securityhub:BatchGetControlEvaluations is a Read access-level action in the securityhub service. Grants permission to get the enablement and compliance status of controls, the findings count for controls, and the overall security score for controls on the Security Hub console
ARNs that securityhub:BatchGetControlEvaluations can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants securityhub:BatchGetControlEvaluations.
Filters access by actions based on tag key-value pairs attached to the resource
A minimal policy that allows securityhub:BatchGetControlEvaluations. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSecurityhubBatchGetControlEvaluations",
"Effect": "Allow",
"Action": "securityhub:BatchGetControlEvaluations",
"Resource": "*"
}
]
}