| Column Name | Column Data Type |
|---|
attribute Required Input Column
The list of setting attribute enum values. | VARCHAR |
_aws_profile Input Column
The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role. | STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
) |
Show child fields- _aws_profile.account_id
The AWS account id - _aws_profile.assumed_role_arn
The ARN of the assumed role - _aws_profile.name
The unique name of the profile. - _aws_profile.organization
Information about this profile's membership in the AWS organization. Show child fields- _aws_profile.organization.account_name
The name of account speciifed by the organization - _aws_profile.organization.id
The organization id - _aws_profile.organization.master_account
Show child fields- _aws_profile.organization.master_account.email
The organization master account email address - _aws_profile.organization.master_account.id
The organization master account id
- _aws_profile.organization.parents[]
Show child fields- _aws_profile.organization.parents[].id
The id of the parent - _aws_profile.organization.parents[].name
The name of the parent - _aws_profile.organization.parents[].tags[]
Show child fields- _aws_profile.organization.parents[].tags[].key
- _aws_profile.organization.parents[].tags[].value
- _aws_profile.organization.parents[].type
The type of parent can be an organization unit or a root
- _aws_profile.organization.tags[]
Show child fields- _aws_profile.organization.tags[].key
- _aws_profile.organization.tags[].value
- _aws_profile.type
The type of profile, either 'credentials' or 'assumed_role' - _aws_profile.via_profile_name
This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.
|
_aws_region Input Column
The AWS region to use. | VARCHAR |
settings
The settings object that holds all supported Audit Manager settings. | STRUCT(
"is_aws_org_enabled" BOOLEAN,
"sns_topic" VARCHAR,
"default_assessment_reports_destination" STRUCT(
"destination_type" VARCHAR,
"destination" VARCHAR
),
"default_process_owners" STRUCT(
"role_type" VARCHAR,
"role_arn" VARCHAR
)[],
"kms_key" VARCHAR,
"evidence_finder_enablement" STRUCT(
"event_data_store_arn" VARCHAR,
"enablement_status" VARCHAR,
"backfill_status" VARCHAR,
"error" VARCHAR
),
"deregistration_policy" STRUCT(
"delete_resources" VARCHAR
),
"default_export_destination" STRUCT(
"destination_type" VARCHAR,
"destination" VARCHAR
)
) |
Show child fields- settings.default_assessment_reports_destination
The default S3 destination bucket for storing assessment reports. Show child fields- settings.default_assessment_reports_destination.destination
The destination bucket where Audit Manager stores assessment reports. - settings.default_assessment_reports_destination.destination_type
The destination type, such as Amazon S3.
- settings.default_export_destination
The default S3 destination bucket for storing evidence finder exports. Show child fields- settings.default_export_destination.destination
The destination bucket where Audit Manager stores exported files. - settings.default_export_destination.destination_type
The destination type, such as Amazon S3.
- settings.default_process_owners[]
Show child fields- settings.default_process_owners[].role_arn
The Amazon Resource Name (ARN) of the IAM role. - settings.default_process_owners[].role_type
The type of customer persona. In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
- settings.deregistration_policy
The deregistration policy for your Audit Manager data. You can use this attribute to determine how your data is handled when you deregister Audit Manager. Show child fields- settings.deregistration_policy.delete_resources
Specifies which Audit Manager data will be deleted when you deregister Audit Manager. -
If you set the value to ALL, all of your data is deleted within seven days of deregistration. -
If you set the value to DEFAULT, none of your data is deleted at the time of deregistration. However, keep in mind that the Audit Manager data retention policy still applies. As a result, any evidence data will be deleted two years after its creation date. Your other Audit Manager resources will continue to exist indefinitely.
- settings.evidence_finder_enablement
The current evidence finder status and event data store details. Show child fields- settings.evidence_finder_enablement.backfill_status
The current status of the evidence data backfill process. The backfill starts after you enable evidence finder. During this task, Audit Manager populates an event data store with your past two years’ worth of evidence data so that your evidence can be queried. -
NOT_STARTED means that the backfill hasn’t started yet. -
IN_PROGRESS means that the backfill is in progress. This can take up to 7 days to complete, depending on the amount of evidence data. -
COMPLETED means that the backfill is complete. All of your past evidence is now queryable. - settings.evidence_finder_enablement.enablement_status
The current status of the evidence finder feature and the related event data store. -
ENABLE_IN_PROGRESS means that you requested to enable evidence finder. An event data store is currently being created to support evidence finder queries. -
ENABLED means that an event data store was successfully created and evidence finder is enabled. We recommend that you wait 7 days until the event data store is backfilled with your past two years’ worth of evidence data. You can use evidence finder in the meantime, but not all data might be available until the backfill is complete. -
DISABLE_IN_PROGRESS means that you requested to disable evidence finder, and your request is pending the deletion of the event data store. -
DISABLED means that you have permanently disabled evidence finder and the event data store has been deleted. You can't re-enable evidence finder after this point. - settings.evidence_finder_enablement.error
Represents any errors that occurred when enabling or disabling evidence finder. - settings.evidence_finder_enablement.event_data_store_arn
The Amazon Resource Name (ARN) of the CloudTrail Lake event data store that’s used by evidence finder. The event data store is the lake of evidence data that evidence finder runs queries against.
- settings.is_aws_org_enabled
Specifies whether Organizations is enabled. - settings.kms_key
The KMS key details. - settings.sns_topic
The designated Amazon Simple Notification Service (Amazon SNS) topic.
|