Skip to content
AWS for Query.Farm

aws.config.get_resource_evaluation_summary

Example SQL Queries

SELECT * FROM
aws.config.get_resource_evaluation_summary
WHERE
"resource_evaluation_id" = 'VALUE';

Description

Returns a summary of resource evaluation for the specified resource evaluation ID from the proactive rules that were run. The results indicate which evaluation context was used to evaluate the rules, which resource details were evaluated, the evaluation mode that was run, and whether the resource details comply with the configuration of the proactive rules.

To see additional information about the evaluation result, such as which rule flagged a resource as NON_COMPLIANT, use the GetComplianceDetailsByResource API. For more information, see the Examples section.

Table Definition

Column NameColumn Data Type
resource_evaluation_id Required Input Column

The unique ResourceEvaluationId of Amazon Web Services resource execution for which you want to retrieve the evaluation summary.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
compliance

The compliance status of the resource evaluation summary.

VARCHAR
evaluation_context

Returns an EvaluationContext object.

STRUCT(
    "evaluation_context_identifier" VARCHAR
)
Show child fields
evaluation_context.evaluation_context_identifier

A unique EvaluationContextIdentifier ID for an EvaluationContext.

evaluation_mode

Lists results of the mode that you requested to retrieve the resource evaluation summary. The valid values are Detective or Proactive.

VARCHAR
evaluation_start_timestamp

The start timestamp when Config rule starts evaluating compliance for the provided resource details.

TIMESTAMP_S
evaluation_status

Returns an EvaluationStatus object.

STRUCT(
    "status" VARCHAR,
    "failure_reason" VARCHAR
)
Show child fields
evaluation_status.failure_reason

An explanation for failed execution status.

evaluation_status.status

The status of an execution. The valid values are In_Progress, Succeeded or Failed.

resource_details

Returns a ResourceDetails object.

STRUCT(
    "resource_id" VARCHAR,
    "resource_type" VARCHAR,
    "resource_configuration" VARCHAR,
    "resource_configuration_schema_type" VARCHAR
)
Show child fields
resource_details.resource_configuration

The resource definition to be evaluated as per the resource configuration schema type.

resource_details.resource_configuration_schema_type

The schema type of the resource configuration.

You can find the Resource type schema, or CFN_RESOURCE_SCHEMA, in "Amazon Web Services public extensions" within the CloudFormation registry or with the following CLI commmand: aws cloudformation describe-type --type-name "AWS::S3::Bucket" --type RESOURCE.

For more information, see Managing extensions through the CloudFormation registry and Amazon Web Services resource and property types reference in the CloudFormation User Guide.

resource_details.resource_id

A unique resource ID for an evaluation.

resource_details.resource_type

The type of resource being evaluated.