audit_findings

Creates, updates, deletes, gets or lists an audit_findings resource.

Overview

Name	audit_findings
Type	Resource
Id	aws.iot.audit_findings

Fields

The following fields are returned by SELECT queries:

describe_audit_finding

Name	Datatype	Description
check_name	string	An audit check name. Checks must be enabled for your account. (Use DescribeAccountAuditConfiguration to see the list of all checks, including those that are enabled or use UpdateAccountAuditConfiguration to select which checks are enabled.)
finding_id	string	A unique identifier for this set of audit findings. This identifier is used to apply mitigation tasks to one or more sets of findings. (pattern: <code>[a-zA-Z0-9_-]+</code>)
finding_time	string (date-time)	The time the result (finding) was discovered.
is_suppressed	boolean	Indicates whether the audit finding was suppressed or not during reporting.
non_compliant_resource	object	The resource that was found to be noncompliant with the audit check.
reason_for_non_compliance	string	The reason the resource was noncompliant.
reason_for_non_compliance_code	string	A code that indicates the reason that the resource was noncompliant.
related_resources	array	The list of related resources.
severity	string	The severity of the result (finding). (CRITICAL, HIGH, MEDIUM, LOW)
task_id	string	The ID of the audit that generated this result (finding). (pattern: <code>[a-zA-Z0-9-]+</code>)
task_start_time	string (date-time)	The time the audit started.

list_audit_findings

Name	Datatype	Description
check_name	string	An audit check name. Checks must be enabled for your account. (Use DescribeAccountAuditConfiguration to see the list of all checks, including those that are enabled or use UpdateAccountAuditConfiguration to select which checks are enabled.)
finding_id	string	A unique identifier for this set of audit findings. This identifier is used to apply mitigation tasks to one or more sets of findings. (pattern: <code>[a-zA-Z0-9_-]+</code>)
finding_time	string (date-time)	The time the result (finding) was discovered.
is_suppressed	boolean	Indicates whether the audit finding was suppressed or not during reporting.
non_compliant_resource	object	The resource that was found to be noncompliant with the audit check.
reason_for_non_compliance	string	The reason the resource was noncompliant.
reason_for_non_compliance_code	string	A code that indicates the reason that the resource was noncompliant.
related_resources	array	The list of related resources.
severity	string	The severity of the result (finding). (CRITICAL, HIGH, MEDIUM, LOW)
task_id	string	The ID of the audit that generated this result (finding). (pattern: <code>[a-zA-Z0-9-]+</code>)
task_start_time	string (date-time)	The time the audit started.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_audit_finding	select	finding_id, region		Gets information about a single audit finding. Properties include the reason for noncompliance, the severity of the issue, and the start time when the audit that returned the finding. Requires permission to access the DescribeAuditFinding action.
list_audit_findings	select	region		Lists the findings (results) of a Device Defender audit or of the audits performed during a specified time period. (Findings are retained for 90 days.) Requires permission to access the ListAuditFindings action.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
finding_id	string	A unique identifier for a single audit finding. You can use this identifier to apply mitigation actions to the finding.
region	string	AWS region (default: us-east-1)

SELECT examples

describe_audit_finding

Gets information about a single audit finding. Properties include the reason for noncompliance, the severity of the issue, and the start time when the audit that returned the finding. Requires permission to access the DescribeAuditFinding action.

SELECT
check_name,
finding_id,
finding_time,
is_suppressed,
non_compliant_resource,
reason_for_non_compliance,
reason_for_non_compliance_code,
related_resources,
severity,
task_id,
task_start_time
FROM aws.iot.audit_findings
WHERE finding_id = '{{ finding_id }}' -- required
AND region = '{{ region }}' -- required
;

list_audit_findings

Lists the findings (results) of a Device Defender audit or of the audits performed during a specified time period. (Findings are retained for 90 days.) Requires permission to access the ListAuditFindings action.

SELECT
check_name,
finding_id,
finding_time,
is_suppressed,
non_compliant_resource,
reason_for_non_compliance,
reason_for_non_compliance_code,
related_resources,
severity,
task_id,
task_start_time
FROM aws.iot.audit_findings
WHERE region = '{{ region }}' -- required
;