Skip to content
AWS for Query.Farm

aws.auditmanager.get_evidence_folder

Example SQL Queries

SELECT * FROM
aws.auditmanager.get_evidence_folder
WHERE
"assessment_id" = 'VALUE'
AND "control_set_id" = 'VALUE'
AND "evidence_folder_id" = 'VALUE';

Description

Gets an evidence folder from a specified assessment in Audit Manager.

Table Definition

Column NameColumn Data Type
assessment_id Required Input Column

The unique identifier for the assessment. 

VARCHAR
control_set_id Required Input Column

The unique identifier for the control set. 

VARCHAR
evidence_folder_id Required Input Column

The unique identifier for the folder that the evidence is stored in. 

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
evidence_folder

The folder that the evidence is stored in. 

STRUCT(
    "name" VARCHAR,
    "date" TIMESTAMP_S,
    "assessment_id" VARCHAR,
    "control_set_id" VARCHAR,
    "control_id" VARCHAR,
    "id" VARCHAR,
    "data_source" VARCHAR,
    "author" VARCHAR,
    "total_evidence" BIGINT,
    "assessment_report_selection_count" BIGINT,
    "control_name" VARCHAR,
    "evidence_resources_included_count" BIGINT,
    "evidence_by_type_configuration_data_count" BIGINT,
    "evidence_by_type_manual_count" BIGINT,
    "evidence_by_type_compliance_check_count" BIGINT,
    "evidence_by_type_compliance_check_issues_count" BIGINT,
    "evidence_by_type_user_activity_count" BIGINT,
    "evidence_aws_service_source_count" BIGINT
)
Show child fields
evidence_folder.assessment_id

The identifier for the assessment.

evidence_folder.assessment_report_selection_count

The total count of evidence that's included in the assessment report.

evidence_folder.author

The name of the user who created the evidence folder.

evidence_folder.control_id

The unique identifier for the control.

evidence_folder.control_name

The name of the control.

evidence_folder.control_set_id

The identifier for the control set.

evidence_folder.data_source

The Amazon Web Service that the evidence was collected from.

evidence_folder.date

The date when the first evidence was added to the evidence folder.

evidence_folder.evidence_aws_service_source_count

The total number of Amazon Web Services resources that were assessed to generate the evidence.

evidence_folder.evidence_by_type_compliance_check_count

The number of evidence that falls under the compliance check category. This evidence is collected from Config or Security Hub.

evidence_folder.evidence_by_type_compliance_check_issues_count

The total number of issues that were reported directly from Security Hub, Config, or both.

evidence_folder.evidence_by_type_configuration_data_count

The number of evidence that falls under the configuration data category. This evidence is collected from configuration snapshots of other Amazon Web Services such as Amazon EC2, Amazon S3, or IAM.

evidence_folder.evidence_by_type_manual_count

The number of evidence that falls under the manual category. This evidence is imported manually.

evidence_folder.evidence_by_type_user_activity_count

The number of evidence that falls under the user activity category. This evidence is collected from CloudTrail logs.

evidence_folder.evidence_resources_included_count

The amount of evidence that's included in the evidence folder.

evidence_folder.id

The identifier for the folder that the evidence is stored in.

evidence_folder.name

The name of the evidence folder.

evidence_folder.total_evidence

The total amount of evidence in the evidence folder.