"""Map Security Hub control-ID prefixes to terraform resource types. This table is hand-curated and conservative — when a control could apply to multiple terraform resource types, list them all. Update as new control families ship. """ from __future__ import annotations PREFIX_TO_TERRAFORM_TYPES: dict[str, list[str]] = { "Account": ["aws_account_alternate_contact"], "ACM": ["aws_acm_certificate"], "APIGateway": ["aws_api_gateway_rest_api", "aws_apigatewayv2_api", "aws_api_gateway_stage", "aws_api_gateway_method"], "AppSync": ["aws_appsync_graphql_api"], "Athena": ["aws_athena_workgroup"], "AutoScaling": ["aws_autoscaling_group", "aws_launch_template", "aws_launch_configuration"], "Autoscaling": ["aws_autoscaling_group", "aws_launch_template", "aws_launch_configuration"], "Backup": ["aws_backup_plan", "aws_backup_vault"], "BedrockAgentCore": [], "CloudFormation": ["aws_cloudformation_stack", "aws_cloudformation_stack_set"], "CloudFront": ["aws_cloudfront_distribution"], "CloudTrail": ["aws_cloudtrail"], "CodeBuild": ["aws_codebuild_project"], "Cognito": ["aws_cognito_user_pool", "aws_cognito_identity_pool"], "Config": ["aws_config_configuration_recorder", "aws_config_delivery_channel", "aws_config_config_rule"], "Connect": ["aws_connect_instance"], "DataFirehose": ["aws_kinesis_firehose_delivery_stream"], "DataSync": ["aws_datasync_task"], "DMS": ["aws_dms_endpoint", "aws_dms_replication_instance"], "DocumentDB": ["aws_docdb_cluster", "aws_docdb_cluster_instance"], "DynamoDB": ["aws_dynamodb_table"], "EC2": ["aws_instance", "aws_security_group", "aws_security_group_rule", "aws_vpc", "aws_subnet", "aws_network_acl", "aws_ebs_volume", "aws_ebs_default_kms_key", "aws_eip", "aws_nat_gateway", "aws_internet_gateway", "aws_route_table", "aws_vpc_endpoint", "aws_flow_log", "aws_default_security_group"], "ECR": ["aws_ecr_repository", "aws_ecr_repository_policy"], "ECS": ["aws_ecs_cluster", "aws_ecs_service", "aws_ecs_task_definition"], "EFS": ["aws_efs_file_system", "aws_efs_file_system_policy", "aws_efs_access_point"], "EKS": ["aws_eks_cluster", "aws_eks_node_group"], "ELB": ["aws_lb", "aws_alb", "aws_elb", "aws_lb_listener", "aws_alb_listener", "aws_lb_target_group"], "ElastiCache": ["aws_elasticache_cluster", "aws_elasticache_replication_group"], "ElasticBeanstalk": ["aws_elastic_beanstalk_environment"], "ElasticSearch": ["aws_elasticsearch_domain", "aws_opensearch_domain"], "EMR": ["aws_emr_cluster"], "ES": ["aws_elasticsearch_domain"], "EventBridge": ["aws_cloudwatch_event_rule", "aws_cloudwatch_event_bus"], "FSx": ["aws_fsx_lustre_file_system", "aws_fsx_windows_file_system", "aws_fsx_openzfs_file_system", "aws_fsx_ontap_file_system"], "Glue": ["aws_glue_catalog_database", "aws_glue_crawler", "aws_glue_job"], "GuardDuty": ["aws_guardduty_detector"], "IAM": ["aws_iam_user", "aws_iam_role", "aws_iam_policy", "aws_iam_user_policy", "aws_iam_role_policy", "aws_iam_access_key", "aws_iam_account_password_policy", "aws_iam_group", "aws_iam_user_policy_attachment", "aws_iam_role_policy_attachment"], "Inspector": ["aws_inspector2_enabler"], "Kinesis": ["aws_kinesis_stream"], "KMS": ["aws_kms_key", "aws_kms_alias"], "Lambda": ["aws_lambda_function", "aws_lambda_permission", "aws_lambda_function_url"], "Macie": ["aws_macie2_account"], "MQ": ["aws_mq_broker"], "MSK": ["aws_msk_cluster"], "Neptune": ["aws_neptune_cluster", "aws_neptune_cluster_instance"], "NetworkFirewall": ["aws_networkfirewall_firewall", "aws_networkfirewall_firewall_policy", "aws_networkfirewall_rule_group"], "Opensearch": ["aws_opensearch_domain"], "PCA": ["aws_acmpca_certificate_authority"], "RDS": ["aws_db_instance", "aws_rds_cluster", "aws_db_subnet_group", "aws_db_parameter_group", "aws_rds_cluster_instance", "aws_db_snapshot", "aws_db_event_subscription"], "Redshift": ["aws_redshift_cluster", "aws_redshift_parameter_group"], "RedshiftServerless": ["aws_redshiftserverless_namespace", "aws_redshiftserverless_workgroup"], "Route53": ["aws_route53_zone"], "S3": ["aws_s3_bucket", "aws_s3_bucket_policy", "aws_s3_bucket_public_access_block", "aws_s3_bucket_versioning", "aws_s3_bucket_server_side_encryption_configuration", "aws_s3_bucket_logging", "aws_s3_bucket_lifecycle_configuration", "aws_s3_bucket_acl"], "SageMaker": ["aws_sagemaker_notebook_instance", "aws_sagemaker_endpoint_configuration", "aws_sagemaker_model"], "SecretsManager": ["aws_secretsmanager_secret", "aws_secretsmanager_secret_rotation"], "ServiceCatalog": ["aws_servicecatalog_portfolio"], "SES": ["aws_ses_configuration_set", "aws_ses_domain_identity"], "SNS": ["aws_sns_topic", "aws_sns_topic_policy"], "SQS": ["aws_sqs_queue"], "SSM": ["aws_ssm_document", "aws_ssm_parameter", "aws_ssm_association"], "StepFunctions": ["aws_sfn_state_machine"], "Transfer": ["aws_transfer_server", "aws_transfer_user"], "WAF": ["aws_wafv2_web_acl", "aws_waf_web_acl", "aws_wafv2_web_acl_association"], "WorkSpaces": ["aws_workspaces_directory", "aws_workspaces_workspace"], } def control_id_to_types(control_id: str) -> list[str]: """Given e.g. 'FSBP S3.5' or 'S3.5', return likely terraform types. Strips the leading 'FSBP '/'CIS ' source prefix, then matches the service prefix (the segment before the first dot). """ s = control_id.strip() for source in ("FSBP", "CIS"): prefix = f"{source} " if s.startswith(prefix): s = s[len(prefix):] break service, _, _ = s.partition(".") return list(PREFIX_TO_TERRAFORM_TYPES.get(service, []))