Skip to content
AWS for Query.Farm

aws.auditmanager.list_assessment_control_insights_by_control_domain

Example SQL Queries

SELECT * FROM
aws.auditmanager.list_assessment_control_insights_by_control_domain
WHERE
"control_domain_id" = 'VALUE'
AND "assessment_id" = 'VALUE';

Description

Lists the latest analytics data for controls within a specific control domain and a specific active assessment.

Control insights are listed only if the control belongs to the control domain and assessment that was specified. Moreover, the control must have collected evidence on the lastUpdated date of controlInsightsByAssessment. If neither of these conditions are met, no data is listed for that control.

Table Definition

Column NameColumn Data Type
assessment_id Required Input Column

The unique identifier for the active assessment. 

VARCHAR
control_domain_id Required Input Column

The unique identifier for the control domain.

Audit Manager supports the control domains that are provided by Amazon Web Services Control Catalog. For information about how to find a list of available control domains, see ListDomains in the Amazon Web Services Control Catalog API Reference.

VARCHAR
max_results Input Column

Represents the maximum number of results on a page or for an API request call. 

BIGINT
next_token Input Column

The pagination token that's used to fetch the next set of results. 

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
control_insights_by_assessment

The assessment control analytics data that the ListAssessmentControlInsightsByControlDomain API returned. 

STRUCT(
    "name" VARCHAR,
    "id" VARCHAR,
    "evidence_insights" STRUCT(
        "noncompliant_evidence_count" BIGINT,
        "compliant_evidence_count" BIGINT,
        "inconclusive_evidence_count" BIGINT
    ),
    "control_set_name" VARCHAR,
    "last_updated" TIMESTAMP_S
)[]
Show child fields
control_insights_by_assessment[]
Show child fields
control_insights_by_assessment[].control_set_name

The name of the control set that the assessment control belongs to.

control_insights_by_assessment[].evidence_insights

A breakdown of the compliance check status for the evidence that’s associated with the assessment control.

Show child fields
control_insights_by_assessment[].evidence_insights.compliant_evidence_count

The number of compliance check evidence that Audit Manager classified as compliant. This includes evidence that was collected from Security Hub with a Pass ruling, or collected from Config with a Compliant ruling.

control_insights_by_assessment[].evidence_insights.inconclusive_evidence_count

The number of evidence that a compliance check ruling isn't available for. Evidence is inconclusive when the associated control uses Security Hub or Config as a data source but you didn't enable those services. This is also the case when a control uses a data source that doesn’t support compliance checks (for example, manual evidence, API calls, or CloudTrail).

If evidence has a compliance check status of not applicable in the console, it's classified as inconclusive in EvidenceInsights data.

control_insights_by_assessment[].evidence_insights.noncompliant_evidence_count

The number of compliance check evidence that Audit Manager classified as non-compliant. This includes evidence that was collected from Security Hub with a Fail ruling, or collected from Config with a Non-compliant ruling.

control_insights_by_assessment[].id

The unique identifier for the assessment control.

control_insights_by_assessment[].last_updated

The time when the assessment control insights were last updated.

control_insights_by_assessment[].name

The name of the assessment control.