findings

Creates, updates, deletes, gets or lists a findings resource.

Overview

Name	findings
Type	Resource
Id	aws.accessanalyzer.findings

Fields

The following fields are returned by SELECT queries:

get_finding

Name	Datatype	Description
id	string	The ID of the finding.
action	array	The action in the analyzed policy statement that an external principal has permission to use.
analyzed_at	string (date-time)	The time at which the resource was analyzed.
condition	object	The condition in the analyzed policy statement that resulted in a finding.
created_at	string (date-time)	The time at which the finding was generated.
error	string	An error.
is_public	boolean	Indicates whether the policy that generated the finding allows public access to the resource.
principal	object	The external principal that has access to a resource within the zone of trust.
resource	string	The resource that an external principal has access to.
resource_control_policy_restriction	string	The type of restriction applied to the finding by the resource owner with an Organizations resource control policy (RCP). (APPLICABLE, FAILED_TO_EVALUATE_RCP, NOT_APPLICABLE, APPLIED)
resource_owner_account	string	The Amazon Web Services account ID that owns the resource.
resource_type	string	The type of the resource identified in the finding. (AWS::S3::Bucket, AWS::IAM::Role, AWS::SQS::Queue, AWS::Lambda::Function, AWS::Lambda::LayerVersion, AWS::KMS::Key, AWS::SecretsManager::Secret, AWS::EFS::FileSystem, AWS::EC2::Snapshot, AWS::ECR::Repository, AWS::RDS::DBSnapshot, AWS::RDS::DBClusterSnapshot, AWS::SNS::Topic, AWS::S3Express::DirectoryBucket, AWS::DynamoDB::Table, AWS::DynamoDB::Stream, AWS::IAM::User)
sources	array	The sources of the finding. This indicates how the access that generated the finding is granted. It is populated for Amazon S3 bucket findings.
status	string	The current status of the finding. (ACTIVE, ARCHIVED, RESOLVED)
updated_at	string (date-time)	The time at which the finding was updated.

list_findings

Name	Datatype	Description
id	string	The ID of the finding.
action	array	The action in the analyzed policy statement that an external principal has permission to use.
analyzed_at	string (date-time)	The time at which the resource-based policy that generated the finding was analyzed.
condition	object	The condition in the analyzed policy statement that resulted in a finding.
created_at	string (date-time)	The time at which the finding was created.
error	string	The error that resulted in an Error finding.
is_public	boolean	Indicates whether the finding reports a resource that has a policy that allows public access.
principal	object	The external principal that has access to a resource within the zone of trust.
resource	string	The resource that the external principal has access to.
resource_control_policy_restriction	string	The type of restriction applied to the finding by the resource owner with an Organizations resource control policy (RCP). (APPLICABLE, FAILED_TO_EVALUATE_RCP, NOT_APPLICABLE, APPLIED)
resource_owner_account	string	The Amazon Web Services account ID that owns the resource.
resource_type	string	The type of the resource that the external principal has access to. (AWS::S3::Bucket, AWS::IAM::Role, AWS::SQS::Queue, AWS::Lambda::Function, AWS::Lambda::LayerVersion, AWS::KMS::Key, AWS::SecretsManager::Secret, AWS::EFS::FileSystem, AWS::EC2::Snapshot, AWS::ECR::Repository, AWS::RDS::DBSnapshot, AWS::RDS::DBClusterSnapshot, AWS::SNS::Topic, AWS::S3Express::DirectoryBucket, AWS::DynamoDB::Table, AWS::DynamoDB::Stream, AWS::IAM::User)
sources	array	The sources of the finding. This indicates how the access that generated the finding is granted. It is populated for Amazon S3 bucket findings.
status	string	The status of the finding. (ACTIVE, ARCHIVED, RESOLVED)
updated_at	string (date-time)	The time at which the finding was most recently updated.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_finding	select	analyzerArn, id, region		Retrieves information about the specified finding. GetFinding and GetFindingV2 both use access-analyzer:GetFinding in the Action element of an IAM policy statement. You must have permission to perform the access-analyzer:GetFinding action. GetFinding is supported only for external access analyzers. You must use GetFindingV2 for internal and unused access analyzers.
list_findings	select	region		Retrieves a list of findings generated by the specified analyzer. ListFindings and ListFindingsV2 both use access-analyzer:ListFindings in the Action element of an IAM policy statement. You must have permission to perform the access-analyzer:ListFindings action. To learn about filter keys that you can use to retrieve a list of findings, see IAM Access Analyzer filter keys in the IAM User Guide. ListFindings is supported only for external access analyzers. You must use ListFindingsV2 for internal and unused access analyzers.
update_findings	update	region, analyzerArn, status		Updates the status for the specified findings.
generate_finding_recommendation	exec	analyzerArn, id, region		Creates a recommendation for an unused permissions finding.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
analyzerArn	string	The ARN of the analyzer used to generate the finding recommendation.
id	string	The unique ID for the finding recommendation.
region	string	AWS region (default: us-east-1)

SELECT examples

get_finding

Retrieves information about the specified finding. GetFinding and GetFindingV2 both use access-analyzer:GetFinding in the Action element of an IAM policy statement. You must have permission to perform the access-analyzer:GetFinding action. GetFinding is supported only for external access analyzers. You must use GetFindingV2 for internal and unused access analyzers.

SELECT
id,
action,
analyzed_at,
condition,
created_at,
error,
is_public,
principal,
resource,
resource_control_policy_restriction,
resource_owner_account,
resource_type,
sources,
status,
updated_at
FROM aws.accessanalyzer.findings
WHERE analyzerArn = '{{ analyzerArn }}' -- required
AND id = '{{ id }}' -- required
AND region = '{{ region }}' -- required
;

list_findings

Retrieves a list of findings generated by the specified analyzer. ListFindings and ListFindingsV2 both use access-analyzer:ListFindings in the Action element of an IAM policy statement. You must have permission to perform the access-analyzer:ListFindings action. To learn about filter keys that you can use to retrieve a list of findings, see IAM Access Analyzer filter keys in the IAM User Guide. ListFindings is supported only for external access analyzers. You must use ListFindingsV2 for internal and unused access analyzers.

SELECT
id,
action,
analyzed_at,
condition,
created_at,
error,
is_public,
principal,
resource,
resource_control_policy_restriction,
resource_owner_account,
resource_type,
sources,
status,
updated_at
FROM aws.accessanalyzer.findings
WHERE region = '{{ region }}' -- required
;

UPDATE examples

update_findings

Updates the status for the specified findings.

UPDATE aws.accessanalyzer.findings
SET 
analyzerArn = '{{ analyzerArn }}',
status = '{{ status }}',
ids = '{{ ids }}',
resourceArn = '{{ resourceArn }}',
clientToken = '{{ clientToken }}'
WHERE 
region = '{{ region }}' --required
AND analyzerArn = '{{ analyzerArn }}' --required
AND status = '{{ status }}' --required;

Lifecycle Methods

generate_finding_recommendation

Creates a recommendation for an unused permissions finding.

EXEC aws.accessanalyzer.findings.generate_finding_recommendation 
@analyzerArn='{{ analyzerArn }}' --required, 
@id='{{ id }}' --required, 
@region='{{ region }}' --required
;