aws-sh-controls-mngr.py
def dump(config, region, dry_run, verbose):
    """
    Reads the control status from the configs and applies (if changes are detected).
    """
    if verbose:
        click.secho("Apply controls settings for the security hub", bold=True)

    config = read_config(config_file=config)

    client = boto3.client('securityhub', region_name=region)

    subs = client.get_enabled_standards()

    for s in subs["StandardsSubscriptions"]:
        standard = reusable_arn(arn=s['StandardsArn'], region=region)
        click.echo(f"Working with standard: {standard}")

        controls = client.describe_standards_controls(
            StandardsSubscriptionArn=s["StandardsSubscriptionArn"]
        )
        ds = config[standard]
        for c in controls["Controls"]:
            id = c['ControlId']
            current_status = c['ControlStatus']
            desired_status = ds['controls'][id]['status'].upper()

            if desired_status not in ("ENABLED", "DISABLED"):
                click.secho(
                    f"Status should be either 'ENABLED' or 'DISABLED', got {desired_status}. Skipping",
                    fg="red"
                )
            elif current_status == desired_status:
                if verbose:
                    click.echo(f"\t{id} --> current status {current_status} is the same as desired, no action needed")
            elif dry_run:
                click.echo(f"\t{id} --> update status from {current_status} to {desired_status} (but we're in dry run mode so no action taken).")
            else:
                click.echo(f"\t{id} --> update status from {current_status} to {desired_status}")

                response = client.update_standards_control(
                    StandardsControlArn=c['StandardsControlArn'],
                    ControlStatus=desired_status,
                    DisabledReason="" if desired_status == 'ENABLED' else ds['controls'][id]['disabled_reason']
                )

    Reads the control status from the configs and applies (if changes are detected).
    
Reads the control status from the configs and applies (if changes are detected).
Reads the control status from the configs and applies ( if changes are detected ) .
def dump(config, region, dry_run, verbose):
    if verbose:
        click.secho("Apply controls settings for the security hub", bold=True)
    config = read_config(config_file=config)
    client = boto3.client('securityhub', region_name=region)
    subs = client.get_enabled_standards()
    for s in subs["StandardsSubscriptions"]:
        standard = reusable_arn(arn=s['StandardsArn'], region=region)
        click.echo(f"Working with standard: {standard}")
        controls = client.describe_standards_controls(
            StandardsSubscriptionArn=s["StandardsSubscriptionArn"]
        )
        ds = config[standard]
        for c in controls["Controls"]:
            id = c['ControlId']
            current_status = c['ControlStatus']
            desired_status = ds['controls'][id]['status'].upper()
            if desired_status not in ("ENABLED", "DISABLED"):
                click.secho(
                    f"Status should be either 'ENABLED' or 'DISABLED', got {desired_status}. Skipping",
                    fg="red"
                )
            elif current_status == desired_status:
                if verbose:
                    click.echo(f"\t{id} --> current status {current_status} is the same as desired, no action needed")
            elif dry_run:
                click.echo(f"\t{id} --> update status from {current_status} to {desired_status} (but we're in dry run mode so no action taken).")
            else:
                click.echo(f"\t{id} --> update status from {current_status} to {desired_status}")
                response = client.update_standards_control(
                    StandardsControlArn=c['StandardsControlArn'],
                    ControlStatus=desired_status,
                    DisabledReason="" if desired_status == 'ENABLED' else ds['controls'][id]['disabled_reason']
                )
def dump ( config , region , dry_run , verbose ) : if verbose : click . secho ( "Apply controls settings for the security hub" , bold = True ) config = read_config ( config_file = config ) client = boto3 . client ( 'securityhub' , region_name = region ) subs = client . get_enabled_standards ( ) for s in subs [ "StandardsSubscriptions" ] : standard = reusable_arn ( arn = s [ 'StandardsArn' ] , region = region ) click . echo ( f"Working with standard: {standard}" ) controls = client . describe_standards_controls ( StandardsSubscriptionArn = s [ "StandardsSubscriptionArn" ] ) ds = config [ standard ] for c in controls [ "Controls" ] : id = c [ 'ControlId' ] current_status = c [ 'ControlStatus' ] desired_status = ds [ 'controls' ] [ id ] [ 'status' ] . upper ( ) if desired_status not in ( "ENABLED" , "DISABLED" ) : click . secho ( f"Status should be either 'ENABLED' or 'DISABLED', got {desired_status}. Skipping" , fg = "red" ) elif current_status == desired_status : if verbose : click . echo ( f"\t{id} --> current status {current_status} is the same as desired, no action needed" ) elif dry_run : click . echo ( f"\t{id} --> update status from {current_status} to {desired_status} (but we're in dry run mode so no action taken)." ) else : click . echo ( f"\t{id} --> update status from {current_status} to {desired_status}" ) response = client . update_standards_control ( StandardsControlArn = c [ 'StandardsControlArn' ] , ControlStatus = desired_status , DisabledReason = "" if desired_status == 'ENABLED' else ds [ 'controls' ] [ id ] [ 'disabled_reason' ] )
Reads the control status from the configs and applies (if changes are detected).
Reads the control status from the configs and applies ( if changes are detected ) .
"""
    Reads the control status from the configs and applies (if changes are detected).
    """
config
region
dry_run
verbose