Skip to content
AWS for Query.Farm

aws.securityhub.get_members

Example SQL Queries

SELECT * FROM
aws.securityhub.get_members
WHERE
"account_ids" = 'VALUE';

Description

Returns the details for the Security Hub member accounts for the specified account IDs.

An administrator account can be either the delegated Security Hub administrator account for an organization or an administrator account that enabled Security Hub manually.

The results include both member accounts that are managed using Organizations and accounts that were invited manually.

Table Definition

Column NameColumn Data Type
account_ids Required Input Column

The list of account IDs for the Security Hub member accounts to return the details for. 

VARCHAR[]
Show child fields
account_ids[]
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
members

The list of details about the Security Hub member accounts.

STRUCT(
    "account_id" VARCHAR,
    "email" VARCHAR,
    "master_id" VARCHAR,
    "administrator_id" VARCHAR,
    "member_status" VARCHAR,
    "invited_at" TIMESTAMP_S,
    "updated_at" TIMESTAMP_S
)[]
Show child fields
members[]
Show child fields
members[].account_id

The Amazon Web Services account ID of the member account.

members[].administrator_id

The Amazon Web Services account ID of the Security Hub administrator account associated with this member account.

members[].email

The email address of the member account.

members[].invited_at

A timestamp for the date and time when the invitation was sent to the member account.

members[].master_id

This is replaced by AdministratorID.

The Amazon Web Services account ID of the Security Hub administrator account associated with this member account.

members[].member_status

The status of the relationship between the member account and its administrator account.

The status can have one of the following values:

  • Created - Indicates that the administrator account added the member account, but has not yet invited the member account.

  • Invited - Indicates that the administrator account invited the member account. The member account has not yet responded to the invitation.

  • Enabled - Indicates that the member account is currently active. For manually invited member accounts, indicates that the member account accepted the invitation.

  • Removed - Indicates that the administrator account disassociated the member account.

  • Resigned - Indicates that the member account disassociated themselves from the administrator account.

  • Deleted - Indicates that the administrator account deleted the member account.

  • AccountSuspended - Indicates that an organization account was suspended from Amazon Web Services at the same time that the administrator account tried to enable the organization account as a member account.

members[].updated_at

The timestamp for the date and time when the member account was updated.

unprocessed_accounts

The list of Amazon Web Services accounts that could not be processed. For each account, the list includes the account ID and the email address.

STRUCT(
    "account_id" VARCHAR,
    "processing_result" VARCHAR
)[]
Show child fields
unprocessed_accounts[]
Show child fields
unprocessed_accounts[].account_id

An Amazon Web Services account ID of the account that was not processed.

unprocessed_accounts[].processing_result

The reason that the account was not processed.