Skip to content
AWS for Query.Farm

aws.fms.get_admin_scope

Example SQL Queries

SELECT * FROM
aws.fms.get_admin_scope
WHERE
"admin_account" = 'VALUE';

Description

Returns information about the specified account's administrative scope. The administrative scope defines the resources that an Firewall Manager administrator can manage.

Table Definition

Column NameColumn Data Type
admin_account Required Input Column

The administrator account that you want to get the details for.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
admin_scope

Contains details about the administrative scope of the requested account.

STRUCT(
    "account_scope" STRUCT(
        "accounts" VARCHAR[],
        "all_accounts_enabled" BOOLEAN,
        "exclude_specified_accounts" BOOLEAN
    ),
    "organizational_unit_scope" STRUCT(
        "organizational_units" VARCHAR[],
        "all_organizational_units_enabled" BOOLEAN,
        "exclude_specified_organizational_units" BOOLEAN
    ),
    "region_scope" STRUCT(
        "regions" VARCHAR[],
        "all_regions_enabled" BOOLEAN
    ),
    "policy_type_scope" STRUCT(
        "policy_types" VARCHAR[],
        "all_policy_types_enabled" BOOLEAN
    )
)
Show child fields
admin_scope.account_scope

Defines the accounts that the specified Firewall Manager administrator can apply policies to.

Show child fields
admin_scope.account_scope.accounts[]
admin_scope.account_scope.all_accounts_enabled

A boolean value that indicates if the administrator can apply policies to all accounts within an organization. If true, the administrator can apply policies to all accounts within the organization. You can either enable management of all accounts through this operation, or you can specify a list of accounts to manage in AccountScope$Accounts. You cannot specify both.

admin_scope.account_scope.exclude_specified_accounts

A boolean value that excludes the accounts in AccountScope$Accounts from the administrator's scope. If true, the Firewall Manager administrator can apply policies to all members of the organization except for the accounts listed in AccountScope$Accounts. You can either specify a list of accounts to exclude by AccountScope$Accounts, or you can enable management of all accounts by AccountScope$AllAccountsEnabled. You cannot specify both.

admin_scope.organizational_unit_scope

Defines the Organizations organizational units that the specified Firewall Manager administrator can apply policies to. For more information about OUs in Organizations, see Managing organizational units (OUs) in the Organizations User Guide.

Show child fields
admin_scope.organizational_unit_scope.all_organizational_units_enabled

A boolean value that indicates if the administrator can apply policies to all OUs within an organization. If true, the administrator can manage all OUs within the organization. You can either enable management of all OUs through this operation, or you can specify OUs to manage in OrganizationalUnitScope$OrganizationalUnits. You cannot specify both.

admin_scope.organizational_unit_scope.exclude_specified_organizational_units

A boolean value that excludes the OUs in OrganizationalUnitScope$OrganizationalUnits from the administrator's scope. If true, the Firewall Manager administrator can apply policies to all OUs in the organization except for the OUs listed in OrganizationalUnitScope$OrganizationalUnits. You can either specify a list of OUs to exclude by OrganizationalUnitScope$OrganizationalUnits, or you can enable management of all OUs by OrganizationalUnitScope$AllOrganizationalUnitsEnabled. You cannot specify both.

admin_scope.organizational_unit_scope.organizational_units[]
admin_scope.policy_type_scope

Defines the Firewall Manager policy types that the specified Firewall Manager administrator can create and manage.

Show child fields
admin_scope.policy_type_scope.all_policy_types_enabled

Allows the specified Firewall Manager administrator to manage all Firewall Manager policy types, except for third-party policy types. Third-party policy types can only be managed by the Firewall Manager default administrator.

admin_scope.policy_type_scope.policy_types[]
admin_scope.region_scope

Defines the Amazon Web Services Regions that the specified Firewall Manager administrator can perform actions in.

Show child fields
admin_scope.region_scope.all_regions_enabled

Allows the specified Firewall Manager administrator to manage all Amazon Web Services Regions.

admin_scope.region_scope.regions[]
status

The current status of the request to onboard a member account as an Firewall Manager administrator.

  • ONBOARDING - The account is onboarding to Firewall Manager as an administrator.

  • ONBOARDING_COMPLETE - Firewall Manager The account is onboarded to Firewall Manager as an administrator, and can perform actions on the resources defined in their AdminScope.

  • OFFBOARDING - The account is being removed as an Firewall Manager administrator.

  • OFFBOARDING_COMPLETE - The account has been removed as an Firewall Manager administrator.

VARCHAR