Skip to content
AWS for Query.Farm

aws.iot.describe_audit_mitigation_actions_task

Example SQL Queries

SELECT * FROM
aws.iot.describe_audit_mitigation_actions_task
WHERE
"task_id" = 'VALUE';

Description

Gets information about an audit mitigation task that is used to apply mitigation actions to a set of audit findings. Properties include the actions being applied, the audit checks to which they're being applied, the task status, and aggregated task statistics.

Table Definition

Column NameColumn Data Type
task_id Required Input Column

The unique identifier for the audit mitigation task.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
actions_definition

Specifies the mitigation actions and their parameters that are applied as part of this task.

STRUCT(
    "name" VARCHAR,
    "id" VARCHAR,
    "role_arn" VARCHAR,
    "action_params" STRUCT(
        "update_device_certificate_params" STRUCT(
            "action" VARCHAR
        ),
        "update_ca_certificate_params" STRUCT(
            "action" VARCHAR
        ),
        "add_things_to_thing_group_params" STRUCT(
            "thing_group_names" VARCHAR[],
            "override_dynamic_groups" BOOLEAN
        ),
        "replace_default_policy_version_params" STRUCT(
            "template_name" VARCHAR
        ),
        "enable_io_t_logging_params" STRUCT(
            "role_arn_for_logging" VARCHAR,
            "log_level" VARCHAR
        ),
        "publish_finding_to_sns_params" STRUCT(
            "topic_arn" VARCHAR
        )
    )
)[]
Show child fields
actions_definition[]
Show child fields
actions_definition[].action_params

The set of parameters for this mitigation action. The parameters vary, depending on the kind of action you apply.

Show child fields
actions_definition[].action_params.add_things_to_thing_group_params

Parameters to define a mitigation action that moves devices associated with a certificate to one or more specified thing groups, typically for quarantine.

Show child fields
actions_definition[].action_params.add_things_to_thing_group_params.override_dynamic_groups

Specifies if this mitigation action can move the things that triggered the mitigation action even if they are part of one or more dynamic thing groups.

actions_definition[].action_params.add_things_to_thing_group_params.thing_group_names[]
actions_definition[].action_params.enable_io_t_logging_params

Parameters to define a mitigation action that enables Amazon Web Services IoT Core logging at a specified level of detail.

Show child fields
actions_definition[].action_params.enable_io_t_logging_params.log_level

Specifies the type of information to be logged.

actions_definition[].action_params.enable_io_t_logging_params.role_arn_for_logging

The Amazon Resource Name (ARN) of the IAM role used for logging.

actions_definition[].action_params.publish_finding_to_sns_params

Parameters to define a mitigation action that publishes findings to Amazon Simple Notification Service (Amazon SNS. You can implement your own custom actions in response to the Amazon SNS messages.

Show child fields
actions_definition[].action_params.publish_finding_to_sns_params.topic_arn

The ARN of the topic to which you want to publish the findings.

actions_definition[].action_params.replace_default_policy_version_params

Parameters to define a mitigation action that adds a blank policy to restrict permissions.

Show child fields
actions_definition[].action_params.replace_default_policy_version_params.template_name

The name of the template to be applied. The only supported value is BLANK_POLICY.

actions_definition[].action_params.update_ca_certificate_params

Parameters to define a mitigation action that changes the state of the CA certificate to inactive.

Show child fields
actions_definition[].action_params.update_ca_certificate_params.action

The action that you want to apply to the CA certificate. The only supported value is DEACTIVATE.

actions_definition[].action_params.update_device_certificate_params

Parameters to define a mitigation action that changes the state of the device certificate to inactive.

Show child fields
actions_definition[].action_params.update_device_certificate_params.action

The action that you want to apply to the device certificate. The only supported value is DEACTIVATE.

actions_definition[].id

A unique identifier for the mitigation action.

actions_definition[].name

A user-friendly name for the mitigation action.

actions_definition[].role_arn

The IAM role ARN used to apply this mitigation action.

audit_check_to_actions_mapping

Specifies the mitigation actions that should be applied to specific audit checks.

MAP(VARCHAR, VARCHAR[])
end_time

The date and time when the task was completed or canceled.

TIMESTAMP_S
start_time

The date and time when the task was started.

TIMESTAMP_S
target

Identifies the findings to which the mitigation actions are applied. This can be by audit checks, by audit task, or a set of findings.

STRUCT(
    "audit_task_id" VARCHAR,
    "finding_ids" VARCHAR[],
    "audit_check_to_reason_code_filter" MAP(VARCHAR, VARCHAR[])
)
Show child fields
target.audit_check_to_reason_code_filter

Specifies a filter in the form of an audit check and set of reason codes that identify the findings from the audit to which the audit mitigation actions task apply.

target.audit_task_id

If the task will apply a mitigation action to findings from a specific audit, this value uniquely identifies the audit.

target.finding_ids[]
task_statistics

Aggregate counts of the results when the mitigation tasks were applied to the findings for this audit mitigation actions task.

MAP(VARCHAR, STRUCT(
        "total_findings_count" BIGINT,
        "failed_findings_count" BIGINT,
        "succeeded_findings_count" BIGINT,
        "skipped_findings_count" BIGINT,
        "canceled_findings_count" BIGINT
    ))
task_status

The current status of the task.

VARCHAR