Skip to content
AWS for Query.Farm

aws.resiliencehub.list_app_assessment_compliance_drifts

Example SQL Queries

SELECT * FROM
aws.resiliencehub.list_app_assessment_compliance_drifts
WHERE
"assessment_arn" = 'VALUE';

Description

List of compliance drifts that were detected while running an assessment.

Table Definition

Column NameColumn Data Type
assessment_arn Required Input Column

Amazon Resource Name (ARN) of the assessment. The format for this ARN is: arn:partition:resiliencehub:region:account:app-assessment/app-id. For more information about ARNs, see Amazon Resource Names (ARNs) in the Amazon Web Services General Reference guide.

VARCHAR
max_results Input Column

Indicates the maximum number of compliance drifts requested.

BIGINT
next_token Input Column

Null, or the token from a previous call to get the next set of results.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
compliance_drifts

Indicates compliance drifts (recovery time objective (RTO) and recovery point objective (RPO)) detected for an assessed entity.

STRUCT(
    "actual_reference_id" VARCHAR,
    "actual_value" MAP(VARCHAR, STRUCT(
            "achievable_rpo_in_secs" BIGINT,
            "achievable_rto_in_secs" BIGINT,
            "compliance_status" VARCHAR,
            "current_rpo_in_secs" BIGINT,
            "current_rto_in_secs" BIGINT,
            "message" VARCHAR,
            "rpo_description" VARCHAR,
            "rpo_reference_id" VARCHAR,
            "rto_description" VARCHAR,
            "rto_reference_id" VARCHAR
        )),
    "app_id" VARCHAR,
    "app_version" VARCHAR,
    "diff_type" VARCHAR,
    "drift_type" VARCHAR,
    "entity_id" VARCHAR,
    "entity_type" VARCHAR,
    "expected_reference_id" VARCHAR,
    "expected_value" MAP(VARCHAR, STRUCT(
            "achievable_rpo_in_secs" BIGINT,
            "achievable_rto_in_secs" BIGINT,
            "compliance_status" VARCHAR,
            "current_rpo_in_secs" BIGINT,
            "current_rto_in_secs" BIGINT,
            "message" VARCHAR,
            "rpo_description" VARCHAR,
            "rpo_reference_id" VARCHAR,
            "rto_description" VARCHAR,
            "rto_reference_id" VARCHAR
        ))
)[]
Show child fields
compliance_drifts[]
Show child fields
compliance_drifts[].actual_reference_id

Assessment identifier that is associated with this drift item.

compliance_drifts[].actual_value

Actual compliance value of the entity.

compliance_drifts[].app_id

Identifier of your application.

compliance_drifts[].app_version

Published version of your application on which drift was detected.

compliance_drifts[].diff_type

Difference type between actual and expected recovery point objective (RPO) and recovery time objective (RTO) values. Currently, Resilience Hub supports only NotEqual difference type.

compliance_drifts[].drift_type

The type of drift detected. Currently, Resilience Hub supports only ApplicationCompliance drift type.

compliance_drifts[].entity_id

Identifier of an entity in which drift was detected. For compliance drift, the entity ID can be either application ID or the AppComponent ID.

compliance_drifts[].entity_type

The type of entity in which drift was detected. For compliance drifts, Resilience Hub supports AWS::ResilienceHub::AppComponent and AWS::ResilienceHub::Application.

compliance_drifts[].expected_reference_id

Assessment identifier of a previous assessment of the same application version. Resilience Hub uses the previous assessment (associated with the reference identifier) to compare the compliance with the current assessment to identify drifts.

compliance_drifts[].expected_value

The expected compliance value of an entity.