update¶

The fugue update command enables you to update an AWS, AWS GovCloud, Azure, Azure Government, or Google environment, a custom rule, a user’s RBAC groups, or a rule waiver.

update¶

Update a resource

Usage:
  fugue update [command]

Available Commands:
  environment  Update environment settings
  rule         Update rule settings
  rule-waiver  Update rule waiver settings
  users-groups Batch update group assignments for multiple users

Flags:
  -h, --help   help for update

Global Flags:
      --output string   The formatting style for command output [table | json] (default "table")

Use "fugue update [command] --help" for more information about a command.

update environment¶

Example
Output attributes
Accepted parameter values
Arguments:
- [environment_id]

Update environment settings

Usage:
  fugue update environment [environment_id] [flags]

Aliases:
  environment, env

Flags:
      --baseline-id string                 Baseline scan ID
     --compliance-families strings        Compliance families
 -h, --help                               help for environment
     --name string                        Environment name
     --regions strings                    AWS regions (SEE NOTE)
     --remediate-resource-types strings   Remediation resource types (AWS and AWS GovCloud only)
     --remediation                        Enable automatic remediation (AWS and AWS GovCloud only)
     --scan-interval int                  Scan interval (seconds)
     --scan-schedule-enabled              Enable automatic scanning schedule (default true)
     --service-account-email string       Google service account email
     --survey-resource-types strings      Survey resource types

Global Flags:
      --output string   The formatting style for command output [table | json] (default "table")

update rule¶

Example
Output attributes
Accepted parameter values
Arguments:
- [rule_id]
Required flags:
- --text

Update rule settings

Usage:
  fugue update rule [rule_id] [flags]

Flags:
      --description string     Description
  -h, --help                   help for rule
      --name string            Rule name
      --resource-type string   Resource type
      --severity               Severity
      --text string            Rule text

Global Flags:
      --output string   The formatting style for command output [table | json] (default "table")

update rule-waiver¶

Example
Output attributes
Accepted parameter values
Arguments:
- [rule_waiver_id]

Update rule waiver settings

Usage:
  fugue update rule-waiver [rule_waiver_id] [flags]

Aliases:
  rule-waiver, waiver, rule_waiver

Flags:
      --comment string         Rule waiver comment
  -h, --help                   help for rule-waiver
      --name string            Rule waiver name

Global Flags:
      --output string   The formatting style for command output [table | json] (default "table")

update users-groups¶

Example
Accepted parameter values
Required flags:
- --group-ids
- --user-ids

Batch update group assignments for multiple users

Usage:
  fugue update users-groups [flags]

Aliases:
  users-groups, users_groups

Flags:
      --group-ids strings   Groups to assign to provided users
  -h, --help                help for users-groups
      --user-ids strings    Users to update

Global Flags:
      --output string   The formatting style for command output [table | json] (default "table")

Output Attributes¶

Update environment output¶

The fugue update environment output includes the following attributes:

ENVIRONMENT_ID: ID of the environment.
NAME: Name of the environment.
PROVIDER: Name of the cloud service provider for the environment. Values - aws, aws_govcloud, azure (applies to both Azure and Azure Government environments), google
SCAN_INTERVAL: Time in seconds between the end of one scan to the start of the next. Learn more about scan intervals.
BASELINE_ID: Scan ID of the baseline if baseline is enabled.
LAST_SCAN_AT: When the current or most recently completed scan for the environment started, Unix time.
NEXT_SCAN_AT: When the next scan will start, Unix time.
SCAN_STATUS: Status of the current or most recently completed scan for the environment. Values - CREATED, QUEUED, IN_PROGRESS, ERROR, SUCCESS, CANCELED
COMPLIANCE_FAMILIES: List of compliance families validated against the environment.
DRIFT: Indicates whether drift detection is enabled for the environment.
REMEDIATION: Indicates whether baseline enforcement is enabled for the environment.
ROLE: AWS IAM Role ARN that will be assumed to scan and enforce infrastructure. AWS and AWS GovCloud only
REGION: Deprecated. The AWS or AWS GovCloud region to scan and enforce infrastructure in. AWS and AWS GovCloud only
REGIONS: The AWS or AWS GovCloud region(s) to scan and enforce infrastructure in. Values - see Service Coverage. "*" denotes all regions. AWS and AWS GovCloud only
SUBSCRIPTION_ID: The subscription ID of the Azure subscription to be used. Azure & Azure Government only
APPLICATION_ID: The application ID/client ID of the service principal to be used. Azure & Azure Government only
PROJECT_ID: The project ID of the Google project to be used. Google Only
SERVICE_ACCOUNT_EMAIL: Fugue securely scans your resources by impersonating a properly permissioned service account and generating short-lived credentials. Refer to Google Service accounts for more information. Google Only

Update rule output¶

The fugue update rule output includes the following attributes:

NAME: ID of the custom rule.
DESCRIPTION: Description of the custom rule.
PROVIDER: Provider of the custom rule. Values - AWS, AWS_GOVCLOUD, AZURE (applies to both Azure and Azure Government environments)
RESOURCE_TYPE: Resource type to which the custom rule applies.
SEVERITY: Rule severity. Values - Informational, Low, Medium, High, Critical
STATUS: The current status of the rule. Values - ENABLED, DISABLED, INVALID

Update rule waiver output¶

The fugue update rule-waiver output includes the following attributes:

RULE_WAIVER_ID: ID of the rule waiver.
NAME: Name of the rule waiver.
COMMENT: Comment on why the rule waiver was created.
ENVIRONMENT_ID: ID of the environment in which the rule waiver was created.
ENVIRONMENT_NAME: Name of the environment in which the rule waiver was created.
RULE_ID: ID of the rule to which the rule waiver applies.
RESOURCE_ID: ID of the resource to which the rule waiver applies.
RESOURCE_TYPE: Type of the resource to which the rule waiver applies.
RESOURCE_PROVIDER: Provider of the resource to which the rule waiver applies.
CREATED_AT: Create date and time of the rule waiver.
CREATED_BY: ID of the API client or user that created the rule waiver.
CREATED_BY_DISPLAY_NAME: Name of the user that created the rule waiver. Blank for API clients.
UPDATED_AT: Last update date and time of the rule waiver.
UPDATED_BY: ID of the API client or user that last updated the rule waiver.
UPDATED_BY_DISPLAY_NAME: Name of the user that last updated the rule waiver. Blank for API clients.

Examples¶

Updating an environment¶

To update an environment, use the fugue update environment command. The [environment_id] argument is required. You can specify one or more flags.

Note

Azure and Azure Government resource groups cannot be updated through the CLI. Instead, use the API to change which resource groups are scanned.

The following example changes the name to “Updated CLI Example” and the scan interval to 1 hour for AWS GovCloud environment a3130ff0-5c32-43e2-1111-112233445566:

fugue update environment a3130ff0-5c32-43e2-1111-112233445566 --name "Updated CLI Example" --scan-interval 3600

You’ll see output like this:

==========================================================
ATTRIBUTE           | VALUE
==========================================================
ENVIRONMENT_ID      | a3130ff0-5c32-43e2-1111-112233445566
NAME                | Updated CLI Example
PROVIDER            | aws_govcloud
SCAN_INTERVAL       | 3600
BASELINE_ID         | -
LAST_SCAN_AT        | 2019-09-11T11:29:22-04:00
NEXT_SCAN_AT        | 2019-09-14T12:34:25-04:00
SCAN_STATUS         | SUCCESS
COMPLIANCE_FAMILIES | SOC2
DRIFT               | true
REMEDIATION         | false
ROLE                | arn:aws-us-gov:iam::123456789012:role/FugueRole1568823736
REGION              | us-gov-west-1

For more information about updating scan intervals, see the API User Guide.

See Output Attributes for details.

Updating the regions for an AWS environment¶

Only environments with certain conditions support region updates. See our note here.

To update the regions for an environment, use the --regions flag, which allows you to select one or more regions.

If us-east-1 is currently scanned but you also want to scan us-east-2, you’ll need to specify both:

fugue update environment 19d77f18-cf71-47b5-8003-112233445566 --regions "us-east-1","us-east-2"

You can specify all regions by using "*":

fugue update environment 19d77f18-cf71-47b5-8003-112233445566 --regions "*"

For a list of supported regions, see Service Coverage.

Updating the baseline ID for an environment¶

To update the baseline ID for an environment, you’ll first need to find the scan ID to use as a baseline. Then, specify it with the --baseline-id flag:

fugue update environment a3130ff0-5c32-43e2-1111-112233445566 --baseline-id "8627293b-af89-47c8-b7d0-9cf6c7559b7f"

You can disable the baseline (and therefore drift detection) by passing an empty string:

fugue update environment a3130ff0-5c32-43e2-1111-112233445566 --baseline-id ""

For more information about baselines, see the API User Guide.

Updating resource types or compliance standards¶

To update the list of scanned/enforced resource types or compliance standards, you’ll need to list all desired items. For example, if AWS.EC2.Vpc is currently scanned but you also want to scan AWS.EC2.SecurityGroup, you’ll need to specify both:

fugue update environment a3130ff0-5c32-43e2-1111-112233445566 --survey-resource-types "AWS.EC2.Vpc","AWS.EC2.SecurityGroup"

Similarly, if you want to change your compliance standards from CIS and GDPR to just CIS, specify only the standard you want:

fugue update environment a3130ff0-5c32-43e2-1111-112233445566 --compliance-families "CIS"

Note

The --survey-resource-types and --remediate-resource-types flags are only for AWS and AWS GovCloud environments. To update an Azure or Azure Government environment’s scanned or enforced resource groups, use the UI or API.

Updating a custom rule¶

To update a custom rule for an organization, use the fugue update rule command. The [rule_id] argument and --text flag are required. You can specify one or more other flags.

The following example changes rule ee9c69ba-d484-40cf-9c92-123456789012 to have the name “Updated - Require RDS instance multi-AZ” and the rule text (code) "allow { input.multi_az == true }":

fugue update rule ee9c69ba-d484-40cf-9c92-123456789012 --name "Updated - Require RDS instance multi-AZ" --text "allow { input.multi_az == true }"

You’ll see output like this:

===============================================================================================================================
ATTRIBUTE     | VALUE
===============================================================================================================================
NAME          | Updated - Require RDS instance multi-AZ
DESCRIPTION   | RDS instance multi-AZ should be required. An RDS instance in a multi-AZ deployment promotes durability of data.
PROVIDER      | AWS_GOVCLOUD
RESOURCE_TYPE | AWS.RDS.Instance
SEVERITY      | High
STATUS        | ENABLED

See Output Attributes for details.

Updating a rule waiver¶

To update a rule waiver for an organization, use the fugue update rule-waiver command. The [rule_waiver_id] argument is required. You can use either the --name flag or the --comment flag, or both, to change the name or the comment of the rule waiver.

The following example updates rule waiver 36283aca-b747-43cf-8af2-ee20b7b51b9c to have the name “Waive CMK for frontend-security-function” and the comment “KMS CMK is not required in test environments.”

fugue update rule-waiver 36283aca-b747-43cf-8af2-ee20b7b51b9c --name "Waive CMK for frontend-security-function" --comment "KMS CMK is not required in test environments."

You’ll see output like this:

================================================================================================
ATTRIBUTE               | VALUE
================================================================================================
RULE_WAIVER_ID          | 36283aca-b747-43cf-8af2-ee20b7b51b9c
NAME                    | Waive CMK for frontend-security-function
COMMENT                 | KMS CMK is not required in test environments.
ENVIRONMENT_ID          | 95705e29-3605-4b5f-b8cb-35a7af93ba06
ENVIRONMENT_NAME        | Demo 3
RULE_ID                 | FG_R00068
RULE_DESCRIPTION        | CloudWatch log groups should be encrypted with KMS CMKs. CloudWatch
                          log groups are encrypted by default. However, utilizing KMS CMKs gives
                          you more control over key rotation and provides auditing visibility
                          into key usage.
RULE_COMPLIANCE_MAPPING |
RESOURCE_ID             | /aws/lambda/us-east-1.frontend-security-function
RESOURCE_TYPE           | AWS.CloudWatchLogs.LogGroup
RESOURCE_PROVIDER       | aws.us-west-2
CREATED_AT              | 2021-02-19T00:51:43-05:00
CREATED_BY              | api_client:343b807b-019a-484b-9bce-c774270efb5e
CREATED_BY_DISPLAY_NAME |
UPDATED_AT              | 2021-02-25T19:24:25-05:00
UPDATED_BY              | api_client:343b807b-019a-484b-9bce-c774270efb5e
UPDATED_BY_DISPLAY_NAME |

See Output Attributes for details.

Updating users’ groups¶

To update a user’s group, use the fugue update users-groups command. The --user-ids argument and --group-ids flag are required.

fugue update users-groups "521a57db-5148-4226-958c-8a8a220dd598" --group-ids "d201d380-1c3f-427c-bd3c-80d49650bd5d" --user-ids

You’ll see output like this:

Successfully updated user(s) group assignments