Skip to content
AWS for Query.Farm

aws.macie2.describe_buckets

Example SQL Queries

SELECT * FROM
aws.macie2.describe_buckets;

Description

Retrieves (queries) statistical data and other information about one or more S3 buckets that Amazon Macie monitors and analyzes for an account.

Table Definition

Column NameColumn Data Type
criteria Input Column

The criteria to use to filter the query results.

MAP(VARCHAR, STRUCT(
        "eq" VARCHAR[],
        "gt" BIGINT,
        "gte" BIGINT,
        "lt" BIGINT,
        "lte" BIGINT,
        "neq" VARCHAR[],
        "prefix" VARCHAR
    ))
sort_criteria Input Column

The criteria to use to sort the query results.

STRUCT(
    "attribute_name" VARCHAR,
    "order_by" VARCHAR
)
Show child fields
sort_criteria.attribute_name

The name of the bucket property to sort the results by. This value can be one of the following properties that Amazon Macie defines as bucket metadata: accountId, bucketName, classifiableObjectCount, classifiableSizeInBytes, objectCount, sensitivityScore, or sizeInBytes.

sort_criteria.order_by

The sort order to apply to the results, based on the value specified by the attributeName property. Valid values are: ASC, sort the results in ascending order; and, DESC, sort the results in descending order.

_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
account_id

The unique identifier for the Amazon Web Services account that owns the bucket.

VARCHAR
allows_unencrypted_object_uploads

Specifies whether the bucket policy for the bucket requires server-side encryption of objects when objects are added to the bucket. Possible values are:

  • FALSE - The bucket policy requires server-side encryption of new objects. PutObject requests must include a valid server-side encryption header.

  • TRUE - The bucket doesn't have a bucket policy or it has a bucket policy that doesn't require server-side encryption of new objects. If a bucket policy exists, it doesn't require PutObject requests to include a valid server-side encryption header.

  • UNKNOWN - Amazon Macie can't determine whether the bucket policy requires server-side encryption of new objects.

Valid server-side encryption headers are: x-amz-server-side-encryption with a value of AES256 or aws:kms, and x-amz-server-side-encryption-customer-algorithm with a value of AES256.

VARCHAR
automated_discovery_monitoring_status

Specifies whether automated sensitive data discovery is currently configured to analyze objects in the bucket. Possible values are: MONITORED, the bucket is included in analyses; and, NOT_MONITORED, the bucket is excluded from analyses. If automated sensitive data discovery is disabled for your account, this value is NOT_MONITORED.

VARCHAR
bucket_arn

The Amazon Resource Name (ARN) of the bucket.

VARCHAR
bucket_created_at

The date and time, in UTC and extended ISO 8601 format, when the bucket was created. This value can also indicate when changes such as edits to the bucket's policy were most recently made to the bucket.

TIMESTAMP_S
bucket_name

The name of the bucket.

VARCHAR
classifiable_object_count

The total number of objects that Amazon Macie can analyze in the bucket. These objects use a supported storage class and have a file name extension for a supported file or storage format.

BIGINT
classifiable_size_in_bytes

The total storage size, in bytes, of the objects that Amazon Macie can analyze in the bucket. These objects use a supported storage class and have a file name extension for a supported file or storage format.

If versioning is enabled for the bucket, Macie calculates this value based on the size of the latest version of each applicable object in the bucket. This value doesn't reflect the storage size of all versions of each applicable object in the bucket.

BIGINT
error_code

The error code for an error that prevented Amazon Macie from retrieving and processing information about the bucket and the bucket's objects. If this value is ACCESS_DENIED, Macie doesn't have permission to retrieve the information. For example, the bucket has a restrictive bucket policy and Amazon S3 denied the request. If this value is null, Macie was able to retrieve and process the information.

VARCHAR
error_message

A brief description of the error (errorCode) that prevented Amazon Macie from retrieving and processing information about the bucket and the bucket's objects. This value is null if Macie was able to retrieve and process the information.

VARCHAR
job_details

Specifies whether any one-time or recurring classification jobs are configured to analyze objects in the bucket, and, if so, the details of the job that ran most recently.

STRUCT(
    "is_defined_in_job" VARCHAR,
    "is_monitored_by_job" VARCHAR,
    "last_job_id" VARCHAR,
    "last_job_run_time" TIMESTAMP_S
)
Show child fields
job_details.is_defined_in_job

Specifies whether any one-time or recurring jobs are configured to analyze objects in the bucket. Possible values are:

  • TRUE - The bucket is explicitly included in the bucket definition (S3BucketDefinitionForJob) for one or more jobs and at least one of those jobs has a status other than CANCELLED. Or the bucket matched the bucket criteria (S3BucketCriteriaForJob) for at least one job that previously ran.

  • FALSE - The bucket isn't explicitly included in the bucket definition (S3BucketDefinitionForJob) for any jobs, all the jobs that explicitly include the bucket in their bucket definitions have a status of CANCELLED, or the bucket didn't match the bucket criteria (S3BucketCriteriaForJob) for any jobs that previously ran.

  • UNKNOWN - An exception occurred when Amazon Macie attempted to retrieve job data for the bucket.

job_details.is_monitored_by_job

Specifies whether any recurring jobs are configured to analyze objects in the bucket. Possible values are:

  • TRUE - The bucket is explicitly included in the bucket definition (S3BucketDefinitionForJob) for one or more recurring jobs or the bucket matches the bucket criteria (S3BucketCriteriaForJob) for one or more recurring jobs. At least one of those jobs has a status other than CANCELLED.

  • FALSE - The bucket isn't explicitly included in the bucket definition (S3BucketDefinitionForJob) for any recurring jobs, the bucket doesn't match the bucket criteria (S3BucketCriteriaForJob) for any recurring jobs, or all the recurring jobs that are configured to analyze data in the bucket have a status of CANCELLED.

  • UNKNOWN - An exception occurred when Amazon Macie attempted to retrieve job data for the bucket.

job_details.last_job_id

The unique identifier for the job that ran most recently and is configured to analyze objects in the bucket, either the latest run of a recurring job or the only run of a one-time job.

This value is typically null if the value for the isDefinedInJob property is FALSE or UNKNOWN.

job_details.last_job_run_time

The date and time, in UTC and extended ISO 8601 format, when the job (lastJobId) started. If the job is a recurring job, this value indicates when the most recent run started.

This value is typically null if the value for the isDefinedInJob property is FALSE or UNKNOWN.

last_automated_discovery_time

The date and time, in UTC and extended ISO 8601 format, when Amazon Macie most recently analyzed objects in the bucket while performing automated sensitive data discovery. This value is null if automated sensitive data discovery is disabled for your account.

TIMESTAMP_S
last_updated

The date and time, in UTC and extended ISO 8601 format, when Amazon Macie most recently retrieved bucket or object metadata from Amazon S3 for the bucket.

TIMESTAMP_S
object_count

The total number of objects in the bucket.

BIGINT
object_count_by_encryption_type

The total number of objects in the bucket, grouped by server-side encryption type. This includes a grouping that reports the total number of objects that aren't encrypted or use client-side encryption.

STRUCT(
    "customer_managed" BIGINT,
    "kms_managed" BIGINT,
    "s3_managed" BIGINT,
    "unencrypted" BIGINT,
    "unknown" BIGINT
)
Show child fields
object_count_by_encryption_type.customer_managed

The total number of objects that are encrypted with customer-provided keys. The objects use server-side encryption with customer-provided keys (SSE-C).

object_count_by_encryption_type.kms_managed

The total number of objects that are encrypted with KMS keys, either Amazon Web Services managed keys or customer managed keys. The objects use dual-layer server-side encryption or server-side encryption with KMS keys (DSSE-KMS or SSE-KMS).

object_count_by_encryption_type.s3_managed

The total number of objects that are encrypted with Amazon S3 managed keys. The objects use server-side encryption with Amazon S3 managed keys (SSE-S3).

object_count_by_encryption_type.unencrypted

The total number of objects that use client-side encryption or aren't encrypted.

object_count_by_encryption_type.unknown

The total number of objects that Amazon Macie doesn't have current encryption metadata for. Macie can't provide current data about the encryption settings for these objects.

public_access

Specifies whether the bucket is publicly accessible due to the combination of permissions settings that apply to the bucket, and provides information about those settings.

STRUCT(
    "effective_permission" VARCHAR,
    "permission_configuration" STRUCT(
        "account_level_permissions" STRUCT(
            "block_public_access" STRUCT(
                "block_public_acls" BOOLEAN,
                "block_public_policy" BOOLEAN,
                "ignore_public_acls" BOOLEAN,
                "restrict_public_buckets" BOOLEAN
            )
        ),
        "bucket_level_permissions" STRUCT(
            "access_control_list" STRUCT(
                "allows_public_read_access" BOOLEAN,
                "allows_public_write_access" BOOLEAN
            ),
            "block_public_access" STRUCT(
                "block_public_acls" BOOLEAN,
                "block_public_policy" BOOLEAN,
                "ignore_public_acls" BOOLEAN,
                "restrict_public_buckets" BOOLEAN
            ),
            "bucket_policy" STRUCT(
                "allows_public_read_access" BOOLEAN,
                "allows_public_write_access" BOOLEAN
            )
        )
    )
)
Show child fields
public_access.effective_permission

Specifies whether the bucket is publicly accessible due to the combination of permissions settings that apply to the bucket. Possible values are:

  • NOT_PUBLIC - The bucket isn't publicly accessible.

  • PUBLIC - The bucket is publicly accessible.

  • UNKNOWN - Amazon Macie can't determine whether the bucket is publicly accessible.

public_access.permission_configuration

The account-level and bucket-level permissions settings for the bucket.

Show child fields
public_access.permission_configuration.account_level_permissions

The account-level permissions settings that apply to the bucket.

Show child fields
public_access.permission_configuration.account_level_permissions.block_public_access

The block public access settings for the Amazon Web Services account that owns the bucket.

Show child fields
public_access.permission_configuration.account_level_permissions.block_public_access.block_public_acls

Specifies whether Amazon S3 blocks public access control lists (ACLs) for the bucket and objects in the bucket.

public_access.permission_configuration.account_level_permissions.block_public_access.block_public_policy

Specifies whether Amazon S3 blocks public bucket policies for the bucket.

public_access.permission_configuration.account_level_permissions.block_public_access.ignore_public_acls

Specifies whether Amazon S3 ignores public ACLs for the bucket and objects in the bucket.

public_access.permission_configuration.account_level_permissions.block_public_access.restrict_public_buckets

Specifies whether Amazon S3 restricts public bucket policies for the bucket.

public_access.permission_configuration.bucket_level_permissions

The bucket-level permissions settings for the bucket.

Show child fields
public_access.permission_configuration.bucket_level_permissions.access_control_list

The permissions settings of the access control list (ACL) for the bucket. This value is null if an ACL hasn't been defined for the bucket.

Show child fields
public_access.permission_configuration.bucket_level_permissions.access_control_list.allows_public_read_access

Specifies whether the ACL grants the general public with read access permissions for the bucket.

public_access.permission_configuration.bucket_level_permissions.access_control_list.allows_public_write_access

Specifies whether the ACL grants the general public with write access permissions for the bucket.

public_access.permission_configuration.bucket_level_permissions.block_public_access

The block public access settings for the bucket.

Show child fields
public_access.permission_configuration.bucket_level_permissions.block_public_access.block_public_acls

Specifies whether Amazon S3 blocks public access control lists (ACLs) for the bucket and objects in the bucket.

public_access.permission_configuration.bucket_level_permissions.block_public_access.block_public_policy

Specifies whether Amazon S3 blocks public bucket policies for the bucket.

public_access.permission_configuration.bucket_level_permissions.block_public_access.ignore_public_acls

Specifies whether Amazon S3 ignores public ACLs for the bucket and objects in the bucket.

public_access.permission_configuration.bucket_level_permissions.block_public_access.restrict_public_buckets

Specifies whether Amazon S3 restricts public bucket policies for the bucket.

public_access.permission_configuration.bucket_level_permissions.bucket_policy

The permissions settings of the bucket policy for the bucket. This value is null if a bucket policy hasn't been defined for the bucket.

Show child fields
public_access.permission_configuration.bucket_level_permissions.bucket_policy.allows_public_read_access

Specifies whether the bucket policy allows the general public to have read access to the bucket.

public_access.permission_configuration.bucket_level_permissions.bucket_policy.allows_public_write_access

Specifies whether the bucket policy allows the general public to have write access to the bucket.

region

The Amazon Web Services Region that hosts the bucket.

VARCHAR
replication_details

Specifies whether the bucket is configured to replicate one or more objects to buckets for other Amazon Web Services accounts and, if so, which accounts.

STRUCT(
    "replicated" BOOLEAN,
    "replicated_externally" BOOLEAN,
    "replication_accounts" VARCHAR[]
)
Show child fields
replication_details.replicated

Specifies whether the bucket is configured to replicate one or more objects to any destination.

replication_details.replicated_externally

Specifies whether the bucket is configured to replicate one or more objects to a bucket for an Amazon Web Services account that isn't part of your Amazon Macie organization. An Amazon Macie organization is a set of Macie accounts that are centrally managed as a group of related accounts through Organizations or by Macie invitation.

replication_details.replication_accounts[]
sensitivity_score

The sensitivity score for the bucket, ranging from -1 (classification error) to 100 (sensitive).

If automated sensitive data discovery has never been enabled for your account or it’s been disabled for your organization or your standalone account for more than 30 days, possible values are: 1, the bucket is empty; or, 50, the bucket stores objects but it’s been excluded from recent analyses.

BIGINT
server_side_encryption

The default server-side encryption settings for the bucket.

STRUCT(
    "kms_master_key_id" VARCHAR,
    "type" VARCHAR
)
Show child fields
server_side_encryption.kms_master_key_id

The Amazon Resource Name (ARN) or unique identifier (key ID) for the KMS key that's used by default to encrypt objects that are added to the bucket. This value is null if the bucket is configured to use an Amazon S3 managed key to encrypt new objects.

server_side_encryption.type

The server-side encryption algorithm that's used by default to encrypt objects that are added to the bucket. Possible values are:

  • AES256 - New objects use SSE-S3 encryption. They're encrypted with an Amazon S3 managed key.

  • aws:kms - New objects use SSE-KMS encryption. They're encrypted with an KMS key (kmsMasterKeyId), either an Amazon Web Services managed key or a customer managed key.

  • aws:kms:dsse - New objects use DSSE-KMS encryption. They're encrypted with an KMS key (kmsMasterKeyId), either an Amazon Web Services managed key or a customer managed key.

  • NONE - The bucket's default encryption settings don't specify server-side encryption behavior for new objects.

shared_access

Specifies whether the bucket is shared with another Amazon Web Services account, an Amazon CloudFront origin access identity (OAI), or a CloudFront origin access control (OAC). Possible values are:

  • EXTERNAL - The bucket is shared with one or more of the following or any combination of the following: a CloudFront OAI, a CloudFront OAC, or an Amazon Web Services account that isn't part of your Amazon Macie organization.

  • INTERNAL - The bucket is shared with one or more Amazon Web Services accounts that are part of your Amazon Macie organization. It isn't shared with a CloudFront OAI or OAC.

  • NOT_SHARED - The bucket isn't shared with another Amazon Web Services account, a CloudFront OAI, or a CloudFront OAC.

  • UNKNOWN - Amazon Macie wasn't able to evaluate the shared access settings for the bucket.

An Amazon Macie organization is a set of Macie accounts that are centrally managed as a group of related accounts through Organizations or by Macie invitation.

VARCHAR
size_in_bytes

The total storage size, in bytes, of the bucket.

If versioning is enabled for the bucket, Amazon Macie calculates this value based on the size of the latest version of each object in the bucket. This value doesn't reflect the storage size of all versions of each object in the bucket.

BIGINT
size_in_bytes_compressed

The total storage size, in bytes, of the objects that are compressed (.gz, .gzip, .zip) files in the bucket.

If versioning is enabled for the bucket, Amazon Macie calculates this value based on the size of the latest version of each applicable object in the bucket. This value doesn't reflect the storage size of all versions of each applicable object in the bucket.

BIGINT
tags

An array that specifies the tags (keys and values) that are associated with the bucket.

STRUCT(
    "key" VARCHAR,
    "value" VARCHAR
)[]
Show child fields
tags[]
Show child fields
tags[].key

One part of a key-value pair that comprises a tag. A tag key is a general label that acts as a category for more specific tag values.

tags[].value

One part of a key-value pair that comprises a tag. A tag value acts as a descriptor for a tag key. A tag value can be an empty string.

unclassifiable_object_count

The total number of objects that Amazon Macie can't analyze in the bucket. These objects don't use a supported storage class or don't have a file name extension for a supported file or storage format.

STRUCT(
    "file_type" BIGINT,
    "storage_class" BIGINT,
    "total" BIGINT
)
Show child fields
unclassifiable_object_count.file_type

The total storage size (in bytes) or number of objects that Amazon Macie can't analyze because the objects don't have a file name extension for a supported file or storage format.

unclassifiable_object_count.storage_class

The total storage size (in bytes) or number of objects that Amazon Macie can't analyze because the objects use an unsupported storage class.

unclassifiable_object_count.total

The total storage size (in bytes) or number of objects that Amazon Macie can't analyze because the objects use an unsupported storage class or don't have a file name extension for a supported file or storage format.

unclassifiable_object_size_in_bytes

The total storage size, in bytes, of the objects that Amazon Macie can't analyze in the bucket. These objects don't use a supported storage class or don't have a file name extension for a supported file or storage format.

STRUCT(
    "file_type" BIGINT,
    "storage_class" BIGINT,
    "total" BIGINT
)
Show child fields
unclassifiable_object_size_in_bytes.file_type

The total storage size (in bytes) or number of objects that Amazon Macie can't analyze because the objects don't have a file name extension for a supported file or storage format.

unclassifiable_object_size_in_bytes.storage_class

The total storage size (in bytes) or number of objects that Amazon Macie can't analyze because the objects use an unsupported storage class.

unclassifiable_object_size_in_bytes.total

The total storage size (in bytes) or number of objects that Amazon Macie can't analyze because the objects use an unsupported storage class or don't have a file name extension for a supported file or storage format.

versioning

Specifies whether versioning is enabled for the bucket.

BOOLEAN