Skip to content

/AWS1/IF_SHB=>CREATECONFIGURATIONPOLICY()

About CreateConfigurationPolicy

Creates a configuration policy with the defined configuration. Only the Security Hub CSPM delegated administrator can invoke this operation from the home Region.

Method Signature

METHODS /AWS1/IF_SHB~CREATECONFIGURATIONPOLICY
  IMPORTING
    !IV_NAME TYPE /AWS1/SHBNONEMPTYSTRING OPTIONAL
    !IV_DESCRIPTION TYPE /AWS1/SHBNONEMPTYSTRING OPTIONAL
    !IO_CONFIGURATIONPOLICY TYPE REF TO /AWS1/CL_SHBPOLICY OPTIONAL
    !IT_TAGS TYPE /AWS1/CL_SHBTAGMAP_W=>TT_TAGMAP OPTIONAL
  RETURNING
    VALUE(OO_OUTPUT) TYPE REF TO /aws1/cl_shbcreateconfplyrsp
  RAISING
    /AWS1/CX_SHBACCESSDENIEDEX
    /AWS1/CX_SHBINTERNALEXCEPTION
    /AWS1/CX_SHBINVALIDACCESSEX
    /AWS1/CX_SHBINVALIDINPUTEX
    /AWS1/CX_SHBLIMITEXCEEDEDEX
    /AWS1/CX_SHBRESOURCECONFLICTEX
    /AWS1/CX_SHBCLIENTEXC
    /AWS1/CX_SHBSERVEREXC
    /AWS1/CX_RT_TECHNICAL_GENERIC
    /AWS1/CX_RT_SERVICE_GENERIC.

IMPORTING

Required arguments:

iv_name TYPE /AWS1/SHBNONEMPTYSTRING /AWS1/SHBNONEMPTYSTRING

The name of the configuration policy. Alphanumeric characters and the following ASCII characters are permitted: -, ., !, *, /.

io_configurationpolicy TYPE REF TO /AWS1/CL_SHBPOLICY /AWS1/CL_SHBPOLICY

An object that defines how Security Hub CSPM is configured. It includes whether Security Hub CSPM is enabled or disabled, a list of enabled security standards, a list of enabled or disabled security controls, and a list of custom parameter values for specified controls. If you provide a list of security controls that are enabled in the configuration policy, Security Hub CSPM disables all other controls (including newly released controls). If you provide a list of security controls that are disabled in the configuration policy, Security Hub CSPM enables all other controls (including newly released controls).

Optional arguments:

iv_description TYPE /AWS1/SHBNONEMPTYSTRING /AWS1/SHBNONEMPTYSTRING

The description of the configuration policy.

it_tags TYPE /AWS1/CL_SHBTAGMAP_W=>TT_TAGMAP TT_TAGMAP

User-defined tags associated with a configuration policy. For more information, see Tagging Security Hub CSPM resources in the Security Hub CSPM user guide.

RETURNING

oo_output TYPE REF TO /aws1/cl_shbcreateconfplyrsp /AWS1/CL_SHBCREATECONFPLYRSP

Examples

Syntax Example

This is an example of the syntax for calling the method. It includes every possible argument and initializes every possible value. The data provided is not necessarily semantically accurate (for example the value "string" may be provided for something that is intended to be an instance ID, or in some cases two arguments may be mutually exclusive). The syntax shows the ABAP syntax for creating the various data structures.

DATA(lo_result) = lo_client->createconfigurationpolicy(
  io_configurationpolicy = new /aws1/cl_shbpolicy(
    io_securityhub = new /aws1/cl_shbsecurityhubpolicy(
      io_securitycontrolsconf = new /aws1/cl_shbseccontrolsconf(
        it_disabledseccontrolids = VALUE /aws1/cl_shbdsbdsecctlidlist_w=>tt_disabledseccontrolidlist(
          ( new /aws1/cl_shbdsbdsecctlidlist_w( |string| ) )
        )
        it_enabledsecuritycontrolids = VALUE /aws1/cl_shbenbdsecctlidlist_w=>tt_enabledseccontrolidlist(
          ( new /aws1/cl_shbenbdsecctlidlist_w( |string| ) )
        )
        it_seccontrolcustomparams = VALUE /aws1/cl_shbsecctlcustomparam=>tt_seccontrolcustomparamslist(
          (
            new /aws1/cl_shbsecctlcustomparam(
              it_parameters = VALUE /aws1/cl_shbparameterconf=>tt_parameters(
                (
                  VALUE /aws1/cl_shbparameterconf=>ts_parameters_maprow(
                    value = new /aws1/cl_shbparameterconf(
                      io_value = new /aws1/cl_shbparametervalue(
                        it_enumlist = VALUE /aws1/cl_shbstringlist_w=>tt_stringlist(
                          ( new /aws1/cl_shbstringlist_w( |string| ) )
                        )
                        it_integerlist = VALUE /aws1/cl_shbintegerlist_w=>tt_integerlist(
                          ( new /aws1/cl_shbintegerlist_w( 123 ) )
                        )
                        it_stringlist = VALUE /aws1/cl_shbstringlist_w=>tt_stringlist(
                          ( new /aws1/cl_shbstringlist_w( |string| ) )
                        )
                        iv_boolean = ABAP_TRUE
                        iv_double = '0.1'
                        iv_enum = |string|
                        iv_integer = 123
                        iv_string = |string|
                      )
                      iv_valuetype = |string|
                    )
                    key = |string|
                  )
                )
              )
              iv_securitycontrolid = |string|
            )
          )
        )
      )
      it_enabledstandardids = VALUE /aws1/cl_shbenbdstandardidls00=>tt_enabledstandardidlist(
        ( new /aws1/cl_shbenbdstandardidls00( |string| ) )
      )
      iv_serviceenabled = ABAP_TRUE
    )
  )
  it_tags = VALUE /aws1/cl_shbtagmap_w=>tt_tagmap(
    (
      VALUE /aws1/cl_shbtagmap_w=>ts_tagmap_maprow(
        value = new /aws1/cl_shbtagmap_w( |string| )
        key = |string|
      )
    )
  )
  iv_description = |string|
  iv_name = |string|
).

This is an example of reading all possible response values

lo_result = lo_result.
IF lo_result IS NOT INITIAL.
  lv_nonemptystring = lo_result->get_arn( ).
  lv_nonemptystring = lo_result->get_id( ).
  lv_nonemptystring = lo_result->get_name( ).
  lv_nonemptystring = lo_result->get_description( ).
  lv_timestamp = lo_result->get_updatedat( ).
  lv_timestamp = lo_result->get_createdat( ).
  lo_policy = lo_result->get_configurationpolicy( ).
  IF lo_policy IS NOT INITIAL.
    lo_securityhubpolicy = lo_policy->get_securityhub( ).
    IF lo_securityhubpolicy IS NOT INITIAL.
      lv_boolean = lo_securityhubpolicy->get_serviceenabled( ).
      LOOP AT lo_securityhubpolicy->get_enabledstandardids( ) into lo_row.
        lo_row_1 = lo_row.
        IF lo_row_1 IS NOT INITIAL.
          lv_nonemptystring = lo_row_1->get_value( ).
        ENDIF.
      ENDLOOP.
      lo_securitycontrolsconfigu = lo_securityhubpolicy->get_securitycontrolsconf( ).
      IF lo_securitycontrolsconfigu IS NOT INITIAL.
        LOOP AT lo_securitycontrolsconfigu->get_enabledseccontrolids( ) into lo_row_2.
          lo_row_3 = lo_row_2.
          IF lo_row_3 IS NOT INITIAL.
            lv_nonemptystring = lo_row_3->get_value( ).
          ENDIF.
        ENDLOOP.
        LOOP AT lo_securitycontrolsconfigu->get_disabledseccontrolids( ) into lo_row_4.
          lo_row_5 = lo_row_4.
          IF lo_row_5 IS NOT INITIAL.
            lv_nonemptystring = lo_row_5->get_value( ).
          ENDIF.
        ENDLOOP.
        LOOP AT lo_securitycontrolsconfigu->get_seccontrolcustomparams( ) into lo_row_6.
          lo_row_7 = lo_row_6.
          IF lo_row_7 IS NOT INITIAL.
            lv_nonemptystring = lo_row_7->get_securitycontrolid( ).
            LOOP AT lo_row_7->get_parameters( ) into ls_row_8.
              lv_key = ls_row_8-key.
              lo_value = ls_row_8-value.
              IF lo_value IS NOT INITIAL.
                lv_parametervaluetype = lo_value->get_valuetype( ).
                lo_parametervalue = lo_value->get_value( ).
                IF lo_parametervalue IS NOT INITIAL.
                  lv_integer = lo_parametervalue->get_integer( ).
                  LOOP AT lo_parametervalue->get_integerlist( ) into lo_row_9.
                    lo_row_10 = lo_row_9.
                    IF lo_row_10 IS NOT INITIAL.
                      lv_integer = lo_row_10->get_value( ).
                    ENDIF.
                  ENDLOOP.
                  lv_double = lo_parametervalue->get_double( ).
                  lv_nonemptystring = lo_parametervalue->get_string( ).
                  LOOP AT lo_parametervalue->get_stringlist( ) into lo_row_11.
                    lo_row_12 = lo_row_11.
                    IF lo_row_12 IS NOT INITIAL.
                      lv_nonemptystring = lo_row_12->get_value( ).
                    ENDIF.
                  ENDLOOP.
                  lv_boolean = lo_parametervalue->get_boolean( ).
                  lv_nonemptystring = lo_parametervalue->get_enum( ).
                  LOOP AT lo_parametervalue->get_enumlist( ) into lo_row_11.
                    lo_row_12 = lo_row_11.
                    IF lo_row_12 IS NOT INITIAL.
                      lv_nonemptystring = lo_row_12->get_value( ).
                    ENDIF.
                  ENDLOOP.
                ENDIF.
              ENDIF.
            ENDLOOP.
          ENDIF.
        ENDLOOP.
      ENDIF.
    ENDIF.
  ENDIF.
ENDIF.

To create a configuration policy

This operation creates a configuration policy in Security Hub.

DATA(lo_result) = lo_client->createconfigurationpolicy(
  io_configurationpolicy = new /aws1/cl_shbpolicy(
    io_securityhub = new /aws1/cl_shbsecurityhubpolicy(
      io_securitycontrolsconf = new /aws1/cl_shbseccontrolsconf(
        it_disabledseccontrolids = VALUE /aws1/cl_shbdsbdsecctlidlist_w=>tt_disabledseccontrolidlist(
          ( new /aws1/cl_shbdsbdsecctlidlist_w( |CloudWatch.1| ) )
        )
        it_seccontrolcustomparams = VALUE /aws1/cl_shbsecctlcustomparam=>tt_seccontrolcustomparamslist(
          (
            new /aws1/cl_shbsecctlcustomparam(
              it_parameters = VALUE /aws1/cl_shbparameterconf=>tt_parameters(
                (
                  VALUE /aws1/cl_shbparameterconf=>ts_parameters_maprow(
                    value = new /aws1/cl_shbparameterconf(
                      io_value = new /aws1/cl_shbparametervalue( iv_integer = 14 )
                      iv_valuetype = |CUSTOM|
                    )
                    key = |daysToExpiration|
                  )
                )
              )
              iv_securitycontrolid = |ACM.1|
            )
          )
        )
      )
      it_enabledstandardids = VALUE /aws1/cl_shbenbdstandardidls00=>tt_enabledstandardidlist(
        ( new /aws1/cl_shbenbdstandardidls00( |arn:aws:securityhub:us-east-1::standards/aws-foundational-security-best-practices/v/1.0.0| ) )
        ( new /aws1/cl_shbenbdstandardidls00( |arn:aws:securityhub:::ruleset/cis-aws-foundations-benchmark/v/1.2.0| ) )
      )
      iv_serviceenabled = ABAP_TRUE
    )
  )
  iv_description = |Configuration policy for testing FSBP and CIS|
  iv_name = |TestConfigurationPolicy|
).