analyzed_resources

Creates, updates, deletes, gets or lists an analyzed_resources resource.

Overview

Name	analyzed_resources
Type	Resource
Id	aws.accessanalyzer.analyzed_resources

Fields

The following fields are returned by SELECT queries:

get_analyzed_resource

Name	Datatype	Description
actions	array	The actions that an external principal is granted permission to use by the policy that generated the finding.
analyzed_at	string (date-time)	The time at which the resource was analyzed.
created_at	string (date-time)	The time at which the finding was created.
error	string	An error message.
is_public	boolean	Indicates whether the policy that generated the finding grants public access to the resource.
resource_arn	string	The ARN of the resource that was analyzed. (pattern: <code>arn:[^:]:[^:]:[^:]:[^:]:.*</code>)
resource_owner_account	string	The Amazon Web Services account ID that owns the resource.
resource_type	string	The type of the resource that was analyzed. (AWS::S3::Bucket, AWS::IAM::Role, AWS::SQS::Queue, AWS::Lambda::Function, AWS::Lambda::LayerVersion, AWS::KMS::Key, AWS::SecretsManager::Secret, AWS::EFS::FileSystem, AWS::EC2::Snapshot, AWS::ECR::Repository, AWS::RDS::DBSnapshot, AWS::RDS::DBClusterSnapshot, AWS::SNS::Topic, AWS::S3Express::DirectoryBucket, AWS::DynamoDB::Table, AWS::DynamoDB::Stream, AWS::IAM::User)
shared_via	array	Indicates how the access that generated the finding is granted. This is populated for Amazon S3 bucket findings.
status	string	The current status of the finding generated from the analyzed resource. (ACTIVE, ARCHIVED, RESOLVED)
updated_at	string (date-time)	The time at which the finding was updated.

list_analyzed_resources

Name	Datatype	Description
resource_arn	string	The ARN of the analyzed resource. (pattern: <code>arn:[^:]:[^:]:[^:]:[^:]:.*</code>)
resource_owner_account	string	The Amazon Web Services account ID that owns the resource.
resource_type	string	The type of resource that was analyzed. (AWS::S3::Bucket, AWS::IAM::Role, AWS::SQS::Queue, AWS::Lambda::Function, AWS::Lambda::LayerVersion, AWS::KMS::Key, AWS::SecretsManager::Secret, AWS::EFS::FileSystem, AWS::EC2::Snapshot, AWS::ECR::Repository, AWS::RDS::DBSnapshot, AWS::RDS::DBClusterSnapshot, AWS::SNS::Topic, AWS::S3Express::DirectoryBucket, AWS::DynamoDB::Table, AWS::DynamoDB::Stream, AWS::IAM::User)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_analyzed_resource	select	analyzerArn, resourceArn, region		Retrieves information about a resource that was analyzed. This action is supported only for external access analyzers.
list_analyzed_resources	select	region		Retrieves a list of resources of the specified type that have been analyzed by the specified analyzer.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
analyzerArn	string	The ARN of the analyzer to retrieve information from.
region	string	AWS region (default: us-east-1)
resourceArn	string	The ARN of the resource to retrieve information about.

SELECT examples

get_analyzed_resource

Retrieves information about a resource that was analyzed. This action is supported only for external access analyzers.

SELECT
actions,
analyzed_at,
created_at,
error,
is_public,
resource_arn,
resource_owner_account,
resource_type,
shared_via,
status,
updated_at
FROM aws.accessanalyzer.analyzed_resources
WHERE analyzerArn = '{{ analyzerArn }}' -- required
AND resourceArn = '{{ resourceArn }}' -- required
AND region = '{{ region }}' -- required
;

list_analyzed_resources

Retrieves a list of resources of the specified type that have been analyzed by the specified analyzer.

SELECT
resource_arn,
resource_owner_account,
resource_type
FROM aws.accessanalyzer.analyzed_resources
WHERE region = '{{ region }}' -- required
;