AWS Cloud Control v1.9.0, Nov 18 24

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.9.0 published on Monday, Nov 18, 2024 by Pulumi

pulumi/pulumi-aws-native

aws-native.iot.getAccountAuditConfiguration

Explore with Pulumi AI

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.9.0 published on Monday, Nov 18, 2024 by Pulumi

pulumi/pulumi-aws-native

Using getAccountAuditConfiguration

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getAccountAuditConfiguration(args: GetAccountAuditConfigurationArgs, opts?: InvokeOptions): Promise<GetAccountAuditConfigurationResult>
function getAccountAuditConfigurationOutput(args: GetAccountAuditConfigurationOutputArgs, opts?: InvokeOptions): Output<GetAccountAuditConfigurationResult>

def get_account_audit_configuration(account_id: Optional[str] = None,
                                    opts: Optional[InvokeOptions] = None) -> GetAccountAuditConfigurationResult
def get_account_audit_configuration_output(account_id: Optional[pulumi.Input[str]] = None,
                                    opts: Optional[InvokeOptions] = None) -> Output[GetAccountAuditConfigurationResult]

func LookupAccountAuditConfiguration(ctx *Context, args *LookupAccountAuditConfigurationArgs, opts ...InvokeOption) (*LookupAccountAuditConfigurationResult, error)
func LookupAccountAuditConfigurationOutput(ctx *Context, args *LookupAccountAuditConfigurationOutputArgs, opts ...InvokeOption) LookupAccountAuditConfigurationResultOutput

> Note: This function is named LookupAccountAuditConfiguration in the Go SDK.

public static class GetAccountAuditConfiguration 
{
    public static Task<GetAccountAuditConfigurationResult> InvokeAsync(GetAccountAuditConfigurationArgs args, InvokeOptions? opts = null)
    public static Output<GetAccountAuditConfigurationResult> Invoke(GetAccountAuditConfigurationInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetAccountAuditConfigurationResult> getAccountAuditConfiguration(GetAccountAuditConfigurationArgs args, InvokeOptions options)
// Output-based functions aren't available in Java yet

fn::invoke:
  function: aws-native:iot:getAccountAuditConfiguration
  arguments:
    # arguments dictionary

The following arguments are supported:

AccountId string: Your 12-digit account ID (used as the primary identifier for the CloudFormation resource).

AccountId string: Your 12-digit account ID (used as the primary identifier for the CloudFormation resource).

accountId String: Your 12-digit account ID (used as the primary identifier for the CloudFormation resource).

accountId string: Your 12-digit account ID (used as the primary identifier for the CloudFormation resource).

account_id str: Your 12-digit account ID (used as the primary identifier for the CloudFormation resource).

accountId String: Your 12-digit account ID (used as the primary identifier for the CloudFormation resource).

getAccountAuditConfiguration Result

The following output properties are available:

AuditCheckConfigurations Pulumi.AwsNative.IoT.Outputs.AccountAuditConfigurationAuditCheckConfigurations

Specifies which audit checks are enabled and disabled for this account.

Some data collection might start immediately when certain checks are enabled. When a check is disabled, any data collected so far in relation to the check is deleted. To disable a check, set the value of the Enabled: key to false .

If an enabled check is removed from the template, it will also be disabled.

You can't disable a check if it's used by any scheduled audit. You must delete the check from the scheduled audit or delete the scheduled audit itself to disable the check.

For more information on avialbe auidt checks see AWS::IoT::AccountAuditConfiguration AuditCheckConfigurations

AuditNotificationTargetConfigurations Pulumi.AwsNative.IoT.Outputs.AccountAuditConfigurationAuditNotificationTargetConfigurations

Information about the targets to which audit notifications are sent.

RoleArn string

The ARN of the role that grants permission to AWS IoT to access information about your devices, policies, certificates and other items as required when performing an audit.

AuditCheckConfigurations AccountAuditConfigurationAuditCheckConfigurations

Specifies which audit checks are enabled and disabled for this account.

If an enabled check is removed from the template, it will also be disabled.

You can't disable a check if it's used by any scheduled audit. You must delete the check from the scheduled audit or delete the scheduled audit itself to disable the check.

For more information on avialbe auidt checks see AWS::IoT::AccountAuditConfiguration AuditCheckConfigurations

AuditNotificationTargetConfigurations AccountAuditConfigurationAuditNotificationTargetConfigurations

Information about the targets to which audit notifications are sent.

RoleArn string

The ARN of the role that grants permission to AWS IoT to access information about your devices, policies, certificates and other items as required when performing an audit.

auditCheckConfigurations AccountAuditConfigurationAuditCheckConfigurations

Specifies which audit checks are enabled and disabled for this account.

If an enabled check is removed from the template, it will also be disabled.

You can't disable a check if it's used by any scheduled audit. You must delete the check from the scheduled audit or delete the scheduled audit itself to disable the check.

For more information on avialbe auidt checks see AWS::IoT::AccountAuditConfiguration AuditCheckConfigurations

auditNotificationTargetConfigurations AccountAuditConfigurationAuditNotificationTargetConfigurations

Information about the targets to which audit notifications are sent.

roleArn String

The ARN of the role that grants permission to AWS IoT to access information about your devices, policies, certificates and other items as required when performing an audit.

auditCheckConfigurations AccountAuditConfigurationAuditCheckConfigurations

Specifies which audit checks are enabled and disabled for this account.

If an enabled check is removed from the template, it will also be disabled.

You can't disable a check if it's used by any scheduled audit. You must delete the check from the scheduled audit or delete the scheduled audit itself to disable the check.

For more information on avialbe auidt checks see AWS::IoT::AccountAuditConfiguration AuditCheckConfigurations

auditNotificationTargetConfigurations AccountAuditConfigurationAuditNotificationTargetConfigurations

Information about the targets to which audit notifications are sent.

roleArn string

The ARN of the role that grants permission to AWS IoT to access information about your devices, policies, certificates and other items as required when performing an audit.

audit_check_configurations AccountAuditConfigurationAuditCheckConfigurations

Specifies which audit checks are enabled and disabled for this account.

If an enabled check is removed from the template, it will also be disabled.

You can't disable a check if it's used by any scheduled audit. You must delete the check from the scheduled audit or delete the scheduled audit itself to disable the check.

For more information on avialbe auidt checks see AWS::IoT::AccountAuditConfiguration AuditCheckConfigurations

audit_notification_target_configurations AccountAuditConfigurationAuditNotificationTargetConfigurations

Information about the targets to which audit notifications are sent.

role_arn str

The ARN of the role that grants permission to AWS IoT to access information about your devices, policies, certificates and other items as required when performing an audit.

auditCheckConfigurations Property Map

Specifies which audit checks are enabled and disabled for this account.

If an enabled check is removed from the template, it will also be disabled.

You can't disable a check if it's used by any scheduled audit. You must delete the check from the scheduled audit or delete the scheduled audit itself to disable the check.

For more information on avialbe auidt checks see AWS::IoT::AccountAuditConfiguration AuditCheckConfigurations

auditNotificationTargetConfigurations Property Map

Information about the targets to which audit notifications are sent.

roleArn String

The ARN of the role that grants permission to AWS IoT to access information about your devices, policies, certificates and other items as required when performing an audit.

Supporting Types

AccountAuditConfigurationAuditCheckConfiguration

Enabled bool: True if the check is enabled.

Enabled bool: True if the check is enabled.

enabled Boolean: True if the check is enabled.

enabled boolean: True if the check is enabled.

enabled bool: True if the check is enabled.

enabled Boolean: True if the check is enabled.

AccountAuditConfigurationAuditCheckConfigurations

AuthenticatedCognitoRoleOverlyPermissiveCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of an authenticated Amazon Cognito identity pool role. For this check, AWS IoT Device Defender audits all Amazon Cognito identity pools that have been used to connect to the AWS IoT message broker during the 31 days before the audit is performed.
CaCertificateExpiringCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if a CA certificate is expiring. This check applies to CA certificates expiring within 30 days or that have expired.
CaCertificateKeyQualityCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the CA certificate key. The quality checks if the key is in a valid format, not expired, and if the key meets a minimum required size. This check applies to CA certificates that are ACTIVE or PENDING_TRANSFER .
ConflictingClientIdsCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple devices connect using the same client ID.
DeviceCertificateExpiringCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if a device certificate is expiring. This check applies to device certificates expiring within 30 days or that have expired.
DeviceCertificateKeyQualityCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the device certificate key. The quality checks if the key is in a valid format, not expired, signed by a registered certificate authority, and if the key meets a minimum required size.
DeviceCertificateSharedCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT .
IntermediateCaRevokedForActiveDeviceCertificatesCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if device certificates are still active despite being revoked by an intermediate CA.
IoTPolicyPotentialMisConfigurationCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if an AWS IoT policy is potentially misconfigured. Misconfigured policies, including overly permissive policies, can cause security incidents like allowing devices access to unintended resources. This check is a warning for you to make sure that only intended actions are allowed before updating the policy.
IotPolicyOverlyPermissiveCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role.
IotRoleAliasAllowsAccessToUnusedServicesCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year.
IotRoleAliasOverlyPermissiveCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive.
LoggingDisabledCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if AWS IoT logs are disabled.
RevokedCaCertificateStillActiveCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked CA certificate is still active.
RevokedDeviceCertificateStillActiveCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked device certificate is still active.
UnauthenticatedCognitoRoleOverlyPermissiveCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive.

AuthenticatedCognitoRoleOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of an authenticated Amazon Cognito identity pool role. For this check, AWS IoT Device Defender audits all Amazon Cognito identity pools that have been used to connect to the AWS IoT message broker during the 31 days before the audit is performed.
CaCertificateExpiringCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a CA certificate is expiring. This check applies to CA certificates expiring within 30 days or that have expired.
CaCertificateKeyQualityCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the CA certificate key. The quality checks if the key is in a valid format, not expired, and if the key meets a minimum required size. This check applies to CA certificates that are ACTIVE or PENDING_TRANSFER .
ConflictingClientIdsCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple devices connect using the same client ID.
DeviceCertificateExpiringCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a device certificate is expiring. This check applies to device certificates expiring within 30 days or that have expired.
DeviceCertificateKeyQualityCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the device certificate key. The quality checks if the key is in a valid format, not expired, signed by a registered certificate authority, and if the key meets a minimum required size.
DeviceCertificateSharedCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT .
IntermediateCaRevokedForActiveDeviceCertificatesCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if device certificates are still active despite being revoked by an intermediate CA.
IoTPolicyPotentialMisConfigurationCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if an AWS IoT policy is potentially misconfigured. Misconfigured policies, including overly permissive policies, can cause security incidents like allowing devices access to unintended resources. This check is a warning for you to make sure that only intended actions are allowed before updating the policy.
IotPolicyOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role.
IotRoleAliasAllowsAccessToUnusedServicesCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year.
IotRoleAliasOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive.
LoggingDisabledCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if AWS IoT logs are disabled.
RevokedCaCertificateStillActiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked CA certificate is still active.
RevokedDeviceCertificateStillActiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked device certificate is still active.
UnauthenticatedCognitoRoleOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive.

authenticatedCognitoRoleOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of an authenticated Amazon Cognito identity pool role. For this check, AWS IoT Device Defender audits all Amazon Cognito identity pools that have been used to connect to the AWS IoT message broker during the 31 days before the audit is performed.
caCertificateExpiringCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a CA certificate is expiring. This check applies to CA certificates expiring within 30 days or that have expired.
caCertificateKeyQualityCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the CA certificate key. The quality checks if the key is in a valid format, not expired, and if the key meets a minimum required size. This check applies to CA certificates that are ACTIVE or PENDING_TRANSFER .
conflictingClientIdsCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple devices connect using the same client ID.
deviceCertificateExpiringCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a device certificate is expiring. This check applies to device certificates expiring within 30 days or that have expired.
deviceCertificateKeyQualityCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the device certificate key. The quality checks if the key is in a valid format, not expired, signed by a registered certificate authority, and if the key meets a minimum required size.
deviceCertificateSharedCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT .
intermediateCaRevokedForActiveDeviceCertificatesCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if device certificates are still active despite being revoked by an intermediate CA.
ioTPolicyPotentialMisConfigurationCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if an AWS IoT policy is potentially misconfigured. Misconfigured policies, including overly permissive policies, can cause security incidents like allowing devices access to unintended resources. This check is a warning for you to make sure that only intended actions are allowed before updating the policy.
iotPolicyOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role.
iotRoleAliasAllowsAccessToUnusedServicesCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year.
iotRoleAliasOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive.
loggingDisabledCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if AWS IoT logs are disabled.
revokedCaCertificateStillActiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked CA certificate is still active.
revokedDeviceCertificateStillActiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked device certificate is still active.
unauthenticatedCognitoRoleOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive.

authenticatedCognitoRoleOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of an authenticated Amazon Cognito identity pool role. For this check, AWS IoT Device Defender audits all Amazon Cognito identity pools that have been used to connect to the AWS IoT message broker during the 31 days before the audit is performed.
caCertificateExpiringCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a CA certificate is expiring. This check applies to CA certificates expiring within 30 days or that have expired.
caCertificateKeyQualityCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the CA certificate key. The quality checks if the key is in a valid format, not expired, and if the key meets a minimum required size. This check applies to CA certificates that are ACTIVE or PENDING_TRANSFER .
conflictingClientIdsCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple devices connect using the same client ID.
deviceCertificateExpiringCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a device certificate is expiring. This check applies to device certificates expiring within 30 days or that have expired.
deviceCertificateKeyQualityCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the device certificate key. The quality checks if the key is in a valid format, not expired, signed by a registered certificate authority, and if the key meets a minimum required size.
deviceCertificateSharedCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT .
intermediateCaRevokedForActiveDeviceCertificatesCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if device certificates are still active despite being revoked by an intermediate CA.
ioTPolicyPotentialMisConfigurationCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if an AWS IoT policy is potentially misconfigured. Misconfigured policies, including overly permissive policies, can cause security incidents like allowing devices access to unintended resources. This check is a warning for you to make sure that only intended actions are allowed before updating the policy.
iotPolicyOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role.
iotRoleAliasAllowsAccessToUnusedServicesCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year.
iotRoleAliasOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive.
loggingDisabledCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if AWS IoT logs are disabled.
revokedCaCertificateStillActiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked CA certificate is still active.
revokedDeviceCertificateStillActiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked device certificate is still active.
unauthenticatedCognitoRoleOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive.

authenticated_cognito_role_overly_permissive_check AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of an authenticated Amazon Cognito identity pool role. For this check, AWS IoT Device Defender audits all Amazon Cognito identity pools that have been used to connect to the AWS IoT message broker during the 31 days before the audit is performed.
ca_certificate_expiring_check AccountAuditConfigurationAuditCheckConfiguration: Checks if a CA certificate is expiring. This check applies to CA certificates expiring within 30 days or that have expired.
ca_certificate_key_quality_check AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the CA certificate key. The quality checks if the key is in a valid format, not expired, and if the key meets a minimum required size. This check applies to CA certificates that are ACTIVE or PENDING_TRANSFER .
conflicting_client_ids_check AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple devices connect using the same client ID.
device_certificate_expiring_check AccountAuditConfigurationAuditCheckConfiguration: Checks if a device certificate is expiring. This check applies to device certificates expiring within 30 days or that have expired.
device_certificate_key_quality_check AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the device certificate key. The quality checks if the key is in a valid format, not expired, signed by a registered certificate authority, and if the key meets a minimum required size.
device_certificate_shared_check AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT .
intermediate_ca_revoked_for_active_device_certificates_check AccountAuditConfigurationAuditCheckConfiguration: Checks if device certificates are still active despite being revoked by an intermediate CA.
io_t_policy_potential_mis_configuration_check AccountAuditConfigurationAuditCheckConfiguration: Checks if an AWS IoT policy is potentially misconfigured. Misconfigured policies, including overly permissive policies, can cause security incidents like allowing devices access to unintended resources. This check is a warning for you to make sure that only intended actions are allowed before updating the policy.
iot_policy_overly_permissive_check AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role.
iot_role_alias_allows_access_to_unused_services_check AccountAuditConfigurationAuditCheckConfiguration: Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year.
iot_role_alias_overly_permissive_check AccountAuditConfigurationAuditCheckConfiguration: Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive.
logging_disabled_check AccountAuditConfigurationAuditCheckConfiguration: Checks if AWS IoT logs are disabled.
revoked_ca_certificate_still_active_check AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked CA certificate is still active.
revoked_device_certificate_still_active_check AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked device certificate is still active.
unauthenticated_cognito_role_overly_permissive_check AccountAuditConfigurationAuditCheckConfiguration: Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive.

authenticatedCognitoRoleOverlyPermissiveCheck Property Map: Checks the permissiveness of an authenticated Amazon Cognito identity pool role. For this check, AWS IoT Device Defender audits all Amazon Cognito identity pools that have been used to connect to the AWS IoT message broker during the 31 days before the audit is performed.
caCertificateExpiringCheck Property Map: Checks if a CA certificate is expiring. This check applies to CA certificates expiring within 30 days or that have expired.
caCertificateKeyQualityCheck Property Map: Checks the quality of the CA certificate key. The quality checks if the key is in a valid format, not expired, and if the key meets a minimum required size. This check applies to CA certificates that are ACTIVE or PENDING_TRANSFER .
conflictingClientIdsCheck Property Map: Checks if multiple devices connect using the same client ID.
deviceCertificateExpiringCheck Property Map: Checks if a device certificate is expiring. This check applies to device certificates expiring within 30 days or that have expired.
deviceCertificateKeyQualityCheck Property Map: Checks the quality of the device certificate key. The quality checks if the key is in a valid format, not expired, signed by a registered certificate authority, and if the key meets a minimum required size.
deviceCertificateSharedCheck Property Map: Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT .
intermediateCaRevokedForActiveDeviceCertificatesCheck Property Map: Checks if device certificates are still active despite being revoked by an intermediate CA.
ioTPolicyPotentialMisConfigurationCheck Property Map: Checks if an AWS IoT policy is potentially misconfigured. Misconfigured policies, including overly permissive policies, can cause security incidents like allowing devices access to unintended resources. This check is a warning for you to make sure that only intended actions are allowed before updating the policy.
iotPolicyOverlyPermissiveCheck Property Map: Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role.
iotRoleAliasAllowsAccessToUnusedServicesCheck Property Map: Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year.
iotRoleAliasOverlyPermissiveCheck Property Map: Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive.
loggingDisabledCheck Property Map: Checks if AWS IoT logs are disabled.
revokedCaCertificateStillActiveCheck Property Map: Checks if a revoked CA certificate is still active.
revokedDeviceCertificateStillActiveCheck Property Map: Checks if a revoked device certificate is still active.
unauthenticatedCognitoRoleOverlyPermissiveCheck Property Map: Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive.

AccountAuditConfigurationAuditNotificationTarget

Enabled bool: True if notifications to the target are enabled.
RoleArn string: The ARN of the role that grants permission to send notifications to the target.
TargetArn string: The ARN of the target (SNS topic) to which audit notifications are sent.

Enabled bool: True if notifications to the target are enabled.
RoleArn string: The ARN of the role that grants permission to send notifications to the target.
TargetArn string: The ARN of the target (SNS topic) to which audit notifications are sent.

enabled Boolean: True if notifications to the target are enabled.
roleArn String: The ARN of the role that grants permission to send notifications to the target.
targetArn String: The ARN of the target (SNS topic) to which audit notifications are sent.

enabled boolean: True if notifications to the target are enabled.
roleArn string: The ARN of the role that grants permission to send notifications to the target.
targetArn string: The ARN of the target (SNS topic) to which audit notifications are sent.

enabled bool: True if notifications to the target are enabled.
role_arn str: The ARN of the role that grants permission to send notifications to the target.
target_arn str: The ARN of the target (SNS topic) to which audit notifications are sent.

enabled Boolean: True if notifications to the target are enabled.
roleArn String: The ARN of the role that grants permission to send notifications to the target.
targetArn String: The ARN of the target (SNS topic) to which audit notifications are sent.