Access Analyzer filter keys - AWS Identity and Access Management

Access Analyzer filter keys

You can use the filter keys below to define an archive rule CreateArchiveRule, update an archive rule UpdateArchiveRule, or retrieve a list of findings ListFindings.

Criterion Description Type Archive rule List findings
resource The ARN uniquely identifying the resource that the external principal has access to. To learn more, see Amazon resource names (ARNs). String Yes Yes
resourceType

AWS::IAM::Role | AWS::KMS::Key | AWS::Lambda::Function | AWS::Lambda::LayerVersion | AWS::S3::Bucket | AWS::SQS::Queue

The type of resource that the external principal has access to. String Yes Yes
resourceOwnerAccount The 12 digit AWS account ID that owns the resource. To learn more, see AWS account identifiers. String Yes Yes
isPublic Indicates whether the finding reports a resource that has a policy that allows public access. Boolean Yes Yes
status

ACTIVE | ARCHIVED | RESOLVED

The current status of the finding. String No Yes
error Indicates the error reported for the finding. String Yes Yes
principal.AWS The ARN of of the account granted access to the resource in the Principal field of the finding. To learn more, see AWS account identifiers. String Yes Yes
principal.Federated The ARN of the federated identity that has access to the resource in the finding. To learn more, see Identity providers and federation String Yes Yes
condition.aws:PrincipalArn The ARN of the principal (IAM user, role, or group) indicated as the condition for resource access. To learn more, see AWS global condition context keys. String Yes Yes
condition.aws:PrincipalOrgID The organization identifier of the principal indicated as the condition for resource access. To learn more, see AWS global condition context keys. String Yes Yes
condition.aws:PrincipalOrgPaths The organization or organizational unit (OU) ID indicated as the condition for resource access. To learn more, see AWS global condition context keys. String Yes Yes
condition.aws:SourceIP The IP address that allows the principal access to the resource when using the specified IP address. To learn more, see AWS global condition context keys. IP address Yes Yes
condition.aws:SourceVPC The VPC ID that allows the principal access to the resource when using the specified VPC. To learn more, see AWS global condition context keys. String Yes Yes
condition.aws:UserID The user ID of the IAM user from an external account indicated as the condition for access to the resource. To learn more, see AWS global condition context keys. String Yes Yes
condition.cognito-identity.amazonaws.com:aud The Amazon Cognito identity pool ID specified as a condition for IAM role access in the finding. To learn more, see IAM and AWS STS condition context keys. String Yes Yes
condition.graph.facebook.com:app_id The Facebook application ID (or site ID) specified as a condition to allow Login with Facebook federation access to the IAM role in the finding. To learn more, see IAM and AWS STS condition context keys. String Yes Yes
condition.accounts.google.com:aud The Google application ID specified as a condition for access to the IAM role. To learn more, see IAM and AWS STS condition context keys. String Yes Yes
condition.kms:CallerAccount The AWS account ID that owns the calling entity (IAM user, role or account root user) used by services calling AWS KMS. To learn more, see Condition keys for AWS Key Management Service. String Yes Yes
condition.www.amazon.com:app_id The Amazon application ID (or site ID) specified as a condition to allow Login with Amazon federation access to the role. To learn more, see String Yes Yes
id The ID of the finding. String No Yes