analyzers

Creates, updates, deletes, gets or lists an analyzers resource.

Overview

Name	`analyzers`
Type	Resource
Id	`aws.accessanalyzer.analyzers`

Fields

The following fields are returned by SELECT queries:

get_analyzer
list_analyzers

Name	Datatype	Description
`name`	`string`	The name of the analyzer. (pattern: <code>[A-Za-z_][A-Za-z0-9_.-]*</code>)
`arn`	`string`	The ARN of the analyzer. (pattern: <code>[^:]:[^:]:[^:]:[^:]:[^:]*:analyzer/.{1,255}</code>)
`configuration`	`object`	Contains information about the configuration of an analyzer for an Amazon Web Services organization or account.
`created_at`	`string (date-time)`	A timestamp for the time at which the analyzer was created.
`last_resource_analyzed`	`string`	The resource that was most recently analyzed by the analyzer.
`last_resource_analyzed_at`	`string (date-time)`	The time at which the most recently analyzed resource was analyzed.
`managed_by`	`string`	The service principal that manages this analyzer (for example, securityhubv2.amazonaws.com). This field is only present for service-linked analyzers and is not included for customer-managed analyzers.
`status`	`string`	The status of the analyzer. An Active analyzer successfully monitors supported resources and generates new findings. The analyzer is Disabled when a user action, such as removing trusted access for Identity and Access Management Access Analyzer from Organizations, causes the analyzer to stop generating new findings. The status is Creating when the analyzer creation is in progress and Failed when the analyzer creation has failed. (ACTIVE, CREATING, DISABLED, FAILED)
`status_reason`	`object`	The statusReason provides more details about the current status of the analyzer. For example, if the creation for the analyzer fails, a Failed status is returned. For an analyzer with organization as the type, this failure can be due to an issue with creating the service-linked roles required in the member accounts of the Amazon Web Services organization.
`tags`	`object`	An array of key-value pairs applied to the analyzer. The key-value pairs consist of the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. The tag key is a value that is 1 to 128 characters in length and cannot be prefixed with aws:. The tag value is a value that is 0 to 256 characters in length.
`type_`	`string`	The type represents the zone of trust or scope for the analyzer. (ACCOUNT, ORGANIZATION, ACCOUNT_UNUSED_ACCESS, ORGANIZATION_UNUSED_ACCESS, ACCOUNT_INTERNAL_ACCESS, ORGANIZATION_INTERNAL_ACCESS)

Name	Datatype	Description
`name`	`string`	The name of the analyzer. (pattern: <code>[A-Za-z_][A-Za-z0-9_.-]*</code>)
`arn`	`string`	The ARN of the analyzer. (pattern: <code>[^:]:[^:]:[^:]:[^:]:[^:]*:analyzer/.{1,255}</code>)
`configuration`	`object`	Contains information about the configuration of an analyzer for an Amazon Web Services organization or account.
`created_at`	`string (date-time)`	A timestamp for the time at which the analyzer was created.
`last_resource_analyzed`	`string`	The resource that was most recently analyzed by the analyzer.
`last_resource_analyzed_at`	`string (date-time)`	The time at which the most recently analyzed resource was analyzed.
`managed_by`	`string`	The service principal that manages this analyzer (for example, securityhubv2.amazonaws.com). This field is only present for service-linked analyzers and is not included for customer-managed analyzers.
`status`	`string`	The status of the analyzer. An Active analyzer successfully monitors supported resources and generates new findings. The analyzer is Disabled when a user action, such as removing trusted access for Identity and Access Management Access Analyzer from Organizations, causes the analyzer to stop generating new findings. The status is Creating when the analyzer creation is in progress and Failed when the analyzer creation has failed. (ACTIVE, CREATING, DISABLED, FAILED)
`status_reason`	`object`	The statusReason provides more details about the current status of the analyzer. For example, if the creation for the analyzer fails, a Failed status is returned. For an analyzer with organization as the type, this failure can be due to an issue with creating the service-linked roles required in the member accounts of the Amazon Web Services organization.
`tags`	`object`	An array of key-value pairs applied to the analyzer. The key-value pairs consist of the set of Unicode letters, digits, whitespace, _, ., /, =, +, and -. The tag key is a value that is 1 to 128 characters in length and cannot be prefixed with aws:. The tag value is a value that is 0 to 256 characters in length.
`type_`	`string`	The type represents the zone of trust or scope for the analyzer. (ACCOUNT, ORGANIZATION, ACCOUNT_UNUSED_ACCESS, ORGANIZATION_UNUSED_ACCESS, ACCOUNT_INTERNAL_ACCESS, ORGANIZATION_INTERNAL_ACCESS)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
`get_analyzer`	`select`	`analyzer_name`, `region`		Retrieves information about the specified analyzer.
`list_analyzers`	`select`	`region`	`nextToken`, `maxResults`, `type`	Retrieves a list of analyzers.
`create_analyzer`	`insert`	`region`, `analyzerName`, `type`		Creates an analyzer for your account.
`create_service_linked_analyzer`	`insert`	`region`, `type`		Creates a service-linked analyzer managed by an Amazon Web Services service. This operation can only be invoked by authorized Amazon Web Services services. Direct customer invocation returns AccessDeniedException. Service-linked analyzers enable Amazon Web Services services to create and manage analyzers on behalf of customers. The lifecycle of these analyzers is managed by the calling service.
`update_analyzer`	`update`	`analyzer_name`, `region`		Modifies the configuration of an existing analyzer. This action is not supported for external access analyzers.
`delete_analyzer`	`delete`	`analyzer_name`, `region`	`clientToken`	Deletes the specified analyzer. When you delete an analyzer, IAM Access Analyzer is disabled for the account or organization in the current or specific Region. All findings that were generated by the analyzer are deleted. You cannot undo this action.
`apply_archive_rule`	`exec`	`region`, `analyzerArn`, `ruleName`		Retroactively applies the archive rule to existing findings that meet the archive rule criteria.
`delete_service_linked_analyzer`	`exec`	`analyzer_name`, `region`	`clientToken`	Deletes a service-linked analyzer. This operation can be invoked by both authorized Amazon Web Services services and customers. When invoked by a customer, IAM Access Analyzer performs a callback to the managing service to verify whether the analyzer is still in use and can be deleted. If the service indicates the analyzer is still in use, the deletion is rejected with ConflictException.
`start_resource_scan`	`exec`	`region`, `analyzerArn`, `resourceArn`		Immediately starts a scan of the policies applied to the specified resource. This action is supported only for external access analyzers.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`analyzer_name`	`string`	The name of the service-linked analyzer to delete. Service-linked analyzer names follow the format _AccessAnalyzerFor{ServiceName}-{Id}.
`region`	`string`	AWS region (default: us-east-1)
`clientToken`	`string`	A client token.
`maxResults`	`integer`	The maximum number of results to return in the response.
`nextToken`	`string`	A token used for pagination of results returned.
`type`	`string`	The type of analyzer.

`SELECT` examples

get_analyzer
list_analyzers

Retrieves information about the specified analyzer.

SELECT
name,
arn,
configuration,
created_at,
last_resource_analyzed,
last_resource_analyzed_at,
managed_by,
status,
status_reason,
tags,
type_
FROM aws.accessanalyzer.analyzers
WHERE analyzer_name = '{{ analyzer_name }}' -- required
AND region = '{{ region }}' -- required
;

Retrieves a list of analyzers.

SELECT
name,
arn,
configuration,
created_at,
last_resource_analyzed,
last_resource_analyzed_at,
managed_by,
status,
status_reason,
tags,
type_
FROM aws.accessanalyzer.analyzers
WHERE region = '{{ region }}' -- required
AND nextToken = '{{ nextToken }}'
AND maxResults = '{{ maxResults }}'
AND type = '{{ type }}'
;

`INSERT` examples

create_analyzer
create_service_linked_analyzer
Manifest

Creates an analyzer for your account.

INSERT INTO aws.accessanalyzer.analyzers (
analyzerName,
type,
archiveRules,
tags,
clientToken,
configuration,
region
)
SELECT 
'{{ analyzerName }}' /* required */,
'{{ type }}' /* required */,
'{{ archiveRules }}',
'{{ tags }}',
'{{ clientToken }}',
'{{ configuration }}',
'{{ region }}'
RETURNING
arn
;

Creates a service-linked analyzer managed by an Amazon Web Services service. This operation can only be invoked by authorized Amazon Web Services services. Direct customer invocation returns AccessDeniedException. Service-linked analyzers enable Amazon Web Services services to create and manage analyzers on behalf of customers. The lifecycle of these analyzers is managed by the calling service.

INSERT INTO aws.accessanalyzer.analyzers (
type,
archiveRules,
clientToken,
configuration,
region
)
SELECT 
'{{ type }}' /* required */,
'{{ archiveRules }}',
'{{ clientToken }}',
'{{ configuration }}',
'{{ region }}'
RETURNING
arn
;

# Description fields are for documentation purposes
- name: analyzers
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the analyzers resource.
  - name: analyzerName
    value: "{{ analyzerName }}"
  - name: type
    value: "{{ type }}"
    valid_values: ['ACCOUNT', 'ORGANIZATION', 'ACCOUNT_UNUSED_ACCESS', 'ORGANIZATION_UNUSED_ACCESS', 'ACCOUNT_INTERNAL_ACCESS', 'ORGANIZATION_INTERNAL_ACCESS']
  - name: archiveRules
    value:
      - ruleName: "{{ ruleName }}"
        filter: "{{ filter }}"
  - name: tags
    value: "{{ tags }}"
  - name: clientToken
    value: "{{ clientToken }}"
  - name: configuration
    description: |
      Contains information about the configuration of an analyzer for an Amazon Web Services organization or account.
    value:
      unusedAccess:
        unusedAccessAge: {{ unusedAccessAge }}
        analysisRule:
          exclusions:
            - accountIds: "{{ accountIds }}"
              resourceTags: "{{ resourceTags }}"
      internalAccess:
        analysisRule:
          inclusions:
            - accountIds: "{{ accountIds }}"
              resourceTypes: "{{ resourceTypes }}"
              resourceArns: "{{ resourceArns }}"

`UPDATE` examples

update_analyzer

Modifies the configuration of an existing analyzer. This action is not supported for external access analyzers.

UPDATE aws.accessanalyzer.analyzers
SET 
configuration = '{{ configuration }}'
WHERE 
analyzer_name = '{{ analyzer_name }}' --required
AND region = '{{ region }}' --required
RETURNING
configuration;

`DELETE` examples

delete_analyzer

Deletes the specified analyzer. When you delete an analyzer, IAM Access Analyzer is disabled for the account or organization in the current or specific Region. All findings that were generated by the analyzer are deleted. You cannot undo this action.

DELETE FROM aws.accessanalyzer.analyzers
WHERE analyzer_name = '{{ analyzer_name }}' --required
AND region = '{{ region }}' --required
AND clientToken = '{{ clientToken }}'
;

Lifecycle Methods

apply_archive_rule
delete_service_linked_analyzer
start_resource_scan

Retroactively applies the archive rule to existing findings that meet the archive rule criteria.

EXEC aws.accessanalyzer.analyzers.apply_archive_rule 
@region='{{ region }}' --required 
@@json=
'{
"analyzerArn": "{{ analyzerArn }}", 
"ruleName": "{{ ruleName }}", 
"clientToken": "{{ clientToken }}"
}'
;

Deletes a service-linked analyzer. This operation can be invoked by both authorized Amazon Web Services services and customers. When invoked by a customer, IAM Access Analyzer performs a callback to the managing service to verify whether the analyzer is still in use and can be deleted. If the service indicates the analyzer is still in use, the deletion is rejected with ConflictException.

EXEC aws.accessanalyzer.analyzers.delete_service_linked_analyzer 
@analyzer_name='{{ analyzer_name }}' --required, 
@region='{{ region }}' --required, 
@clientToken='{{ clientToken }}'
;

Immediately starts a scan of the policies applied to the specified resource. This action is supported only for external access analyzers.

EXEC aws.accessanalyzer.analyzers.start_resource_scan 
@region='{{ region }}' --required 
@@json=
'{
"analyzerArn": "{{ analyzerArn }}", 
"resourceArn": "{{ resourceArn }}", 
"resourceOwnerAccount": "{{ resourceOwnerAccount }}"
}'
;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

INSERT examples​

UPDATE examples​

DELETE examples​

Lifecycle Methods​