category: Data Enrichment & Threat Intelligence
provider: Amazon
commonfields:
  id: AWS - AccessAnalyzer
  version: -1
sectionorder:
- Connect
- Collect
fromversion: 5.0.0
configuration:
- display: AWS Default Region
  name: defaultRegion
  options:
  - us-east-1
  - us-east-2
  - us-west-1
  - us-west-2
  - ca-central-1
  - eu-west-1
  - eu-central-1
  - eu-west-2
  - ap-northeast-1
  - ap-northeast-2
  - ap-southeast-1
  - ap-southeast-2
  - ap-south-1
  - sa-east-1
  - eu-north-1
  - eu-west-3
  - us-gov-east-1
  - us-gov-west-1
  type: 15
  section: Connect
  required: true
- display: Role Arn
  additionalinfo: The Amazon Resource Name (ARN) role used for EC2 instance authentication. If this is used, an access key and secret key are not required.
  name: roleArn
  type: 0
  section: Connect
  required: false
- display: Role Session Name
  additionalinfo: A descriptive name for the assumed role session. For example, xsiam-IAM.integration-Role_SESSION
  name: roleSessionName
  type: 0
  section: Connect
  required: false
- display: Role Session Duration
  additionalinfo: The maximum length of each session in seconds. The integration will have the permissions assigned only when the session is initiated and for the defined duration.
  name: sessionDuration
  defaultvalue: 900
  type: 0
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: Access Key
  name: credentials
  type: 9
  displaypassword: Secret Key
  section: Connect
  required: false
- display: Access Key
  name: access_key
  type: 0
  hidden: true
  section: Connect
  required: false
- display: Secret Key
  name: secret_key
  type: 4
  hidden: true
  section: Connect
  required: false
- display: First fetch time interval
  additionalinfo: The time range to consider for the initial data fetch. (<number> <unit>, e.g., 2 minutes, 2 hours, 2 days, 2 months, 2 years).
  defaultvalue: 3 days
  name: first_fetch
  type: 0
  section: Collect
  required: false
- display: Maximum number of incidents to fetch every time.
  defaultvalue: '25'
  name: max_fetch
  type: 0
  section: Collect
  required: false
- display: Fetch Analyzer ARN
  name: analyzerArn
  additionalinfo: The ARN to fetch findings for.
  defaultvalue: ""
  type: 0
  section: Collect
  required: false
- display: AWS STS Regional Endpoints
  additionalinfo: Sets the AWS_STS_REGIONAL_ENDPOINTS environment variable to specify the AWS STS endpoint resolution logic. By default, this option is set to “legacy” in AWS. Leave empty if the environment variable is already set using server configuration.
  name: sts_regional_endpoint
  options:
  - legacy
  - regional
  type: 15
  section: Connect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- display: Timeout
  name: timeout
  additionalinfo: The time in seconds until a timeout exception is reached. You can specify just the read timeout (for example 60) or also the connect timeout following a comma (for example 60,10). If a connect timeout is not specified, a default of 10 seconds will be used.
  defaultvalue: 60,10
  type: 0
  section: Connect
  required: false
- display: Retries
  name: retries
  defaultvalue: 5
  additionalinfo: "The maximum number of retry attempts when connection or throttling errors are encountered. Set to 0 to disable retries. The default value is 5 and the limit is 10. Note: Increasing the number of retries will increase the execution time."
  type: 0
  section: Connect
  required: false
description: Amazon Web Services IAM Access Analyzer.
display: AWS - AccessAnalyzer
name: AWS - AccessAnalyzer
script:
  commands:
  - arguments:
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves a list of analyzers.
    name: aws-access-analyzer-list-analyzers
    outputs:
    - contextPath: AWS.AccessAnalyzer.Analyzers
      description: List of Analyzers and their details.
      type: Unknown
    - contextPath: AWS.AccessAnalyzer.Analyzers.arn
      description: The analyzer ARN.
      type: String
  - arguments:
    - description: The ARN of the analyzer to retrieve a list of analyzed resources from.
      name: analyzerArn
      required: true
    - description: The maximum number of results to return in the response.
      name: maxResults
    - auto: PREDEFINED
      description: Filter findings by one of the resource type.
      name: resourceType
      predefined:
      - AWS::IAM::Role
      - AWS::KMS::Key
      - AWS::Lambda::Function
      - AWS::Lambda::LayerVersion
      - AWS::S3::Bucket
      - AWS::SQS::Queue
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves a list of resources that have been analyzed.
    name: aws-access-analyzer-list-analyzed-resource
    outputs:
    - contextPath: AWS.AccessAnalyzer.Resource
      description: List of analyzed resources.
      type: Unknown
    - contextPath: AWS.AccessAnalyzer.Resource.resourceArn
      description: The resource ARN.
      type: String
    - contextPath: AWS.AccessAnalyzer.Resource.analyzerArn
      description: The analyzer ARN.
      type: String
  - arguments:
    - description: The ARN of the analyzer to retrieve findings from.
      name: analyzerArn
      required: true
    - description: The maximum number of results to return in the response.
      name: maxResults
    - auto: PREDEFINED
      description: Filter findings by one of the resource type.
      name: resourceType
      predefined:
      - AWS::IAM::Role # disable-secrets-detection
      - AWS::KMS::Key # disable-secrets-detection
      - AWS::Lambda::Function # disable-secrets-detection
      - AWS::Lambda::LayerVersion # disable-secrets-detection
      - AWS::S3::Bucket # disable-secrets-detection
      - AWS::SQS::Queue # disable-secrets-detection
    - auto: PREDEFINED
      description: Filter findings by status.
      name: status
      predefined:
      - ACTIVE
      - ARCHIVED
      - RESOLVED
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves a list of findings generated by the specified analyzer.
    name: aws-access-analyzer-list-findings
    outputs:
    - contextPath: AWS.AccessAnalyzer.Finding
      description: Access Analyzer findings.
      type: Unknown
    - contextPath: AWS.AccessAnalyzer.Finding.id
      description: The finding ID.
      type: String
    - contextPath: AWS.AccessAnalyzer.Finding.analyzerArn
      description: The analyzer ARN.
      type: String
  - arguments:
    - description: The ARN of the analyzer to retrieve information from.
      name: analyzerArn
      required: true
    - description: The ARN of the resource to retrieve information about.
      name: resourceArn
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves information about an analyzed resource.
    name: aws-access-analyzer-get-analyzed-resource
    outputs:
    - contextPath: AWS.AccessAnalyzer.Resource
      description: Analyzed resource detail.
      type: Unknown
    - contextPath: AWS.AccessAnalyzer.Resource.id
      description: The resource ID.
      type: String
    - contextPath: AWS.AccessAnalyzer.Resource.analyzerArn
      description: The analyzer ARN.
      type: String
  - arguments:
    - description: The ARN of the analyzer to retrieve information from.
      name: analyzerArn
      required: true
    - description: The ID of the finding to retrieve.
      name: findingId
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Retrieves information about the specified finding.
    name: aws-access-analyzer-get-finding
    outputs:
    - contextPath: AWS.AccessAnalyzer.Finding
      description: Finding details.
      type: Unknown
    - contextPath: AWS.AccessAnalyzer.Finding.id
      description: The finding ID.
      type: String
    - contextPath: AWS.AccessAnalyzer.Finding.analyzerArn
      description: The analyzer ARN.
      type: String
  - arguments:
    - description: The ARN of the analyzer to use to scan the policies applied to the specified resource.
      name: analyzerArn
      required: true
    - description: The ARN of the resource to scan.
      name: resourceArn
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Starts a scan of the policies applied to the specified resource.
    name: aws-access-analyzer-start-resource-scan
  - arguments:
    - description: The ARN of the analyzer that generated the findings to update.
      name: analyzerArn
      required: true
    - description: The IDs of the findings to update (comma separated).
      isArray: true
      name: findingIds
      required: true
    - auto: PREDEFINED
      description: The ARN of the resource to scan.
      name: status
      predefined:
      - ACTIVE
      - ARCHIVED
      required: true
    - description: The AWS Region, if not specified the default region will be used.
      name: region
    - description: The Amazon Resource Name (ARN) of the role to assume.
      name: roleArn
    - description: An identifier for the assumed role session.
      name: roleSessionName
    - description: The duration, in seconds, of the role session. The value can range from 900 seconds (15 minutes) up to the maximum session duration setting for the role.
      name: roleSessionDuration
    description: Updates findings with the new values provided in the request.
    name: aws-access-analyzer-update-findings
  dockerimage: demisto/boto3py3:1.0.0.10221838
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No test