assessments

Creates, updates, deletes, gets or lists an assessments resource.

Overview

Name	assessments
Type	Resource
Id	aws.auditmanager.assessments

Fields

The following fields are returned by SELECT queries:

get_assessment

Name	Datatype	Description
assessment	object	An entity that defines the scope of audit evidence collected by Audit Manager. An Audit Manager assessment is an implementation of an Audit Manager framework.
user_role	object	The wrapper that contains the Audit Manager role information of the current user. This includes the role type and IAM Amazon Resource Name (ARN).

list_assessments

Name	Datatype	Description
assessment_metadata	array	The metadata that the ListAssessments API returns for each assessment.
next_token	string	The pagination token that's used to fetch the next set of results. (pattern: <code>^[A-Za-z0-9+/=]*$</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_assessment	select	assessment_id, region		Gets information about a specified assessment.
list_assessments	select	region	status, nextToken, maxResults	Returns a list of current and past assessments from Audit Manager.
create_assessment	insert	region, name, assessmentReportsDestination, scope, roles, frameworkId		Creates an assessment in Audit Manager.
update_assessment_control_set_status	update	assessment_id, control_set_id, region, status, comment		Updates the status of a control set in an Audit Manager assessment.
update_assessment	update	assessment_id, region, scope		Edits an Audit Manager assessment.
update_assessment_status	update	assessment_id, region, status		Updates the status of an assessment in Audit Manager.
delete_assessment	delete	assessment_id, region		Deletes an assessment in Audit Manager.
batch_create_delegation_by_assessment	exec	assessment_id, region, createDelegationRequests		Creates a batch of delegations for an assessment in Audit Manager.
batch_delete_delegation_by_assessment	exec	assessment_id, region, delegationIds		Deletes a batch of delegations for an assessment in Audit Manager.
batch_import_evidence_to_assessment_control	exec	assessment_id, control_set_id, control_id, region, manualEvidence		Adds one or more pieces of evidence to a control in an Audit Manager assessment. You can import manual evidence from any S3 bucket by specifying the S3 URI of the object. You can also upload a file from your browser, or enter plain text in response to a risk assessment question. The following restrictions apply to this action: manualEvidence can be only one of the following: evidenceFileName, s3ResourcePath, or textResponse Maximum size of an individual evidence file: 100 MB Number of daily manual evidence uploads per control: 100 Supported file formats: See Supported file types for manual evidence in the Audit Manager User Guide For more information about Audit Manager service restrictions, see Quotas and restrictions for Audit Manager.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
assessment_id	string	The identifier for the assessment.
control_id	string	The identifier for the control.
control_set_id	string	The identifier for the control set.
region	string	AWS region (default: us-east-1)
maxResults	integer	Represents the maximum number of results on a page or for an API request call.
nextToken	string	The pagination token that's used to fetch the next set of results.
status	string	The current status of the assessment.

SELECT examples

get_assessment

Gets information about a specified assessment.

SELECT
assessment,
user_role
FROM aws.auditmanager.assessments
WHERE assessment_id = '{{ assessment_id }}' -- required
AND region = '{{ region }}' -- required
;

list_assessments

Returns a list of current and past assessments from Audit Manager.

SELECT
assessment_metadata,
next_token
FROM aws.auditmanager.assessments
WHERE region = '{{ region }}' -- required
AND status = '{{ status }}'
AND nextToken = '{{ nextToken }}'
AND maxResults = '{{ maxResults }}'
;

INSERT examples

create_assessment

Creates an assessment in Audit Manager.

INSERT INTO aws.auditmanager.assessments (
name,
description,
assessmentReportsDestination,
scope,
roles,
frameworkId,
tags,
region
)
SELECT 
'{{ name }}' /* required */,
'{{ description }}',
'{{ assessmentReportsDestination }}' /* required */,
'{{ scope }}' /* required */,
'{{ roles }}' /* required */,
'{{ frameworkId }}' /* required */,
'{{ tags }}',
'{{ region }}'
RETURNING
assessment
;

Manifest

# Description fields are for documentation purposes
- name: assessments
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the assessments resource.
  - name: name
    value: "{{ name }}"
  - name: description
    value: "{{ description }}"
  - name: assessmentReportsDestination
    description: |
      The location where Audit Manager saves assessment reports for the given assessment.
    value:
      destinationType: "{{ destinationType }}"
      destination: "{{ destination }}"
  - name: scope
    description: |
      The wrapper that contains the Amazon Web Services accounts that are in scope for the assessment. You no longer need to specify which Amazon Web Services services are in scope when you create or update an assessment. Audit Manager infers the services in scope by examining your assessment controls and their data sources, and then mapping this information to the relevant Amazon Web Services services. If an underlying data source changes for your assessment, we automatically update the services scope as needed to reflect the correct Amazon Web Services services. This ensures that your assessment collects accurate and comprehensive evidence about all of the relevant services in your AWS environment.
    value:
      awsAccounts:
        - id: "{{ id }}"
          emailAddress: "{{ emailAddress }}"
          name: "{{ name }}"
      awsServices:
        - serviceName: "{{ serviceName }}"
  - name: roles
    value:
      - roleType: "{{ roleType }}"
        roleArn: "{{ roleArn }}"
  - name: frameworkId
    value: "{{ frameworkId }}"
  - name: tags
    value: "{{ tags }}"

UPDATE examples

update_assessment_control_set_status

Updates the status of a control set in an Audit Manager assessment.

UPDATE aws.auditmanager.assessments
SET 
status = '{{ status }}',
comment = '{{ comment }}'
WHERE 
assessment_id = '{{ assessment_id }}' --required
AND control_set_id = '{{ control_set_id }}' --required
AND region = '{{ region }}' --required
AND status = '{{ status }}' --required
AND comment = '{{ comment }}' --required
RETURNING
control_set;

update_assessment

Edits an Audit Manager assessment.

UPDATE aws.auditmanager.assessments
SET 
assessmentName = '{{ assessmentName }}',
assessmentDescription = '{{ assessmentDescription }}',
scope = '{{ scope }}',
assessmentReportsDestination = '{{ assessmentReportsDestination }}',
roles = '{{ roles }}'
WHERE 
assessment_id = '{{ assessment_id }}' --required
AND region = '{{ region }}' --required
AND scope = '{{ scope }}' --required
RETURNING
assessment;

update_assessment_status

Updates the status of an assessment in Audit Manager.

UPDATE aws.auditmanager.assessments
SET 
status = '{{ status }}'
WHERE 
assessment_id = '{{ assessment_id }}' --required
AND region = '{{ region }}' --required
AND status = '{{ status }}' --required
RETURNING
assessment;

DELETE examples

delete_assessment

Deletes an assessment in Audit Manager.

DELETE FROM aws.auditmanager.assessments
WHERE assessment_id = '{{ assessment_id }}' --required
AND region = '{{ region }}' --required
;

Lifecycle Methods

batch_create_delegation_by_assessment

Creates a batch of delegations for an assessment in Audit Manager.

EXEC aws.auditmanager.assessments.batch_create_delegation_by_assessment 
@assessment_id='{{ assessment_id }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"createDelegationRequests": "{{ createDelegationRequests }}"
}'
;

batch_delete_delegation_by_assessment

Deletes a batch of delegations for an assessment in Audit Manager.

EXEC aws.auditmanager.assessments.batch_delete_delegation_by_assessment 
@assessment_id='{{ assessment_id }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"delegationIds": "{{ delegationIds }}"
}'
;

batch_import_evidence_to_assessment_control

Adds one or more pieces of evidence to a control in an Audit Manager assessment. You can import manual evidence from any S3 bucket by specifying the S3 URI of the object. You can also upload a file from your browser, or enter plain text in response to a risk assessment question. The following restrictions apply to this action: manualEvidence can be only one of the following: evidenceFileName, s3ResourcePath, or textResponse Maximum size of an individual evidence file: 100 MB Number of daily manual evidence uploads per control: 100 Supported file formats: See Supported file types for manual evidence in the Audit Manager User Guide For more information about Audit Manager service restrictions, see Quotas and restrictions for Audit Manager.

EXEC aws.auditmanager.assessments.batch_import_evidence_to_assessment_control 
@assessment_id='{{ assessment_id }}' --required, 
@control_set_id='{{ control_set_id }}' --required, 
@control_id='{{ control_id }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"manualEvidence": "{{ manualEvidence }}"
}'
;