| Column Name | Column Data Type |
|---|
detector_id Required Input Column
The ID of the detector to retrieve information about the delegated administrator from. | VARCHAR |
max_results Input Column
You can use this parameter to indicate the maximum number of items that you want in the response. | BIGINT |
next_token Input Column
The pagination parameter to be used on the next list operation to retrieve more items. | VARCHAR |
_aws_profile Input Column
The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role. | STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
) |
Show child fields- _aws_profile.account_id
The AWS account id - _aws_profile.assumed_role_arn
The ARN of the assumed role - _aws_profile.name
The unique name of the profile. - _aws_profile.organization
Information about this profile's membership in the AWS organization. Show child fields- _aws_profile.organization.account_name
The name of account speciifed by the organization - _aws_profile.organization.id
The organization id - _aws_profile.organization.master_account
Show child fields- _aws_profile.organization.master_account.email
The organization master account email address - _aws_profile.organization.master_account.id
The organization master account id
- _aws_profile.organization.parents[]
Show child fields- _aws_profile.organization.parents[].id
The id of the parent - _aws_profile.organization.parents[].name
The name of the parent - _aws_profile.organization.parents[].tags[]
Show child fields- _aws_profile.organization.parents[].tags[].key
- _aws_profile.organization.parents[].tags[].value
- _aws_profile.organization.parents[].type
The type of parent can be an organization unit or a root
- _aws_profile.organization.tags[]
Show child fields- _aws_profile.organization.tags[].key
- _aws_profile.organization.tags[].value
- _aws_profile.type
The type of profile, either 'credentials' or 'assumed_role' - _aws_profile.via_profile_name
This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.
|
_aws_region Input Column
The AWS region to use. | VARCHAR |
auto_enable
Indicates whether GuardDuty is automatically enabled for accounts added to the organization. Even though this is still supported, we recommend using AutoEnableOrganizationMembers to achieve the similar results. | BOOLEAN |
auto_enable_organization_members
Indicates the auto-enablement configuration of GuardDuty or any of the corresponding protection plans for the member accounts in the organization. -
NEW: Indicates that when a new account joins the organization, they will have GuardDuty or any of the corresponding protection plans enabled automatically. -
ALL: Indicates that all accounts in the organization have GuardDuty and any of the corresponding protection plans enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty. -
NONE: Indicates that GuardDuty or any of the corresponding protection plans will not be automatically enabled for any account in the organization. The administrator must manage GuardDuty for each account in the organization individually. When you update the auto-enable setting from ALL or NEW to NONE, this action doesn't disable the corresponding option for your existing accounts. This configuration will apply to the new accounts that join the organization. After you update the auto-enable settings, no new account will have the corresponding option as enabled. | VARCHAR |
data_sources
Describes which data sources are enabled automatically for member accounts. | STRUCT(
"s3_logs" STRUCT(
"auto_enable" BOOLEAN
),
"kubernetes" STRUCT(
"audit_logs" STRUCT(
"auto_enable" BOOLEAN
)
),
"malware_protection" STRUCT(
"scan_ec2_instance_with_findings" STRUCT(
"ebs_volumes" STRUCT(
"auto_enable" BOOLEAN
)
)
)
) |
Show child fields- data_sources.kubernetes
Describes the configuration of Kubernetes data sources. Show child fields- data_sources.kubernetes.audit_logs
The current configuration of Kubernetes audit logs as a data source for the organization. Show child fields- data_sources.kubernetes.audit_logs.auto_enable
Whether Kubernetes audit logs data source should be auto-enabled for new members joining the organization.
- data_sources.malware_protection
Describes the configuration of Malware Protection data source for an organization. Show child fields- data_sources.malware_protection.scan_ec2_instance_with_findings
Describes the configuration for scanning EC2 instances with findings for an organization. Show child fields- data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes
Describes the configuration for scanning EBS volumes for an organization. Show child fields- data_sources.malware_protection.scan_ec2_instance_with_findings.ebs_volumes.auto_enable
An object that contains the status of whether scanning EBS volumes should be auto-enabled for new members joining the organization.
- data_sources.s3_logs
Describes whether S3 data event logs are enabled as a data source. Show child fields- data_sources.s3_logs.auto_enable
A value that describes whether S3 data event logs are automatically enabled for new members of the organization.
|
features
A list of features that are configured for this organization. | STRUCT(
"name" VARCHAR,
"auto_enable" VARCHAR,
"additional_configuration" STRUCT(
"name" VARCHAR,
"auto_enable" VARCHAR
)[]
)[] |
Show child fields- features[]
Show child fields- features[].additional_configuration[]
Show child fields- features[].additional_configuration[].auto_enable
Describes the status of the additional configuration that is configured for the member accounts within the organization. One of the following values is the status for the entire organization: -
NEW: Indicates that when a new account joins the organization, they will have the additional configuration enabled automatically. -
ALL: Indicates that all accounts in the organization have the additional configuration enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty. It may take up to 24 hours to update the configuration for all the member accounts. -
NONE: Indicates that the additional configuration will not be automatically enabled for any account in the organization. The administrator must manage the additional configuration for each account individually. - features[].additional_configuration[].name
The name of the additional configuration that is configured for the member accounts within the organization.
- features[].auto_enable
Describes the status of the feature that is configured for the member accounts within the organization. -
NEW: Indicates that when a new account joins the organization, they will have the feature enabled automatically. -
ALL: Indicates that all accounts in the organization have the feature enabled automatically. This includes NEW accounts that join the organization and accounts that may have been suspended or removed from the organization in GuardDuty. -
NONE: Indicates that the feature will not be automatically enabled for any account in the organization. In this case, each account will be managed individually by the administrator. - features[].name
The name of the feature that is configured for the member accounts within the organization.
|
member_account_limit_reached
Indicates whether the maximum number of allowed member accounts are already associated with the delegated administrator account for your organization. | BOOLEAN |