investigation_group_policies

Creates, updates, deletes, gets or lists an investigation_group_policies resource.

Overview

Name	investigation_group_policies
Type	Resource
Id	aws.aiops.investigation_group_policies

Fields

The following fields are returned by SELECT queries:

get_investigation_group_policy

Name	Datatype	Description
investigation_group_arn	string	The Amazon Resource Name (ARN) of the investigation group that you want to view the policy of. (pattern: <code>arn:(aws|aws-us-gov|aws-cn|aws-iso|aws-iso-b):aiops:[a-zA-Z0-9-]*:[0-9]{12}:investigation-group/[A-Za-z0-9]{16}</code>)
policy	string	The policy, in JSON format. (pattern: <code>[\u0009\u000A\u000D\u0020-\u00FF]+</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_investigation_group_policy	select	identifier, region		Returns the JSON of the IAM resource policy associated with the specified investigation group in a string. For example, {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"aiops.alarms.cloudwatch.amazonaws.com"},"Action":["aiops:CreateInvestigation","aiops:CreateInvestigationEvent"],"Resource":"","Condition":{"StringEquals":{"aws:SourceAccount":"111122223333"},"ArnLike":{"aws:SourceArn":"arn:aws:cloudwatch:us-east-1:111122223333:alarm:"}}}]}.
put_investigation_group_policy	replace	identifier, region, policy		Creates an IAM resource policy and assigns it to the specified investigation group. If you create your investigation group with CreateInvestigationGroup and you want to enable CloudWatch alarms to create investigations and add events to investigations, you must use this operation to create a policy similar to this example. { "Version": "2008-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "aiops.alarms.cloudwatch.amazonaws.com" }, "Action": [ "aiops:CreateInvestigation", "aiops:CreateInvestigationEvent" ], "Resource": "", "Condition": { "StringEquals": { "aws:SourceAccount": "account-id" }, "ArnLike": { "aws:SourceArn": "arn:aws:cloudwatch:region:account-id:alarm:" } } } ] }
delete_investigation_group_policy	delete	identifier, region		Removes the IAM resource policy from being associated with the investigation group that you specify.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
identifier	string	Specify either the name or the ARN of the investigation group that you want to remove the policy from.
region	string	AWS region (default: us-east-1)

SELECT examples

get_investigation_group_policy

Returns the JSON of the IAM resource policy associated with the specified investigation group in a string. For example, {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"aiops.alarms.cloudwatch.amazonaws.com"},"Action":["aiops:CreateInvestigation","aiops:CreateInvestigationEvent"],"Resource":"","Condition":{"StringEquals":{"aws:SourceAccount":"111122223333"},"ArnLike":{"aws:SourceArn":"arn:aws:cloudwatch:us-east-1:111122223333:alarm:"}}}]}.

SELECT
investigation_group_arn,
policy
FROM aws.aiops.investigation_group_policies
WHERE identifier = '{{ identifier }}' -- required
AND region = '{{ region }}' -- required
;

REPLACE examples

put_investigation_group_policy

Creates an IAM resource policy and assigns it to the specified investigation group. If you create your investigation group with CreateInvestigationGroup and you want to enable CloudWatch alarms to create investigations and add events to investigations, you must use this operation to create a policy similar to this example. { "Version": "2008-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "aiops.alarms.cloudwatch.amazonaws.com" }, "Action": [ "aiops:CreateInvestigation", "aiops:CreateInvestigationEvent" ], "Resource": "", "Condition": { "StringEquals": { "aws:SourceAccount": "account-id" }, "ArnLike": { "aws:SourceArn": "arn:aws:cloudwatch:region:account-id:alarm:" } } } ] }

REPLACE aws.aiops.investigation_group_policies
SET 
policy = '{{ policy }}'
WHERE 
identifier = '{{ identifier }}' --required
AND region = '{{ region }}' --required
AND policy = '{{ policy }}' --required
RETURNING
investigation_group_arn;

DELETE examples

delete_investigation_group_policy

Removes the IAM resource policy from being associated with the investigation group that you specify.

DELETE FROM aws.aiops.investigation_group_policies
WHERE identifier = '{{ identifier }}' --required
AND region = '{{ region }}' --required
;