AWS Security Hubのコントロール状態をCLIで確認してみた

aws securityhub get-enabled-standards --region ap-northeast-1

{
    "StandardsSubscriptions": [
        {
            "StandardsSubscriptionArn": "arn:aws:securityhub:ap-northeast-1:XXXXXXXXXXXX:subscription/aws-foundational-security-best-practices/v/1.0.0",
            "StandardsArn": "arn:aws:securityhub:ap-northeast-1::standards/aws-foundational-security-best-practices/v/1.0.0",
            "StandardsInput": {},
            "StandardsStatus": "READY",
            "StandardsControlsUpdatable": "READY_FOR_UPDATES"
        }
    ]
}

aws securityhub describe-standards-controls \
  --standards-subscription-arn "スタンダードのARN" \
  --region ap-northeast-1

aws securityhub batch-get-security-controls \
  --security-control-ids "DocumentDB.6" \
  --region ap-northeast-1

{
    "SecurityControls": [
        {
            "SecurityControlId": "DocumentDB.6",
            "SecurityControlArn": "arn:aws:securityhub:ap-northeast-1:XXXXXXXXXXXX:security-control/DocumentDB.6",
            "Title": "Amazon DocumentDB clusters should be encrypted in transit",
            "Description": "This controls checks whether an Amazon DocumentDB cluster requires TLS for connections to the cluster. The control fails if the cluster parameter group associated with the cluster is not in sync, or the TLS cluster parameter in the group is set to 'disabled'.",
            "RemediationUrl": "https://docs.aws.amazon.com/console/securityhub/DocumentDB.6/remediation",
            "SeverityRating": "MEDIUM",
            "SecurityControlStatus": "ENABLED",
            "UpdateStatus": "READY",
            "Parameters": {}
        }
    ]
}