Skip to content
AWS for Query.Farm

aws.securityhub.list_members

Example SQL Queries

SELECT * FROM
aws.securityhub.list_members;

Description

Lists details about all member accounts for the current Security Hub administrator account.

The results include both member accounts that belong to an organization and member accounts that were invited manually.

Table Definition

Column NameColumn Data Type
only_associated Input Column

Specifies which member accounts to include in the response based on their relationship status with the administrator account. The default value is TRUE.

If OnlyAssociated is set to TRUE, the response includes member accounts whose relationship status with the administrator account is set to ENABLED.

If OnlyAssociated is set to FALSE, the response includes all existing member accounts. 

BOOLEAN
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
account_id

The Amazon Web Services account ID of the member account.

VARCHAR
administrator_id

The Amazon Web Services account ID of the Security Hub administrator account associated with this member account.

VARCHAR
email

The email address of the member account.

VARCHAR
invited_at

A timestamp for the date and time when the invitation was sent to the member account.

TIMESTAMP_S
master_id

This is replaced by AdministratorID.

The Amazon Web Services account ID of the Security Hub administrator account associated with this member account.

VARCHAR
member_status

The status of the relationship between the member account and its administrator account.

The status can have one of the following values:

  • Created - Indicates that the administrator account added the member account, but has not yet invited the member account.

  • Invited - Indicates that the administrator account invited the member account. The member account has not yet responded to the invitation.

  • Enabled - Indicates that the member account is currently active. For manually invited member accounts, indicates that the member account accepted the invitation.

  • Removed - Indicates that the administrator account disassociated the member account.

  • Resigned - Indicates that the member account disassociated themselves from the administrator account.

  • Deleted - Indicates that the administrator account deleted the member account.

  • AccountSuspended - Indicates that an organization account was suspended from Amazon Web Services at the same time that the administrator account tried to enable the organization account as a member account.

VARCHAR
updated_at

The timestamp for the date and time when the member account was updated.

TIMESTAMP_S