Skip to content
AWS for Query.Farm

aws.mailmanager.get_rule_set

Example SQL Queries

SELECT * FROM
aws.mailmanager.get_rule_set
WHERE
"rule_set_id" = 'VALUE';

Description

Fetch attributes of a rule set.

Table Definition

Column NameColumn Data Type
rule_set_id Required Input Column

The identifier of the rule set resource.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

created_date

The date of when then rule set was created.

TIMESTAMP_S
last_modification_date

The date of when the rule set was last modified.

TIMESTAMP_S
rule_set_arn

The Amazon Resource Name (ARN) of the rule set resource.

VARCHAR
rule_set_name

A user-friendly name for the rule set resource.

VARCHAR
rules

The rules contained in the rule set.

STRUCT(
    "actions" STRUCT(
        "add_header" STRUCT(
            "header_name" VARCHAR,
            "header_value" VARCHAR
        ),
        "archive" STRUCT(
            "action_failure_policy" VARCHAR,
            "target_archive" VARCHAR
        ),
        "deliver_to_mailbox" STRUCT(
            "action_failure_policy" VARCHAR,
            "mailbox_arn" VARCHAR,
            "role_arn" VARCHAR
        ),
        "drop" BOOLEAN,
        "relay" STRUCT(
            "action_failure_policy" VARCHAR,
            "mail_from" VARCHAR,
            "relay" VARCHAR
        ),
        "replace_recipient" STRUCT(
            "replace_with" VARCHAR[]
        ),
        "send" STRUCT(
            "action_failure_policy" VARCHAR,
            "role_arn" VARCHAR
        ),
        "write_to_s3" STRUCT(
            "action_failure_policy" VARCHAR,
            "role_arn" VARCHAR,
            "s3_bucket" VARCHAR,
            "s3_prefix" VARCHAR,
            "s3_sse_kms_key_id" VARCHAR
        )
    )[],
    "conditions" STRUCT(
        "boolean_expression" STRUCT(
            "evaluate" STRUCT(
                "attribute" VARCHAR
            ),
            "operator" VARCHAR
        ),
        "dmarc_expression" STRUCT(
            "operator" VARCHAR,
            "values" VARCHAR[]
        ),
        "ip_expression" STRUCT(
            "evaluate" STRUCT(
                "attribute" VARCHAR
            ),
            "operator" VARCHAR,
            "values" VARCHAR[]
        ),
        "number_expression" STRUCT(
            "evaluate" STRUCT(
                "attribute" VARCHAR
            ),
            "operator" VARCHAR,
            "value" DOUBLE
        ),
        "string_expression" STRUCT(
            "evaluate" STRUCT(
                "attribute" VARCHAR
            ),
            "operator" VARCHAR,
            "values" VARCHAR[]
        ),
        "verdict_expression" STRUCT(
            "evaluate" STRUCT(
                "analysis" STRUCT(
                    "analyzer" VARCHAR,
                    "result_field" VARCHAR
                ),
                "attribute" VARCHAR
            ),
            "operator" VARCHAR,
            "values" VARCHAR[]
        )
    )[],
    "name" VARCHAR,
    "unless" STRUCT(
        "boolean_expression" STRUCT(
            "evaluate" STRUCT(
                "attribute" VARCHAR
            ),
            "operator" VARCHAR
        ),
        "dmarc_expression" STRUCT(
            "operator" VARCHAR,
            "values" VARCHAR[]
        ),
        "ip_expression" STRUCT(
            "evaluate" STRUCT(
                "attribute" VARCHAR
            ),
            "operator" VARCHAR,
            "values" VARCHAR[]
        ),
        "number_expression" STRUCT(
            "evaluate" STRUCT(
                "attribute" VARCHAR
            ),
            "operator" VARCHAR,
            "value" DOUBLE
        ),
        "string_expression" STRUCT(
            "evaluate" STRUCT(
                "attribute" VARCHAR
            ),
            "operator" VARCHAR,
            "values" VARCHAR[]
        ),
        "verdict_expression" STRUCT(
            "evaluate" STRUCT(
                "analysis" STRUCT(
                    "analyzer" VARCHAR,
                    "result_field" VARCHAR
                ),
                "attribute" VARCHAR
            ),
            "operator" VARCHAR,
            "values" VARCHAR[]
        )
    )[]
)[]
Show child fields
rules[]
Show child fields
rules[].actions[]
Show child fields
rules[].actions[].add_header

This action adds a header. This can be used to add arbitrary email headers.

Show child fields
rules[].actions[].add_header.header_name

The name of the header to add to an email. The header must be prefixed with "X-". Headers are added regardless of whether the header name pre-existed in the email.

rules[].actions[].add_header.header_value

The value of the header to add to the email.

rules[].actions[].archive

This action archives the email. This can be used to deliver an email to an archive.

Show child fields
rules[].actions[].archive.action_failure_policy

A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the specified archive has been deleted.

rules[].actions[].archive.target_archive

The identifier of the archive to send the email to.

rules[].actions[].deliver_to_mailbox

This action delivers an email to a WorkMail mailbox.

Show child fields
rules[].actions[].deliver_to_mailbox.action_failure_policy

A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the mailbox ARN is no longer valid.

rules[].actions[].deliver_to_mailbox.mailbox_arn

The Amazon Resource Name (ARN) of a WorkMail organization to deliver the email to.

rules[].actions[].deliver_to_mailbox.role_arn

The Amazon Resource Name (ARN) of an IAM role to use to execute this action. The role must have access to the workmail:DeliverToMailbox API.

rules[].actions[].drop

This action terminates the evaluation of rules in the rule set.

rules[].actions[].relay

This action relays the email to another SMTP server.

Show child fields
rules[].actions[].relay.action_failure_policy

A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the specified relay has been deleted.

rules[].actions[].relay.mail_from

This action specifies whether to preserve or replace original mail from address while relaying received emails to a destination server.

rules[].actions[].relay.relay

The identifier of the relay resource to be used when relaying an email.

rules[].actions[].replace_recipient

The action replaces certain or all recipients with a different set of recipients.

Show child fields
rules[].actions[].replace_recipient.replace_with[]
rules[].actions[].send

This action sends the email to the internet.

Show child fields
rules[].actions[].send.action_failure_policy

A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the caller does not have the permissions to call the sendRawEmail API.

rules[].actions[].send.role_arn

The Amazon Resource Name (ARN) of the role to use for this action. This role must have access to the ses:SendRawEmail API.

rules[].actions[].write_to_s3

This action writes the MIME content of the email to an S3 bucket.

Show child fields
rules[].actions[].write_to_s3.action_failure_policy

A policy that states what to do in the case of failure. The action will fail if there are configuration errors. For example, the specified the bucket has been deleted.

rules[].actions[].write_to_s3.role_arn

The Amazon Resource Name (ARN) of the IAM Role to use while writing to S3. This role must have access to the s3:PutObject, kms:Encrypt, and kms:GenerateDataKey APIs for the given bucket.

rules[].actions[].write_to_s3.s3_bucket

The bucket name of the S3 bucket to write to.

rules[].actions[].write_to_s3.s3_prefix

The S3 prefix to use for the write to the s3 bucket.

rules[].actions[].write_to_s3.s3_sse_kms_key_id

The KMS Key ID to use to encrypt the message in S3.

rules[].conditions[]
Show child fields
rules[].conditions[].boolean_expression

The condition applies to a boolean expression passed in this field.

Show child fields
rules[].conditions[].boolean_expression.evaluate

The operand on which to perform a boolean condition operation.

Show child fields
rules[].conditions[].boolean_expression.evaluate.attribute

The boolean type representing the allowed attribute types for an email.

rules[].conditions[].boolean_expression.operator

The matching operator for a boolean condition expression.

rules[].conditions[].dmarc_expression

The condition applies to a DMARC policy expression passed in this field.

Show child fields
rules[].conditions[].dmarc_expression.operator

The operator to apply to the DMARC policy of the incoming email.

rules[].conditions[].dmarc_expression.values[]
rules[].conditions[].ip_expression

The condition applies to an IP address expression passed in this field.

Show child fields
rules[].conditions[].ip_expression.evaluate

The IP address to evaluate in this condition.

Show child fields
rules[].conditions[].ip_expression.evaluate.attribute

The attribute of the email to evaluate.

rules[].conditions[].ip_expression.operator

The operator to evaluate the IP address.

rules[].conditions[].ip_expression.values[]
rules[].conditions[].number_expression

The condition applies to a number expression passed in this field.

Show child fields
rules[].conditions[].number_expression.evaluate

The number to evaluate in a numeric condition expression.

Show child fields
rules[].conditions[].number_expression.evaluate.attribute

An email attribute that is used as the number to evaluate.

rules[].conditions[].number_expression.operator

The operator for a numeric condition expression.

rules[].conditions[].number_expression.value

The value to evaluate in a numeric condition expression.

rules[].conditions[].string_expression

The condition applies to a string expression passed in this field.

Show child fields
rules[].conditions[].string_expression.evaluate

The string to evaluate in a string condition expression.

Show child fields
rules[].conditions[].string_expression.evaluate.attribute

The email attribute to evaluate in a string condition expression.

rules[].conditions[].string_expression.operator

The matching operator for a string condition expression.

rules[].conditions[].string_expression.values[]
rules[].conditions[].verdict_expression

The condition applies to a verdict expression passed in this field.

Show child fields
rules[].conditions[].verdict_expression.evaluate

The verdict to evaluate in a verdict condition expression.

Show child fields
rules[].conditions[].verdict_expression.evaluate.analysis

The Add On ARN and its returned value to evaluate in a verdict condition expression.

Show child fields
rules[].conditions[].verdict_expression.evaluate.analysis.analyzer

The Amazon Resource Name (ARN) of an Add On.

rules[].conditions[].verdict_expression.evaluate.analysis.result_field

The returned value from an Add On.

rules[].conditions[].verdict_expression.evaluate.attribute

The email verdict attribute to evaluate in a string verdict expression.

rules[].conditions[].verdict_expression.operator

The matching operator for a verdict condition expression.

rules[].conditions[].verdict_expression.values[]
rules[].name

The user-friendly name of the rule.

rules[].unless[]
Show child fields
rules[].unless[].boolean_expression

The condition applies to a boolean expression passed in this field.

Show child fields
rules[].unless[].boolean_expression.evaluate

The operand on which to perform a boolean condition operation.

Show child fields
rules[].unless[].boolean_expression.evaluate.attribute

The boolean type representing the allowed attribute types for an email.

rules[].unless[].boolean_expression.operator

The matching operator for a boolean condition expression.

rules[].unless[].dmarc_expression

The condition applies to a DMARC policy expression passed in this field.

Show child fields
rules[].unless[].dmarc_expression.operator

The operator to apply to the DMARC policy of the incoming email.

rules[].unless[].dmarc_expression.values[]
rules[].unless[].ip_expression

The condition applies to an IP address expression passed in this field.

Show child fields
rules[].unless[].ip_expression.evaluate

The IP address to evaluate in this condition.

Show child fields
rules[].unless[].ip_expression.evaluate.attribute

The attribute of the email to evaluate.

rules[].unless[].ip_expression.operator

The operator to evaluate the IP address.

rules[].unless[].ip_expression.values[]
rules[].unless[].number_expression

The condition applies to a number expression passed in this field.

Show child fields
rules[].unless[].number_expression.evaluate

The number to evaluate in a numeric condition expression.

Show child fields
rules[].unless[].number_expression.evaluate.attribute

An email attribute that is used as the number to evaluate.

rules[].unless[].number_expression.operator

The operator for a numeric condition expression.

rules[].unless[].number_expression.value

The value to evaluate in a numeric condition expression.

rules[].unless[].string_expression

The condition applies to a string expression passed in this field.

Show child fields
rules[].unless[].string_expression.evaluate

The string to evaluate in a string condition expression.

Show child fields
rules[].unless[].string_expression.evaluate.attribute

The email attribute to evaluate in a string condition expression.

rules[].unless[].string_expression.operator

The matching operator for a string condition expression.

rules[].unless[].string_expression.values[]
rules[].unless[].verdict_expression

The condition applies to a verdict expression passed in this field.

Show child fields
rules[].unless[].verdict_expression.evaluate

The verdict to evaluate in a verdict condition expression.

Show child fields
rules[].unless[].verdict_expression.evaluate.analysis

The Add On ARN and its returned value to evaluate in a verdict condition expression.

Show child fields
rules[].unless[].verdict_expression.evaluate.analysis.analyzer

The Amazon Resource Name (ARN) of an Add On.

rules[].unless[].verdict_expression.evaluate.analysis.result_field

The returned value from an Add On.

rules[].unless[].verdict_expression.evaluate.attribute

The email verdict attribute to evaluate in a string verdict expression.

rules[].unless[].verdict_expression.operator

The matching operator for a verdict condition expression.

rules[].unless[].verdict_expression.values[]