Skip to content
AWS for Query.Farm

aws.macie2.get_allow_list

Example SQL Queries

SELECT * FROM
aws.macie2.get_allow_list
WHERE
"id" = 'VALUE';

Description

Retrieves the settings and status of an allow list.

Table Definition

Column NameColumn Data Type
id Required Input Column

The unique identifier for the allow list.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
arn

The Amazon Resource Name (ARN) of the allow list.

VARCHAR
created_at

The date and time, in UTC and extended ISO 8601 format, when the allow list was created in Amazon Macie.

TIMESTAMP_S
criteria

The criteria that specify the text or text pattern to ignore. The criteria can be the location and name of an S3 object that lists specific text to ignore (s3WordsList), or a regular expression (regex) that defines a text pattern to ignore.

STRUCT(
    "regex" VARCHAR,
    "s3_words_list" STRUCT(
        "bucket_name" VARCHAR,
        "object_key" VARCHAR
    )
)
Show child fields
criteria.regex

The regular expression (regex) that defines the text pattern to ignore. The expression can contain as many as 512 characters.

criteria.s3_words_list

The location and name of the S3 object that lists specific text to ignore.

Show child fields
criteria.s3_words_list.bucket_name

The full name of the S3 bucket that contains the object.

criteria.s3_words_list.object_key

The full name (key) of the object.

description

The custom description of the allow list.

VARCHAR
name

The custom name of the allow list.

VARCHAR
status

The current status of the allow list, which indicates whether Amazon Macie can access and use the list's criteria.

STRUCT(
    "code" VARCHAR,
    "description" VARCHAR
)
Show child fields
status.code

The current status of the allow list. If the list's criteria specify a regular expression (regex), this value is typically OK. Amazon Macie can compile the expression.

If the list's criteria specify an S3 object, possible values are:

  • OK - Macie can retrieve and parse the contents of the object.

  • S3_OBJECT_ACCESS_DENIED - Macie isn't allowed to access the object or the object is encrypted with a customer managed KMS key that Macie isn't allowed to use. Check the bucket policy and other permissions settings for the bucket and the object. If the object is encrypted, also ensure that it's encrypted with a key that Macie is allowed to use.

  • S3_OBJECT_EMPTY - Macie can retrieve the object but the object doesn't contain any content. Ensure that the object contains the correct entries. Also ensure that the list's criteria specify the correct bucket and object names.

  • S3_OBJECT_NOT_FOUND - The object doesn't exist in Amazon S3. Ensure that the list's criteria specify the correct bucket and object names.

  • S3_OBJECT_OVERSIZE - Macie can retrieve the object. However, the object contains too many entries or its storage size exceeds the quota for an allow list. Try breaking the list into multiple files and ensure that each file doesn't exceed any quotas. Then configure list settings in Macie for each file.

  • S3_THROTTLED - Amazon S3 throttled the request to retrieve the object. Wait a few minutes and then try again.

  • S3_USER_ACCESS_DENIED - Amazon S3 denied the request to retrieve the object. If the specified object exists, you're not allowed to access it or it's encrypted with an KMS key that you're not allowed to use. Work with your Amazon Web Services administrator to ensure that the list's criteria specify the correct bucket and object names, and you have read access to the bucket and the object. If the object is encrypted, also ensure that it's encrypted with a key that you're allowed to use.

  • UNKNOWN_ERROR - A transient or internal error occurred when Macie attempted to retrieve or parse the object. Wait a few minutes and then try again. A list can also have this status if it's encrypted with a key that Amazon S3 and Macie can't access or use.

status.description

A brief description of the status of the allow list. Amazon Macie uses this value to provide additional information about an error that occurred when Macie tried to access and use the list's criteria.

tags

A map of key-value pairs that specifies which tags (keys and values) are associated with the allow list.

MAP(VARCHAR, VARCHAR)
updated_at

The date and time, in UTC and extended ISO 8601 format, when the allow list's settings were most recently changed in Amazon Macie.

TIMESTAMP_S