Parity grade: A · SDK aws-sdk-go-v2/service/securityhub@v1.75.4 · last audited 2026-10-07 (b7c35baea)
| Metric | Value |
|---|---|
| PARITY entries audited | 116 (115 ok, 1 partial) |
| Feature families | 2 (2 ok) |
| Known gaps | 2 |
| Structural gaps (can't be emulated) | 4 |
| Deferred items | 0 |
| Resource leaks | clean |
- GetFindingStatisticsV2/GetResourcesStatisticsV2.MaxStatisticResults is range-checked (1-400) but not applied as a cap: API_GetFindingStatisticsV2.html says only "the maximum number of results to be returned", not whether it limits groups or values per group.
- vulnerabilities.is_fix_available matches YES/NO only: neither the SDK nor API_OcsfBooleanFilter/API_CompositeFilter define how the ASFF FixAvailable value PARTIAL maps to an OCSF boolean.
These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.
- UpdateConfigurationPolicy.UpdatedReason has no read member in the SDK, so it cannot be surfaced.
- ListSecurityControlDefinitions.StandardsArn is unapplied: the 3-control catalog carries no per-standard control mapping (AWS-owned catalog data).
- OCSF-only filter fields with no ASFF source (evidences.api/dst/src non-IP, vendor_attributes., resources.image., databucket.tags, compliance.assessments.*, activity_name) resolve to no value: ingestion is ASFF-only.
- CSPM Connector status stays PENDING/UNKNOWN (no out-of-band Azure signal); Scopes.AwsOrganizations is accepted but not applied (no OU tree without the Organizations service).