Skip to content
AWS for Query.Farm

aws.config.get_resource_config_history

Example SQL Queries

SELECT * FROM
aws.config.get_resource_config_history
WHERE
"resource_type" = 'VALUE'
AND "resource_id" = 'VALUE';

Description

For accurate reporting on the compliance status, you must record the AWS::Config::ResourceCompliance resource type. For more information, see Selecting Which Resources Config Records.

Returns a list of ConfigurationItems for the specified resource. The list contains details about each state of the resource during the specified time interval. If you specified a retention period to retain your ConfigurationItems between a minimum of 30 days and a maximum of 7 years (2557 days), Config returns the ConfigurationItems for the specified retention period.

The response is paginated. By default, Config returns a limit of 10 configuration items per page. You can customize this number with the limit parameter. The response includes a nextToken string. To get the next page of results, run the request again and specify the string for the nextToken parameter.

Each call to the API is limited to span a duration of seven days. It is likely that the number of records returned is smaller than the specified limit. In such cases, you can make another call, using the nextToken.

Table Definition

Column NameColumn Data Type
resource_id Required Input Column

The ID of the resource (for example, sg-xxxxxx).

VARCHAR
resource_type Required Input Column

The type of Amazon Web Services resource.

VARCHAR
chronological_order Input Column

The chronological order for configuration items listed. By default, the results are listed in reverse chronological order.

VARCHAR
earlier_time Input Column

The chronologically earliest time in the time range for which the history requested. If not specified, the action returns paginated results that contain configuration items that start when the first configuration item was recorded.

TIMESTAMP_S
later_time Input Column

The chronologically latest time in the time range for which the history requested. If not specified, current time is taken.

TIMESTAMP_S
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
account_id

The 12-digit Amazon Web Services account ID associated with the resource.

VARCHAR
arn

Amazon Resource Name (ARN) associated with the resource.

VARCHAR
availability_zone

The Availability Zone associated with the resource.

VARCHAR
aws_region

The region where the resource resides.

VARCHAR
configuration

The description of the resource configuration.

VARCHAR
configuration_item_capture_time

The time when the recording of configuration changes was initiated for the resource.

TIMESTAMP_S
configuration_item_delivery_time

The time when configuration changes for the resource were delivered.

This field is optional and is not guaranteed to be present in a configuration item (CI). If you are using daily recording, this field will be populated. However, if you are using continuous recording, this field will be omitted since the delivery time is instantaneous as the CI is available right away. For more information on daily recording and continuous recording, see Recording Frequency in the Config Developer Guide.

TIMESTAMP_S
configuration_item_md5_hash

Unique MD5 hash that represents the configuration item's state.

You can use MD5 hash to compare the states of two or more configuration items that are associated with the same resource.

VARCHAR
configuration_item_status

The configuration item status. Valid values include:

  • OK – The resource configuration has been updated

  • ResourceDiscovered – The resource was newly discovered

  • ResourceNotRecorded – The resource was discovered but its configuration was not recorded since the recorder doesn't record resources of this type

  • ResourceDeleted – The resource was deleted

  • ResourceDeletedNotRecorded – The resource was deleted but its configuration was not recorded since the recorder doesn't record resources of this type

VARCHAR
configuration_state_id

An identifier that indicates the ordering of the configuration items of a resource.

VARCHAR
recording_frequency

The recording frequency that Config uses to record configuration changes for the resource.

VARCHAR
related_events

A list of CloudTrail event IDs.

A populated field indicates that the current configuration was initiated by the events recorded in the CloudTrail log. For more information about CloudTrail, see What Is CloudTrail.

An empty field indicates that the current configuration was not initiated by any event. As of Version 1.3, the relatedEvents field is empty. You can access the LookupEvents API in the CloudTrail API Reference to retrieve the events for the resource.

VARCHAR[]
Show child fields
related_events[]
relationships

A list of related Amazon Web Services resources.

STRUCT(
    "resource_type" VARCHAR,
    "resource_id" VARCHAR,
    "resource_name" VARCHAR,
    "relationship_name" VARCHAR
)[]
Show child fields
relationships[]
Show child fields
relationships[].relationship_name

The type of relationship with the related resource.

relationships[].resource_id

The ID of the related resource (for example, sg-xxxxxx).

relationships[].resource_name

The custom name of the related resource, if available.

relationships[].resource_type

The resource type of the related resource.

resource_creation_time

The time stamp when the resource was created.

TIMESTAMP_S
resource_name

The custom name of the resource, if available.

VARCHAR
supplementary_configuration

Configuration attributes that Config returns for certain resource types to supplement the information returned for the configuration parameter.

MAP(VARCHAR, VARCHAR)
tags

A mapping of key value tags associated with the resource.

MAP(VARCHAR, VARCHAR)
version

The version number of the resource configuration.

VARCHAR