trusted_entity_sets

Creates, updates, deletes, gets or lists a trusted_entity_sets resource.

Overview

Name	trusted_entity_sets
Type	Resource
Id	aws.guardduty.trusted_entity_sets

Fields

The following fields are returned by SELECT queries:

get_trusted_entity_set

Name	Datatype	Description
created_at	string (date-time)	The timestamp when the associated trusted entity set was created.
error_details	string	The error details when the status is shown as ERROR.
expected_bucket_owner	string	The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter. (pattern: <code>[0-9]+</code>)
format	string	The format of the file that contains the trusted entity set. (TXT, STIX, OTX_CSV, ALIEN_VAULT, PROOF_POINT, FIRE_EYE)
location	string	The URI of the file that contains the trusted entity set.
name	string	The name of the threat entity set associated with the specified trustedEntitySetId.
status	string	The status of the associated trusted entity set. (INACTIVE, ACTIVATING, ACTIVE, DEACTIVATING, ERROR, DELETE_PENDING, DELETED)
tags	object	The tags associated with trusted entity set resource.
updated_at	string (date-time)	The timestamp when the associated trusted entity set was updated.

list_trusted_entity_sets

Name	Datatype	Description
trusted_entity_set_id	string	The IDs of the trusted entity set resources.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_trusted_entity_set	select	detector_id, trusted_entity_set_id, region		Retrieves the trusted entity set associated with the specified trustedEntitySetId.
list_trusted_entity_sets	select	detector_id, region	maxResults, nextToken	Lists the trusted entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the trusted entity sets that are returned as a response, belong to the administrator account.
create_trusted_entity_set	insert	detector_id, region, Activate		Creates a new trusted entity set. In the trusted entity set, you can provide IP addresses and domains that you believe are secure for communication in your Amazon Web Services environment. GuardDuty will not generate findings for the entries that are specified in a trusted entity set. At any given time, you can have only one trusted entity set. Only users of the administrator account can manage the entity sets, which automatically apply to member accounts.
update_trusted_entity_set	update	detector_id, trusted_entity_set_id, region		Updates the trusted entity set associated with the specified trustedEntitySetId.
delete_trusted_entity_set	delete	detector_id, trusted_entity_set_id, region		Deletes the trusted entity set that is associated with the specified trustedEntitySetId.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
detector_id	string	The unique ID of the detector associated with the trusted entity set resource. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
region	string	AWS region (default: us-east-1)
trusted_entity_set_id	string	The unique ID that helps GuardDuty identify which trusted entity set needs to be deleted.
maxResults	integer	You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50.
nextToken	string	You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

SELECT examples

get_trusted_entity_set

Retrieves the trusted entity set associated with the specified trustedEntitySetId.

SELECT
created_at,
error_details,
expected_bucket_owner,
format,
location,
name,
status,
tags,
updated_at
FROM aws.guardduty.trusted_entity_sets
WHERE detector_id = '{{ detector_id }}' -- required
AND trusted_entity_set_id = '{{ trusted_entity_set_id }}' -- required
AND region = '{{ region }}' -- required
;

list_trusted_entity_sets

Lists the trusted entity sets associated with the specified GuardDuty detector ID. If you use this operation from a member account, the trusted entity sets that are returned as a response, belong to the administrator account.

SELECT
trusted_entity_set_id
FROM aws.guardduty.trusted_entity_sets
WHERE detector_id = '{{ detector_id }}' -- required
AND region = '{{ region }}' -- required
AND maxResults = '{{ maxResults }}'
AND nextToken = '{{ nextToken }}'
;

INSERT examples

create_trusted_entity_set

Creates a new trusted entity set. In the trusted entity set, you can provide IP addresses and domains that you believe are secure for communication in your Amazon Web Services environment. GuardDuty will not generate findings for the entries that are specified in a trusted entity set. At any given time, you can have only one trusted entity set. Only users of the administrator account can manage the entity sets, which automatically apply to member accounts.

INSERT INTO aws.guardduty.trusted_entity_sets (
Name,
Format,
Location,
ExpectedBucketOwner,
Activate,
ClientToken,
Tags,
detector_id,
region
)
SELECT 
'{{ Name }}',
'{{ Format }}',
'{{ Location }}',
'{{ ExpectedBucketOwner }}',
{{ Activate }} /* required */,
'{{ ClientToken }}',
'{{ Tags }}',
'{{ detector_id }}',
'{{ region }}'
RETURNING
trusted_entity_set_id
;

Manifest

# Description fields are for documentation purposes
- name: trusted_entity_sets
props:
  - name: detector_id
    value: "{{ detector_id }}"
    description: Required parameter for the trusted_entity_sets resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the trusted_entity_sets resource.
  - name: Name
    value: "{{ Name }}"
  - name: Format
    value: "{{ Format }}"
    valid_values: ['TXT', 'STIX', 'OTX_CSV', 'ALIEN_VAULT', 'PROOF_POINT', 'FIRE_EYE']
  - name: Location
    value: "{{ Location }}"
  - name: ExpectedBucketOwner
    value: "{{ ExpectedBucketOwner }}"
  - name: Activate
    value: {{ Activate }}
  - name: ClientToken
    value: "{{ ClientToken }}"
  - name: Tags
    value: "{{ Tags }}"

UPDATE examples

update_trusted_entity_set

Updates the trusted entity set associated with the specified trustedEntitySetId.

UPDATE aws.guardduty.trusted_entity_sets
SET 
Name = '{{ Name }}',
Location = '{{ Location }}',
ExpectedBucketOwner = '{{ ExpectedBucketOwner }}',
Activate = {{ Activate }}
WHERE 
detector_id = '{{ detector_id }}' --required
AND trusted_entity_set_id = '{{ trusted_entity_set_id }}' --required
AND region = '{{ region }}' --required;

DELETE examples

delete_trusted_entity_set

Deletes the trusted entity set that is associated with the specified trustedEntitySetId.

DELETE FROM aws.guardduty.trusted_entity_sets
WHERE detector_id = '{{ detector_id }}' --required
AND trusted_entity_set_id = '{{ trusted_entity_set_id }}' --required
AND region = '{{ region }}' --required
;