AWS - AccessAnalyzer

Details

ID	`AWS - AccessAnalyzer`
Provider	Amazon
Category	Data Enrichment & Threat Intelligence
From Version	5.0.0
Docker Image	`demisto/boto3py3:1.0.0.10221838`
Supported Modules	Agentix XSIAM

README

Amazon Web Services IAM Access Analyzer

For detailed instructions about setting up authentication, see: AWS Integrations - Authentication.

Configure AWS - AccessAnalyzer in Cortex

Parameter	Description	Required
AWS Default Region		False
Role Arn		False
Role Session Name		False
Role Session Duration		False
Fetch incidents		False
Incident type		False
Access Key		False
Secret Key		False
Fetch Analyzer ARN (Required for fetching incidents)	The ARN to fetch findings for	False
Trust any certificate (not secure)	Trust any certificate (not secure).	False
Use system proxy settings	Use system proxy settings.	False
Timeout	The time in seconds till a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout followed after a comma (for example 60,10). If a connect timeout is not specified, a default of 10 second will be used.	False
Retries	The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time.	False

Fetch Incidents

The integration fetches findings, generated by the analyzer specified in the Fetch Analyzer ARN parameter, as incidents.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

aws-access-analyzer-list-analyzers

Retrieves a list of analyzers.

Base Command

aws-access-analyzer-list-analyzers

Input

Argument Name	Description	Required
region	The AWS Region, if not specified the default region will be used.	Optional
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Type	Description
AWS.AccessAnalyzer.Analyzers	Unknown	List of Analyzers and their details.
AWS.AccessAnalyzer.Analyzers.arn	String	The analyzer ARN.

Command example


#### Context Example

```json
{
    "AWS": {
        "AccessAnalyzer": {
            "Analyzers": {
                "arn": "arn:aws:access-analyzer:us-east-2:123456789012:analyzer/ConsoleAnalyzer-k80aff71-2468-47l7-b24c-p8992b3f10d5",
                "createdAt": "2021-09-08T17:25:37",
                "lastResourceAnalyzed": "arn:aws:iam::123456789012:role/accessadvisor",
                "lastResourceAnalyzedAt": "2021-09-08T17:25:37",
                "name": "ConsoleAnalyzer-k80aff71-2468-47l7-b24c-p8992b3f10d5",
                "status": "ACTIVE",
                "tags": {},
                "type": "ACCOUNT"
            }
        }
    }
}

Human Readable Output

AWS Access Analyzer Analyzers

Arn Created At Last Resource Analyzed Last Resource Analyzed At Name Status Tags Type

arn:aws:access-analyzer:us-east-2:123456789012:analyzer/ConsoleAnalyzer-k80aff71-2468-47l7-b24c-p8992b3f10d5 2021-09-08T17:25:37 arn:aws:iam::123456789012:role/XSOARCortexXDRReadOnlyRole 2021-09-08T17:25:37 ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898 ACTIVE ACCOUNT

Arn	Created At	Last Resource Analyzed	Last Resource Analyzed At	Name	Status	Tags	Type
arn:aws:access-analyzer:us-east-2:123456789012:analyzer/ConsoleAnalyzer-k80aff71-2468-47l7-b24c-p8992b3f10d5	2021-09-08T17:25:37	arn:aws:iam::123456789012:role/XSOARCortexXDRReadOnlyRole	2021-09-08T17:25:37	ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898	ACTIVE		ACCOUNT

aws-access-analyzer-list-analyzed-resource

Retrieves a list of resources that have been analyzed.

Base Command

aws-access-analyzer-list-analyzed-resource

Input

Argument Name	Description	Required
analyzerArn	The ARN of the analyzer to retrieve a list of analyzed resources from.	Required
maxResults	The maximum number of results to return in the response.	Optional
resourceType	Filter findings by one of the resource type. Possible values are: AWS::IAM::Role, AWS::KMS::Key, AWS::Lambda::Function, AWS::Lambda::LayerVersion, AWS::S3::Bucket, AWS::SQS::Queue.	Optional
region	The AWS Region, if not specified the default region will be used.	Optional
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Type	Description
AWS.AccessAnalyzer.Resource	Unknown	List of analyzed resources.
AWS.AccessAnalyzer.Resource.resourceArn	String	The resource ARN.
AWS.AccessAnalyzer.Resource.analyzerArn	String	The analyzer ARN.

Command example

!aws-access-analyzer-list-analyzed-resource analyzerArn=arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898

Context Example

{
    "AWS": {
        "AccessAnalyzer": {
            "Resource": [
                {
                    "analyzerArn": "arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898",
                    "resourceArn": "arn:aws:iam::123456789012:role/-TestRole",
                    "resourceOwnerAccount": "123456789012",
                    "resourceType": "AWS::IAM::Role"
                },
                {
                    "analyzerArn": "arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898",
                    "resourceArn": "arn:aws:iam::123456789012:role/BishopFoxPlatformAssumeRole",
                    "resourceOwnerAccount": "123456789012",
                    "resourceType": "AWS::IAM::Role"
                }
            ]
        }
    }
}

Human Readable Output

AWS Access Analyzer Resources

Resource Arn Resource Owner Account Resource Type

arn:aws:iam::123456789012:role/-TestRole 123456789012 AWS::IAM::Role

arn:aws:iam::123456789012:role/BishopFoxPlatformAssumeRole 123456789012 AWS::IAM::Role

Resource Arn	Resource Owner Account	Resource Type
arn:aws:iam::123456789012:role/-TestRole	123456789012	AWS::IAM::Role
arn:aws:iam::123456789012:role/BishopFoxPlatformAssumeRole	123456789012	AWS::IAM::Role

aws-access-analyzer-list-findings

Retrieves a list of findings generated by the specified analyzer.

Base Command

aws-access-analyzer-list-findings

Input

Argument Name	Description	Required
analyzerArn	The ARN of the analyzer to retrieve findings from.	Required
maxResults	The maximum number of results to return in the response.	Optional
resourceType	Filter findings by one of the resource type. Possible values are: AWS::IAM::Role, AWS::KMS::Key, AWS::Lambda::Function, AWS::Lambda::LayerVersion, AWS::S3::Bucket, AWS::SQS::Queue.	Optional
status	Filter findings by status. Possible values are: ACTIVE, ARCHIVED, RESOLVED.	Optional
region	The AWS Region, if not specified the default region will be used.	Optional
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Type	Description
AWS.AccessAnalyzer.Finding	Unknown	Access Analyzer findings.
AWS.AccessAnalyzer.Finding.id	String	The finding ID.
AWS.AccessAnalyzer.Finding.analyzerArn	String	The analyzer ARN.

Command example

!aws-access-analyzer-list-findings analyzerArn=arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898

Context Example

{
    "AWS": {
        "AccessAnalyzer": {
            "Finding": [
                {
                    "action": [
                        "sts:AssumeRoleWithWebIdentity"
                    ],
                    "analyzedAt": "2023-02-28T07:47:01",
                    "analyzerArn": "arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898",
                    "condition": {
                        "accounts.google.com:aud": "1234567890123456789012"
                    },
                    "createdAt": "2023-02-13T21:28:04",
                    "id": "03c44171-223c-4615-be8a-bf0b626f0b13",
                    "isPublic": false,
                    "principal": {
                        "Federated": "accounts.google.com"
                    },
                    "resource": "arn:aws:iam::123456789012:role/billing-bot-role",
                    "resourceOwnerAccount": "123456789012",
                    "resourceType": "AWS::IAM::Role",
                    "status": "ARCHIVED",
                    "updatedAt": "2023-02-23T10:08:54"
                },
                {
                    "action": [
                        "sts:AssumeRole"
                    ],
                    "analyzedAt": "2023-02-27T10:59:00",
                    "analyzerArn": "arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898",
                    "condition": {},
                    "createdAt": "2023-02-13T21:28:04",
                    "id": "babbbe27-835e-4c34-8cbd-f19dc877fa31",
                    "isPublic": false,
                    "principal": {
                        "AWS": "252015767101"
                    },
                    "resource": "arn:aws:iam::123456789012:role/c7nSecurityAuditRole",
                    "resourceOwnerAccount": "123456789012",
                    "resourceType": "AWS::IAM::Role",
                    "status": "ACTIVE",
                    "updatedAt": "2023-02-13T21:28:04"
                }
            ]
        }
    }
}

Human Readable Output

AWS Access Analyzer Findings

Id Resource Principal Condition Updated At Status

03c44171-223c-4615-be8a-bf0b626f0b13 arn:aws:iam::123456789012:role/billing-bot-role Federated: accounts.google.com accounts.google.com:aud: 1234567890123456789012 2023-02-23T10:08:54 ARCHIVED

babbbe27-835e-4c34-8cbd-f19dc877fa31 arn:aws:iam::123456789012:role/c7nSecurityAuditRole AWS: 252015767101 2023-02-13T21:28:04 ACTIVE

Id	Resource	Principal	Condition	Updated At	Status
03c44171-223c-4615-be8a-bf0b626f0b13	arn:aws:iam::123456789012:role/billing-bot-role	Federated: accounts.google.com	accounts.google.com:aud: 1234567890123456789012	2023-02-23T10:08:54	ARCHIVED
babbbe27-835e-4c34-8cbd-f19dc877fa31	arn:aws:iam::123456789012:role/c7nSecurityAuditRole	AWS: 252015767101		2023-02-13T21:28:04	ACTIVE

aws-access-analyzer-get-analyzed-resource

Retrieves information about an analyzed resource.

Base Command

aws-access-analyzer-get-analyzed-resource

Input

Argument Name	Description	Required
analyzerArn	The ARN of the analyzer to retrieve information from.	Required
resourceArn	The ARN of the resource to retrieve information about.	Required
region	The AWS Region, if not specified the default region will be used.	Optional
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Type	Description
AWS.AccessAnalyzer.Resource	Unknown	Analyzed resource detail.
AWS.AccessAnalyzer.Resource.id	String	The resource ID.
AWS.AccessAnalyzer.Resource.analyzerArn	String	The analyzer ARN.

Command example

!aws-access-analyzer-get-analyzed-resource analyzerArn=arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898 resourceArn=arn:aws:iam::123456789012:role/-TestRole

Context Example

{
    "AWS": {
        "AccessAnalyzer": {
            "Resource": {
                "analyzedAt": "2023-02-27T10:59:00",
                "analyzerArn": "arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898",
                "isPublic": false,
                "resourceArn": "arn:aws:iam::123456789012:role/-TestRole",
                "resourceOwnerAccount": "123456789012",
                "resourceType": "AWS::IAM::Role"
            }
        }
    }
}

Human Readable Output

AWS Access Analyzer Resource

Analyzed At Analyzer Arn Is Public Resource Arn Resource Owner Account Resource Type

2023-02-27T10:59:00 arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898 false arn:aws:iam::123456789012:role/-TestRole 123456789012 AWS::IAM::Role

Analyzed At	Analyzer Arn	Is Public	Resource Arn	Resource Owner Account	Resource Type
2023-02-27T10:59:00	arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898	false	arn:aws:iam::123456789012:role/-TestRole	123456789012	AWS::IAM::Role

aws-access-analyzer-get-finding

Retrieves information about the specified finding.

Base Command

aws-access-analyzer-get-finding

Input

Argument Name	Description	Required
analyzerArn	The ARN of the analyzer to retrieve information from.	Required
findingId	The ID of the finding to retrieve.	Required
region	The AWS Region, if not specified the default region will be used.	Optional
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

Path	Type	Description
AWS.AccessAnalyzer.Finding	Unknown	Finding details.
AWS.AccessAnalyzer.Finding.id	String	The finding ID.
AWS.AccessAnalyzer.Finding.analyzerArn	String	The analyzer ARN.

Command example

!aws-access-analyzer-get-finding analyzerArn=arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898 findingId=03c44171-223c-4615-be8a-bf0b626f0b13

Context Example

{
    "AWS": {
        "AccessAnalyzer": {
            "Finding": {
                "action": [
                    "sts:AssumeRoleWithWebIdentity"
                ],
                "analyzedAt": "2023-02-28T07:47:01",
                "analyzerArn": "arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898",
                "condition": {
                    "accounts.google.com:aud": "1234567890123456789012"
                },
                "createdAt": "2023-02-13T21:28:04",
                "id": "03c44171-223c-4615-be8a-bf0b626f0b13",
                "isPublic": false,
                "principal": {
                    "Federated": "accounts.google.com"
                },
                "resource": "arn:aws:iam::123456789012:role/billing-bot-role",
                "resourceOwnerAccount": "123456789012",
                "resourceType": "AWS::IAM::Role",
                "status": "ARCHIVED",
                "updatedAt": "2023-02-23T10:08:54"
            }
        }
    }
}

Human Readable Output

AWS Access Analyzer Finding

Action Analyzed At Analyzer Arn Condition Created At Id Is Public Principal Resource Resource Owner Account Resource Type Status Updated At

sts:AssumeRoleWithWebIdentity 2023-02-28T07:47:01 arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898 accounts.google.com:aud: 1234567890123456789012 2023-02-13T21:28:04 03c44171-223c-4615-be8a-bf0b626f0b13 false Federated: accounts.google.com arn:aws:iam::123456789012:role/billing-bot-role 123456789012 AWS::IAM::Role ARCHIVED 2023-02-23T10:08:54

Action	Analyzed At	Analyzer Arn	Condition	Created At	Id	Is Public	Principal	Resource	Resource Owner Account	Resource Type	Status	Updated At
sts:AssumeRoleWithWebIdentity	2023-02-28T07:47:01	arn:aws:access-analyzer:us-east-1:123456789012:analyzer/ConsoleAnalyzer-fc3b189d-f88a-48a5-9c2b-f42f9187c898	accounts.google.com:aud: 1234567890123456789012	2023-02-13T21:28:04	03c44171-223c-4615-be8a-bf0b626f0b13	false	Federated: accounts.google.com	arn:aws:iam::123456789012:role/billing-bot-role	123456789012	AWS::IAM::Role	ARCHIVED	2023-02-23T10:08:54

aws-access-analyzer-start-resource-scan

Starts a scan of the policies applied to the specified resource.

Base Command

aws-access-analyzer-start-resource-scan

Input

Argument Name	Description	Required
analyzerArn	The ARN of the analyzer to use to scan the policies applied to the specified resource.	Required
resourceArn	The ARN of the resource to scan.	Required
region	The AWS Region, if not specified the default region will be used.	Optional
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

There is no context output for this command.

Command Example

!aws-access-analyzer-start-resource-scan analyzerArn=arn:aws:access-analyzer:us-east-2:123456789012:analyzer/ConsoleAnalyzer-k80aff71-2468-47l7-b24c-p8992b3f10d5 resourceArn=arn:aws:iam::123456789012:role/OrganizationAccountAccessRole

Human Readable Output

Resource scan request sent.

aws-access-analyzer-update-findings

Updates findings with the new values provided in the request.

Base Command

aws-access-analyzer-update-findings

Input

Argument Name	Description	Required
analyzerArn	The ARN of the analyzer that generated the findings to update.	Required
findingIds	The IDs of the findings to update (comma separated).	Required
status	The ARN of the resource to scan. Possible values are: ACTIVE, ARCHIVED.	Required
region	The AWS Region, if not specified the default region will be used.	Optional
roleArn	The Amazon Resource Name (ARN) of the role to assume.	Optional
roleSessionName	An identifier for the assumed role session.	Optional
roleSessionDuration	The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.	Optional

Context Output

There is no context output for this command.

Command Example

!aws-access-analyzer-update-findings analyzerArn=arn:aws:access-analyzer:us-east-2:123456789012:analyzer/ConsoleAnalyzer-k80aff71-2468-47l7-b24c-p8992b3f10d5 findingIds=78eb6782-5387-49k0-bpe5-39am61c3baee status=ACTIVE

Human Readable Output

Findings updated

Configuration parameters

defaultRegion — AWS Default Region (required)
roleArn — Role Arn
roleSessionName — Role Session Name
sessionDuration — Role Session Duration
isFetch — Fetch incidents
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval
credentials — Access Key
access_key — Access Key
secret_key — Secret Key
first_fetch — First fetch time interval
max_fetch — Maximum number of incidents to fetch every time.
analyzerArn — Fetch Analyzer ARN
sts_regional_endpoint — AWS STS Regional Endpoints
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
timeout — Timeout
retries — Retries

Commands (7)

aws-access-analyzer-get-analyzed-resource
Retrieves information about an analyzed resource.
aws-access-analyzer-get-finding
Retrieves information about the specified finding.
aws-access-analyzer-list-analyzed-resource
Retrieves a list of resources that have been analyzed.
aws-access-analyzer-list-analyzers
Retrieves a list of analyzers.
aws-access-analyzer-list-findings
Retrieves a list of findings generated by the specified analyzer.
aws-access-analyzer-start-resource-scan
Starts a scan of the policies applied to the specified resource.
aws-access-analyzer-update-findings
Updates findings with the new values provided in the request.

Source

AWS-AccessAnalyzer.py AWS-AccessAnalyzer_test.py AWS-AccessAnalyzer.yml AWS-AccessAnalyzer_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Amazon
commonfields:
  id: AWS - AccessAnalyzer
  version: -1
sectionorder:
- Connect
- Collect
fromversion: 5.0.0
configuration:
- display: AWS Default Region
  name: defaultRegion
  options:
  - us-east-1
  - us-east-2
  - us-west-1
  - us-west-2
  - ca-central-1
  - eu-west-1
  - eu-central-1
  - eu-west-2
  - ap-northeast-1
  - ap-northeast-2
  - ap-southeast-1
  - ap-southeast-2
  - ap-south-1
  - sa-east-1
  - eu-north-1
  - eu-west-3
  - us-gov-east-1
  - us-gov-west-1
  type: 15
  section: Connect
  required: true
- display: Role Arn
  additionalinfo: The Amazon Resource Name (ARN) role used for EC2 instance authentication. If this is used, an access key and secret key are not required.
  name: roleArn
  type: 0
  section: Connect
  required: false
- display: Role Session Name
  additionalinfo: A descriptive name for the assumed role session. For example, xsiam-IAM.integration-Role_SESSION
  name: roleSessionName
  type: 0
  section: Connect
  required: false
- display: Role Session Duration
  additionalinfo: The maximum length of each session in seconds. The integration will have the permissions assigned only when the session is initiated and for the defined duration.
  name: sessionDuration
  defaultvalue: 900
  type: 0
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Access Key
  name: credentials
  type: 9
  displaypassword: Secret Key
  section: Connect
  required: false
- display: Access Key
  name: access_key
  type: 0
  hidden: true
  section: Connect
  required: false
- display: Secret Key
  name: secret_key
  type: 4
  hidden: true
  section: Connect
  required: false
- display: First fetch time interval
  additionalinfo: The time range to consider for the initial data fetch. (<number> <unit>, e.g., 2 minutes, 2 hours, 2 days, 2 months, 2 years).
  defaultvalue: 3 days
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Maximum number of incidents to fetch every time.
  defaultvalue: '25'
  name: max_fetch
  type: 0
  section: Collect
  required: false
- display: Fetch Analyzer ARN
  name: analyzerArn
  additionalinfo: The ARN to fetch findings for.
  defaultvalue: ""
  type: 0
  section: Collect
  required: false
- display: AWS STS Regional Endpoints
  additionalinfo: Sets the AWS_STS_REGIONAL_ENDPOINTS environment variable to specify the AWS STS endpoint resolution logic. By default, this option is set to “legacy” in AWS. Leave empty if the environment variable is already set using server configuration.
  name: sts_regional_endpoint
  options:
  - legacy
  - regional
  type: 15
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- display: Timeout
  name: timeout
  additionalinfo: The time in seconds until a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout following a comma (for example 60,10). If a connect timeout is not specified, a default of 10 seconds will be used.
  defaultvalue: 60,10
  type: 0
  section: Connect
  required: false
- display: Retries
  name: retries
  defaultvalue: 5
  additionalinfo: "The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time."
  type: 0
  section: Connect
  required: false
description: Amazon Web Services IAM Access Analyzer.
display: AWS - AccessAnalyzer
name: AWS - AccessAnalyzer
script:
  commands:
  - arguments:
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves a list of analyzers.
    name: aws-access-analyzer-list-analyzers
    outputs:
    - contextPath: AWS.AccessAnalyzer.Analyzers
      description: List of Analyzers and their details.
      type: Unknown
    - contextPath: AWS.AccessAnalyzer.Analyzers.arn
      description: The analyzer ARN.
      type: String
  - arguments:
    - description: The ARN of the analyzer to retrieve a list of analyzed resources from.
      name: analyzerArn
      required: true
    - description: The maximum number of results to return in the response.
      name: maxResults
    - auto: PREDEFINED
      description: Filter findings by one of the resource type.
      name: resourceType
      predefined:
      - AWS::IAM::Role
      - AWS::KMS::Key
      - AWS::Lambda::Function
      - AWS::Lambda::LayerVersion
      - AWS::S3::Bucket
      - AWS::SQS::Queue
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves a list of resources that have been analyzed.
    name: aws-access-analyzer-list-analyzed-resource
    outputs:
    - contextPath: AWS.AccessAnalyzer.Resource
      description: List of analyzed resources.
      type: Unknown
    - contextPath: AWS.AccessAnalyzer.Resource.resourceArn
      description: The resource ARN.
      type: String
    - contextPath: AWS.AccessAnalyzer.Resource.analyzerArn
      description: The analyzer ARN.
      type: String
  - arguments:
    - description: The ARN of the analyzer to retrieve findings from.
      name: analyzerArn
      required: true
    - description: The maximum number of results to return in the response.
      name: maxResults
    - auto: PREDEFINED
      description: Filter findings by one of the resource type.
      name: resourceType
      predefined:
      - AWS::IAM::Role # disable-secrets-detection
      - AWS::KMS::Key # disable-secrets-detection
      - AWS::Lambda::Function # disable-secrets-detection
      - AWS::Lambda::LayerVersion # disable-secrets-detection
      - AWS::S3::Bucket # disable-secrets-detection
      - AWS::SQS::Queue # disable-secrets-detection
    - auto: PREDEFINED
      description: Filter findings by status.
      name: status
      predefined:
      - ACTIVE
      - ARCHIVED
      - RESOLVED
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves a list of findings generated by the specified analyzer.
    name: aws-access-analyzer-list-findings
    outputs:
    - contextPath: AWS.AccessAnalyzer.Finding
      description: Access Analyzer findings.
      type: Unknown
    - contextPath: AWS.AccessAnalyzer.Finding.id
      description: The finding ID.
      type: String
    - contextPath: AWS.AccessAnalyzer.Finding.analyzerArn
      description: The analyzer ARN.
      type: String
  - arguments:
    - description: The ARN of the analyzer to retrieve information from.
      name: analyzerArn
      required: true
    - description: The ARN of the resource to retrieve information about.
      name: resourceArn
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves information about an analyzed resource.
    name: aws-access-analyzer-get-analyzed-resource
    outputs:
    - contextPath: AWS.AccessAnalyzer.Resource
      description: Analyzed resource detail.
      type: Unknown
    - contextPath: AWS.AccessAnalyzer.Resource.id
      description: The resource ID.
      type: String
    - contextPath: AWS.AccessAnalyzer.Resource.analyzerArn
      description: The analyzer ARN.
      type: String
  - arguments:
    - description: The ARN of the analyzer to retrieve information from.
      name: analyzerArn
      required: true
    - description: The ID of the finding to retrieve.
      name: findingId
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves information about the specified finding.
    name: aws-access-analyzer-get-finding
    outputs:
    - contextPath: AWS.AccessAnalyzer.Finding
      description: Finding details.
      type: Unknown
    - contextPath: AWS.AccessAnalyzer.Finding.id
      description: The finding ID.
      type: String
    - contextPath: AWS.AccessAnalyzer.Finding.analyzerArn
      description: The analyzer ARN.
      type: String
  - arguments:
    - description: The ARN of the analyzer to use to scan the policies applied to the specified resource.
      name: analyzerArn
      required: true
    - description: The ARN of the resource to scan.
      name: resourceArn
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Starts a scan of the policies applied to the specified resource.
    name: aws-access-analyzer-start-resource-scan
  - arguments:
    - description: The ARN of the analyzer that generated the findings to update.
      name: analyzerArn
      required: true
    - description: The IDs of the findings to update (comma separated).
      isArray: true
      name: findingIds
      required: true
    - auto: PREDEFINED
      description: The ARN of the resource to scan.
      name: status
      predefined:
      - ACTIVE
      - ARCHIVED
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Updates findings with the new values provided in the request.
    name: aws-access-analyzer-update-findings
  dockerimage: demisto/boto3py3:1.0.0.10221838
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No test