evidences

Creates, updates, deletes, gets or lists an evidences resource.

Overview

Name	evidences
Type	Resource
Id	aws.auditmanager.evidences

Fields

The following fields are returned by SELECT queries:

get_evidence

Name	Datatype	Description
id	string	The identifier for the evidence. (pattern: <code>^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$</code>)
assessment_report_selection	string	Specifies whether the evidence is included in the assessment report. (pattern: <code>.*</code>)
attributes	object	The names and values that are used by the evidence event. This includes an attribute name (such as allowUsersToChangePassword) and value (such as true or false).
aws_account_id	string	The identifier for the Amazon Web Services account. (pattern: <code>^[0-9]{12}$</code>)
aws_organization	string	The Amazon Web Services account that the evidence is collected from, and its organization path. (pattern: <code>.*</code>)
compliance_check	string	The evaluation status for automated evidence that falls under the compliance check category. Audit Manager classes evidence as non-compliant if Security Hub CSPM reports a Fail result, or if Config reports a Non-compliant result. Audit Manager classes evidence as compliant if Security Hub CSPM reports a Pass result, or if Config reports a Compliant result. If a compliance check isn't available or applicable, then no compliance evaluation can be made for that evidence. This is the case if the evidence uses Config or Security Hub CSPM as the underlying data source type, but those services aren't enabled. This is also the case if the evidence uses an underlying data source type that doesn't support compliance checks (such as manual evidence, Amazon Web Services API calls, or CloudTrail). (pattern: <code>.*</code>)
data_source	string	The data source where the evidence was collected from. (pattern: <code>.*</code>)
event_name	string	The name of the evidence event. (pattern: <code>^[\w\W\s\S]*$</code>)
event_source	string	The Amazon Web Services service that the evidence is collected from. (pattern: <code>^[a-zA-Z0-9-\s().]+$</code>)
evidence_aws_account_id	string	The identifier for the Amazon Web Services account. (pattern: <code>^[0-9]{12}$</code>)
evidence_by_type	string	The type of automated evidence. (pattern: <code>.*</code>)
evidence_folder_id	string	The identifier for the folder that the evidence is stored in. (pattern: <code>^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$</code>)
iam_id	string	The unique identifier for the user or role that's associated with the evidence. (pattern: <code>^arn:.:iam:.</code>)
resources_included	array	The list of resources that are assessed to generate the evidence.
time	string (date-time)	The timestamp that represents when the evidence was collected.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_evidence	select	assessment_id, control_set_id, evidence_folder_id, evidence_id, region		Gets information about a specified evidence item.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
assessment_id	string	The unique identifier for the assessment.
control_set_id	string	The unique identifier for the control set.
evidence_folder_id	string	The unique identifier for the folder that the evidence is stored in.
evidence_id	string	The unique identifier for the evidence.
region	string	AWS region (default: us-east-1)

SELECT examples

get_evidence

Gets information about a specified evidence item.

SELECT
id,
assessment_report_selection,
attributes,
aws_account_id,
aws_organization,
compliance_check,
data_source,
event_name,
event_source,
evidence_aws_account_id,
evidence_by_type,
evidence_folder_id,
iam_id,
resources_included,
time
FROM aws.auditmanager.evidences
WHERE assessment_id = '{{ assessment_id }}' -- required
AND control_set_id = '{{ control_set_id }}' -- required
AND evidence_folder_id = '{{ evidence_folder_id }}' -- required
AND evidence_id = '{{ evidence_id }}' -- required
AND region = '{{ region }}' -- required
;