members

Creates, updates, deletes, gets or lists a members resource.

Overview

Name	members
Type	Resource
Id	aws.detective.members

Fields

The following fields are returned by SELECT queries:

get_members

Name	Datatype	Description
member_details	array	The member account details that Detective is returning in response to the request.
unprocessed_accounts	array	The requested member accounts for which Detective was unable to return member details. For each account, provides the reason why the request could not be processed.

list_members

Name	Datatype	Description
member_details	array	The list of member accounts in the behavior graph. For invited accounts, the results include member accounts that did not pass verification and member accounts that have not yet accepted the invitation to the behavior graph. The results do not include member accounts that were removed from the behavior graph. For the organization behavior graph, the results do not include organization accounts that the Detective administrator account has not enabled as member accounts.
next_token	string	If there are more member accounts remaining in the results, then use this pagination token to request the next page of member accounts.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_members	select	region		Returns the membership details for specified member accounts for a behavior graph.
list_members	select	region		Retrieves the list of member accounts for a behavior graph. For invited accounts, the results do not include member accounts that were removed from the behavior graph. For the organization behavior graph, the results do not include organization accounts that the Detective administrator account has not enabled as member accounts.
create_members	insert	region, GraphArn, Accounts		CreateMembers is used to send invitations to accounts. For the organization behavior graph, the Detective administrator account uses CreateMembers to enable organization accounts as member accounts. For invited accounts, CreateMembers sends a request to invite the specified Amazon Web Services accounts to be member accounts in the behavior graph. This operation can only be called by the administrator account for a behavior graph. CreateMembers verifies the accounts and then invites the verified accounts. The administrator can optionally specify to not send invitation emails to the member accounts. This would be used when the administrator manages their member accounts centrally. For organization accounts in the organization behavior graph, CreateMembers attempts to enable the accounts. The organization accounts do not receive invitations. The request provides the behavior graph ARN and the list of accounts to invite or to enable. The response separates the requested accounts into two lists: The accounts that CreateMembers was able to process. For invited accounts, includes member accounts that are being verified, that have passed verification and are to be invited, and that have failed verification. For organization accounts in the organization behavior graph, includes accounts that can be enabled and that cannot be enabled. The accounts that CreateMembers was unable to process. This list includes accounts that were already invited to be member accounts in the behavior graph.
delete_members	delete	region		Removes the specified member accounts from the behavior graph. The removed accounts no longer contribute data to the behavior graph. This operation can only be called by the administrator account for the behavior graph. For invited accounts, the removed accounts are deleted from the list of accounts in the behavior graph. To restore the account, the administrator account must send another invitation. For organization accounts in the organization behavior graph, the Detective administrator account can always enable the organization account again. Organization accounts that are not enabled as member accounts are not included in the ListMembers results for the organization behavior graph. An administrator account cannot use DeleteMembers to remove their own account from the behavior graph. To disable a behavior graph, the administrator account uses the DeleteGraph API method.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

get_members

Returns the membership details for specified member accounts for a behavior graph.

SELECT
member_details,
unprocessed_accounts
FROM aws.detective.members
WHERE region = '{{ region }}' -- required
;

list_members

Retrieves the list of member accounts for a behavior graph. For invited accounts, the results do not include member accounts that were removed from the behavior graph. For the organization behavior graph, the results do not include organization accounts that the Detective administrator account has not enabled as member accounts.

SELECT
member_details,
next_token
FROM aws.detective.members
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_members

CreateMembers is used to send invitations to accounts. For the organization behavior graph, the Detective administrator account uses CreateMembers to enable organization accounts as member accounts. For invited accounts, CreateMembers sends a request to invite the specified Amazon Web Services accounts to be member accounts in the behavior graph. This operation can only be called by the administrator account for a behavior graph. CreateMembers verifies the accounts and then invites the verified accounts. The administrator can optionally specify to not send invitation emails to the member accounts. This would be used when the administrator manages their member accounts centrally. For organization accounts in the organization behavior graph, CreateMembers attempts to enable the accounts. The organization accounts do not receive invitations. The request provides the behavior graph ARN and the list of accounts to invite or to enable. The response separates the requested accounts into two lists: The accounts that CreateMembers was able to process. For invited accounts, includes member accounts that are being verified, that have passed verification and are to be invited, and that have failed verification. For organization accounts in the organization behavior graph, includes accounts that can be enabled and that cannot be enabled. The accounts that CreateMembers was unable to process. This list includes accounts that were already invited to be member accounts in the behavior graph.

INSERT INTO aws.detective.members (
GraphArn,
Message,
DisableEmailNotification,
Accounts,
region
)
SELECT 
'{{ GraphArn }}' /* required */,
'{{ Message }}',
{{ DisableEmailNotification }},
'{{ Accounts }}' /* required */,
'{{ region }}'
RETURNING
members,
unprocessed_accounts
;

Manifest

# Description fields are for documentation purposes
- name: members
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the members resource.
  - name: GraphArn
    value: "{{ GraphArn }}"
  - name: Message
    value: "{{ Message }}"
  - name: DisableEmailNotification
    value: {{ DisableEmailNotification }}
  - name: Accounts
    value:
      - AccountId: "{{ AccountId }}"
        EmailAddress: "{{ EmailAddress }}"

DELETE examples

delete_members

Removes the specified member accounts from the behavior graph. The removed accounts no longer contribute data to the behavior graph. This operation can only be called by the administrator account for the behavior graph. For invited accounts, the removed accounts are deleted from the list of accounts in the behavior graph. To restore the account, the administrator account must send another invitation. For organization accounts in the organization behavior graph, the Detective administrator account can always enable the organization account again. Organization accounts that are not enabled as member accounts are not included in the ListMembers results for the organization behavior graph. An administrator account cannot use DeleteMembers to remove their own account from the behavior graph. To disable a behavior graph, the administrator account uses the DeleteGraph API method.

DELETE FROM aws.detective.members
WHERE region = '{{ region }}' --required
;