Issue With SecurityHub.Client.update_organization_configuration Method

[bcamp1138]

Describe the bug

When attempting to enable Security Hub in Central configuration mode, I receive a ParamValidationError saying the OrganizationConfiguration parameter doesn't exist for the SecurityHub.Client.update_organization_configuration() method.

Expected Behavior

Security Hub should be enabled and running in Central Configuration mode.

Current Behavior

[ERROR] ParamValidationError: Parameter validation failed:
Unknown parameter in input: "OrganizationConfiguration", must be one of: AutoEnable, AutoEnableStandards
Traceback (most recent call last):
  File "/var/task/index.py", line 110, in handler
    return fn.handle(event, context)
  File "/var/task/index.py", line 99, in handle
    return self.on_create(event)
  File "/var/task/index.py", line 37, in on_create
    configure_response = self.client.update_organization_configuration(
  File "/var/runtime/botocore/client.py", line 530, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/var/runtime/botocore/client.py", line 919, in _make_api_call
    request_dict = self._convert_to_request_dict(
  File "/var/runtime/botocore/client.py", line 990, in _convert_to_request_dict
    request_dict = self._serializer.serialize_to_request(
  File "/var/runtime/botocore/validate.py", line 381, in serialize_to_request
    raise ParamValidationError(report=report.generate_report())

Reproduction Steps

class enableSecHub():

    def __init__(self):

        self.client = boto3.client('securityhub')
        self.region = os.environ.get('AWS_REGION')

    def on_create(self, event):
        logger.info('Enabling Security Hub')
        logger.debug('Event: %s' % event)
        try:
            enable_response = self.client.enable_security_hub(
                Tags={
                    'Environment':'Dev'
                },
                EnableDefaultStandards=False,
                ControlFindingGenerator='SECURITY_CONTROL'
            )
        except self.client.exceptions.ResourceConflictException:
            logger.info('Security Hub already enabled')
        
        try:
            configure_response = self.client.update_organization_configuration(
                AutoEnable=False,
                AutoEnableStandards='NONE',
                OrganizationConfiguration={
                    'ConfigurationType':'CENTRAL',
                    'Status': 'ENABLED',
                    'StatusMessage': 'Something went very wrong here....'
                }
            )
        except self.client.exceptions.AccessDeniedException:
            logger.info('Access denied to configure Security Hub')

Possible Solution

No response

Additional Information/Context

No response

SDK version used

Version: 1.34.15

Environment details (OS name and version, etc.)

Amazon Linux 2023, CDK version 2.118.0, Python 3.9.16

[RyanFitzSimmonsAK]

Hi @bcamp1138, thanks for reaching out. Could you provide debug logs of this behavior? You can get debug logs by adding boto3.set_stream_logger('') to the top of your script, and redacting any sensitive information. This error typically indicates an outdated version; could you also double check your versions using boto3.__version__ and botocore.__version__? Thanks!

[bcamp1138]

Hi @RyanFitzSimmonsAK, thank you for the response. Boto3 and Botocore versions on my development system -

>>> boto3.__version__
'1.34.16'
>>> botocore.__version__
'1.34.16'

I'm attaching the redacted debug log. I noticed while reviewing these logs that the user agent is reporting a version of boto3 and botocore different from what I have on my dev box.
000000.zip

[bcamp1138]

Hi @RyanFitzSimmonsAK, looks like the older version of the user agent I saw in the debug logs was the issue.

'User-Agent': 'Boto3/1.26.90

After bundling my lambda with a specific version of boto3, the error has gone away. Thank you for helping track that down. I'll close this report.

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.