investigation_groups

Creates, updates, deletes, gets or lists an investigation_groups resource.

Overview

Name	`investigation_groups`
Type	Resource
Id	`aws.aiops.investigation_groups`

Fields

The following fields are returned by SELECT queries:

get_investigation_group
list_investigation_groups

Name	Datatype	Description
`name`	`string`	The name of the investigation group. (pattern: <code>[-_A-Za-z0-9[](){}.: ]+</code>)
`arn`	`string`	The Amazon Resource Name (ARN) of the investigation group. (pattern: <code>arn:(aws\|aws-us-gov\|aws-cn\|aws-iso\|aws-iso-b):aiops:[a-zA-Z0-9-]*:[0-9]{12}:investigation-group/[A-Za-z0-9]{16}</code>)
`chatbot_notification_channel`	`object`	This structure is a string array. The first string is the ARN of a Amazon SNS topic. The array of strings display the ARNs of chat applications configurations that are associated with that topic. For more information about these configuration ARNs, see Getting started with Amazon Q in chat applications and Resource type defined by Amazon Web Services Chatbot.
`created_at`	`integer (int64)`	The date and time that the investigation group was created.
`created_by`	`string`	The name of the user who created the investigation group. (pattern: <code>[-_/A-Za-z0-9:.]+</code>)
`cross_account_configurations`	`array`	Lists the AWSAccountId of the accounts configured for cross-account access and the results of the last scan performed on each account.
`encryption_configuration`	`object`	Use this structure to specify a customer managed KMS key to use to encrypt investigation data.
`is_cloud_trail_event_history_enabled`	`boolean`	Specifies whether CloudWatch investigationshas access to change events that are recorded by CloudTrail.
`last_modified_at`	`integer (int64)`	The date and time that the investigation group was most recently modified.
`last_modified_by`	`string`	The name of the user who created the investigation group. (pattern: <code>[-_/A-Za-z0-9:.]+</code>)
`retention_in_days`	`integer (int64)`	Specifies how long that investigation data is kept.
`role_arn`	`string`	The ARN of the IAM role that the investigation group uses for permissions to gather data. (pattern: <code>arn:.*</code>)
`tag_key_boundaries`	`array`	Displays the custom tag keys for custom applications in your system that you have specified in the investigation group. Resource tags help CloudWatch investigations narrow the search space when it is unable to discover definite relationships between resources.

Name	Datatype	Description
`name`	`string`	The name of the investigation group. (pattern: <code>[-_A-Za-z0-9[](){}.: ]+</code>)
`arn`	`string`	The Amazon Resource Name (ARN) of the investigation group. (pattern: <code>arn:(aws\|aws-us-gov\|aws-cn\|aws-iso\|aws-iso-b):aiops:[a-zA-Z0-9-]*:[0-9]{12}:investigation-group/[A-Za-z0-9]{16}</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
`get_investigation_group`	`select`	`identifier`, `region`		Returns the configuration information for the specified investigation group.
`list_investigation_groups`	`select`	`region`	`nextToken`, `maxResults`	Returns the ARN and name of each investigation group in the account.
`create_investigation_group`	`insert`	`region`, `name`, `roleArn`		Creates an investigation group in your account. Creating an investigation group is a one-time setup task for each Region in your account. It is a necessary task to be able to perform investigations. Settings in the investigation group help you centrally manage the common properties of your investigations, such as the following: Who can access the investigations Whether investigation data is encrypted with a customer managed Key Management Service key. How long investigations and their data are retained by default. Currently, you can have one investigation group in each Region in your account. Each investigation in a Region is a part of the investigation group in that Region To create an investigation group and set up CloudWatch investigations, you must be signed in to an IAM principal that has either the AIOpsConsoleAdminPolicy or the AdministratorAccess IAM policy attached, or to an account that has similar permissions. You can configure CloudWatch alarms to start investigations and add events to investigations. If you create your investigation group with CreateInvestigationGroup and you want to enable alarms to do this, you must use PutInvestigationGroupPolicy to create a resource policy that grants this permission to CloudWatch alarms. For more information about configuring CloudWatch alarms, see Using Amazon CloudWatch alarms
`update_investigation_group`	`update`	`identifier`, `region`		Updates the configuration of the specified investigation group.
`delete_investigation_group`	`delete`	`identifier`, `region`		Deletes the specified investigation group from your account. You can currently have one investigation group per Region in your account. After you delete an investigation group, you can later create a new investigation group in the same Region.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
`identifier`	`string`	Specify either the name or the ARN of the investigation group that you want to delete.
`region`	`string`	AWS region (default: us-east-1)
`maxResults`	`integer`	The maximum number of results to return in one operation. If you omit this parameter, the default of 50 is used.
`nextToken`	`string`	Include this value, if it was returned by the previous operation, to get the next set of service operations.

`SELECT` examples

get_investigation_group
list_investigation_groups

Returns the configuration information for the specified investigation group.

SELECT
name,
arn,
chatbot_notification_channel,
created_at,
created_by,
cross_account_configurations,
encryption_configuration,
is_cloud_trail_event_history_enabled,
last_modified_at,
last_modified_by,
retention_in_days,
role_arn,
tag_key_boundaries
FROM aws.aiops.investigation_groups
WHERE identifier = '{{ identifier }}' -- required
AND region = '{{ region }}' -- required
;

Returns the ARN and name of each investigation group in the account.

SELECT
name,
arn
FROM aws.aiops.investigation_groups
WHERE region = '{{ region }}' -- required
AND nextToken = '{{ nextToken }}'
AND maxResults = '{{ maxResults }}'
;

`INSERT` examples

create_investigation_group
Manifest

Creates an investigation group in your account. Creating an investigation group is a one-time setup task for each Region in your account. It is a necessary task to be able to perform investigations. Settings in the investigation group help you centrally manage the common properties of your investigations, such as the following: Who can access the investigations Whether investigation data is encrypted with a customer managed Key Management Service key. How long investigations and their data are retained by default. Currently, you can have one investigation group in each Region in your account. Each investigation in a Region is a part of the investigation group in that Region To create an investigation group and set up CloudWatch investigations, you must be signed in to an IAM principal that has either the AIOpsConsoleAdminPolicy or the AdministratorAccess IAM policy attached, or to an account that has similar permissions. You can configure CloudWatch alarms to start investigations and add events to investigations. If you create your investigation group with CreateInvestigationGroup and you want to enable alarms to do this, you must use PutInvestigationGroupPolicy to create a resource policy that grants this permission to CloudWatch alarms. For more information about configuring CloudWatch alarms, see Using Amazon CloudWatch alarms

INSERT INTO aws.aiops.investigation_groups (
name,
roleArn,
encryptionConfiguration,
retentionInDays,
tags,
tagKeyBoundaries,
chatbotNotificationChannel,
isCloudTrailEventHistoryEnabled,
crossAccountConfigurations,
region
)
SELECT 
'{{ name }}' /* required */,
'{{ roleArn }}' /* required */,
'{{ encryptionConfiguration }}',
{{ retentionInDays }},
'{{ tags }}',
'{{ tagKeyBoundaries }}',
'{{ chatbotNotificationChannel }}',
{{ isCloudTrailEventHistoryEnabled }},
'{{ crossAccountConfigurations }}',
'{{ region }}'
RETURNING
arn
;

# Description fields are for documentation purposes
- name: investigation_groups
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the investigation_groups resource.
  - name: name
    value: "{{ name }}"
  - name: roleArn
    value: "{{ roleArn }}"
  - name: encryptionConfiguration
    description: |
      Use this structure to specify a customer managed KMS key to use to encrypt investigation data.
    value:
      type_: "{{ type_ }}"
      kmsKeyId: "{{ kmsKeyId }}"
  - name: retentionInDays
    value: {{ retentionInDays }}
  - name: tags
    value: "{{ tags }}"
  - name: tagKeyBoundaries
    value:
      - "{{ tagKeyBoundaries }}"
  - name: chatbotNotificationChannel
    value: "{{ chatbotNotificationChannel }}"
  - name: isCloudTrailEventHistoryEnabled
    value: {{ isCloudTrailEventHistoryEnabled }}
  - name: crossAccountConfigurations
    value:
      - sourceRoleArn: "{{ sourceRoleArn }}"

`UPDATE` examples

update_investigation_group

Updates the configuration of the specified investigation group.

UPDATE aws.aiops.investigation_groups
SET 
roleArn = '{{ roleArn }}',
encryptionConfiguration = '{{ encryptionConfiguration }}',
tagKeyBoundaries = '{{ tagKeyBoundaries }}',
chatbotNotificationChannel = '{{ chatbotNotificationChannel }}',
isCloudTrailEventHistoryEnabled = {{ isCloudTrailEventHistoryEnabled }},
crossAccountConfigurations = '{{ crossAccountConfigurations }}'
WHERE 
identifier = '{{ identifier }}' --required
AND region = '{{ region }}' --required;

`DELETE` examples

delete_investigation_group

Deletes the specified investigation group from your account. You can currently have one investigation group per Region in your account. After you delete an investigation group, you can later create a new investigation group in the same Region.

DELETE FROM aws.aiops.investigation_groups
WHERE identifier = '{{ identifier }}' --required
AND region = '{{ region }}' --required
;

Overview​

Fields​

Methods​

Parameters​

SELECT examples​

INSERT examples​

UPDATE examples​

DELETE examples​