Skip to content

aws.imagebuilder.list_image_scan_finding_aggregations

Example SQL Queries

SELECT * FROM
aws.imagebuilder.list_image_scan_finding_aggregations;

Description

Returns a list of image scan aggregations for your account. You can filter by the type of key that Image Builder uses to group results. For example, if you want to get a list of findings by severity level for one of your pipelines, you might specify your pipeline with the imagePipelineArn filter. If you don't specify a filter, Image Builder returns an aggregation for your account.

To streamline results, you can use the following filters in your request:

  • accountId

  • imageBuildVersionArn

  • imagePipelineArn

  • vulnerabilityId

Table Definition

Column NameColumn Data Type
filter Input Column

A filter name and value pair that is used to return a more specific list of results from a list operation. Filters can be used to match a set of resources by specific criteria, such as tags, attributes, or IDs.

STRUCT(
"name" VARCHAR,
"values" VARCHAR[]
)
Show child fields
filter.name

The name of the filter. Filter names are case-sensitive.

filter.values[]
next_token Input Column

The next token used for paginated responses. When this field isn't empty, there are additional elements that the service hasn't included in this request. Use this token with the next request to retrieve additional objects.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

aggregation_type

The aggregation type specifies what type of key is used to group the image scan findings. Image Builder returns results based on the request filter. If you didn't specify a filter in the request, the type defaults to accountId.

Aggregation types

  • accountId

  • imageBuildVersionArn

  • imagePipelineArn

  • vulnerabilityId

Each aggregation includes counts by severity level for medium severity and higher level findings, plus a total for all of the findings for each key value.

VARCHAR
request_id

The request ID that uniquely identifies this request.

VARCHAR
responses

An array of image scan finding aggregations that match the filter criteria.

STRUCT(
"account_aggregation" STRUCT(
"account_id" VARCHAR,
"severity_counts" STRUCT(
"all" BIGINT,
"critical" BIGINT,
"high" BIGINT,
"medium" BIGINT
)
),
"image_aggregation" STRUCT(
"image_build_version_arn" VARCHAR,
"severity_counts" STRUCT(
"all" BIGINT,
"critical" BIGINT,
"high" BIGINT,
"medium" BIGINT
)
),
"image_pipeline_aggregation" STRUCT(
"image_pipeline_arn" VARCHAR,
"severity_counts" STRUCT(
"all" BIGINT,
"critical" BIGINT,
"high" BIGINT,
"medium" BIGINT
)
),
"vulnerability_id_aggregation" STRUCT(
"vulnerability_id" VARCHAR,
"severity_counts" STRUCT(
"all" BIGINT,
"critical" BIGINT,
"high" BIGINT,
"medium" BIGINT
)
)
)[]
Show child fields
responses[]
Show child fields
responses[].account_aggregation

Returns an object that contains severity counts based on an account ID.

Show child fields
responses[].account_aggregation.account_id

Identifies the account that owns the aggregated resource findings.

responses[].account_aggregation.severity_counts

Counts by severity level for medium severity and higher level findings, plus a total for all of the findings.

Show child fields
responses[].account_aggregation.severity_counts.all

The total number of findings across all severity levels for the specified filter.

responses[].account_aggregation.severity_counts.critical

The number of critical severity findings for the specified filter.

responses[].account_aggregation.severity_counts.high

The number of high severity findings for the specified filter.

responses[].account_aggregation.severity_counts.medium

The number of medium severity findings for the specified filter.

responses[].image_aggregation

Returns an object that contains severity counts based on the Amazon Resource Name (ARN) for a specific image.

Show child fields
responses[].image_aggregation.image_build_version_arn

The Amazon Resource Name (ARN) that identifies the image for this aggregation.

responses[].image_aggregation.severity_counts

Counts by severity level for medium severity and higher level findings, plus a total for all of the findings for the specified image.

Show child fields
responses[].image_aggregation.severity_counts.all

The total number of findings across all severity levels for the specified filter.

responses[].image_aggregation.severity_counts.critical

The number of critical severity findings for the specified filter.

responses[].image_aggregation.severity_counts.high

The number of high severity findings for the specified filter.

responses[].image_aggregation.severity_counts.medium

The number of medium severity findings for the specified filter.

responses[].image_pipeline_aggregation

Returns an object that contains severity counts based on an image pipeline ARN.

Show child fields
responses[].image_pipeline_aggregation.image_pipeline_arn

The Amazon Resource Name (ARN) that identifies the image pipeline for this aggregation.

responses[].image_pipeline_aggregation.severity_counts

Counts by severity level for medium severity and higher level findings, plus a total for all of the findings for the specified image pipeline.

Show child fields
responses[].image_pipeline_aggregation.severity_counts.all

The total number of findings across all severity levels for the specified filter.

responses[].image_pipeline_aggregation.severity_counts.critical

The number of critical severity findings for the specified filter.

responses[].image_pipeline_aggregation.severity_counts.high

The number of high severity findings for the specified filter.

responses[].image_pipeline_aggregation.severity_counts.medium

The number of medium severity findings for the specified filter.

responses[].vulnerability_id_aggregation

Returns an object that contains severity counts based on vulnerability ID.

Show child fields
responses[].vulnerability_id_aggregation.severity_counts

Counts by severity level for medium severity and higher level findings, plus a total for all of the findings for the specified vulnerability.

Show child fields
responses[].vulnerability_id_aggregation.severity_counts.all

The total number of findings across all severity levels for the specified filter.

responses[].vulnerability_id_aggregation.severity_counts.critical

The number of critical severity findings for the specified filter.

responses[].vulnerability_id_aggregation.severity_counts.high

The number of high severity findings for the specified filter.

responses[].vulnerability_id_aggregation.severity_counts.medium

The number of medium severity findings for the specified filter.

responses[].vulnerability_id_aggregation.vulnerability_id

The vulnerability Id for this set of counts.