Skip to content
AWS for Query.Farm

aws.ssm_incidents.get_response_plan

Example SQL Queries

SELECT * FROM
aws.ssm_incidents.get_response_plan
WHERE
"arn" = 'VALUE';

Description

Retrieves the details of the specified response plan.

Table Definition

Column NameColumn Data Type
arn Required Input Column

The ARN of the response plan.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
actions

The actions that this response plan takes at the beginning of the incident.

STRUCT(
    "ssm_automation" STRUCT(
        "document_name" VARCHAR,
        "document_version" VARCHAR,
        "dynamic_parameters" MAP(VARCHAR, STRUCT(
                "variable" VARCHAR
            )),
        "parameters" MAP(VARCHAR, VARCHAR[]),
        "role_arn" VARCHAR,
        "target_account" VARCHAR
    )
)[]
Show child fields
actions[]
Show child fields
actions[].ssm_automation

The Systems Manager automation document to start as the runbook at the beginning of the incident.

Show child fields
actions[].ssm_automation.document_name

The automation document's name.

actions[].ssm_automation.document_version

The automation document's version to use when running.

actions[].ssm_automation.dynamic_parameters

The key-value pair to resolve dynamic parameter values when processing a Systems Manager Automation runbook.

actions[].ssm_automation.parameters

The key-value pair parameters to use when running the automation document.

actions[].ssm_automation.role_arn

The Amazon Resource Name (ARN) of the role that the automation document will assume when running commands.

actions[].ssm_automation.target_account

The account that the automation document will be run in. This can be in either the management account or an application account.

chat_channel

The Chatbot chat channel used for collaboration during an incident.

STRUCT(
    "chatbot_sns" VARCHAR[],
    "empty" BOOLEAN
)
Show child fields
chat_channel.chatbot_sns[]
chat_channel.empty

Used to remove the chat channel from an incident record or response plan.

display_name

The long format name of the response plan. Can contain spaces.

VARCHAR
engagements

The Amazon Resource Name (ARN) for the contacts and escalation plans that the response plan engages during an incident.

VARCHAR[]
Show child fields
engagements[]
incident_template

Details used to create the incident when using this response plan.

STRUCT(
    "dedupe_string" VARCHAR,
    "impact" BIGINT,
    "incident_tags" MAP(VARCHAR, VARCHAR),
    "notification_targets" STRUCT(
        "sns_topic_arn" VARCHAR
    )[],
    "summary" VARCHAR,
    "title" VARCHAR
)
Show child fields
incident_template.dedupe_string

The string Incident Manager uses to prevent the same root cause from creating multiple incidents in the same account.

A deduplication string is a term or phrase the system uses to check for duplicate incidents. If you specify a deduplication string, Incident Manager searches for open incidents that contain the same string in the dedupeString field when it creates the incident. If a duplicate is detected, Incident Manager deduplicates the newer incident into the existing incident.

By default, Incident Manager automatically deduplicates multiple incidents created by the same Amazon CloudWatch alarm or Amazon EventBridge event. You don't have to enter your own deduplication string to prevent duplication for these resource types.

incident_template.impact

The impact of the incident on your customers and applications.

Supported impact codes

  • 1 - Critical

  • 2 - High

  • 3 - Medium

  • 4 - Low

  • 5 - No Impact

incident_template.incident_tags

Tags to assign to the template. When the StartIncident API action is called, Incident Manager assigns the tags specified in the template to the incident.

incident_template.notification_targets[]
Show child fields
incident_template.notification_targets[].sns_topic_arn

The Amazon Resource Name (ARN) of the SNS topic.

incident_template.summary

The summary of the incident. The summary is a brief synopsis of what occurred, what's currently happening, and context.

incident_template.title

The title of the incident.

integrations

Information about third-party services integrated into the Incident Manager response plan.

STRUCT(
    "pager_duty_configuration" STRUCT(
        "name" VARCHAR,
        "pager_duty_incident_configuration" STRUCT(
            "service_id" VARCHAR
        ),
        "secret_id" VARCHAR
    )
)[]
Show child fields
integrations[]
Show child fields
integrations[].pager_duty_configuration

Information about the PagerDuty service where the response plan creates an incident.

Show child fields
integrations[].pager_duty_configuration.name

The name of the PagerDuty configuration.

integrations[].pager_duty_configuration.pager_duty_incident_configuration

Details about the PagerDuty service associated with the configuration.

Show child fields
integrations[].pager_duty_configuration.pager_duty_incident_configuration.service_id

The ID of the PagerDuty service that the response plan associates with an incident when it launches.

integrations[].pager_duty_configuration.secret_id

The ID of the Amazon Web Services Secrets Manager secret that stores your PagerDuty key, either a General Access REST API Key or User Token REST API Key, and other user credentials.

name

The short format name of the response plan. The name can't contain spaces.

VARCHAR