| Column Name | Column Data Type |
|---|
analyzer_arn Required Input Column
The ARN of the analyzer that generated the finding. | VARCHAR |
id Required Input Column
The ID of the finding to retrieve. | VARCHAR |
_aws_profile Input Column
The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role. | STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
) |
Show child fields- _aws_profile.account_id
The AWS account id - _aws_profile.assumed_role_arn
The ARN of the assumed role - _aws_profile.name
The unique name of the profile. - _aws_profile.organization
Information about this profile's membership in the AWS organization. Show child fields- _aws_profile.organization.account_name
The name of account speciifed by the organization - _aws_profile.organization.id
The organization id - _aws_profile.organization.master_account
Show child fields- _aws_profile.organization.master_account.email
The organization master account email address - _aws_profile.organization.master_account.id
The organization master account id
- _aws_profile.organization.parents[]
Show child fields- _aws_profile.organization.parents[].id
The id of the parent - _aws_profile.organization.parents[].name
The name of the parent - _aws_profile.organization.parents[].tags[]
Show child fields- _aws_profile.organization.parents[].tags[].key
- _aws_profile.organization.parents[].tags[].value
- _aws_profile.organization.parents[].type
The type of parent can be an organization unit or a root
- _aws_profile.organization.tags[]
Show child fields- _aws_profile.organization.tags[].key
- _aws_profile.organization.tags[].value
- _aws_profile.type
The type of profile, either 'credentials' or 'assumed_role' - _aws_profile.via_profile_name
This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.
|
analyzed_at
The time at which the resource-based policy or IAM entity that generated the finding was analyzed. | TIMESTAMP_S |
created_at
The time at which the finding was created. | TIMESTAMP_S |
error
An error. | VARCHAR |
finding_details
A localized message that explains the finding and provides guidance on how to address it. | STRUCT(
"external_access_details" STRUCT(
"action" VARCHAR[],
"condition" MAP(VARCHAR, VARCHAR),
"is_public" BOOLEAN,
"principal" MAP(VARCHAR, VARCHAR),
"sources" STRUCT(
"type" VARCHAR,
"detail" STRUCT(
"access_point_arn" VARCHAR,
"access_point_account" VARCHAR
)
)[]
),
"unused_permission_details" STRUCT(
"actions" STRUCT(
"action" VARCHAR,
"last_accessed" TIMESTAMP_S
)[],
"service_namespace" VARCHAR,
"last_accessed" TIMESTAMP_S
),
"unused_iam_user_access_key_details" STRUCT(
"access_key_id" VARCHAR,
"last_accessed" TIMESTAMP_S
),
"unused_iam_role_details" STRUCT(
"last_accessed" TIMESTAMP_S
),
"unused_iam_user_password_details" STRUCT(
"last_accessed" TIMESTAMP_S
)
)[] |
Show child fields- finding_details[]
Show child fields- finding_details[].external_access_details
The details for an external access analyzer finding. Show child fields- finding_details[].external_access_details.action[]
- finding_details[].external_access_details.condition
The condition in the analyzed policy statement that resulted in an external access finding. - finding_details[].external_access_details.is_public
Specifies whether the external access finding is public. - finding_details[].external_access_details.principal
The external principal that has access to a resource within the zone of trust. - finding_details[].external_access_details.sources[]
Show child fields- finding_details[].external_access_details.sources[].detail
Includes details about how the access that generated the finding is granted. This is populated for Amazon S3 bucket findings. Show child fields- finding_details[].external_access_details.sources[].detail.access_point_account
The account of the cross-account access point that generated the finding. - finding_details[].external_access_details.sources[].detail.access_point_arn
The ARN of the access point that generated the finding. The ARN format depends on whether the ARN represents an access point or a multi-region access point.
- finding_details[].external_access_details.sources[].type
Indicates the type of access that generated the finding.
- finding_details[].unused_iam_role_details
The details for an unused access analyzer finding with an unused IAM role finding type. Show child fields- finding_details[].unused_iam_role_details.last_accessed
The time at which the role was last accessed.
- finding_details[].unused_iam_user_access_key_details
The details for an unused access analyzer finding with an unused IAM user access key finding type. Show child fields- finding_details[].unused_iam_user_access_key_details.access_key_id
The ID of the access key for which the unused access finding was generated. - finding_details[].unused_iam_user_access_key_details.last_accessed
The time at which the access key was last accessed.
- finding_details[].unused_iam_user_password_details
The details for an unused access analyzer finding with an unused IAM user password finding type. Show child fields- finding_details[].unused_iam_user_password_details.last_accessed
The time at which the password was last accessed.
- finding_details[].unused_permission_details
The details for an unused access analyzer finding with an unused permission finding type. Show child fields- finding_details[].unused_permission_details.actions[]
Show child fields- finding_details[].unused_permission_details.actions[].action
The action for which the unused access finding was generated. - finding_details[].unused_permission_details.actions[].last_accessed
The time at which the action was last accessed.
- finding_details[].unused_permission_details.last_accessed
The time at which the permission was last accessed. - finding_details[].unused_permission_details.service_namespace
The namespace of the Amazon Web Services service that contains the unused actions.
|
finding_type
The type of the finding. For external access analyzers, the type is ExternalAccess. For unused access analyzers, the type can be UnusedIAMRole, UnusedIAMUserAccessKey, UnusedIAMUserPassword, or UnusedPermission. | VARCHAR |
resource
The resource that generated the finding. | VARCHAR |
resource_owner_account
Tye Amazon Web Services account ID that owns the resource. | VARCHAR |
resource_type
The type of the resource identified in the finding. | VARCHAR |
status
The status of the finding. | VARCHAR |
updated_at
The time at which the finding was updated. | TIMESTAMP_S |