publishing_destinations

Creates, updates, deletes, gets or lists a publishing_destinations resource.

Overview

Name	publishing_destinations
Type	Resource
Id	aws.guardduty.publishing_destinations

Fields

The following fields are returned by SELECT queries:

describe_publishing_destination

Name	Datatype	Description
destination_id	string	The ID of the publishing destination.
destination_properties	object	Contains the Amazon Resource Name (ARN) of the resource to publish to, such as an S3 bucket, and the ARN of the KMS key to use to encrypt published findings.
destination_type	string	The type of publishing destination. Currently, only Amazon S3 buckets are supported. (S3)
publishing_failure_start_timestamp	integer (int64)	The time, in epoch millisecond format, at which GuardDuty was first unable to publish findings to the destination.
status	string	The status of the publishing destination. (PENDING_VERIFICATION, PUBLISHING, UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY, STOPPED)
tags	object	The tags of the publishing destination resource.

list_publishing_destinations

Name	Datatype	Description
destinations	array	A Destinations object that includes information about each publishing destination returned.
next_token	string	A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_publishing_destination	select	detector_id, destination_id, region		Returns information about the publishing destination specified by the provided destinationId.
list_publishing_destinations	select	detector_id, region	maxResults, nextToken	Returns a list of publishing destinations associated with the specified detectorId.
create_publishing_destination	insert	detector_id, region, DestinationType, DestinationProperties		Creates a publishing destination where you can export your GuardDuty findings. Before you start exporting the findings, the destination resource must exist.
update_publishing_destination	update	detector_id, destination_id, region		Updates information about the publishing destination specified by the destinationId.
delete_publishing_destination	delete	detector_id, destination_id, region		Deletes the publishing definition with the specified destinationId.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
destination_id	string	The ID of the publishing destination to delete.
detector_id	string	The unique ID of the detector associated with the publishing destination to delete. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
region	string	AWS region (default: us-east-1)
maxResults	integer	The maximum number of results to return in the response.
nextToken	string	A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page.

SELECT examples

describe_publishing_destination

Returns information about the publishing destination specified by the provided destinationId.

SELECT
destination_id,
destination_properties,
destination_type,
publishing_failure_start_timestamp,
status,
tags
FROM aws.guardduty.publishing_destinations
WHERE detector_id = '{{ detector_id }}' -- required
AND destination_id = '{{ destination_id }}' -- required
AND region = '{{ region }}' -- required
;

list_publishing_destinations

Returns a list of publishing destinations associated with the specified detectorId.

SELECT
destinations,
next_token
FROM aws.guardduty.publishing_destinations
WHERE detector_id = '{{ detector_id }}' -- required
AND region = '{{ region }}' -- required
AND maxResults = '{{ maxResults }}'
AND nextToken = '{{ nextToken }}'
;

INSERT examples

create_publishing_destination

Creates a publishing destination where you can export your GuardDuty findings. Before you start exporting the findings, the destination resource must exist.

INSERT INTO aws.guardduty.publishing_destinations (
DestinationType,
DestinationProperties,
ClientToken,
Tags,
detector_id,
region
)
SELECT 
'{{ DestinationType }}' /* required */,
'{{ DestinationProperties }}' /* required */,
'{{ ClientToken }}',
'{{ Tags }}',
'{{ detector_id }}',
'{{ region }}'
RETURNING
destination_id
;

Manifest

# Description fields are for documentation purposes
- name: publishing_destinations
props:
  - name: detector_id
    value: "{{ detector_id }}"
    description: Required parameter for the publishing_destinations resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the publishing_destinations resource.
  - name: DestinationType
    value: "{{ DestinationType }}"
    valid_values: ['S3']
  - name: DestinationProperties
    description: |
      Contains the Amazon Resource Name (ARN) of the resource to publish to, such as an S3 bucket, and the ARN of the KMS key to use to encrypt published findings.
    value:
      DestinationArn: "{{ DestinationArn }}"
      KmsKeyArn: "{{ KmsKeyArn }}"
  - name: ClientToken
    value: "{{ ClientToken }}"
  - name: Tags
    value: "{{ Tags }}"

UPDATE examples

update_publishing_destination

Updates information about the publishing destination specified by the destinationId.

UPDATE aws.guardduty.publishing_destinations
SET 
DestinationProperties = '{{ DestinationProperties }}'
WHERE 
detector_id = '{{ detector_id }}' --required
AND destination_id = '{{ destination_id }}' --required
AND region = '{{ region }}' --required;

DELETE examples

delete_publishing_destination

Deletes the publishing definition with the specified destinationId.

DELETE FROM aws.guardduty.publishing_destinations
WHERE detector_id = '{{ detector_id }}' --required
AND destination_id = '{{ destination_id }}' --required
AND region = '{{ region }}' --required
;