Class: AWS.AuditManager

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  evidenceFolderId: 'STRING_VALUE', /* required */
  evidenceIds: [ /* required */
    'STRING_VALUE',
    /* more items */
  ]
};
auditmanager.batchAssociateAssessmentReportEvidence(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The identifier for the assessment.

  • evidenceFolderId — (String)

    The identifier for the folder that the evidence is stored in.

  • evidenceIds — (Array<String>)

    The list of evidence identifiers.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • evidenceIds — (Array<String>)

      The list of evidence identifiers.

    • errors — (Array<map>)

      A list of errors that the BatchAssociateAssessmentReportEvidence API returned.

      • evidenceId — (String)

        The identifier for the evidence.

      • errorCode — (String)

        The error code that was returned.

      • errorMessage — (String)

        The error message that was returned.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  createDelegationRequests: [ /* required */
    {
      comment: 'STRING_VALUE',
      controlSetId: 'STRING_VALUE',
      roleArn: 'STRING_VALUE',
      roleType: PROCESS_OWNER | RESOURCE_OWNER
    },
    /* more items */
  ]
};
auditmanager.batchCreateDelegationByAssessment(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • createDelegationRequests — (Array<map>)

    The API request to batch create delegations in Audit Manager.

    • comment — (String)

      A comment that's related to the delegation request.

    • controlSetId — (String)

      The unique identifier for the control set.

    • roleArn — (String)

      The Amazon Resource Name (ARN) of the IAM role.

    • roleType — (String)

      The type of customer persona.

      Note: In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
      Possible values include:
      • "PROCESS_OWNER"
      • "RESOURCE_OWNER"
  • assessmentId — (String)

    The identifier for the assessment.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • delegations — (Array<map>)

      The delegations that are associated with the assessment.

      • id — (String)

        The unique identifier for the delegation.

      • assessmentName — (String)

        The name of the assessment that's associated with the delegation.

      • assessmentId — (String)

        The identifier for the assessment that's associated with the delegation.

      • status — (String)

        The status of the delegation.

        Possible values include:
        • "IN_PROGRESS"
        • "UNDER_REVIEW"
        • "COMPLETE"
      • roleArn — (String)

        The Amazon Resource Name (ARN) of the IAM role.

      • roleType — (String)

        The type of customer persona.

        Note: In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
        Possible values include:
        • "PROCESS_OWNER"
        • "RESOURCE_OWNER"
      • creationTime — (Date)

        Specifies when the delegation was created.

      • lastUpdated — (Date)

        Specifies when the delegation was last updated.

      • controlSetId — (String)

        The identifier for the control set that's associated with the delegation.

      • comment — (String)

        The comment that's related to the delegation.

      • createdBy — (String)

        The user or role that created the delegation.

    • errors — (Array<map>)

      A list of errors that the BatchCreateDelegationByAssessment API returned.

      • createDelegationRequest — (map)

        The API request to batch create delegations in Audit Manager.

        • comment — (String)

          A comment that's related to the delegation request.

        • controlSetId — (String)

          The unique identifier for the control set.

        • roleArn — (String)

          The Amazon Resource Name (ARN) of the IAM role.

        • roleType — (String)

          The type of customer persona.

          Note: In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
          Possible values include:
          • "PROCESS_OWNER"
          • "RESOURCE_OWNER"
      • errorCode — (String)

        The error code that the BatchCreateDelegationByAssessment API returned.

      • errorMessage — (String)

        The error message that the BatchCreateDelegationByAssessment API returned.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  delegationIds: [ /* required */
    'STRING_VALUE',
    /* more items */
  ]
};
auditmanager.batchDeleteDelegationByAssessment(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • delegationIds — (Array<String>)

    The identifiers for the delegations.

  • assessmentId — (String)

    The identifier for the assessment.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • errors — (Array<map>)

      A list of errors that the BatchDeleteDelegationByAssessment API returned.

      • delegationId — (String)

        The identifier for the delegation.

      • errorCode — (String)

        The error code that the BatchDeleteDelegationByAssessment API returned.

      • errorMessage — (String)

        The error message that the BatchDeleteDelegationByAssessment API returned.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  evidenceFolderId: 'STRING_VALUE', /* required */
  evidenceIds: [ /* required */
    'STRING_VALUE',
    /* more items */
  ]
};
auditmanager.batchDisassociateAssessmentReportEvidence(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The identifier for the assessment.

  • evidenceFolderId — (String)

    The identifier for the folder that the evidence is stored in.

  • evidenceIds — (Array<String>)

    The list of evidence identifiers.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • evidenceIds — (Array<String>)

      The identifier for the evidence.

    • errors — (Array<map>)

      A list of errors that the BatchDisassociateAssessmentReportEvidence API returned.

      • evidenceId — (String)

        The identifier for the evidence.

      • errorCode — (String)

        The error code that was returned.

      • errorMessage — (String)

        The error message that was returned.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  controlId: 'STRING_VALUE', /* required */
  controlSetId: 'STRING_VALUE', /* required */
  manualEvidence: [ /* required */
    {
      evidenceFileName: 'STRING_VALUE',
      s3ResourcePath: 'STRING_VALUE',
      textResponse: 'STRING_VALUE'
    },
    /* more items */
  ]
};
auditmanager.batchImportEvidenceToAssessmentControl(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The identifier for the assessment.

  • controlSetId — (String)

    The identifier for the control set.

  • controlId — (String)

    The identifier for the control.

  • manualEvidence — (Array<map>)

    The list of manual evidence objects.

    • s3ResourcePath — (String)

      The S3 URL of the object that's imported as manual evidence.

    • textResponse — (String)

      The plain text response that's entered and saved as manual evidence.

    • evidenceFileName — (String)

      The name of the file that's uploaded as manual evidence. This name is populated using the evidenceFileName value from the GetEvidenceFileUploadUrl API response.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • errors — (Array<map>)

      A list of errors that the BatchImportEvidenceToAssessmentControl API returned.

      • manualEvidence — (map)

        Manual evidence that can't be collected automatically by Audit Manager.

        • s3ResourcePath — (String)

          The S3 URL of the object that's imported as manual evidence.

        • textResponse — (String)

          The plain text response that's entered and saved as manual evidence.

        • evidenceFileName — (String)

          The name of the file that's uploaded as manual evidence. This name is populated using the evidenceFileName value from the GetEvidenceFileUploadUrl API response.

      • errorCode — (String)

        The error code that the BatchImportEvidenceToAssessmentControl API returned.

      • errorMessage — (String)

        The error message that the BatchImportEvidenceToAssessmentControl API returned.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentReportsDestination: { /* required */
    destination: 'STRING_VALUE',
    destinationType: S3
  },
  frameworkId: 'STRING_VALUE', /* required */
  name: 'STRING_VALUE', /* required */
  roles: [ /* required */
    {
      roleArn: 'STRING_VALUE', /* required */
      roleType: PROCESS_OWNER | RESOURCE_OWNER /* required */
    },
    /* more items */
  ],
  scope: { /* required */
    awsAccounts: [
      {
        emailAddress: 'STRING_VALUE',
        id: 'STRING_VALUE',
        name: 'STRING_VALUE'
      },
      /* more items */
    ],
    awsServices: [
      {
        serviceName: 'STRING_VALUE'
      },
      /* more items */
    ]
  },
  description: 'STRING_VALUE',
  tags: {
    '<TagKey>': 'STRING_VALUE',
    /* '<TagKey>': ... */
  }
};
auditmanager.createAssessment(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • name — (String)

    The name of the assessment to be created.

  • description — (String)

    The optional description of the assessment to be created.

  • assessmentReportsDestination — (map)

    The assessment report storage destination for the assessment that's being created.

    • destinationType — (String)

      The destination type, such as Amazon S3.

      Possible values include:
      • "S3"
    • destination — (String)

      The destination bucket where Audit Manager stores assessment reports.

  • scope — (map)

    The wrapper that contains the Amazon Web Services accounts that are in scope for the assessment.

    Note: You no longer need to specify which Amazon Web Services are in scope when you create or update an assessment. Audit Manager infers the services in scope by examining your assessment controls and their data sources, and then mapping this information to the relevant Amazon Web Services. If an underlying data source changes for your assessment, we automatically update the services scope as needed to reflect the correct Amazon Web Services. This ensures that your assessment collects accurate and comprehensive evidence about all of the relevant services in your AWS environment.
    • awsAccounts — (Array<map>)

      The Amazon Web Services accounts that are included in the scope of the assessment.

      • id — (String)

        The identifier for the Amazon Web Services account.

      • emailAddress — (String)

        The email address that's associated with the Amazon Web Services account.

      • name — (String)

        The name of the Amazon Web Services account.

    • awsServices — (Array<map>)

      The Amazon Web Services services that are included in the scope of the assessment.

      This API parameter is no longer supported. If you use this parameter to specify one or more Amazon Web Services, Audit Manager ignores this input. Instead, the value for awsServices will show as empty.

      • serviceName — (String)

        The name of the Amazon Web Service.

  • roles — (Array<map>)

    The list of roles for the assessment.

    • roleType — required — (String)

      The type of customer persona.

      Note: In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
      Possible values include:
      • "PROCESS_OWNER"
      • "RESOURCE_OWNER"
    • roleArn — required — (String)

      The Amazon Resource Name (ARN) of the IAM role.

  • frameworkId — (String)

    The identifier for the framework that the assessment will be created from.

  • tags — (map<String>)

    The tags that are associated with the assessment.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • assessment — (map)

      An entity that defines the scope of audit evidence collected by Audit Manager. An Audit Manager assessment is an implementation of an Audit Manager framework.

      • arn — (String)

        The Amazon Resource Name (ARN) of the assessment.

      • awsAccount — (map)

        The Amazon Web Services account that's associated with the assessment.

        • id — (String)

          The identifier for the Amazon Web Services account.

        • emailAddress — (String)

          The email address that's associated with the Amazon Web Services account.

        • name — (String)

          The name of the Amazon Web Services account.

      • metadata — (map)

        The metadata for the assessment.

        • name — (String)

          The name of the assessment.

        • id — (String)

          The unique identifier for the assessment.

        • description — (String)

          The description of the assessment.

        • complianceType — (String)

          The name of the compliance standard that's related to the assessment, such as PCI-DSS.

        • status — (String)

          The overall status of the assessment.

          Possible values include:
          • "ACTIVE"
          • "INACTIVE"
        • assessmentReportsDestination — (map)

          The destination that evidence reports are stored in for the assessment.

          • destinationType — (String)

            The destination type, such as Amazon S3.

            Possible values include:
            • "S3"
          • destination — (String)

            The destination bucket where Audit Manager stores assessment reports.

        • scope — (map)

          The wrapper of Amazon Web Services accounts and services that are in scope for the assessment.

          • awsAccounts — (Array<map>)

            The Amazon Web Services accounts that are included in the scope of the assessment.

            • id — (String)

              The identifier for the Amazon Web Services account.

            • emailAddress — (String)

              The email address that's associated with the Amazon Web Services account.

            • name — (String)

              The name of the Amazon Web Services account.

          • awsServices — (Array<map>)

            The Amazon Web Services services that are included in the scope of the assessment.

            This API parameter is no longer supported. If you use this parameter to specify one or more Amazon Web Services, Audit Manager ignores this input. Instead, the value for awsServices will show as empty.

            • serviceName — (String)

              The name of the Amazon Web Service.

        • roles — (Array<map>)

          The roles that are associated with the assessment.

          • roleType — required — (String)

            The type of customer persona.

            Note: In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
            Possible values include:
            • "PROCESS_OWNER"
            • "RESOURCE_OWNER"
          • roleArn — required — (String)

            The Amazon Resource Name (ARN) of the IAM role.

        • delegations — (Array<map>)

          The delegations that are associated with the assessment.

          • id — (String)

            The unique identifier for the delegation.

          • assessmentName — (String)

            The name of the assessment that's associated with the delegation.

          • assessmentId — (String)

            The identifier for the assessment that's associated with the delegation.

          • status — (String)

            The status of the delegation.

            Possible values include:
            • "IN_PROGRESS"
            • "UNDER_REVIEW"
            • "COMPLETE"
          • roleArn — (String)

            The Amazon Resource Name (ARN) of the IAM role.

          • roleType — (String)

            The type of customer persona.

            Note: In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
            Possible values include:
            • "PROCESS_OWNER"
            • "RESOURCE_OWNER"
          • creationTime — (Date)

            Specifies when the delegation was created.

          • lastUpdated — (Date)

            Specifies when the delegation was last updated.

          • controlSetId — (String)

            The identifier for the control set that's associated with the delegation.

          • comment — (String)

            The comment that's related to the delegation.

          • createdBy — (String)

            The user or role that created the delegation.

        • creationTime — (Date)

          Specifies when the assessment was created.

        • lastUpdated — (Date)

          The time of the most recent update.

      • framework — (map)

        The framework that the assessment was created from.

        • id — (String)

          The unique identifier for the framework.

        • arn — (String)

          The Amazon Resource Name (ARN) of the framework.

        • metadata — (map)

          The metadata of a framework, such as the name, ID, or description.

          • name — (String)

            The name of the framework.

          • description — (String)

            The description of the framework.

          • logo — (String)

            The logo that's associated with the framework.

          • complianceType — (String)

            The compliance standard that's associated with the framework. For example, this could be PCI DSS or HIPAA.

        • controlSets — (Array<map>)

          The control sets that are associated with the framework.

          • id — (String)

            The identifier of the control set in the assessment. This is the control set name in a plain string format.

          • description — (String)

            The description for the control set.

          • status — (String)

            The current status of the control set.

            Possible values include:
            • "ACTIVE"
            • "UNDER_REVIEW"
            • "REVIEWED"
          • roles — (Array<map>)

            The roles that are associated with the control set.

            • roleType — required — (String)

              The type of customer persona.

              Note: In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
              Possible values include:
              • "PROCESS_OWNER"
              • "RESOURCE_OWNER"
            • roleArn — required — (String)

              The Amazon Resource Name (ARN) of the IAM role.

          • controls — (Array<map>)

            The list of controls that's contained with the control set.

            • id — (String)

              The identifier for the control.

            • name — (String)

              The name of the control.

            • description — (String)

              The description of the control.

            • status — (String)

              The status of the control.

              Possible values include:
              • "UNDER_REVIEW"
              • "REVIEWED"
              • "INACTIVE"
            • response — (String)

              The response of the control.

              Possible values include:
              • "MANUAL"
              • "AUTOMATE"
              • "DEFER"
              • "IGNORE"
            • comments — (Array<map>)

              The list of comments that's attached to the control.

              • authorName — (String)

                The name of the user who authored the comment.

              • commentBody — (String)

                The body text of a control comment.

              • postedDate — (Date)

                The time when the comment was posted.

            • evidenceSources — (Array<String>)

              The list of data sources for the evidence.

            • evidenceCount — (Integer)

              The amount of evidence that's collected for the control.

            • assessmentReportEvidenceCount — (Integer)

              The amount of evidence in the assessment report.

          • delegations — (Array<map>)

            The delegations that are associated with the control set.

            • id — (String)

              The unique identifier for the delegation.

            • assessmentName — (String)

              The name of the assessment that's associated with the delegation.

            • assessmentId — (String)

              The identifier for the assessment that's associated with the delegation.

            • status — (String)

              The status of the delegation.

              Possible values include:
              • "IN_PROGRESS"
              • "UNDER_REVIEW"
              • "COMPLETE"
            • roleArn — (String)

              The Amazon Resource Name (ARN) of the IAM role.

            • roleType — (String)

              The type of customer persona.

              Note: In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
              Possible values include:
              • "PROCESS_OWNER"
              • "RESOURCE_OWNER"
            • creationTime — (Date)

              Specifies when the delegation was created.

            • lastUpdated — (Date)

              Specifies when the delegation was last updated.

            • controlSetId — (String)

              The identifier for the control set that's associated with the delegation.

            • comment — (String)

              The comment that's related to the delegation.

            • createdBy — (String)

              The user or role that created the delegation.

          • systemEvidenceCount — (Integer)

            The total number of evidence objects that are retrieved automatically for the control set.

          • manualEvidenceCount — (Integer)

            The total number of evidence objects that are uploaded manually to the control set.

      • tags — (map<String>)

        The tags that are associated with the assessment.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  controlSets: [ /* required */
    {
      name: 'STRING_VALUE', /* required */
      controls: [
        {
          id: 'STRING_VALUE' /* required */
        },
        /* more items */
      ]
    },
    /* more items */
  ],
  name: 'STRING_VALUE', /* required */
  complianceType: 'STRING_VALUE',
  description: 'STRING_VALUE',
  tags: {
    '<TagKey>': 'STRING_VALUE',
    /* '<TagKey>': ... */
  }
};
auditmanager.createAssessmentFramework(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • name — (String)

    The name of the new custom framework.

  • description — (String)

    An optional description for the new custom framework.

  • complianceType — (String)

    The compliance type that the new custom framework supports, such as CIS or HIPAA.

  • controlSets — (Array<map>)

    The control sets that are associated with the framework.

    • name — required — (String)

      The name of the control set.

    • controls — (Array<map>)

      The list of controls within the control set. This doesn't contain the control set ID.

      • id — required — (String)

        The unique identifier of the control.

  • tags — (map<String>)

    The tags that are associated with the framework.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • framework — (map)

      The name of the new framework that the CreateAssessmentFramework API returned.

      • arn — (String)

        The Amazon Resource Name (ARN) of the framework.

      • id — (String)

        The unique identifier for the framework.

      • name — (String)

        The name of the framework.

      • type — (String)

        Specifies whether the framework is a standard framework or a custom framework.

        Possible values include:
        • "Standard"
        • "Custom"
      • complianceType — (String)

        The compliance type that the framework supports, such as CIS or HIPAA.

      • description — (String)

        The description of the framework.

      • logo — (String)

        The logo that's associated with the framework.

      • controlSources — (String)

        The control data sources where Audit Manager collects evidence from.

      • controlSets — (Array<map>)

        The control sets that are associated with the framework.

        • id — (String)

          The identifier of the control set in the assessment. This is the control set name in a plain string format.

        • name — (String)

          The name of the control set.

        • controls — (Array<map>)

          The list of controls within the control set.

          • arn — (String)

            The Amazon Resource Name (ARN) of the control.

          • id — (String)

            The unique identifier for the control.

          • type — (String)

            Specifies whether the control is a standard control or a custom control.

            Possible values include:
            • "Standard"
            • "Custom"
            • "Core"
          • name — (String)

            The name of the control.

          • description — (String)

            The description of the control.

          • testingInformation — (String)

            The steps that you should follow to determine if the control has been satisfied.

          • actionPlanTitle — (String)

            The title of the action plan for remediating the control.

          • actionPlanInstructions — (String)

            The recommended actions to carry out if the control isn't fulfilled.

          • controlSources — (String)

            The data source types that determine where Audit Manager collects evidence from for the control.

          • controlMappingSources — (Array<map>)

            The data mapping sources for the control.

            • sourceId — (String)

              The unique identifier for the source.

            • sourceName — (String)

              The name of the source.

            • sourceDescription — (String)

              The description of the source.

            • sourceSetUpOption — (String)

              The setup option for the data source. This option reflects if the evidence collection method is automated or manual. If you don’t provide a value for sourceSetUpOption, Audit Manager automatically infers and populates the correct value based on the sourceType that you specify.

              Possible values include:
              • "System_Controls_Mapping"
              • "Procedural_Controls_Mapping"
            • sourceType — (String)

              Specifies which type of data source is used to collect evidence.

              • The source can be an individual data source type, such as AWS_Cloudtrail, AWS_Config, AWS_Security_Hub, AWS_API_Call, or MANUAL.

              • The source can also be a managed grouping of data sources, such as a Core_Control or a Common_Control.

              Possible values include:
              • "AWS_Cloudtrail"
              • "AWS_Config"
              • "AWS_Security_Hub"
              • "AWS_API_Call"
              • "MANUAL"
              • "Common_Control"
              • "Core_Control"
            • sourceKeyword — (map)

              A keyword that relates to the control data source.

              For manual evidence, this keyword indicates if the manual evidence is a file or text.

              For automated evidence, this keyword identifies a specific CloudTrail event, Config rule, Security Hub control, or Amazon Web Services API name.

              To learn more about the supported keywords that you can use when mapping a control data source, see the following pages in the Audit Manager User Guide:

              • Config rules supported by Audit Manager

              • Security Hub controls supported by Audit Manager

              • API calls supported by Audit Manager

              • CloudTrail event names supported by Audit Manager

              • keywordInputType — (String)

                The input method for the keyword.

                • SELECT_FROM_LIST is used when mapping a data source for automated evidence.

                  • When keywordInputType is SELECT_FROM_LIST, a keyword must be selected to collect automated evidence. For example, this keyword can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call.

                • UPLOAD_FILE and INPUT_TEXT are only used when mapping a data source for manual evidence.

                  • When keywordInputType is UPLOAD_FILE, a file must be uploaded as manual evidence.

                  • When keywordInputType is INPUT_TEXT, text must be entered as manual evidence.

                Possible values include:
                • "SELECT_FROM_LIST"
                • "UPLOAD_FILE"
                • "INPUT_TEXT"
              • keywordValue — (String)

                The value of the keyword that's used when mapping a control data source. For example, this can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call.

                If you’re mapping a data source to a rule in Config, the keywordValue that you specify depends on the type of rule:

                • For managed rules, you can use the rule identifier as the keywordValue. You can find the rule identifier from the list of Config managed rules. For some rules, the rule identifier is different from the rule name. For example, the rule name restricted-ssh has the following rule identifier: INCOMING_SSH_DISABLED. Make sure to use the rule identifier, not the rule name.

                  Keyword example for managed rules:

                  • Managed rule name: s3-bucket-acl-prohibited

                    keywordValue: S3_BUCKET_ACL_PROHIBITED

                • For custom rules, you form the keywordValue by adding the Custom_ prefix to the rule name. This prefix distinguishes the custom rule from a managed rule.

                  Keyword example for custom rules:

                  • Custom rule name: my-custom-config-rule

                    keywordValue: Custom_my-custom-config-rule

                • For service-linked rules, you form the keywordValue by adding the Custom_ prefix to the rule name. In addition, you remove the suffix ID that appears at the end of the rule name.

                  Keyword examples for service-linked rules:

                  • Service-linked rule name: CustomRuleForAccount-conformance-pack-szsm1uv0w

                    keywordValue: Custom_CustomRuleForAccount-conformance-pack

                  • Service-linked rule name: OrgConfigRule-s3-bucket-versioning-enabled-dbgzf8ba

                    keywordValue: Custom_OrgConfigRule-s3-bucket-versioning-enabled

                The keywordValue is case sensitive. If you enter a value incorrectly, Audit Manager might not recognize the data source mapping. As a result, you might not successfully collect evidence from that data source as intended.

                Keep in mind the following requirements, depending on the data source type that you're using.

                1. For Config:

                   • For managed rules, make sure that the keywordValue is the rule identifier in ALL_CAPS_WITH_UNDERSCORES. For example, CLOUDWATCH_LOG_GROUP_ENCRYPTED. For accuracy, we recommend that you reference the list of supported Config managed rules.

                   • For custom rules, make sure that the keywordValue has the Custom_ prefix followed by the custom rule name. The format of the custom rule name itself may vary. For accuracy, we recommend that you visit the Config console to verify your custom rule name.

                2. For Security Hub: The format varies for Security Hub control names. For accuracy, we recommend that you reference the list of supported Security Hub controls.

                3. For Amazon Web Services API calls: Make sure that the keywordValue is written as serviceprefix_ActionName. For example, iam_ListGroups. For accuracy, we recommend that you reference the list of supported API calls.

                4. For CloudTrail: Make sure that the keywordValue is written as serviceprefix_ActionName. For example, cloudtrail_StartLogging. For accuracy, we recommend that you review the Amazon Web Service prefix and action names in the Service Authorization Reference.

            • sourceFrequency — (String)

              Specifies how often evidence is collected from the control mapping source.

              Possible values include:
              • "DAILY"
              • "WEEKLY"
              • "MONTHLY"
            • troubleshootingText — (String)

              The instructions for troubleshooting the control.

          • createdAt — (Date)

            The time when the control was created.

          • lastUpdatedAt — (Date)

            The time when the control was most recently updated.

          • createdBy — (String)

            The user or role that created the control.

          • lastUpdatedBy — (String)

            The user or role that most recently updated the control.

          • tags — (map<String>)

            The tags associated with the control.

          • state — (String)

            The state of the control. The END_OF_SUPPORT state is applicable to standard controls only. This state indicates that the standard control can still be used to collect evidence, but Audit Manager is no longer updating or maintaining that control.

            Possible values include:
            • "ACTIVE"
            • "END_OF_SUPPORT"
      • createdAt — (Date)

        The time when the framework was created.

      • lastUpdatedAt — (Date)

        The time when the framework was most recently updated.

      • createdBy — (String)

        The user or role that created the framework.

      • lastUpdatedBy — (String)

        The user or role that most recently updated the framework.

      • tags — (map<String>)

        The tags that are associated with the framework.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  name: 'STRING_VALUE', /* required */
  description: 'STRING_VALUE',
  queryStatement: 'STRING_VALUE'
};
auditmanager.createAssessmentReport(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • name — (String)

    The name of the new assessment report.

  • description — (String)

    The description of the assessment report.

  • assessmentId — (String)

    The identifier for the assessment.

  • queryStatement — (String)

    A SQL statement that represents an evidence finder query.

    Provide this parameter when you want to generate an assessment report from the results of an evidence finder search query. When you use this parameter, Audit Manager generates a one-time report using only the evidence from the query output. This report does not include any assessment evidence that was manually added to a report using the console, or associated with a report using the API.

    To use this parameter, the enablementStatus of evidence finder must be ENABLED.

    For examples and help resolving queryStatement validation exceptions, see Troubleshooting evidence finder issues in the Audit Manager User Guide.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • assessmentReport — (map)

      The new assessment report that the CreateAssessmentReport API returned.

      • id — (String)

        The unique identifier for the assessment report.

      • name — (String)

        The name that's given to the assessment report.

      • description — (String)

        The description of the specified assessment report.

      • awsAccountId — (String)

        The identifier for the specified Amazon Web Services account.

      • assessmentId — (String)

        The identifier for the specified assessment.

      • assessmentName — (String)

        The name of the associated assessment.

      • author — (String)

        The name of the user who created the assessment report.

      • status — (String)

        The current status of the specified assessment report.

        Possible values include:
        • "COMPLETE"
        • "IN_PROGRESS"
        • "FAILED"
      • creationTime — (Date)

        Specifies when the assessment report was created.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  controlMappingSources: [ /* required */
    {
      sourceDescription: 'STRING_VALUE',
      sourceFrequency: DAILY | WEEKLY | MONTHLY,
      sourceKeyword: {
        keywordInputType: SELECT_FROM_LIST | UPLOAD_FILE | INPUT_TEXT,
        keywordValue: 'STRING_VALUE'
      },
      sourceName: 'STRING_VALUE',
      sourceSetUpOption: System_Controls_Mapping | Procedural_Controls_Mapping,
      sourceType: AWS_Cloudtrail | AWS_Config | AWS_Security_Hub | AWS_API_Call | MANUAL | Common_Control | Core_Control,
      troubleshootingText: 'STRING_VALUE'
    },
    /* more items */
  ],
  name: 'STRING_VALUE', /* required */
  actionPlanInstructions: 'STRING_VALUE',
  actionPlanTitle: 'STRING_VALUE',
  description: 'STRING_VALUE',
  tags: {
    '<TagKey>': 'STRING_VALUE',
    /* '<TagKey>': ... */
  },
  testingInformation: 'STRING_VALUE'
};
auditmanager.createControl(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • name — (String)

    The name of the control.

  • description — (String)

    The description of the control.

  • testingInformation — (String)

    The steps to follow to determine if the control is satisfied.

  • actionPlanTitle — (String)

    The title of the action plan for remediating the control.

  • actionPlanInstructions — (String)

    The recommended actions to carry out if the control isn't fulfilled.

  • controlMappingSources — (Array<map>)

    The data mapping sources for the control.

    • sourceName — (String)

      The name of the control mapping data source.

    • sourceDescription — (String)

      The description of the data source that determines where Audit Manager collects evidence from for the control.

    • sourceSetUpOption — (String)

      The setup option for the data source. This option reflects if the evidence collection method is automated or manual. If you don’t provide a value for sourceSetUpOption, Audit Manager automatically infers and populates the correct value based on the sourceType that you specify.

      Possible values include:
      • "System_Controls_Mapping"
      • "Procedural_Controls_Mapping"
    • sourceType — (String)

      Specifies which type of data source is used to collect evidence.

      • The source can be an individual data source type, such as AWS_Cloudtrail, AWS_Config, AWS_Security_Hub, AWS_API_Call, or MANUAL.

      • The source can also be a managed grouping of data sources, such as a Core_Control or a Common_Control.

      Possible values include:
      • "AWS_Cloudtrail"
      • "AWS_Config"
      • "AWS_Security_Hub"
      • "AWS_API_Call"
      • "MANUAL"
      • "Common_Control"
      • "Core_Control"
    • sourceKeyword — (map)

      A keyword that relates to the control data source.

      For manual evidence, this keyword indicates if the manual evidence is a file or text.

      For automated evidence, this keyword identifies a specific CloudTrail event, Config rule, Security Hub control, or Amazon Web Services API name.

      To learn more about the supported keywords that you can use when mapping a control data source, see the following pages in the Audit Manager User Guide:

      • Config rules supported by Audit Manager

      • Security Hub controls supported by Audit Manager

      • API calls supported by Audit Manager

      • CloudTrail event names supported by Audit Manager

      • keywordInputType — (String)

        The input method for the keyword.

        • SELECT_FROM_LIST is used when mapping a data source for automated evidence.

          • When keywordInputType is SELECT_FROM_LIST, a keyword must be selected to collect automated evidence. For example, this keyword can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call.

        • UPLOAD_FILE and INPUT_TEXT are only used when mapping a data source for manual evidence.

          • When keywordInputType is UPLOAD_FILE, a file must be uploaded as manual evidence.

          • When keywordInputType is INPUT_TEXT, text must be entered as manual evidence.

        Possible values include:
        • "SELECT_FROM_LIST"
        • "UPLOAD_FILE"
        • "INPUT_TEXT"
      • keywordValue — (String)

        The value of the keyword that's used when mapping a control data source. For example, this can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call.

        If you’re mapping a data source to a rule in Config, the keywordValue that you specify depends on the type of rule:

        • For managed rules, you can use the rule identifier as the keywordValue. You can find the rule identifier from the list of Config managed rules. For some rules, the rule identifier is different from the rule name. For example, the rule name restricted-ssh has the following rule identifier: INCOMING_SSH_DISABLED. Make sure to use the rule identifier, not the rule name.

          Keyword example for managed rules:

          • Managed rule name: s3-bucket-acl-prohibited

            keywordValue: S3_BUCKET_ACL_PROHIBITED

        • For custom rules, you form the keywordValue by adding the Custom_ prefix to the rule name. This prefix distinguishes the custom rule from a managed rule.

          Keyword example for custom rules:

          • Custom rule name: my-custom-config-rule

            keywordValue: Custom_my-custom-config-rule

        • For service-linked rules, you form the keywordValue by adding the Custom_ prefix to the rule name. In addition, you remove the suffix ID that appears at the end of the rule name.

          Keyword examples for service-linked rules:

          • Service-linked rule name: CustomRuleForAccount-conformance-pack-szsm1uv0w

            keywordValue: Custom_CustomRuleForAccount-conformance-pack

          • Service-linked rule name: OrgConfigRule-s3-bucket-versioning-enabled-dbgzf8ba

            keywordValue: Custom_OrgConfigRule-s3-bucket-versioning-enabled

        The keywordValue is case sensitive. If you enter a value incorrectly, Audit Manager might not recognize the data source mapping. As a result, you might not successfully collect evidence from that data source as intended.

        Keep in mind the following requirements, depending on the data source type that you're using.

        1. For Config:

           • For managed rules, make sure that the keywordValue is the rule identifier in ALL_CAPS_WITH_UNDERSCORES. For example, CLOUDWATCH_LOG_GROUP_ENCRYPTED. For accuracy, we recommend that you reference the list of supported Config managed rules.

           • For custom rules, make sure that the keywordValue has the Custom_ prefix followed by the custom rule name. The format of the custom rule name itself may vary. For accuracy, we recommend that you visit the Config console to verify your custom rule name.

        2. For Security Hub: The format varies for Security Hub control names. For accuracy, we recommend that you reference the list of supported Security Hub controls.

        3. For Amazon Web Services API calls: Make sure that the keywordValue is written as serviceprefix_ActionName. For example, iam_ListGroups. For accuracy, we recommend that you reference the list of supported API calls.

        4. For CloudTrail: Make sure that the keywordValue is written as serviceprefix_ActionName. For example, cloudtrail_StartLogging. For accuracy, we recommend that you review the Amazon Web Service prefix and action names in the Service Authorization Reference.

    • sourceFrequency — (String)

      Specifies how often evidence is collected from the control mapping source.

      Possible values include:
      • "DAILY"
      • "WEEKLY"
      • "MONTHLY"
    • troubleshootingText — (String)

      The instructions for troubleshooting the control.

  • tags — (map<String>)

    The tags that are associated with the control.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • control — (map)

      The new control that the CreateControl API returned.

      • arn — (String)

        The Amazon Resource Name (ARN) of the control.

      • id — (String)

        The unique identifier for the control.

      • type — (String)

        Specifies whether the control is a standard control or a custom control.

        Possible values include:
        • "Standard"
        • "Custom"
        • "Core"
      • name — (String)

        The name of the control.

      • description — (String)

        The description of the control.

      • testingInformation — (String)

        The steps that you should follow to determine if the control has been satisfied.

      • actionPlanTitle — (String)

        The title of the action plan for remediating the control.

      • actionPlanInstructions — (String)

        The recommended actions to carry out if the control isn't fulfilled.

      • controlSources — (String)

        The data source types that determine where Audit Manager collects evidence from for the control.

      • controlMappingSources — (Array<map>)

        The data mapping sources for the control.

        • sourceId — (String)

          The unique identifier for the source.

        • sourceName — (String)

          The name of the source.

        • sourceDescription — (String)

          The description of the source.

        • sourceSetUpOption — (String)

          The setup option for the data source. This option reflects if the evidence collection method is automated or manual. If you don’t provide a value for sourceSetUpOption, Audit Manager automatically infers and populates the correct value based on the sourceType that you specify.

          Possible values include:
          • "System_Controls_Mapping"
          • "Procedural_Controls_Mapping"
        • sourceType — (String)

          Specifies which type of data source is used to collect evidence.

          • The source can be an individual data source type, such as AWS_Cloudtrail, AWS_Config, AWS_Security_Hub, AWS_API_Call, or MANUAL.

          • The source can also be a managed grouping of data sources, such as a Core_Control or a Common_Control.

          Possible values include:
          • "AWS_Cloudtrail"
          • "AWS_Config"
          • "AWS_Security_Hub"
          • "AWS_API_Call"
          • "MANUAL"
          • "Common_Control"
          • "Core_Control"
        • sourceKeyword — (map)

          A keyword that relates to the control data source.

          For manual evidence, this keyword indicates if the manual evidence is a file or text.

          For automated evidence, this keyword identifies a specific CloudTrail event, Config rule, Security Hub control, or Amazon Web Services API name.

          To learn more about the supported keywords that you can use when mapping a control data source, see the following pages in the Audit Manager User Guide:

          • Config rules supported by Audit Manager

          • Security Hub controls supported by Audit Manager

          • API calls supported by Audit Manager

          • CloudTrail event names supported by Audit Manager

          • keywordInputType — (String)

            The input method for the keyword.

            • SELECT_FROM_LIST is used when mapping a data source for automated evidence.

              • When keywordInputType is SELECT_FROM_LIST, a keyword must be selected to collect automated evidence. For example, this keyword can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call.

            • UPLOAD_FILE and INPUT_TEXT are only used when mapping a data source for manual evidence.

              • When keywordInputType is UPLOAD_FILE, a file must be uploaded as manual evidence.

              • When keywordInputType is INPUT_TEXT, text must be entered as manual evidence.

            Possible values include:
            • "SELECT_FROM_LIST"
            • "UPLOAD_FILE"
            • "INPUT_TEXT"
          • keywordValue — (String)

            The value of the keyword that's used when mapping a control data source. For example, this can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call.

            If you’re mapping a data source to a rule in Config, the keywordValue that you specify depends on the type of rule:

            • For managed rules, you can use the rule identifier as the keywordValue. You can find the rule identifier from the list of Config managed rules. For some rules, the rule identifier is different from the rule name. For example, the rule name restricted-ssh has the following rule identifier: INCOMING_SSH_DISABLED. Make sure to use the rule identifier, not the rule name.

              Keyword example for managed rules:

              • Managed rule name: s3-bucket-acl-prohibited

                keywordValue: S3_BUCKET_ACL_PROHIBITED

            • For custom rules, you form the keywordValue by adding the Custom_ prefix to the rule name. This prefix distinguishes the custom rule from a managed rule.

              Keyword example for custom rules:

              • Custom rule name: my-custom-config-rule

                keywordValue: Custom_my-custom-config-rule

            • For service-linked rules, you form the keywordValue by adding the Custom_ prefix to the rule name. In addition, you remove the suffix ID that appears at the end of the rule name.

              Keyword examples for service-linked rules:

              • Service-linked rule name: CustomRuleForAccount-conformance-pack-szsm1uv0w

                keywordValue: Custom_CustomRuleForAccount-conformance-pack

              • Service-linked rule name: OrgConfigRule-s3-bucket-versioning-enabled-dbgzf8ba

                keywordValue: Custom_OrgConfigRule-s3-bucket-versioning-enabled

            The keywordValue is case sensitive. If you enter a value incorrectly, Audit Manager might not recognize the data source mapping. As a result, you might not successfully collect evidence from that data source as intended.

            Keep in mind the following requirements, depending on the data source type that you're using.

            1. For Config:

               • For managed rules, make sure that the keywordValue is the rule identifier in ALL_CAPS_WITH_UNDERSCORES. For example, CLOUDWATCH_LOG_GROUP_ENCRYPTED. For accuracy, we recommend that you reference the list of supported Config managed rules.

               • For custom rules, make sure that the keywordValue has the Custom_ prefix followed by the custom rule name. The format of the custom rule name itself may vary. For accuracy, we recommend that you visit the Config console to verify your custom rule name.

            2. For Security Hub: The format varies for Security Hub control names. For accuracy, we recommend that you reference the list of supported Security Hub controls.

            3. For Amazon Web Services API calls: Make sure that the keywordValue is written as serviceprefix_ActionName. For example, iam_ListGroups. For accuracy, we recommend that you reference the list of supported API calls.

            4. For CloudTrail: Make sure that the keywordValue is written as serviceprefix_ActionName. For example, cloudtrail_StartLogging. For accuracy, we recommend that you review the Amazon Web Service prefix and action names in the Service Authorization Reference.

        • sourceFrequency — (String)

          Specifies how often evidence is collected from the control mapping source.

          Possible values include:
          • "DAILY"
          • "WEEKLY"
          • "MONTHLY"
        • troubleshootingText — (String)

          The instructions for troubleshooting the control.

      • createdAt — (Date)

        The time when the control was created.

      • lastUpdatedAt — (Date)

        The time when the control was most recently updated.

      • createdBy — (String)

        The user or role that created the control.

      • lastUpdatedBy — (String)

        The user or role that most recently updated the control.

      • tags — (map<String>)

        The tags associated with the control.

      • state — (String)

        The state of the control. The END_OF_SUPPORT state is applicable to standard controls only. This state indicates that the standard control can still be used to collect evidence, but Audit Manager is no longer updating or maintaining that control.

        Possible values include:
        • "ACTIVE"
        • "END_OF_SUPPORT"

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE' /* required */
};
auditmanager.deleteAssessment(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The identifier for the assessment.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  frameworkId: 'STRING_VALUE' /* required */
};
auditmanager.deleteAssessmentFramework(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • frameworkId — (String)

    The identifier for the custom framework.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  requestId: 'STRING_VALUE', /* required */
  requestType: SENT | RECEIVED /* required */
};
auditmanager.deleteAssessmentFrameworkShare(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • requestId — (String)

    The unique identifier for the share request to be deleted.

  • requestType — (String)

    Specifies whether the share request is a sent request or a received request.

    Possible values include:
    • "SENT"
    • "RECEIVED"

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  assessmentReportId: 'STRING_VALUE' /* required */
};
auditmanager.deleteAssessmentReport(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The unique identifier for the assessment.

  • assessmentReportId — (String)

    The unique identifier for the assessment report.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  controlId: 'STRING_VALUE' /* required */
};
auditmanager.deleteControl(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • controlId — (String)

    The unique identifier for the control.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
};
auditmanager.deregisterAccount(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {})

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • status — (String)

      The registration status of the account.

      Possible values include:
      • "ACTIVE"
      • "INACTIVE"
      • "PENDING_ACTIVATION"

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  adminAccountId: 'STRING_VALUE'
};
auditmanager.deregisterOrganizationAdminAccount(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • adminAccountId — (String)

    The identifier for the administrator account.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  evidenceFolderId: 'STRING_VALUE' /* required */
};
auditmanager.disassociateAssessmentReportEvidenceFolder(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The unique identifier for the assessment.

  • evidenceFolderId — (String)

    The unique identifier for the folder that the evidence is stored in.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
};
auditmanager.getAccountStatus(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {})

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • status — (String)

      The status of the Amazon Web Services account.

      Possible values include:
      • "ACTIVE"
      • "INACTIVE"
      • "PENDING_ACTIVATION"

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE' /* required */
};
auditmanager.getAssessment(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The unique identifier for the assessment.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • assessment — (map)

      An entity that defines the scope of audit evidence collected by Audit Manager. An Audit Manager assessment is an implementation of an Audit Manager framework.

      • arn — (String)

        The Amazon Resource Name (ARN) of the assessment.

      • awsAccount — (map)

        The Amazon Web Services account that's associated with the assessment.

        • id — (String)

          The identifier for the Amazon Web Services account.

        • emailAddress — (String)

          The email address that's associated with the Amazon Web Services account.

        • name — (String)

          The name of the Amazon Web Services account.

      • metadata — (map)

        The metadata for the assessment.

        • name — (String)

          The name of the assessment.

        • id — (String)

          The unique identifier for the assessment.

        • description — (String)

          The description of the assessment.

        • complianceType — (String)

          The name of the compliance standard that's related to the assessment, such as PCI-DSS.

        • status — (String)

          The overall status of the assessment.

          Possible values include:
          • "ACTIVE"
          • "INACTIVE"
        • assessmentReportsDestination — (map)

          The destination that evidence reports are stored in for the assessment.

          • destinationType — (String)

            The destination type, such as Amazon S3.

            Possible values include:
            • "S3"
          • destination — (String)

            The destination bucket where Audit Manager stores assessment reports.

        • scope — (map)

          The wrapper of Amazon Web Services accounts and services that are in scope for the assessment.

          • awsAccounts — (Array<map>)

            The Amazon Web Services accounts that are included in the scope of the assessment.

            • id — (String)

              The identifier for the Amazon Web Services account.

            • emailAddress — (String)

              The email address that's associated with the Amazon Web Services account.

            • name — (String)

              The name of the Amazon Web Services account.

          • awsServices — (Array<map>)

            The Amazon Web Services services that are included in the scope of the assessment.

            This API parameter is no longer supported. If you use this parameter to specify one or more Amazon Web Services, Audit Manager ignores this input. Instead, the value for awsServices will show as empty.

            • serviceName — (String)

              The name of the Amazon Web Service.

        • roles — (Array<map>)

          The roles that are associated with the assessment.

          • roleType — required — (String)

            The type of customer persona.

            Note: In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
            Possible values include:
            • "PROCESS_OWNER"
            • "RESOURCE_OWNER"
          • roleArn — required — (String)

            The Amazon Resource Name (ARN) of the IAM role.

        • delegations — (Array<map>)

          The delegations that are associated with the assessment.

          • id — (String)

            The unique identifier for the delegation.

          • assessmentName — (String)

            The name of the assessment that's associated with the delegation.

          • assessmentId — (String)

            The identifier for the assessment that's associated with the delegation.

          • status — (String)

            The status of the delegation.

            Possible values include:
            • "IN_PROGRESS"
            • "UNDER_REVIEW"
            • "COMPLETE"
          • roleArn — (String)

            The Amazon Resource Name (ARN) of the IAM role.

          • roleType — (String)

            The type of customer persona.

            Note: In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
            Possible values include:
            • "PROCESS_OWNER"
            • "RESOURCE_OWNER"
          • creationTime — (Date)

            Specifies when the delegation was created.

          • lastUpdated — (Date)

            Specifies when the delegation was last updated.

          • controlSetId — (String)

            The identifier for the control set that's associated with the delegation.

          • comment — (String)

            The comment that's related to the delegation.

          • createdBy — (String)

            The user or role that created the delegation.

        • creationTime — (Date)

          Specifies when the assessment was created.

        • lastUpdated — (Date)

          The time of the most recent update.

      • framework — (map)

        The framework that the assessment was created from.

        • id — (String)

          The unique identifier for the framework.

        • arn — (String)

          The Amazon Resource Name (ARN) of the framework.

        • metadata — (map)

          The metadata of a framework, such as the name, ID, or description.

          • name — (String)

            The name of the framework.

          • description — (String)

            The description of the framework.

          • logo — (String)

            The logo that's associated with the framework.

          • complianceType — (String)

            The compliance standard that's associated with the framework. For example, this could be PCI DSS or HIPAA.

        • controlSets — (Array<map>)

          The control sets that are associated with the framework.

          • id — (String)

            The identifier of the control set in the assessment. This is the control set name in a plain string format.

          • description — (String)

            The description for the control set.

          • status — (String)

            The current status of the control set.

            Possible values include:
            • "ACTIVE"
            • "UNDER_REVIEW"
            • "REVIEWED"
          • roles — (Array<map>)

            The roles that are associated with the control set.

            • roleType — required — (String)

              The type of customer persona.

              Note: In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
              Possible values include:
              • "PROCESS_OWNER"
              • "RESOURCE_OWNER"
            • roleArn — required — (String)

              The Amazon Resource Name (ARN) of the IAM role.

          • controls — (Array<map>)

            The list of controls that's contained with the control set.

            • id — (String)

              The identifier for the control.

            • name — (String)

              The name of the control.

            • description — (String)

              The description of the control.

            • status — (String)

              The status of the control.

              Possible values include:
              • "UNDER_REVIEW"
              • "REVIEWED"
              • "INACTIVE"
            • response — (String)

              The response of the control.

              Possible values include:
              • "MANUAL"
              • "AUTOMATE"
              • "DEFER"
              • "IGNORE"
            • comments — (Array<map>)

              The list of comments that's attached to the control.

              • authorName — (String)

                The name of the user who authored the comment.

              • commentBody — (String)

                The body text of a control comment.

              • postedDate — (Date)

                The time when the comment was posted.

            • evidenceSources — (Array<String>)

              The list of data sources for the evidence.

            • evidenceCount — (Integer)

              The amount of evidence that's collected for the control.

            • assessmentReportEvidenceCount — (Integer)

              The amount of evidence in the assessment report.

          • delegations — (Array<map>)

            The delegations that are associated with the control set.

            • id — (String)

              The unique identifier for the delegation.

            • assessmentName — (String)

              The name of the assessment that's associated with the delegation.

            • assessmentId — (String)

              The identifier for the assessment that's associated with the delegation.

            • status — (String)

              The status of the delegation.

              Possible values include:
              • "IN_PROGRESS"
              • "UNDER_REVIEW"
              • "COMPLETE"
            • roleArn — (String)

              The Amazon Resource Name (ARN) of the IAM role.

            • roleType — (String)

              The type of customer persona.

              Note: In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
              Possible values include:
              • "PROCESS_OWNER"
              • "RESOURCE_OWNER"
            • creationTime — (Date)

              Specifies when the delegation was created.

            • lastUpdated — (Date)

              Specifies when the delegation was last updated.

            • controlSetId — (String)

              The identifier for the control set that's associated with the delegation.

            • comment — (String)

              The comment that's related to the delegation.

            • createdBy — (String)

              The user or role that created the delegation.

          • systemEvidenceCount — (Integer)

            The total number of evidence objects that are retrieved automatically for the control set.

          • manualEvidenceCount — (Integer)

            The total number of evidence objects that are uploaded manually to the control set.

      • tags — (map<String>)

        The tags that are associated with the assessment.

    • userRole — (map)

      The wrapper that contains the Audit Manager role information of the current user. This includes the role type and IAM Amazon Resource Name (ARN).

      • roleType — required — (String)

        The type of customer persona.

        Note: In CreateAssessment, roleType can only be PROCESS_OWNER. In UpdateSettings, roleType can only be PROCESS_OWNER. In BatchCreateDelegationByAssessment, roleType can only be RESOURCE_OWNER.
        Possible values include:
        • "PROCESS_OWNER"
        • "RESOURCE_OWNER"
      • roleArn — required — (String)

        The Amazon Resource Name (ARN) of the IAM role.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  frameworkId: 'STRING_VALUE' /* required */
};
auditmanager.getAssessmentFramework(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • frameworkId — (String)

    The identifier for the framework.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • framework — (map)

      The framework that the GetAssessmentFramework API returned.

      • arn — (String)

        The Amazon Resource Name (ARN) of the framework.

      • id — (String)

        The unique identifier for the framework.

      • name — (String)

        The name of the framework.

      • type — (String)

        Specifies whether the framework is a standard framework or a custom framework.

        Possible values include:
        • "Standard"
        • "Custom"
      • complianceType — (String)

        The compliance type that the framework supports, such as CIS or HIPAA.

      • description — (String)

        The description of the framework.

      • logo — (String)

        The logo that's associated with the framework.

      • controlSources — (String)

        The control data sources where Audit Manager collects evidence from.

      • controlSets — (Array<map>)

        The control sets that are associated with the framework.

        • id — (String)

          The identifier of the control set in the assessment. This is the control set name in a plain string format.

        • name — (String)

          The name of the control set.

        • controls — (Array<map>)

          The list of controls within the control set.

          • arn — (String)

            The Amazon Resource Name (ARN) of the control.

          • id — (String)

            The unique identifier for the control.

          • type — (String)

            Specifies whether the control is a standard control or a custom control.

            Possible values include:
            • "Standard"
            • "Custom"
            • "Core"
          • name — (String)

            The name of the control.

          • description — (String)

            The description of the control.

          • testingInformation — (String)

            The steps that you should follow to determine if the control has been satisfied.

          • actionPlanTitle — (String)

            The title of the action plan for remediating the control.

          • actionPlanInstructions — (String)

            The recommended actions to carry out if the control isn't fulfilled.

          • controlSources — (String)

            The data source types that determine where Audit Manager collects evidence from for the control.

          • controlMappingSources — (Array<map>)

            The data mapping sources for the control.

            • sourceId — (String)

              The unique identifier for the source.

            • sourceName — (String)

              The name of the source.

            • sourceDescription — (String)

              The description of the source.

            • sourceSetUpOption — (String)

              The setup option for the data source. This option reflects if the evidence collection method is automated or manual. If you don’t provide a value for sourceSetUpOption, Audit Manager automatically infers and populates the correct value based on the sourceType that you specify.

              Possible values include:
              • "System_Controls_Mapping"
              • "Procedural_Controls_Mapping"
            • sourceType — (String)

              Specifies which type of data source is used to collect evidence.

              • The source can be an individual data source type, such as AWS_Cloudtrail, AWS_Config, AWS_Security_Hub, AWS_API_Call, or MANUAL.

              • The source can also be a managed grouping of data sources, such as a Core_Control or a Common_Control.

              Possible values include:
              • "AWS_Cloudtrail"
              • "AWS_Config"
              • "AWS_Security_Hub"
              • "AWS_API_Call"
              • "MANUAL"
              • "Common_Control"
              • "Core_Control"
            • sourceKeyword — (map)

              A keyword that relates to the control data source.

              For manual evidence, this keyword indicates if the manual evidence is a file or text.

              For automated evidence, this keyword identifies a specific CloudTrail event, Config rule, Security Hub control, or Amazon Web Services API name.

              To learn more about the supported keywords that you can use when mapping a control data source, see the following pages in the Audit Manager User Guide:

              • Config rules supported by Audit Manager

              • Security Hub controls supported by Audit Manager

              • API calls supported by Audit Manager

              • CloudTrail event names supported by Audit Manager

              • keywordInputType — (String)

                The input method for the keyword.

                • SELECT_FROM_LIST is used when mapping a data source for automated evidence.

                  • When keywordInputType is SELECT_FROM_LIST, a keyword must be selected to collect automated evidence. For example, this keyword can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call.

                • UPLOAD_FILE and INPUT_TEXT are only used when mapping a data source for manual evidence.

                  • When keywordInputType is UPLOAD_FILE, a file must be uploaded as manual evidence.

                  • When keywordInputType is INPUT_TEXT, text must be entered as manual evidence.

                Possible values include:
                • "SELECT_FROM_LIST"
                • "UPLOAD_FILE"
                • "INPUT_TEXT"
              • keywordValue — (String)

                The value of the keyword that's used when mapping a control data source. For example, this can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call.

                If you’re mapping a data source to a rule in Config, the keywordValue that you specify depends on the type of rule:

                • For managed rules, you can use the rule identifier as the keywordValue. You can find the rule identifier from the list of Config managed rules. For some rules, the rule identifier is different from the rule name. For example, the rule name restricted-ssh has the following rule identifier: INCOMING_SSH_DISABLED. Make sure to use the rule identifier, not the rule name.

                  Keyword example for managed rules:

                  • Managed rule name: s3-bucket-acl-prohibited

                    keywordValue: S3_BUCKET_ACL_PROHIBITED

                • For custom rules, you form the keywordValue by adding the Custom_ prefix to the rule name. This prefix distinguishes the custom rule from a managed rule.

                  Keyword example for custom rules:

                  • Custom rule name: my-custom-config-rule

                    keywordValue: Custom_my-custom-config-rule

                • For service-linked rules, you form the keywordValue by adding the Custom_ prefix to the rule name. In addition, you remove the suffix ID that appears at the end of the rule name.

                  Keyword examples for service-linked rules:

                  • Service-linked rule name: CustomRuleForAccount-conformance-pack-szsm1uv0w

                    keywordValue: Custom_CustomRuleForAccount-conformance-pack

                  • Service-linked rule name: OrgConfigRule-s3-bucket-versioning-enabled-dbgzf8ba

                    keywordValue: Custom_OrgConfigRule-s3-bucket-versioning-enabled

                The keywordValue is case sensitive. If you enter a value incorrectly, Audit Manager might not recognize the data source mapping. As a result, you might not successfully collect evidence from that data source as intended.

                Keep in mind the following requirements, depending on the data source type that you're using.

                1. For Config:

                   • For managed rules, make sure that the keywordValue is the rule identifier in ALL_CAPS_WITH_UNDERSCORES. For example, CLOUDWATCH_LOG_GROUP_ENCRYPTED. For accuracy, we recommend that you reference the list of supported Config managed rules.

                   • For custom rules, make sure that the keywordValue has the Custom_ prefix followed by the custom rule name. The format of the custom rule name itself may vary. For accuracy, we recommend that you visit the Config console to verify your custom rule name.

                2. For Security Hub: The format varies for Security Hub control names. For accuracy, we recommend that you reference the list of supported Security Hub controls.

                3. For Amazon Web Services API calls: Make sure that the keywordValue is written as serviceprefix_ActionName. For example, iam_ListGroups. For accuracy, we recommend that you reference the list of supported API calls.

                4. For CloudTrail: Make sure that the keywordValue is written as serviceprefix_ActionName. For example, cloudtrail_StartLogging. For accuracy, we recommend that you review the Amazon Web Service prefix and action names in the Service Authorization Reference.

            • sourceFrequency — (String)

              Specifies how often evidence is collected from the control mapping source.

              Possible values include:
              • "DAILY"
              • "WEEKLY"
              • "MONTHLY"
            • troubleshootingText — (String)

              The instructions for troubleshooting the control.

          • createdAt — (Date)

            The time when the control was created.

          • lastUpdatedAt — (Date)

            The time when the control was most recently updated.

          • createdBy — (String)

            The user or role that created the control.

          • lastUpdatedBy — (String)

            The user or role that most recently updated the control.

          • tags — (map<String>)

            The tags associated with the control.

          • state — (String)

            The state of the control. The END_OF_SUPPORT state is applicable to standard controls only. This state indicates that the standard control can still be used to collect evidence, but Audit Manager is no longer updating or maintaining that control.

            Possible values include:
            • "ACTIVE"
            • "END_OF_SUPPORT"
      • createdAt — (Date)

        The time when the framework was created.

      • lastUpdatedAt — (Date)

        The time when the framework was most recently updated.

      • createdBy — (String)

        The user or role that created the framework.

      • lastUpdatedBy — (String)

        The user or role that most recently updated the framework.

      • tags — (map<String>)

        The tags that are associated with the framework.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  assessmentReportId: 'STRING_VALUE' /* required */
};
auditmanager.getAssessmentReportUrl(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentReportId — (String)

    The unique identifier for the assessment report.

  • assessmentId — (String)

    The unique identifier for the assessment.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • preSignedUrl — (map)

      Short for uniform resource locator. A URL is used as a unique identifier to locate a resource on the internet.

      • hyperlinkName — (String)

        The name or word that's used as a hyperlink to the URL.

      • link — (String)

        The unique identifier for the internet resource.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  controlId: 'STRING_VALUE',
  controlSetId: 'STRING_VALUE',
  maxResults: 'NUMBER_VALUE',
  nextToken: 'STRING_VALUE'
};
auditmanager.getChangeLogs(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The unique identifier for the assessment.

  • controlSetId — (String)

    The unique identifier for the control set.

  • controlId — (String)

    The unique identifier for the control.

  • nextToken — (String)

    The pagination token that's used to fetch the next set of results.

  • maxResults — (Integer)

    Represents the maximum number of results on a page or for an API request call.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • changeLogs — (Array<map>)

      The list of user activity for the control.

      • objectType — (String)

        The object that was changed, such as an assessment, control, or control set.

        Possible values include:
        • "ASSESSMENT"
        • "CONTROL_SET"
        • "CONTROL"
        • "DELEGATION"
        • "ASSESSMENT_REPORT"
      • objectName — (String)

        The name of the object that changed. This could be the name of an assessment, control, or control set.

      • action — (String)

        The action that was performed.

        Possible values include:
        • "CREATE"
        • "UPDATE_METADATA"
        • "ACTIVE"
        • "INACTIVE"
        • "DELETE"
        • "UNDER_REVIEW"
        • "REVIEWED"
        • "IMPORT_EVIDENCE"
      • createdAt — (Date)

        The time when the action was performed and the changelog record was created.

      • createdBy — (String)

        The user or role that performed the action.

    • nextToken — (String)

      The pagination token that's used to fetch the next set of results.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  controlId: 'STRING_VALUE' /* required */
};
auditmanager.getControl(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • controlId — (String)

    The identifier for the control.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • control — (map)

      The details of the control that the GetControl API returned.

      • arn — (String)

        The Amazon Resource Name (ARN) of the control.

      • id — (String)

        The unique identifier for the control.

      • type — (String)

        Specifies whether the control is a standard control or a custom control.

        Possible values include:
        • "Standard"
        • "Custom"
        • "Core"
      • name — (String)

        The name of the control.

      • description — (String)

        The description of the control.

      • testingInformation — (String)

        The steps that you should follow to determine if the control has been satisfied.

      • actionPlanTitle — (String)

        The title of the action plan for remediating the control.

      • actionPlanInstructions — (String)

        The recommended actions to carry out if the control isn't fulfilled.

      • controlSources — (String)

        The data source types that determine where Audit Manager collects evidence from for the control.

      • controlMappingSources — (Array<map>)

        The data mapping sources for the control.

        • sourceId — (String)

          The unique identifier for the source.

        • sourceName — (String)

          The name of the source.

        • sourceDescription — (String)

          The description of the source.

        • sourceSetUpOption — (String)

          The setup option for the data source. This option reflects if the evidence collection method is automated or manual. If you don’t provide a value for sourceSetUpOption, Audit Manager automatically infers and populates the correct value based on the sourceType that you specify.

          Possible values include:
          • "System_Controls_Mapping"
          • "Procedural_Controls_Mapping"
        • sourceType — (String)

          Specifies which type of data source is used to collect evidence.

          • The source can be an individual data source type, such as AWS_Cloudtrail, AWS_Config, AWS_Security_Hub, AWS_API_Call, or MANUAL.

          • The source can also be a managed grouping of data sources, such as a Core_Control or a Common_Control.

          Possible values include:
          • "AWS_Cloudtrail"
          • "AWS_Config"
          • "AWS_Security_Hub"
          • "AWS_API_Call"
          • "MANUAL"
          • "Common_Control"
          • "Core_Control"
        • sourceKeyword — (map)

          A keyword that relates to the control data source.

          For manual evidence, this keyword indicates if the manual evidence is a file or text.

          For automated evidence, this keyword identifies a specific CloudTrail event, Config rule, Security Hub control, or Amazon Web Services API name.

          To learn more about the supported keywords that you can use when mapping a control data source, see the following pages in the Audit Manager User Guide:

          • Config rules supported by Audit Manager

          • Security Hub controls supported by Audit Manager

          • API calls supported by Audit Manager

          • CloudTrail event names supported by Audit Manager

          • keywordInputType — (String)

            The input method for the keyword.

            • SELECT_FROM_LIST is used when mapping a data source for automated evidence.

              • When keywordInputType is SELECT_FROM_LIST, a keyword must be selected to collect automated evidence. For example, this keyword can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call.

            • UPLOAD_FILE and INPUT_TEXT are only used when mapping a data source for manual evidence.

              • When keywordInputType is UPLOAD_FILE, a file must be uploaded as manual evidence.

              • When keywordInputType is INPUT_TEXT, text must be entered as manual evidence.

            Possible values include:
            • "SELECT_FROM_LIST"
            • "UPLOAD_FILE"
            • "INPUT_TEXT"
          • keywordValue — (String)

            The value of the keyword that's used when mapping a control data source. For example, this can be a CloudTrail event name, a rule name for Config, a Security Hub control, or the name of an Amazon Web Services API call.

            If you’re mapping a data source to a rule in Config, the keywordValue that you specify depends on the type of rule:

            • For managed rules, you can use the rule identifier as the keywordValue. You can find the rule identifier from the list of Config managed rules. For some rules, the rule identifier is different from the rule name. For example, the rule name restricted-ssh has the following rule identifier: INCOMING_SSH_DISABLED. Make sure to use the rule identifier, not the rule name.

              Keyword example for managed rules:

              • Managed rule name: s3-bucket-acl-prohibited

                keywordValue: S3_BUCKET_ACL_PROHIBITED

            • For custom rules, you form the keywordValue by adding the Custom_ prefix to the rule name. This prefix distinguishes the custom rule from a managed rule.

              Keyword example for custom rules:

              • Custom rule name: my-custom-config-rule

                keywordValue: Custom_my-custom-config-rule

            • For service-linked rules, you form the keywordValue by adding the Custom_ prefix to the rule name. In addition, you remove the suffix ID that appears at the end of the rule name.

              Keyword examples for service-linked rules:

              • Service-linked rule name: CustomRuleForAccount-conformance-pack-szsm1uv0w

                keywordValue: Custom_CustomRuleForAccount-conformance-pack

              • Service-linked rule name: OrgConfigRule-s3-bucket-versioning-enabled-dbgzf8ba

                keywordValue: Custom_OrgConfigRule-s3-bucket-versioning-enabled

            The keywordValue is case sensitive. If you enter a value incorrectly, Audit Manager might not recognize the data source mapping. As a result, you might not successfully collect evidence from that data source as intended.

            Keep in mind the following requirements, depending on the data source type that you're using.

            1. For Config:

               • For managed rules, make sure that the keywordValue is the rule identifier in ALL_CAPS_WITH_UNDERSCORES. For example, CLOUDWATCH_LOG_GROUP_ENCRYPTED. For accuracy, we recommend that you reference the list of supported Config managed rules.

               • For custom rules, make sure that the keywordValue has the Custom_ prefix followed by the custom rule name. The format of the custom rule name itself may vary. For accuracy, we recommend that you visit the Config console to verify your custom rule name.

            2. For Security Hub: The format varies for Security Hub control names. For accuracy, we recommend that you reference the list of supported Security Hub controls.

            3. For Amazon Web Services API calls: Make sure that the keywordValue is written as serviceprefix_ActionName. For example, iam_ListGroups. For accuracy, we recommend that you reference the list of supported API calls.

            4. For CloudTrail: Make sure that the keywordValue is written as serviceprefix_ActionName. For example, cloudtrail_StartLogging. For accuracy, we recommend that you review the Amazon Web Service prefix and action names in the Service Authorization Reference.

        • sourceFrequency — (String)

          Specifies how often evidence is collected from the control mapping source.

          Possible values include:
          • "DAILY"
          • "WEEKLY"
          • "MONTHLY"
        • troubleshootingText — (String)

          The instructions for troubleshooting the control.

      • createdAt — (Date)

        The time when the control was created.

      • lastUpdatedAt — (Date)

        The time when the control was most recently updated.

      • createdBy — (String)

        The user or role that created the control.

      • lastUpdatedBy — (String)

        The user or role that most recently updated the control.

      • tags — (map<String>)

        The tags associated with the control.

      • state — (String)

        The state of the control. The END_OF_SUPPORT state is applicable to standard controls only. This state indicates that the standard control can still be used to collect evidence, but Audit Manager is no longer updating or maintaining that control.

        Possible values include:
        • "ACTIVE"
        • "END_OF_SUPPORT"

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  maxResults: 'NUMBER_VALUE',
  nextToken: 'STRING_VALUE'
};
auditmanager.getDelegations(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • nextToken — (String)

    The pagination token that's used to fetch the next set of results.

  • maxResults — (Integer)

    Represents the maximum number of results on a page or for an API request call.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • delegations — (Array<map>)

      The list of delegations that the GetDelegations API returned.

      • id — (String)

        The unique identifier for the delegation.

      • assessmentName — (String)

        The name of the associated assessment.

      • assessmentId — (String)

        The unique identifier for the assessment.

      • status — (String)

        The current status of the delegation.

        Possible values include:
        • "IN_PROGRESS"
        • "UNDER_REVIEW"
        • "COMPLETE"
      • roleArn — (String)

        The Amazon Resource Name (ARN) of the IAM role.

      • creationTime — (Date)

        Specifies when the delegation was created.

      • controlSetName — (String)

        Specifies the name of the control set that was delegated for review.

    • nextToken — (String)

      The pagination token that's used to fetch the next set of results.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  controlSetId: 'STRING_VALUE', /* required */
  evidenceFolderId: 'STRING_VALUE', /* required */
  evidenceId: 'STRING_VALUE' /* required */
};
auditmanager.getEvidence(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The unique identifier for the assessment.

  • controlSetId — (String)

    The unique identifier for the control set.

  • evidenceFolderId — (String)

    The unique identifier for the folder that the evidence is stored in.

  • evidenceId — (String)

    The unique identifier for the evidence.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • evidence — (map)

      The evidence that the GetEvidence API returned.

      • dataSource — (String)

        The data source where the evidence was collected from.

      • evidenceAwsAccountId — (String)

        The identifier for the Amazon Web Services account.

      • time — (Date)

        The timestamp that represents when the evidence was collected.

      • eventSource — (String)

        The Amazon Web Service that the evidence is collected from.

      • eventName — (String)

        The name of the evidence event.

      • evidenceByType — (String)

        The type of automated evidence.

      • resourcesIncluded — (Array<map>)

        The list of resources that are assessed to generate the evidence.

        • arn — (String)

          The Amazon Resource Name (ARN) for the resource.

        • value — (String)

          The value of the resource.

        • complianceCheck — (String)

          The evaluation status for a resource that was assessed when collecting compliance check evidence.

          • Audit Manager classes the resource as non-compliant if Security Hub reports a Fail result, or if Config reports a Non-compliant result.

          • Audit Manager classes the resource as compliant if Security Hub reports a Pass result, or if Config reports a Compliant result.

          • If a compliance check isn't available or applicable, then no compliance evaluation can be made for that resource. This is the case if a resource assessment uses Config or Security Hub as the underlying data source type, but those services aren't enabled. This is also the case if the resource assessment uses an underlying data source type that doesn't support compliance checks (such as manual evidence, Amazon Web Services API calls, or CloudTrail).

      • attributes — (map<String>)

        The names and values that are used by the evidence event. This includes an attribute name (such as allowUsersToChangePassword) and value (such as true or false).

      • iamId — (String)

        The unique identifier for the user or role that's associated with the evidence.

      • complianceCheck — (String)

        The evaluation status for automated evidence that falls under the compliance check category.

        • Audit Manager classes evidence as non-compliant if Security Hub reports a Fail result, or if Config reports a Non-compliant result.

        • Audit Manager classes evidence as compliant if Security Hub reports a Pass result, or if Config reports a Compliant result.

        • If a compliance check isn't available or applicable, then no compliance evaluation can be made for that evidence. This is the case if the evidence uses Config or Security Hub as the underlying data source type, but those services aren't enabled. This is also the case if the evidence uses an underlying data source type that doesn't support compliance checks (such as manual evidence, Amazon Web Services API calls, or CloudTrail).

      • awsOrganization — (String)

        The Amazon Web Services account that the evidence is collected from, and its organization path.

      • awsAccountId — (String)

        The identifier for the Amazon Web Services account.

      • evidenceFolderId — (String)

        The identifier for the folder that the evidence is stored in.

      • id — (String)

        The identifier for the evidence.

      • assessmentReportSelection — (String)

        Specifies whether the evidence is included in the assessment report.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  controlSetId: 'STRING_VALUE', /* required */
  evidenceFolderId: 'STRING_VALUE', /* required */
  maxResults: 'NUMBER_VALUE',
  nextToken: 'STRING_VALUE'
};
auditmanager.getEvidenceByEvidenceFolder(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The identifier for the assessment.

  • controlSetId — (String)

    The identifier for the control set.

  • evidenceFolderId — (String)

    The unique identifier for the folder that the evidence is stored in.

  • nextToken — (String)

    The pagination token that's used to fetch the next set of results.

  • maxResults — (Integer)

    Represents the maximum number of results on a page or for an API request call.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • evidence — (Array<map>)

      The list of evidence that the GetEvidenceByEvidenceFolder API returned.

      • dataSource — (String)

        The data source where the evidence was collected from.

      • evidenceAwsAccountId — (String)

        The identifier for the Amazon Web Services account.

      • time — (Date)

        The timestamp that represents when the evidence was collected.

      • eventSource — (String)

        The Amazon Web Service that the evidence is collected from.

      • eventName — (String)

        The name of the evidence event.

      • evidenceByType — (String)

        The type of automated evidence.

      • resourcesIncluded — (Array<map>)

        The list of resources that are assessed to generate the evidence.

        • arn — (String)

          The Amazon Resource Name (ARN) for the resource.

        • value — (String)

          The value of the resource.

        • complianceCheck — (String)

          The evaluation status for a resource that was assessed when collecting compliance check evidence.

          • Audit Manager classes the resource as non-compliant if Security Hub reports a Fail result, or if Config reports a Non-compliant result.

          • Audit Manager classes the resource as compliant if Security Hub reports a Pass result, or if Config reports a Compliant result.

          • If a compliance check isn't available or applicable, then no compliance evaluation can be made for that resource. This is the case if a resource assessment uses Config or Security Hub as the underlying data source type, but those services aren't enabled. This is also the case if the resource assessment uses an underlying data source type that doesn't support compliance checks (such as manual evidence, Amazon Web Services API calls, or CloudTrail).

      • attributes — (map<String>)

        The names and values that are used by the evidence event. This includes an attribute name (such as allowUsersToChangePassword) and value (such as true or false).

      • iamId — (String)

        The unique identifier for the user or role that's associated with the evidence.

      • complianceCheck — (String)

        The evaluation status for automated evidence that falls under the compliance check category.

        • Audit Manager classes evidence as non-compliant if Security Hub reports a Fail result, or if Config reports a Non-compliant result.

        • Audit Manager classes evidence as compliant if Security Hub reports a Pass result, or if Config reports a Compliant result.

        • If a compliance check isn't available or applicable, then no compliance evaluation can be made for that evidence. This is the case if the evidence uses Config or Security Hub as the underlying data source type, but those services aren't enabled. This is also the case if the evidence uses an underlying data source type that doesn't support compliance checks (such as manual evidence, Amazon Web Services API calls, or CloudTrail).

      • awsOrganization — (String)

        The Amazon Web Services account that the evidence is collected from, and its organization path.

      • awsAccountId — (String)

        The identifier for the Amazon Web Services account.

      • evidenceFolderId — (String)

        The identifier for the folder that the evidence is stored in.

      • id — (String)

        The identifier for the evidence.

      • assessmentReportSelection — (String)

        Specifies whether the evidence is included in the assessment report.

    • nextToken — (String)

      The pagination token that's used to fetch the next set of results.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  fileName: 'STRING_VALUE' /* required */
};
auditmanager.getEvidenceFileUploadUrl(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • fileName — (String)

    The file that you want to upload. For a list of supported file formats, see Supported file types for manual evidence in the Audit Manager User Guide.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • evidenceFileName — (String)

      The name of the uploaded manual evidence file that the presigned URL was generated for.

    • uploadUrl — (String)

      The presigned URL that was generated.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  controlSetId: 'STRING_VALUE', /* required */
  evidenceFolderId: 'STRING_VALUE' /* required */
};
auditmanager.getEvidenceFolder(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The unique identifier for the assessment.

  • controlSetId — (String)

    The unique identifier for the control set.

  • evidenceFolderId — (String)

    The unique identifier for the folder that the evidence is stored in.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • evidenceFolder — (map)

      The folder that the evidence is stored in.

      • name — (String)

        The name of the evidence folder.

      • date — (Date)

        The date when the first evidence was added to the evidence folder.

      • assessmentId — (String)

        The identifier for the assessment.

      • controlSetId — (String)

        The identifier for the control set.

      • controlId — (String)

        The unique identifier for the control.

      • id — (String)

        The identifier for the folder that the evidence is stored in.

      • dataSource — (String)

        The Amazon Web Service that the evidence was collected from.

      • author — (String)

        The name of the user who created the evidence folder.

      • totalEvidence — (Integer)

        The total amount of evidence in the evidence folder.

      • assessmentReportSelectionCount — (Integer)

        The total count of evidence that's included in the assessment report.

      • controlName — (String)

        The name of the control.

      • evidenceResourcesIncludedCount — (Integer)

        The amount of evidence that's included in the evidence folder.

      • evidenceByTypeConfigurationDataCount — (Integer)

        The number of evidence that falls under the configuration data category. This evidence is collected from configuration snapshots of other Amazon Web Services such as Amazon EC2, Amazon S3, or IAM.

      • evidenceByTypeManualCount — (Integer)

        The number of evidence that falls under the manual category. This evidence is imported manually.

      • evidenceByTypeComplianceCheckCount — (Integer)

        The number of evidence that falls under the compliance check category. This evidence is collected from Config or Security Hub.

      • evidenceByTypeComplianceCheckIssuesCount — (Integer)

        The total number of issues that were reported directly from Security Hub, Config, or both.

      • evidenceByTypeUserActivityCount — (Integer)

        The number of evidence that falls under the user activity category. This evidence is collected from CloudTrail logs.

      • evidenceAwsServiceSourceCount — (Integer)

        The total number of Amazon Web Services resources that were assessed to generate the evidence.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  maxResults: 'NUMBER_VALUE',
  nextToken: 'STRING_VALUE'
};
auditmanager.getEvidenceFoldersByAssessment(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The unique identifier for the assessment.

  • nextToken — (String)

    The pagination token that's used to fetch the next set of results.

  • maxResults — (Integer)

    Represents the maximum number of results on a page or for an API request call.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • evidenceFolders — (Array<map>)

      The list of evidence folders that the GetEvidenceFoldersByAssessment API returned.

      • name — (String)

        The name of the evidence folder.

      • date — (Date)

        The date when the first evidence was added to the evidence folder.

      • assessmentId — (String)

        The identifier for the assessment.

      • controlSetId — (String)

        The identifier for the control set.

      • controlId — (String)

        The unique identifier for the control.

      • id — (String)

        The identifier for the folder that the evidence is stored in.

      • dataSource — (String)

        The Amazon Web Service that the evidence was collected from.

      • author — (String)

        The name of the user who created the evidence folder.

      • totalEvidence — (Integer)

        The total amount of evidence in the evidence folder.

      • assessmentReportSelectionCount — (Integer)

        The total count of evidence that's included in the assessment report.

      • controlName — (String)

        The name of the control.

      • evidenceResourcesIncludedCount — (Integer)

        The amount of evidence that's included in the evidence folder.

      • evidenceByTypeConfigurationDataCount — (Integer)

        The number of evidence that falls under the configuration data category. This evidence is collected from configuration snapshots of other Amazon Web Services such as Amazon EC2, Amazon S3, or IAM.

      • evidenceByTypeManualCount — (Integer)

        The number of evidence that falls under the manual category. This evidence is imported manually.

      • evidenceByTypeComplianceCheckCount — (Integer)

        The number of evidence that falls under the compliance check category. This evidence is collected from Config or Security Hub.

      • evidenceByTypeComplianceCheckIssuesCount — (Integer)

        The total number of issues that were reported directly from Security Hub, Config, or both.

      • evidenceByTypeUserActivityCount — (Integer)

        The number of evidence that falls under the user activity category. This evidence is collected from CloudTrail logs.

      • evidenceAwsServiceSourceCount — (Integer)

        The total number of Amazon Web Services resources that were assessed to generate the evidence.

    • nextToken — (String)

      The pagination token that's used to fetch the next set of results.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE', /* required */
  controlId: 'STRING_VALUE', /* required */
  controlSetId: 'STRING_VALUE', /* required */
  maxResults: 'NUMBER_VALUE',
  nextToken: 'STRING_VALUE'
};
auditmanager.getEvidenceFoldersByAssessmentControl(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The identifier for the assessment.

  • controlSetId — (String)

    The identifier for the control set.

  • controlId — (String)

    The identifier for the control.

  • nextToken — (String)

    The pagination token that's used to fetch the next set of results.

  • maxResults — (Integer)

    Represents the maximum number of results on a page or for an API request call.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • evidenceFolders — (Array<map>)

      The list of evidence folders that the GetEvidenceFoldersByAssessmentControl API returned.

      • name — (String)

        The name of the evidence folder.

      • date — (Date)

        The date when the first evidence was added to the evidence folder.

      • assessmentId — (String)

        The identifier for the assessment.

      • controlSetId — (String)

        The identifier for the control set.

      • controlId — (String)

        The unique identifier for the control.

      • id — (String)

        The identifier for the folder that the evidence is stored in.

      • dataSource — (String)

        The Amazon Web Service that the evidence was collected from.

      • author — (String)

        The name of the user who created the evidence folder.

      • totalEvidence — (Integer)

        The total amount of evidence in the evidence folder.

      • assessmentReportSelectionCount — (Integer)

        The total count of evidence that's included in the assessment report.

      • controlName — (String)

        The name of the control.

      • evidenceResourcesIncludedCount — (Integer)

        The amount of evidence that's included in the evidence folder.

      • evidenceByTypeConfigurationDataCount — (Integer)

        The number of evidence that falls under the configuration data category. This evidence is collected from configuration snapshots of other Amazon Web Services such as Amazon EC2, Amazon S3, or IAM.

      • evidenceByTypeManualCount — (Integer)

        The number of evidence that falls under the manual category. This evidence is imported manually.

      • evidenceByTypeComplianceCheckCount — (Integer)

        The number of evidence that falls under the compliance check category. This evidence is collected from Config or Security Hub.

      • evidenceByTypeComplianceCheckIssuesCount — (Integer)

        The total number of issues that were reported directly from Security Hub, Config, or both.

      • evidenceByTypeUserActivityCount — (Integer)

        The number of evidence that falls under the user activity category. This evidence is collected from CloudTrail logs.

      • evidenceAwsServiceSourceCount — (Integer)

        The total number of Amazon Web Services resources that were assessed to generate the evidence.

    • nextToken — (String)

      The pagination token that's used to fetch the next set of results.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
};
auditmanager.getInsights(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {})

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • insights — (map)

      The analytics data that the GetInsights API returned.

      • activeAssessmentsCount — (Integer)

        The number of active assessments in Audit Manager.

      • noncompliantEvidenceCount — (Integer)

        The number of compliance check evidence that Audit Manager classified as non-compliant on the lastUpdated date. This includes evidence that was collected from Security Hub with a Fail ruling, or collected from Config with a Non-compliant ruling.

      • compliantEvidenceCount — (Integer)

        The number of compliance check evidence that Audit Manager classified as compliant on the lastUpdated date. This includes evidence that was collected from Security Hub with a Pass ruling, or collected from Config with a Compliant ruling.

      • inconclusiveEvidenceCount — (Integer)

        The number of evidence without a compliance check ruling. Evidence is inconclusive when the associated control uses Security Hub or Config as a data source but you didn't enable those services. This is also the case when a control uses a data source that doesn’t support compliance checks (for example: manual evidence, API calls, or CloudTrail).

        Note: If evidence has a compliance check status of not applicable, it's classed as inconclusive in Insights data.
      • assessmentControlsCountByNoncompliantEvidence — (Integer)

        The number of assessment controls that collected non-compliant evidence on the lastUpdated date.

      • totalAssessmentControlsCount — (Integer)

        The total number of controls across all active assessments.

      • lastUpdated — (Date)

        The time when the cross-assessment insights were last updated.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
  assessmentId: 'STRING_VALUE' /* required */
};
auditmanager.getInsightsByAssessment(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {}) —
  • assessmentId — (String)

    The unique identifier for the assessment.

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • insights — (map)

      The assessment analytics data that the GetInsightsByAssessment API returned.

      • noncompliantEvidenceCount — (Integer)

        The number of compliance check evidence that Audit Manager classified as non-compliant. This includes evidence that was collected from Security Hub with a Fail ruling, or collected from Config with a Non-compliant ruling.

      • compliantEvidenceCount — (Integer)

        The number of compliance check evidence that Audit Manager classified as compliant. This includes evidence that was collected from Security Hub with a Pass ruling, or collected from Config with a Compliant ruling.

      • inconclusiveEvidenceCount — (Integer)

        The amount of evidence without a compliance check ruling. Evidence is inconclusive if the associated control uses Security Hub or Config as a data source and you didn't enable those services. This is also the case if a control uses a data source that doesn’t support compliance checks (for example, manual evidence, API calls, or CloudTrail).

        Note: If evidence has a compliance check status of not applicable, it's classified as inconclusive in InsightsByAssessment data.
      • assessmentControlsCountByNoncompliantEvidence — (Integer)

        The number of assessment controls that collected non-compliant evidence on the lastUpdated date.

      • totalAssessmentControlsCount — (Integer)

        The total number of controls in the assessment.

      • lastUpdated — (Date)

        The time when the assessment insights were last updated.

Returns:

• (AWS.Request) —

  a handle to the operation request for subsequent event callback registration.

var params = {
};
auditmanager.getOrganizationAdminAccount(params, function(err, data) {
  if (err) console.log(err, err.stack); // an error occurred
  else     console.log(data);           // successful response
});

Parameters:

• params (Object) (defaults to: {})

Callback (callback):

• function(err, data) { ... }

  Called when a response from the service is returned. If a callback is not supplied, you must call AWS.Request.send() on the returned request object to initiate the request.

  Context (this):

  • (AWS.Response) —

    the response object containing error, data properties, and the original request object.

  Parameters:

  • err (Error) —

    the error object returned from the request. Set to null if the request is successful.

  • data (Object) —

    the de-serialized data returned from the request. Set to null if a request error occurs. The data object has the following properties:

    • adminAccountId — (String)

      The identifier for the administrator account.

    • organizationId — (String)

      The identifier for the organization.