access_preview_findings

Creates, updates, deletes, gets or lists an access_preview_findings resource.

Overview

Name	access_preview_findings
Type	Resource
Id	aws.accessanalyzer.access_preview_findings

Fields

The following fields are returned by SELECT queries:

list_access_preview_findings

Name	Datatype	Description
id	string	The ID of the access preview finding. This ID uniquely identifies the element in the list of access preview findings and is not related to the finding ID in Access Analyzer.
action	array	The action in the analyzed policy statement that an external principal has permission to perform.
change_type	string	Provides context on how the access preview finding compares to existing access identified in IAM Access Analyzer. New - The finding is for newly-introduced access. Unchanged - The preview finding is an existing finding that would remain unchanged. Changed - The preview finding is an existing finding with a change in status. For example, a Changed finding with preview status Resolved and existing status Active indicates the existing Active finding would become Resolved as a result of the proposed permissions change. (CHANGED, NEW, UNCHANGED)
condition	object	The condition in the analyzed policy statement that resulted in a finding.
created_at	string (date-time)	The time at which the access preview finding was created.
error	string	An error.
existing_finding_id	string	The existing ID of the finding in IAM Access Analyzer, provided only for existing findings.
existing_finding_status	string	The existing status of the finding, provided only for existing findings. (ACTIVE, ARCHIVED, RESOLVED)
is_public	boolean	Indicates whether the policy that generated the finding allows public access to the resource.
principal	object	The external principal that has access to a resource within the zone of trust.
resource	string	The resource that an external principal has access to. This is the resource associated with the access preview.
resource_control_policy_restriction	string	The type of restriction applied to the finding by the resource owner with an Organizations resource control policy (RCP). (APPLICABLE, FAILED_TO_EVALUATE_RCP, NOT_APPLICABLE, APPLIED)
resource_owner_account	string	The Amazon Web Services account ID that owns the resource. For most Amazon Web Services resources, the owning account is the account in which the resource was created.
resource_type	string	The type of the resource that can be accessed in the finding. (AWS::S3::Bucket, AWS::IAM::Role, AWS::SQS::Queue, AWS::Lambda::Function, AWS::Lambda::LayerVersion, AWS::KMS::Key, AWS::SecretsManager::Secret, AWS::EFS::FileSystem, AWS::EC2::Snapshot, AWS::ECR::Repository, AWS::RDS::DBSnapshot, AWS::RDS::DBClusterSnapshot, AWS::SNS::Topic, AWS::S3Express::DirectoryBucket, AWS::DynamoDB::Table, AWS::DynamoDB::Stream, AWS::IAM::User)
sources	array	The sources of the finding. This indicates how the access that generated the finding is granted. It is populated for Amazon S3 bucket findings.
status	string	The preview status of the finding. This is what the status of the finding would be after permissions deployment. For example, a Changed finding with preview status Resolved and existing status Active indicates the existing Active finding would become Resolved as a result of the proposed permissions change. (ACTIVE, ARCHIVED, RESOLVED)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
list_access_preview_findings	select	access_preview_id, region		Retrieves a list of access preview findings generated by the specified access preview.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
access_preview_id	string	The unique ID for the access preview.
region	string	AWS region (default: us-east-1)

SELECT examples

list_access_preview_findings

Retrieves a list of access preview findings generated by the specified access preview.

SELECT
id,
action,
change_type,
condition,
created_at,
error,
existing_finding_id,
existing_finding_status,
is_public,
principal,
resource,
resource_control_policy_restriction,
resource_owner_account,
resource_type,
sources,
status
FROM aws.accessanalyzer.access_preview_findings
WHERE access_preview_id = '{{ access_preview_id }}' -- required
AND region = '{{ region }}' -- required
;