_securityhub.types.non_empty_string.NonEmptyString",
    *,
    config_overrides: Optional[SecurityHubClientConfig] = None,
    name: Optional["capo_securityhub.types.non_empty_string.NonEmptyString"] = None,
    description: Optional[
        "capo_securityhub.types.non_empty_string.NonEmptyString"
    ] = None,
    updated_reason: Optional[
        "capo_securityhub.types.non_empty_string.NonEmptyString"
    ] = None,
    configuration_policy: Optional["capo_securityhub.types.policy.Policy"] = None,
) -> "capo_securityhub.types.update_configuration_policy_response.UpdateConfigurationPolicyResponse":
    """<p> Updates a configuration policy. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region. </p>

    Args:
        identifier: <p> The Amazon Resource Name (ARN) or universally unique identifier (UUID) of the configuration policy. </p>
        name: <p> The name of the configuration policy. Alphanumeric characters and the following ASCII characters are permitted: <code>-, ., !, *, /</code>. </p>
        description: <p> The description of the configuration policy. </p>
        updated_reason: <p> The reason for updating the configuration policy. </p>
        configuration_policy: <p> An object that defines how Security Hub CSPM is configured. It includes whether Security Hub CSPM is enabled or disabled, a list of enabled security standards, a list of enabled or disabled security controls, and a list of custom parameter values for specified controls. If you provide a list of security controls that are enabled in the configuration policy, Security Hub CSPM disables all other controls (including newly released controls). If you provide a list of security controls that are disabled in the configuration policy, Security Hub CSPM enables all other controls (including newly released controls). </p> <p>When updating a configuration policy, provide a complete list of standards that you want to enable and a complete list of controls that you want to enable or disable. The updated configuration replaces the current configuration.</p>

    Raises:
        capo_securityhub.errors.access_denied_exception.AccessDeniedException: <p>You don't have permission to perform the action specified in the request.</p>
        capo_securityhub.errors.internal_exception.InternalException: <p>Internal server error.</p>
        capo_securityhub.errors.invalid_access_exception.InvalidAccessException: <p>The account doesn't have permission to perform this action.</p>
        capo_securityhub.errors.invalid_input_exception.InvalidInputException: <p>The request was rejected because you supplied an invalid or out-of-range value for an input parameter.</p>
        capo_securityhub.errors.limit_exceeded_exception.LimitExceededException: <p>The request was rejected because it attempted to create resources beyond the current Amazon Web Services account or throttling limits. The error code describes the limit exceeded.</p>
        capo_securityhub.errors.resource_conflict_exception.ResourceConflictException: <p>The resource specified in the request conflicts with an existing resource.</p>
        capo_securityhub.errors.resource_not_found_exception.ResourceNotFoundException: <p>The request was rejected because we can't find the specified resource.</p>
        capo_securityhub.errors.UnknownServiceError: The service returned an error code this client does not model.

    Examples:
        To update a configuration policy
        This operation updates the specified configuration policy.

        >>> client.update_configuration_policy(identifier='arn:aws:securityhub:us-east-1:123456789012:configuration-policy/a1b2c3d4-5678-90ab-cdef-EXAMPLE11111', name='TestConfigurationPolicy', description='Updated configuration policy for testing FSBP and CIS', updated_reason='Enabling ACM.2', configuration_policy={'SecurityHub': {'ServiceEnabled': True, 'EnabledStandardIdentifiers': ['arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0', 'arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0'], 'SecurityControlsConfiguration': {'DisabledSecurityControlIdentifiers': ['CloudWatch.1', 'CloudWatch.2'], 'SecurityControlCustomParameters': [{'SecurityControlId': 'ACM.1', 'Parameters': {'daysToExpiration': {'ValueType': 'CUSTOM', 'Value': {'Integer': 21}}}}]}}})
    """

    def _handler(
        req: "OperationRequest[capo_securityhub.types.update_configuration_policy_request.UpdateConfigurationPolicyRequest]",
    ) -> OperationResponse[
        "capo_securityhub.types.update_configuration_policy_response.UpdateConfigurationPolicyResponse"
    ]:
        import capo_securityhub._operations.security_hub_api_service.update_configuration_policy

        output, http_response = (
            capo_securityhub._operations.security_hub_api_service.update_configuration_policy.update_configuration_policy(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("UpdateConfigurationPolicy")
    )
    input_: capo_securityhub.types.update_configuration_policy_request.UpdateConfigurationPolicyRequest = {
        "identifier": identifier
    }
    if name is not None:
        input_["name"] = name
    if description is not None:
        input_["description"] = description
    if updated_reason is not None:
        input_["updated_reason"] = updated_reason
    if configuration_policy is not None:
        input_["configuration_policy"] = configuration_policy

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output