Terraform module for configuring an integration with Lacework and AWS for cloud resource configuration assessment.
| Name | Version |
|---|---|
| terraform | >= 0.14 |
| aws | >= 3.35.0 |
| lacework | ~> 2.0 |
| random | >= 2.1 |
| time | ~> 0.7 |
| Name | Version |
|---|---|
| aws | >= 3.35.0 |
| lacework | ~> 2.0 |
| random | >= 2.1 |
| time | ~> 0.7 |
| Name | Source | Version |
|---|---|---|
| lacework_cfg_iam_role | lacework/iam-role/aws | ~> 0.4 |
| Name | Description | Type | Default | Required |
|---|---|---|---|---|
| external_id_length | Deprecated - Will be removed on our next major release v1.0.0 | number |
16 |
no |
| iam_role_arn | The IAM role ARN is required when setting use_existing_iam_role to true |
string |
"" |
no |
| iam_role_external_id | The external ID configured inside the IAM role is required when setting use_existing_iam_role to true |
string |
"" |
no |
| iam_role_name | The IAM role name. Required to match with iam_role_arn if use_existing_iam_role is set to true |
string |
"" |
no |
| lacework_audit_policy_name | The name of the custom audit policy (which extends SecurityAudit) to allow Lacework to read configs. Defaults to lwaudit-policy-${random_id.uniq.hex} when empty | string |
"" |
no |
| lacework_aws_account_id | The Lacework AWS account that the IAM role will grant access | string |
"434813966438" |
no |
| lacework_integration_name | The name of the integration in Lacework | string |
"TF config" |
no |
| permission_boundary_arn | Optional - ARN of the policy that is used to set the permissions boundary for the role. | string |
null |
no |
| tags | A map/dictionary of Tags to be assigned to created resources | map(string) |
{} |
no |
| use_existing_iam_role | Set this to true to use an existing IAM role | bool |
false |
no |
| use_existing_iam_role_policy | Set this to true to use an existing policy on the IAM role, rather than attaching a new one |
bool |
false |
no |
| wait_time | Amount of time to wait before the next resource is provisioned | string |
"10s" |
no |
| Name | Description |
|---|---|
| external_id | The External ID configured into the IAM role |
| iam_role_arn | The IAM Role ARN |
| iam_role_name | The IAM Role name |
| lacework_integration_guid | The GUID for the created Lacework integration |
Release for 0.19.0(Feb 2025): Terraform changes to add a second policy and its attachment under the same role.(This changes is to bypass the 6144 chars limit for one policy) Add permissions for kinesisvideo, amp, appstream, personalize, codeartifact, fis; Add missing permission for services ses, backup Add permissions for future services to come: memoryDB, resource groups, qbusiness, qapps, qconnect, servicecatalogappregistry, oam, clouddirectory, optimizationhub, budgets,billingconsole
The audit policy is comprised of the following permissions:
| sid | actions | resources |
|---|---|---|
| GetEbsEncryptionByDefault | ec2:GetEbsEncryptionByDefault | * |
| EFS | elasticfilesystem:DescribeFileSystemPolicy | * |
| elasticfilesystem:DescribeLifecycleConfiguration | ||
| elasticfilesystem:DescribeAccessPoints | ||
| elasticfilesystem:DescribeAccountPreferences | ||
| elasticfilesystem:DescribeBackupPolicy | ||
| elasticfilesystem:DescribeReplicationConfigurations | ||
| elasticfilesystem:ListTagsForResource | ||
| EMR | elasticmapreduce:ListBootstrapActions | * |
| elasticmapreduce:ListInstanceFleets | ||
| elasticmapreduce:ListInstanceGroups | ||
| SAGEMAKER | sagemaker:GetModelPackageGroupPolicy | * |
| sagemaker:GetLineageGroupPolicy | ||
| sagemaker:GetDeviceFleetReport | ||
| IDENTITYSTORE | identitystore:DescribeGroup | * |
| identitystore:DescribeGroupMembership | ||
| identitystore:DescribeUser | ||
| identitystore:ListGroupMemberships | ||
| identitystore:ListGroupMembershipsForMember | ||
| identitystore:ListGroups | ||
| identitystore:ListUsers | ||
| SSO | sso:DescribeAccountAssignmentDeletionStatus | * |
| sso:DescribeInstanceAccessControlAttributeConfiguration | ||
| sso:GetInlinePolicyForPermissionSet | ||
| GLACIER | glacier:ListTagsForVault | * |
| glacier:GetJobOutput | ||
| glacier:ListJobs | ||
| glacier:ListMultipartUploads | ||
| glacier:ListParts | ||
| glacier:ListProvisionedCapacity | ||
| glacier:GetVaultNotifications | ||
| APIGATEWAY | apigateway:GET | arn:aws:apigateway:::/apikeys, arn:aws:apigateway:::/apikeys/* |
| WAFREGIONAL | waf-regional:ListRules | * |
| waf-regional:GetRule | ||
| waf-regional:ListRuleGroups | ||
| waf-regional:GetRuleGroup | ||
| waf-regional:ListActivatedRulesInRuleGroup | ||
| waf-regional:ListIpSets | ||
| waf-regional:ListRegexPatternSets | ||
| waf-regional:GetByteMatchSet | ||
| waf-regional:GetPermissionPolicy | ||
| waf-regional:GetRateBasedRule | ||
| waf-regional:ListSizeConstraintSets | ||
| waf-regional:ListByteMatchSets | ||
| waf-regional:ListGeoMatchSets | ||
| waf-regional:GetLoggingConfiguration | ||
| waf-regional:GetSqlInjectionMatchSet | ||
| waf-regional:ListRateBasedRules | ||
| waf-regional:GetSizeConstraintSet | ||
| waf-regional:GetRegexMatchSet | ||
| waf-regional:GetGeoMatchSet | ||
| waf-regional:GetRegexPatternSet | ||
| waf-regional:ListRegexMatchSets | ||
| waf-regional:GetIPSet | ||
| waf-regional:ListSqlInjectionMatchSets | ||
| waf-regional:ListXssMatchSets | ||
| waf-regional:GetXssMatchSet | ||
| GLUE | glue:ListWorkflows | * |
| glue:BatchGetWorkflows | ||
| glue:GetTags | ||
| glue:GetTables | ||
| glue:GetWorkflow | ||
| CODEBUILD | codebuild:ListBuilds | * |
| codebuild:BatchGetBuilds | ||
| codebuild:BatchGetBuildBatches | ||
| codebuild:ListBuildBatches | ||
| codebuild:DescribeCodeCoverages | ||
| codebuild:ListCuratedEnvironmentImages | ||
| codebuild:BatchGetReports | ||
| codebuild:ListReports | ||
| codebuild:BatchGetReportGroups | ||
| codebuild:ListReportGroups | ||
| codebuild:ListSharedProjects | ||
| codebuild:ListSharedReportGroups | ||
| codebuild:DescribeTestCases | ||
| SNS | sns:GetDataProtectionPolicy | * |
| sns:ListPlatformApplications | ||
| sns:GetSubscriptionAttributes | ||
| SES | ses:ListContactLists | * |
| ses:GetContactList | ||
| ses:ListContacts | ||
| ses:GetContact | ||
| ses:ListCustomVerificationEmailTemplates | ||
| ses:GetCustomVerificationEmailTemplate | ||
| ses:GetDedicatedIpPool | ||
| ses:GetBlacklistReports | ||
| ses:GetDedicatedIp | ||
| ses:ListDeliverabilityTestReports | ||
| ses:GetDeliverabilityTestReport | ||
| ses:ListEmailIdentities | ||
| ses:GetEmailIdentity | ||
| ses:GetEmailIdentityPolicies | ||
| ses:ListEmailTemplates | ||
| ses:GetEmailTemplate | ||
| ses:ListImportJobs | ||
| ses:GetImportJob | ||
| ses:ListRecommendations | ||
| ses:ListSuppressedDestinations | ||
| ses:GetSuppressedDestination | ||
| ses:ListTagsForResource | ||
| ses:GetExportJob | ||
| ses:GetMultiRegionEndpoint | ||
| ses:ListExportJobs | ||
| ses:ListMultiRegionEndpoints | ||
| BACKUP | backup:ListBackupJobs | * |
| backup:DescribeBackupJob | ||
| backup:ListBackupPlanTemplates | ||
| backup:GetBackupPlanFromTemplate | ||
| backup:ListBackupPlans | ||
| backup:GetBackupPlan | ||
| backup:ListBackupPlanVersions | ||
| backup:ListBackupSelections | ||
| backup:GetBackupSelection | ||
| backup:DescribeBackupVault | ||
| backup:ListRecoveryPointsByBackupVault | ||
| backup:DescribeRecoveryPoint | ||
| backup:GetRecoveryPointRestoreMetadata | ||
| backup:ListCopyJobs | ||
| backup:ListFrameworks | ||
| backup:DescribeFramework | ||
| backup:ListLegalHolds | ||
| backup:GetLegalHold | ||
| backup:ListRecoveryPointsByLegalHold | ||
| backup:ListProtectedResources | ||
| backup:DescribeProtectedResource | ||
| backup:ListRecoveryPointsByResource | ||
| backup:ListReportPlans | ||
| backup:ListRestoreJobs | ||
| backup:ListTags | ||
| COGNITO-IDP | cognito-idp:GetSigningCertificate | |
| cognito-idp:GetCSVHeader | ||
| cognito-idp:GetUserPoolMfaConfig | ||
| cognito-idp:GetUICustomization | ||
| COMPUTEOPTIMIZER | compute-optimizer:DescribeRecommendationExportJobs | * |
| compute-optimizer:GetAutoScalingGroupRecommendations | ||
| compute-optimizer:GetEffectiveRecommendationPreferences | ||
| compute-optimizer:GetEBSVolumeRecommendations | ||
| compute-optimizer:GetEC2InstanceRecommendations | ||
| compute-optimizer:GetEnrollmentStatus | ||
| compute-optimizer:GetLambdaFunctionRecommendations | ||
| compute-optimizer:GetRecommendationPreferences | ||
| compute-optimizer:GetRecommendationSummaries | ||
| compute-optimizer:GetEcsServiceRecommendations | ||
| compute-optimizer:GetLicenseRecommendations | ||
| KINESISANALYTICS | kinesisanalytics:ListApplicationSnapshots | |
| kinesisanalytics:ListApplicationVersions | ||
| kinesisanalytics:DescribeApplicationVersion | ||
| kinesisanalytics:DescribeApplication | ||
| KINESISVIDEO | kinesisvideo:GetSignalingChannelEndpoint | * |
| kinesisvideo:GetDataEndpoint | ||
| kinesisvideo:DescribeImageGenerationConfiguration | ||
| AMP | aps:ListScrapers | * |
| aps:DescribeScraper | ||
| aps:ListWorkspaces | ||
| aps:DescribeAlertManagerDefinition | ||
| aps:DescribeLoggingConfiguration | ||
| aps:DescribeWorkspace | ||
| aps:ListRuleGroupsNamespaces | ||
| aps:DescribeRuleGroupsNamespace | ||
| aps:ListTagsForResource | ||
| APPSTREAM | appstream:Describe* | |
| appstream:List* | ||
| appstream:ListTagsForResource | ||
| PERSONALIZE | personalize:Describe* | |
| personalize:List* | ||
| personalize:GetSolutionMetrics | ||
| CODEARTIFACT | codeartifact:ListDomains | * |
| codeartifact:DescribeDomain | ||
| codeartifact:DescribeRepository | ||
| codeartifact:ListPackages | ||
| codeartifact:GetRepositoryEndpoint | ||
| codeartifact:DescribePackage | ||
| codeartifact:ListPackageVersions | ||
| codeartifact:DescribePackageVersion | ||
| codeartifact:GetPackageVersionReadme | ||
| codeartifact:ListPackageVersionDependencies | ||
| codeartifact:ListPackageVersionAssets | ||
| codeartifact:GetPackageVersionAsset | ||
| codeartifact:ListTagsForResource | ||
| FIS | fis:ListActions | * |
| fis:GetAction | ||
| fis:ListExperimentTemplates | ||
| fis:GetExperimentTemplate | ||
| fis:ListTargetAccountConfigurations | ||
| fis:ListExperiments | ||
| fis:GetExperiment | ||
| fis:ListExperimentResolvedTargets | ||
| fis:ListTagsForResource | ||
| MEMORYDB | memorydb:DescribeMultiRegionClusters | * |
| memorydb:DescribeSnapshots | ||
| memorydb:DescribeSubnetGroups | ||
| memorydb:DescribeParameterGroups | ||
| memorydb:DescribeParameters | ||
| memorydb:DescribeUsers | ||
| memorydb:DescribeACLs | ||
| memorydb:DescribeServiceUpdates | ||
| memorydb:DescribeEngineVersions | ||
| memorydb:DescribeReservedNodes | ||
| memorydb:DescribeReservedNodesOfferings | ||
| memorydb:ListTags | ||
| memorydb:ListAllowedNodeTypeUpdates | ||
| memorydb:ListAllowedMultiRegionClusterUpdates | ||
| QBUSINESS | qbusiness:GetApplication | * |
| qbusiness:GetChatControlsConfiguration | ||
| qbusiness:GetPolicy | ||
| qbusiness:ListAttachments | ||
| qbusiness:ListConversations | ||
| qbusiness:ListMessages | ||
| qbusiness:ListDataAccessors | ||
| qbusiness:GetDataAccessor | ||
| qbusiness:GetIndex | ||
| qbusiness:GetDataSource | ||
| qbusiness:GetPlugin | ||
| qbusiness:ListPluginActions | ||
| qbusiness:GetRetriever | ||
| qbusiness:GetWebExperience | ||
| qbusiness:ListPluginTypeMetadata | ||
| qbusiness:ListPluginTypeActions | ||
| QAPPS | qapps:DescribeQAppPermissions | * |
| qapps:GetLibraryItem | ||
| qapps:GetQApp | ||
| qapps:GetQAppSession | ||
| qapps:GetQAppSessionMetadata | ||
| qapps:ListCategories | ||
| qapps:ListLibraryItems | ||
| qapps:ListQAppSessionData | ||
| qapps:ListQApps | ||
| qapps:ListTagsForResource | ||
| QCONNECT | wisdom:GetAIAgent | * |
| wisdom:GetAIGuardrail | ||
| wisdom:GetAIPrompt | ||
| wisdom:GetContent | ||
| wisdom:GetImportJob | ||
| wisdom:GetKnowledgeBase | ||
| wisdom:GetMessageTemplate | ||
| wisdom:GetQuickResponse | ||
| wisdom:ListAIAgentVersions | ||
| wisdom:ListAIAgents | ||
| wisdom:ListAIGuardrailVersions | ||
| wisdom:ListAIGuardrails | ||
| wisdom:ListAIPromptVersions | ||
| wisdom:ListAIPrompts | ||
| wisdom:ListAssistantAssociations | ||
| wisdom:ListAssistants | ||
| wisdom:ListContentAssociations | ||
| wisdom:ListContents | ||
| wisdom:ListImportJobs | ||
| wisdom:ListKnowledgeBases | ||
| wisdom:ListMessageTemplateVersions | ||
| wisdom:ListMessageTemplates | ||
| wisdom:ListQuickResponses | ||
| wisdom:ListTagsForResource | ||
| RESOURCEGROUPS | resource-groups:ListGroups | * |
| resource-groups:GetGroupQuery | ||
| resource-groups:GetGroupConfiguration | ||
| resource-groups:GetTags | ||
| SERVICECATALOGAPPREGISTRY | servicecatalog:GetApplication | * |
| servicecatalog:ListApplications | ||
| servicecatalog:GetAssociatedResource | ||
| servicecatalog:ListAssociatedResources | ||
| servicecatalog:ListAssociatedAttributeGroups | ||
| servicecatalog:GetAttributeGroup | ||
| servicecatalog:ListAttributeGroups | ||
| servicecatalog:ListTagsForResource | ||
| servicecatalog:ListAttributeGroupsForApplication | ||
| servicecatalog:GetConfiguration | ||
| OAM | oam:GetLink | * |
| oam:GetSink | ||
| oam:GetSinkPolicy | ||
| oam:ListAttachedLinks | ||
| oam:ListLinks | ||
| oam:ListSinks | ||
| CLOUDDIRECTORY | clouddirectory:GetAppliedSchemaVersion | * |
| clouddirectory:GetDirectory | ||
| clouddirectory:GetFacet | ||
| clouddirectory:GetLinkAttributes | ||
| clouddirectory:GetObjectAttributes | ||
| clouddirectory:GetObjectInformation | ||
| clouddirectory:GetSchemaAsJson | ||
| clouddirectory:GetTypedLinkFacetInformation | ||
| clouddirectory:ListAppliedSchemaArns | ||
| clouddirectory:ListAttachedIndices | ||
| clouddirectory:ListDevelopmentSchemaArns | ||
| clouddirectory:ListFacetAttributes | ||
| clouddirectory:ListFacetNames | ||
| clouddirectory:ListIncomingTypedLinks | ||
| clouddirectory:ListIndex | ||
| clouddirectory:ListManagedSchemaArns | ||
| clouddirectory:ListObjectAttributes | ||
| clouddirectory:ListObjectChildren | ||
| clouddirectory:ListObjectParentPaths | ||
| clouddirectory:ListObjectParents | ||
| clouddirectory:ListObjectPolicies | ||
| clouddirectory:ListOutgoingTypedLinks | ||
| clouddirectory:ListPolicyAttachments | ||
| clouddirectory:ListPublishedSchemaArns | ||
| clouddirectory:ListTagsForResource | ||
| clouddirectory:ListTypedLinkFacetAttributes | ||
| clouddirectory:ListTypedLinkFacetNames | ||
| COSTOPTIMIZATIONHUB | cost-optimization-hub:GetPreferences | * |
| cost-optimization-hub:GetRecommendation | ||
| cost-optimization-hub:ListEnrollmentStatuses | ||
| cost-optimization-hub:ListRecommendationSummaries | ||
| cost-optimization-hub:ListRecommendations | ||
| BUDGETS | budgets:DescribeBudgetAction | * |
| budgets:DescribeBudgetActionHistories | ||
| budgets:DescribeBudgetActionsForAccount | ||
| budgets:DescribeBudgetActionsForBudget | ||
| budgets:ListTagsForResource | ||
| budgets:ViewBudget | ||
| BILLING | billing:GetBillingViewData | * |
| BILLINGCONSOLE | aws-portal:GetConsoleActionSetEnforced | * |
| aws-portal:ViewAccount | ||
| aws-portal:ViewBilling | ||
| aws-portal:ViewPaymentMethods | ||
| aws-portal:ViewUsage | ||
| ACM-PCA | acm-pca:GetCertificateAuthorityCertificate | * |
| acm-pca:GetCertificateAuthorityCertificate | * | |
| acm-pca:GetCertificateAuthorityCsr | ||
| APPCONFIG | appconfig:GetConfigurationProfile | * |
| appconfig:GetDeploymentStrategy | ||
| appconfig:GetExtension | ||
| appconfig:GetExtensionAssociation | ||
| appconfig:GetHostedConfigurationVersion | ||
| appconfig:ListApplications | ||
| appconfig:ListConfigurationProfiles | ||
| appconfig:ListDeployments | ||
| appconfig:ListDeploymentStrategies | ||
| appconfig:ListEnvironments | ||
| appconfig:ListExtensionAssociations | ||
| appconfig:ListExtensions | ||
| appconfig:ListHostedConfigurationVersions | ||
| appconfig:ListTagsForResource | ||
| appconfig:GetDeployment | ||
| APPFLOW | appflow:DescribeConnectorEntity | * |
| appflow:DescribeConnectorProfiles | ||
| appflow:DescribeConnectors | ||
| appflow:DescribeFlow | ||
| appflow:DescribeFlowExecutionRecords | ||
| appflow:ListConnectorEntities | ||
| appflow:ListConnectors | ||
| appflow:DescribeConnector | ||
| DYNAMODB | dynamodb:DescribeContributorInsights | * |
| dynamodb:GetResourcePolicy | ||
| dynamodb:DescribeBackup | ||
| EBS | ebs:GetSnapshotBlock | * |
| ebs:ListSnapshotBlocks | ||
| FREETIER | freetier:GetFreeTierUsage | * |
| LAKEFORMATION | lakeformation:DescribeLakeFormationIdentityCenterConfiguration | * |
| lakeformation:GetDataLakePrincipal | ||
| lakeformation:GetDataLakeSettings | ||
| lakeformation:GetEffectivePermissionsForPath | ||
| lakeformation:GetTableObjects | ||
| lakeformation:ListDataCellsFilter | ||
| lakeformation:ListPermissions | ||
| lakeformation:ListResources | ||
| lakeformation:ListTableStorageOptimizers | ||
| lakeformation:ListTransactions | ||
| LAMBDA | lambda:GetFunction | * |
| lambda:GetFunctionCodeSigningConfig | ||
| SCHEDULER | scheduler:GetSchedule | * |
| scheduler:GetScheduleGroup | ||
| scheduler:ListScheduleGroups | ||
| scheduler:ListSchedules | ||
| scheduler:ListTagsForResource | ||
| SCHEMAS | schemas:GetCodeBindingSource | * |
| DATASYNC | datasync:DescribeTaskExecution | * |
| datasync:DescribeLocationEfs | ||
| datasync:ListAgents | ||
| datasync:ListLocations | ||
| datasync:ListTaskExecutions | ||
| datasync:ListStorageSystems | ||
| datasync:DescribeLocationSmb | ||
| datasync:DescribeAgent | ||
| datasync:DescribeLocationFsxWindows | ||
| datasync:DescribeTask | ||
| datasync:DescribeLocationS3 | ||
| datasync:DescribeDiscoveryJob | ||
| datasync:DescribeLocationObjectStorage | ||
| datasync:DescribeStorageSystem | ||
| datasync:DescribeLocationAzureBlob | ||
| datasync:ListTagsForResource | ||
| datasync:ListTasks | ||
| datasync:DescribeLocationHdfs | ||
| datasync:DescribeLocationFsxLustre | ||
| datasync:ListDiscoveryJobs | ||
| datasync:DescribeLocationNfs | ||
| IOT | iot:GetCommand | * |
| iot:GetCommandExecution | ||
| iot:GetEffectivePolicies | ||
| iot:GetIndexingConfiguration | ||
| iot:GetJobDocument | ||
| iot:GetV2LoggingOptions | ||
| iot:GetOtaUpdate | ||
| iot:GetPackage | ||
| iot:GetPackageConfiguration | ||
| iot:GetPackageVersion | ||
| iot:GetRegistrationCode | ||
| iot:GetBehaviorModelTrainingSummaries | ||
| iot:GetThingConnectivityData | ||
| iot:GetTopicRule | ||
| iot:GetTopicRuleDestination | ||
| iotevents:DescribeAlarmModel | ||
| IOTEVENTS | iotevents:ListAlarmModels | * |
| iotevents:ListTagsForResource | ||
| iotevents:ListAlarmModelVersions | ||
| iotevents:DescribeDetectorModel | ||
| iotevents:ListDetectorModels | ||
| iotevents:ListDetectorModelVersions | ||
| iotevents:DescribeInput | ||
| iotevents:DescribeLoggingOptions | ||
| MEDIAPACKAGE | mediapackage:ListChannels | * |
| mediapackage:ListHarvestJobs | ||
| mediapackage:ListTagsForResource | ||
| MEDIAPACKAGEV2 | mediapackagev2:GetChannel | * |
| mediapackagev2:GetChannelPolicy | ||
| mediapackagev2:ListChannels | ||
| mediapackagev2:ListTagsForResource | ||
| mediapackagev2:GetChannelGroup | ||
| mediapackagev2:ListChannelGroups | ||
| mediapackagev2:ListHarvestJobs | ||
| mediapackagev2:GetOriginEndpoint | ||
| mediapackagev2:GetOriginEndpointPolicy | ||
| mediapackagev2:ListOriginEndpoints | ||
| MEDIAPACKAGE-VOD | mediapackage-vod:DescribeAsset | * |
| mediapackage-vod:ListAssets | ||
| mediapackage-vod:ListPackagingConfigurations | ||
| mediapackage-vod:ListPackagingGroups | ||
| SUPPORT | support:DescribeCases | * |
| support:DescribeCommunications | ||
| support:DescribeServices | ||
| support:DescribeSeverityLevels | ||
| IMAGEBUILDER | imagebuilder:GetComponentPolicy | * |
| imagebuilder:ListComponents | ||
| imagebuilder:ListTagsForResource | ||
| imagebuilder:GetComponent | ||
| imagebuilder:ListComponentBuildVersions | ||
| imagebuilder:GetContainerRecipe | ||
| imagebuilder:GetContainerRecipePolicy | ||
| imagebuilder:ListContainerRecipes | ||
| imagebuilder:GetDistributionConfiguration | ||
| imagebuilder:ListDistributionConfigurations | ||
| imagebuilder:GetImagePolicy | ||
| imagebuilder:ListImages | ||
| imagebuilder:GetImage | ||
| imagebuilder:ListImageBuildVersions | ||
| imagebuilder:ListImagePackages | ||
| imagebuilder:GetImagePipeline | ||
| imagebuilder:ListImagePipelines | ||
| imagebuilder:GetImageRecipe | ||
| imagebuilder:GetImageRecipePolicy | ||
| imagebuilder:ListImageRecipes | ||
| imagebuilder:ListImageScanFindings | ||
| imagebuilder:ListImageScanFindingAggregations | ||
| imagebuilder:GetInfrastructureConfiguration | ||
| imagebuilder:ListInfrastructureConfigurations | ||
| imagebuilder:ListLifecycleExecutions | ||
| imagebuilder:ListLifecycleExecutionResources | ||
| imagebuilder:GetLifecyclePolicy | ||
| imagebuilder:ListLifecyclePolicies | ||
| imagebuilder:ListWorkflows | ||
| imagebuilder:GetWorkflow | ||
| imagebuilder:ListWorkflowBuildVersions | ||
| imagebuilder:ListWorkflowExecutions | ||
| imagebuilder:GetWorkflowStepExecution | ||
| imagebuilder:ListWorkflowStepExecutions | ||
| DETECTIVE | detective:BatchGetMembershipDatasources | * |
| detective:ListDatasourcePackages | ||
| detective:ListTagsForResource | ||
| detective:GetInvestigation | ||
| detective:ListIndicators | ||
| detective:ListInvestigations | ||
| detective:ListInvitations | ||
| detective:BatchGetGraphMemberDatasources | ||
| detective:ListOrganizationAdminAccount | ||
| BATCH | batch:DescribeJobs | * |
| batch:ListJobs | ||
| batch:ListTagsForResource | ||
| batch:DescribeJobQueues | ||
| batch:DescribeSchedulingPolicies | ||
| batch:ListSchedulingPolicies | ||
| NETWORKMANAGER | networkmanager:GetConnectAttachment | * |
| networkmanager:GetSiteToSiteVpnAttachment | ||
| networkmanager:GetTransitGatewayRouteTableAttachment | ||
| networkmanager:GetVpcAttachment | ||
| networkmanager:ListAttachments | ||
| networkmanager:GetConnectPeer | ||
| networkmanager:ListConnectPeers | ||
| networkmanager:GetCoreNetwork | ||
| networkmanager:GetCoreNetworkChangeEvents | ||
| networkmanager:GetCoreNetworkChangeSet | ||
| networkmanager:GetCoreNetworkPolicy | ||
| networkmanager:GetNetworkRoutes | ||
| networkmanager:ListCoreNetworkPolicyVersions | ||
| networkmanager:ListCoreNetworks | ||
| networkmanager:GetConnectPeerAssociations | ||
| networkmanager:GetConnections | ||
| networkmanager:GetCustomerGatewayAssociations | ||
| networkmanager:GetDevices | ||
| networkmanager:GetLinkAssociations | ||
| networkmanager:GetLinks | ||
| networkmanager:GetNetworkResourceCounts | ||
| networkmanager:GetNetworkResourceRelationships | ||
| networkmanager:GetNetworkResources | ||
| networkmanager:GetNetworkTelemetry | ||
| networkmanager:GetResourcePolicy | ||
| networkmanager:GetSites | ||
| networkmanager:GetTransitGatewayConnectPeerAssociations | ||
| networkmanager:GetTransitGatewayRegistrations | ||
| networkmanager:GetTransitGatewayPeering | ||
| networkmanager:ListPeerings | ||
| CODEPIPELINE | codepipeline:ListActionExecutions | * |
| codepipeline:GetActionType | ||
| codepipeline:ListActionTypes | ||
| codepipeline:ListTagsForResource | ||
| codepipeline:ListPipelineExecutions | ||
| codepipeline:ListRuleExecutions | ||
| codepipeline:ListRuleTypes | ||
| codepipeline:ListWebhooks | ||
| GREENGRASS | greengrass:GetBulkDeploymentStatus | * |
| greengrass:GetGroupCertificateAuthority | ||
| greengrass:GetConnectorDefinitionVersion | ||
| greengrass:GetCoreDefinitionVersion | ||
| greengrass:GetDeploymentStatus | ||
| greengrass:GetDeviceDefinitionVersion | ||
| greengrass:GetFunctionDefinitionVersion | ||
| greengrass:GetAssociatedRole | ||
| greengrass:GetGroupCertificateConfiguration | ||
| greengrass:GetGroupVersion | ||
| greengrass:GetLoggerDefinitionVersion | ||
| greengrass:GetResourceDefinitionVersion | ||
| greengrass:GetServiceRoleForAccount | ||
| greengrass:GetSubscriptionDefinitionVersion | ||
| greengrass:DescribeComponent | ||
| GREENGRASSV2 | greengrass:GetComponent | * |
| greengrass:GetConnectivityInfo | ||
| greengrass:GetCoreDevice | ||
| greengrass:GetDeployment | ||
| greengrass:GetServiceRoleForAccount | ||
| INSPECTOR2 | inspector2:BatchGetCodeSnippet | * |
| inspector2:ListCisScanResultsAggregatedByChecks | ||
| inspector2:ListCisScanResultsAggregatedByTargetResource | ||
| inspector2:ListCisScanConfigurations | ||
| inspector2:ListMembers | ||
| inspector2:BatchGetFindingDetails | ||
| inspector2:GetCisScanReport | ||
| inspector2:GetCisScanResultDetails | ||
| inspector2:ListCisScans | ||
| inspector2:GetEncryptionKey | ||
| SSM | ssm:GetConnectionStatus | * |
| ssm:ListCommandInvocations | ||
| ssm:GetDocument | ||
| ssm:GetInventory | ||
| ssm:GetMaintenanceWindowExecutionTask | ||
| ssm:GetMaintenanceWindowTask | ||
| ssm:GetOpsItem | ||
| ssm:ListOpsItemEvents | ||
| ssm:ListOpsItemRelatedItems | ||
| ssm:GetOpsMetadata | ||
| ssm:GetParameter | ||
| ssm:GetParameterHistory | ||
| ssm:GetPatchBaseline | ||
| ssm:GetPatchBaselineForPatchGroup | ||
| ssm:GetResourcePolicies | ||
| EKS | eks:DescribeAddon | * |
| eks:ListAddons | ||
| WAF | waf:GetRegexPatternSet | * |
| waf:GetPermissionPolicy | ||
| waf:ListIPSets | ||
| waf:ListTagsForResource | ||
| waf:ListRuleGroups | ||
| waf:GetRuleGroup | ||
| waf:GetLoggingConfiguration | ||
| waf:ListRegexPatternSets | ||
| waf:GetWebACL | ||
| waf:ListActivatedRulesInRuleGroup | ||
| waf:GetByteMatchSet | ||
| waf:ListByteMatchSets | ||
| waf:GetGeoMatchSet | ||
| waf:ListGeoMatchSets | ||
| waf:GetLoggingConfiguration | ||
| waf:ListLoggingConfigurations | ||
| waf:GetRateBasedRule | ||
| waf:GetRateBasedRuleManagedKeys | ||
| waf:ListRateBasedRules | ||
| waf:GetRegexMatchSet | ||
| waf:ListRegexMatchSets | ||
| waf:ListRegexPatternSets | ||
| waf:GetRule | ||
| waf:ListRules | ||
| waf:ListRuleGroups | ||
| waf:GetSizeConstraintSet | ||
| waf:ListSizeConstraintSets | ||
| waf:GetSqlInjectionMatchSet | ||
| waf:ListSqlInjectionMatchSets | ||
| waf:GetXssMatchSet | ||
| waf:ListXssMatchSets | ||
| waf:GetIPSet | ||
| WAFV2 | wafv2:ListResourcesForWebACL | * |
| wafv2:ListRuleGroups | ||
| wafv2:ListWebACL | ||
| wafv2:ListTagsForResource | ||
| wafv2:GetLoggingConfiguration | ||
| wafv2:GetIPSet | ||
| wafv2:ListIPSets | ||
| wafv2:GetWebACL | ||
| wafv2:ListManagedRuleSet | ||
| wafv2:GetRuleGroup | ||
| wafv2:ListRegexPatternSets | ||
| wafv2:GetManagedRuleSet | ||
| wafv2:GetRegexPatternSet | ||
| wafv2:ListRegexPatternSets | ||
| wafv2:GetPermissionPolicy | ||
| wafv2:ListManagedRuleSets | ||
| FORECAST | forecast:DescribeDataset | * |
| forecast:GetAccuracyMetrics | ||
| forecast:DescribeExplainability | ||
| forecast:ListForecastExportJobs | ||
| forecast:ListForecasts | ||
| forecast:DescribeForecast | ||
| forecast:DescribeMonitor | ||
| forecast:ListMonitorEvaluations | ||
| forecast:DescribePredictor | ||
| forecast:ListWhatIfForecasts | ||
| forecast:DescribeDatasetImportJob | ||
| forecast:ListDatasetGroups | ||
| forecast:ListPredictorBacktestExportJobs | ||
| forecast:DescribeExplainabilityExport | ||
| forecast:ListMonitors | ||
| forecast:DescribePredictorBacktestExportJob | ||
| forecast:DescribeDatasetGroup | ||
| forecast:ListWhatIfAnalyses | ||
| forecast:DescribeWhatIfForecastExport | ||
| forecast:DescribeAutoPredictor | ||
| forecast:ListExplainabilities | ||
| forecast:DescribeForecastExportJob | ||
| forecast:DescribeWhatIfForecast | ||
| forecast:DescribeWhatIfAnalysis | ||
| forecast:ListDatasetImportJobs | ||
| forecast:ListExplainabilityExports | ||
| forecast:ListWhatIfForecastExports | ||
| forecast:ListTagsForResource | ||
| forecast:ListPredictors | ||
| APPRUNNER | apprunner:ListServicesForAutoScalingConfiguration | * |
| APPSYNC | appsync:GetApiAssociation | * |
| ATHENA | athena:GetCalculationExecution | * |
| athena:GetCalculationExecutionCode | ||
| athena:GetCalculationExecutionStatus | ||
| athena:GetDataCatalog | ||
| athena:GetNamedQuery | ||
| athena:GetPreparedStatement | ||
| athena:GetQueryExecution | ||
| athena:GetQueryResults | ||
| athena:GetQueryRuntimeStatistics | ||
| athena:GetSession | ||
| athena:GetSessionStatus | ||
| CE | ce:GetCommitmentPurchaseAnalysis | * |
| ce:ListCommitmentPurchaseAnalyses | ||
| ce:GetAnomalyMonitors | ||
| ce:ListTagsForResource | ||
| ce:GetAnomalySubscriptions | ||
| ce:ListCostAllocationTagBackfillHistory | ||
| ce:ListCostAllocationTags | ||
| ce:DescribeCostCategoryDefinition | ||
| ce:ListCostCategoryDefinitions | ||
| CLOUDFORMATION | cloudformation:DescribeAccountLimits | * |
| cloudformation:DescribeChangeSet | ||
| cloudformation:ListChangeSets | ||
| cloudformation:DescribeChangeSetHooks | ||
| cloudformation:ListExports | ||
| cloudformation:ListImports | ||
| cloudformation:DescribePublisher | ||
| cloudformation:DetectStackDrift | ||
| cloudformation:GetTemplateSummary | ||
| cloudformation:DetectStackSetDrift | ||
| cloudformation:DescribeType | ||
| cloudformation:ListTypes | ||
| cloudformation:DescribeTypeRegistration | ||
| cloudformation:ListTypeRegistrations | ||
| cloudformation:ListTypeVersions | ||
| ELASTICBEANSTALK | elasticbeanstalk:ListAvailableSolutionStacks | * |
| elasticbeanstalk:RetrieveEnvironmentInfo | ||
| elasticbeanstalk:ListPlatformBranches | ||
| elasticbeanstalk:ListPlatformVersions | ||
| MEDIATAILOR | mediatailor:ListAlerts | * |
| mediatailor:DescribeChannel | ||
| mediatailor:DescribeProgram | ||
| mediatailor:GetChannelPolicy | ||
| mediatailor:GetChannelSchedule | ||
| mediatailor:ListChannels | ||
| mediatailor:DescribeLiveSource | ||
| mediatailor:ListLiveSources | ||
| mediatailor:GetPlaybackConfiguration | ||
| mediatailor:ListPlaybackConfigurations | ||
| mediatailor:GetPrefetchSchedule | ||
| mediatailor:ListPrefetchSchedules | ||
| mediatailor:DescribeSourceLocation | ||
| mediatailor:ListSourceLocations | ||
| mediatailor:DescribeVodSource | ||
| mediatailor:ListVodSources | ||
| NETWORKFIREWALL | network-firewall:ListTagsForResource | * |
| network-firewall:DescribeRuleGroupMetadata | ||
| RESILIENCEHUB | resiliencehub:ListAppAssessments | * |
| resiliencehub:DescribeAppAssessment | ||
| resiliencehub:ListAlarmRecommendations | ||
| resiliencehub:ListAppAssessmentComplianceDrifts | ||
| resiliencehub:ListAppAssessmentResourceDrifts | ||
| resiliencehub:ListAppComponentCompliances | ||
| resiliencehub:ListAppComponentRecommendations | ||
| resiliencehub:ListSopRecommendations | ||
| resiliencehub:ListTestRecommendations | ||
| resiliencehub:ListApps | ||
| resiliencehub:DescribeApp | ||
| resiliencehub:DescribeDraftAppVersionResourcesImportStat us | ||
| resiliencehub:DescribeResourceGroupingRecommendationTask | ||
| resiliencehub:ListAppVersions | ||
| resiliencehub:DescribeAppVersion | ||
| resiliencehub:DescribeAppVersionResource | ||
| resiliencehub:DescribeAppVersionResourcesResolutionStatu s | ||
| resiliencehub:DescribeAppVersionTemplate | ||
| resiliencehub:ListAppInputSources | ||
| resiliencehub:ListAppVersionAppComponents | ||
| resiliencehub:ListAppVersionResourceMappings | ||
| resiliencehub:ListAppVersionResources | ||
| resiliencehub:ListUnsupportedAppVersionResources | ||
| resiliencehub:ListRecommendationTemplates | ||
| resiliencehub:ListResiliencyPolicies | ||
| resiliencehub:ListResourceGroupingRecommendations | ||
| resiliencehub:ListTagsForResource | ||
| resiliencehub:ListSuggestedResiliencyPolicies | ||
| resiliencehub:DescribeDraftAppVersionResourcesImportStatus | ||
| resiliencehub:DescribeAppVersionResourcesResolutionStatus | ||
| RESOURCEEXPLORER2 | resource-explorer-2:ListIndexes | * |
| resource-explorer-2:ListManagedViews | ||
| resource-explorer-2:GetManagedView | ||
| resource-explorer-2:ListSupportedResourceTypes | ||
| resource-explorer-2:ListViews | ||
| resource-explorer-2:GetView | ||
| resource-explorer-2:ListResources | ||
| resource-explorer-2:GetAccountLevelServiceConfiguration | ||
| resource-explorer-2:GetDefaultView | ||
| resource-explorer-2:GetIndex | ||
| resource-explorer-2:ListTagsForResource | ||
| resource-explorer-2:Search | ||
| ROUTE53DOMAINS | route53domains:ViewBilling | * |
| route53domains:CheckDomainAvailability | ||
| route53domains:CheckDomainTransferability | ||
| route53domains:ListPrices | ||
| SERVICEDISCOVERY | servicediscovery:GetInstance | * |
| servicediscovery:ListInstances | ||
| servicediscovery:GetNamespace | ||
| servicediscovery:ListNamespaces | ||
| servicediscovery:ListTagsForResource | ||
| servicediscovery:GetOperation | ||
| servicediscovery:ListOperations | ||
| servicediscovery:GetService | ||
| servicediscovery:GetServiceAttributes | ||
| servicediscovery:ListServices | ||
| STEPFUNCTIONS | states:GetActivityTask | * |
| states:ListActivities | ||
| states:DescribeExecution | ||
| states:GetExecutionHistory | ||
| states:ListExecutions | ||
| states:DescribeMapRun | ||
| states:ListMapRuns | ||
| states:ListTagsForResource | ||
| NOTIFICATIONS | notifications:ListEventRules | * |
| notifications:ListNotificationConfigurations | ||
| notifications:ListTagsForResource | ||
| notifications:ListNotificationEvents | ||
| notifications:ListChannels | ||
| notifications:ListNotificationHubs | ||
| notifications:GetNotificationConfiguration | ||
| notifications:GetEventRule | ||
| notifications:GetNotificationEvent |