evidence_folders

Creates, updates, deletes, gets or lists an evidence_folders resource.

Overview

Name	evidence_folders
Type	Resource
Id	aws.auditmanager.evidence_folders

Fields

The following fields are returned by SELECT queries:

get_evidence_folder

Name	Datatype	Description
id	string	The identifier for the folder that the evidence is stored in. (pattern: <code>^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$</code>)
name	string	The name of the evidence folder. (pattern: <code>^[\w\W\s\S]*$</code>)
assessment_id	string	The identifier for the assessment. (pattern: <code>^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$</code>)
assessment_report_selection_count	integer	The total count of evidence that's included in the assessment report.
author	string	The name of the user who created the evidence folder. (pattern: <code>.*</code>)
control_id	string	The unique identifier for the control. (pattern: <code>^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$</code>)
control_name	string	The name of the control. (pattern: <code>^[^\]*$</code>)
control_set_id	string	The identifier for the control set. (pattern: <code>^[\w\W\s\S]*$</code>)
data_source	string	The Amazon Web Services service that the evidence was collected from. (pattern: <code>.*</code>)
date	string (date-time)	The date when the first evidence was added to the evidence folder.
evidence_aws_service_source_count	integer	The total number of Amazon Web Services resources that were assessed to generate the evidence.
evidence_by_type_compliance_check_count	integer	The number of evidence that falls under the compliance check category. This evidence is collected from Config or Security Hub CSPM.
evidence_by_type_compliance_check_issues_count	integer	The total number of issues that were reported directly from Security Hub CSPM, Config, or both.
evidence_by_type_configuration_data_count	integer	The number of evidence that falls under the configuration data category. This evidence is collected from configuration snapshots of other Amazon Web Services services such as Amazon EC2, Amazon S3, or IAM.
evidence_by_type_manual_count	integer	The number of evidence that falls under the manual category. This evidence is imported manually.
evidence_by_type_user_activity_count	integer	The number of evidence that falls under the user activity category. This evidence is collected from CloudTrail logs.
evidence_resources_included_count	integer	The amount of evidence that's included in the evidence folder.
total_evidence	integer	The total amount of evidence in the evidence folder.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_evidence_folder	select	assessment_id, control_set_id, evidence_folder_id, region		Gets an evidence folder from a specified assessment in Audit Manager.
associate_assessment_report_evidence_folder	update	assessment_id, region, evidenceFolderId		Associates an evidence folder to an assessment report in an Audit Manager assessment.
batch_associate_assessment_report_evidence	exec	assessment_id, region, evidenceFolderId, evidenceIds		Associates a list of evidence to an assessment report in an Audit Manager assessment.
batch_disassociate_assessment_report_evidence	exec	assessment_id, region, evidenceFolderId, evidenceIds		Disassociates a list of evidence from an assessment report in Audit Manager.
disassociate_assessment_report_evidence_folder	exec	assessment_id, region, evidenceFolderId		Disassociates an evidence folder from the specified assessment report in Audit Manager.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
assessment_id	string	The unique identifier for the assessment.
control_set_id	string	The unique identifier for the control set.
evidence_folder_id	string	The unique identifier for the folder that the evidence is stored in.
region	string	AWS region (default: us-east-1)

SELECT examples

get_evidence_folder

Gets an evidence folder from a specified assessment in Audit Manager.

SELECT
id,
name,
assessment_id,
assessment_report_selection_count,
author,
control_id,
control_name,
control_set_id,
data_source,
date,
evidence_aws_service_source_count,
evidence_by_type_compliance_check_count,
evidence_by_type_compliance_check_issues_count,
evidence_by_type_configuration_data_count,
evidence_by_type_manual_count,
evidence_by_type_user_activity_count,
evidence_resources_included_count,
total_evidence
FROM aws.auditmanager.evidence_folders
WHERE assessment_id = '{{ assessment_id }}' -- required
AND control_set_id = '{{ control_set_id }}' -- required
AND evidence_folder_id = '{{ evidence_folder_id }}' -- required
AND region = '{{ region }}' -- required
;

UPDATE examples

associate_assessment_report_evidence_folder

Associates an evidence folder to an assessment report in an Audit Manager assessment.

UPDATE aws.auditmanager.evidence_folders
SET 
evidenceFolderId = '{{ evidenceFolderId }}'
WHERE 
assessment_id = '{{ assessment_id }}' --required
AND region = '{{ region }}' --required
AND evidenceFolderId = '{{ evidenceFolderId }}' --required;

Lifecycle Methods

batch_associate_assessment_report_evidence

Associates a list of evidence to an assessment report in an Audit Manager assessment.

EXEC aws.auditmanager.evidence_folders.batch_associate_assessment_report_evidence 
@assessment_id='{{ assessment_id }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"evidenceFolderId": "{{ evidenceFolderId }}", 
"evidenceIds": "{{ evidenceIds }}"
}'
;

batch_disassociate_assessment_report_evidence

Disassociates a list of evidence from an assessment report in Audit Manager.

EXEC aws.auditmanager.evidence_folders.batch_disassociate_assessment_report_evidence 
@assessment_id='{{ assessment_id }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"evidenceFolderId": "{{ evidenceFolderId }}", 
"evidenceIds": "{{ evidenceIds }}"
}'
;

disassociate_assessment_report_evidence_folder

Disassociates an evidence folder from the specified assessment report in Audit Manager.

EXEC aws.auditmanager.evidence_folders.disassociate_assessment_report_evidence_folder 
@assessment_id='{{ assessment_id }}' --required, 
@region='{{ region }}' --required 
@@json=
'{
"evidenceFolderId": "{{ evidenceFolderId }}"
}'
;