Skip to content
AWS for Query.Farm

aws.iot.list_related_resources_for_audit_finding

Example SQL Queries

SELECT * FROM
aws.iot.list_related_resources_for_audit_finding
WHERE
"finding_id" = 'VALUE';

Description

The related resources of an Audit finding. The following resources can be returned from calling this API:

  • DEVICE_CERTIFICATE

  • CA_CERTIFICATE

  • IOT_POLICY

  • COGNITO_IDENTITY_POOL

  • CLIENT_ID

  • ACCOUNT_SETTINGS

  • ROLE_ALIAS

  • IAM_ROLE

  • ISSUER_CERTIFICATE

This API is similar to DescribeAuditFinding's RelatedResources but provides pagination and is not limited to 10 resources. When calling DescribeAuditFinding for the intermediate CA revoked for active device certificates check, RelatedResources will not be populated. You must use this API, ListRelatedResourcesForAuditFinding, to list the certificates.

Table Definition

Column NameColumn Data Type
finding_id Required Input Column

The finding Id.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
additional_info

Other information about the resource.

MAP(VARCHAR, VARCHAR)
resource_identifier

Information that identifies the resource.

STRUCT(
    "device_certificate_id" VARCHAR,
    "ca_certificate_id" VARCHAR,
    "cognito_identity_pool_id" VARCHAR,
    "client_id" VARCHAR,
    "policy_version_identifier" STRUCT(
        "policy_name" VARCHAR,
        "policy_version_id" VARCHAR
    ),
    "account" VARCHAR,
    "iam_role_arn" VARCHAR,
    "role_alias_arn" VARCHAR,
    "issuer_certificate_identifier" STRUCT(
        "issuer_certificate_subject" VARCHAR,
        "issuer_id" VARCHAR,
        "issuer_certificate_serial_number" VARCHAR
    ),
    "device_certificate_arn" VARCHAR
)
Show child fields
resource_identifier.account

The account with which the resource is associated.

resource_identifier.ca_certificate_id

The ID of the CA certificate used to authorize the certificate.

resource_identifier.client_id

The client ID.

resource_identifier.cognito_identity_pool_id

The ID of the Amazon Cognito identity pool.

resource_identifier.device_certificate_arn

The ARN of the identified device certificate.

resource_identifier.device_certificate_id

The ID of the certificate attached to the resource.

resource_identifier.iam_role_arn

The ARN of the IAM role that has overly permissive actions.

resource_identifier.issuer_certificate_identifier

The issuer certificate identifier.

Show child fields
resource_identifier.issuer_certificate_identifier.issuer_certificate_serial_number

The issuer certificate serial number.

resource_identifier.issuer_certificate_identifier.issuer_certificate_subject

The subject of the issuer certificate.

resource_identifier.issuer_certificate_identifier.issuer_id

The issuer ID.

resource_identifier.policy_version_identifier

The version of the policy associated with the resource.

Show child fields
resource_identifier.policy_version_identifier.policy_name

The name of the policy.

resource_identifier.policy_version_identifier.policy_version_id

The ID of the version of the policy associated with the resource.

resource_identifier.role_alias_arn

The ARN of the role alias that has overly permissive actions.

resource_type

The type of resource.

VARCHAR