---
type: resource-type
title: SecurityHubAutomationRule
description: aws resource type AWS::SecurityHub::AutomationRule
name: SecurityHubAutomationRule
lexicon: aws
resource_type: AWS::SecurityHub::AutomationRule
---
`AWS::SecurityHub::AutomationRule`, a resource type of the aws lexicon.

## Properties

- `Actions` (`SecurityHubAutomationRule_AutomationRulesAction[]`, required): One or more actions to update finding fields if a finding matches the conditions specified in ``Criteria``.
- `Criteria` (`SecurityHubAutomationRule_AutomationRulesFindingFilters`, required): A set of [Security Finding Format (ASFF)](https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-findings-format.html) finding field attributes and corresponding expected values that ASH uses to filter findings. If a rule is enabled and a finding matches the criteria specified in this parameter, ASH applies the rule action to the finding.
- `Description` (`string`, required): A description of the rule.
- `RuleName` (`string`, required): The name of the rule.
- `RuleOrder` (`number`, required): An integer ranging from 1 to 1000 that represents the order in which the rule action is applied to findings. Security Hub CSPM applies rules with lower values for this parameter first.
- `CreatedAt` (`string`, optional)
- `CreatedBy` (`string`, optional)
- `IsTerminal` (`boolean`, optional): Specifies whether a rule is the last to be applied with respect to a finding that matches the rule criteria. This is useful when a finding matches the criteria for multiple rules, and each rule has different actions. If a rule is terminal, Security Hub CSPM applies the rule action to a finding that matches the rule criteria and doesn't evaluate other rules for the finding. By default, a rule isn't terminal.
- `RuleArn` (`string`, optional)
- `RuleStatus` (`"DISABLED" | "ENABLED"`, optional): Whether the rule is active after it is created. If this parameter is equal to ``ENABLED``, ASH applies the rule to findings and finding updates after the rule is created.
- `Tags` (`Record<string, unknown>`, optional): User-defined tags associated with an automation rule.
- `UpdatedAt` (`string`, optional)

## Attributes

- `CreatedAt`
- `CreatedBy`
- `RuleArn`
- `UpdatedAt`