IAM Access Analyzer

2 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

AccessAnalyzerAnalyzer # CLOUD CONTROL · AWS::AccessAnalyzer::Analyzer

AccessAnalyzerAnalyzer manages AWS::AccessAnalyzer::Analyzer through the AWS Cloud Control API.

kubectl get accessanalyzeranalyzers · example on GitHub

Example

# AccessAnalyzerAnalyzer — IAM Access Analyzer
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/accessanalyzer.html#accessanalyzeranalyzer
apiVersion: aws.konfig.io/v1alpha1
kind: AccessAnalyzerAnalyzer
metadata:
  name: example-accessanalyzeranalyzer
  namespace: default
spec:
  analyzerConfiguration:
    internalAccessConfiguration:
      internalAccessAnalysisRule:
        inclusions:
        - accountIds:
          - example
          resourceArns:
          - example
          resourceTypes:
          - example
    unusedAccessConfiguration:
      analysisRule:
        exclusions:
        - accountIds:
          - example
          resourceTags:
          - - key: example
              value: example
      unusedAccessAge: 1
  analyzerName: example-accessanalyzeranalyzer
  archiveRules:
  - filter:
    - contains:
      - example
      eq:
      - example
      exists: false
      neq:
      - example
      property: example
    ruleName: example-accessanalyzeranalyzer
  providerRef:
    name: example-accessanalyzeranalyzer
    region: us-east-1
  tags:
  - key: example
    value: example
  type: example

Spec

Field	Type	Required	Description
`analyzerConfiguration`	object	—	The configuration for the analyzer
`analyzerConfiguration.internalAccessConfiguration`	object	—	AccessAnalyzerAnalyzerInternalAccessConfiguration is a nested property type of AWS::AccessAnalyzer::Analyzer.
`analyzerConfiguration.internalAccessConfiguration.internalAccessAnalysisRule`	object	—	Contains information about analysis rules for the internal access analyzer.
`analyzerConfiguration.internalAccessConfiguration.internalAccessAnalysisRule.inclusions`	array<object>	—	A list of rules for the internal access analyzer containing criteria to include in analysis.
`analyzerConfiguration.internalAccessConfiguration.internalAccessAnalysisRule.inclusions[].accountIds`	array<string>	—	A list of AWS account IDs to apply to the internal access analysis rule criteria.
`analyzerConfiguration.internalAccessConfiguration.internalAccessAnalysisRule.inclusions[].resourceArns`	array<string>	—	A list of resource ARNs to apply to the internal access analysis rule criteria.
`analyzerConfiguration.internalAccessConfiguration.internalAccessAnalysisRule.inclusions[].resourceTypes`	array<string>	—	A list of resource types to apply to the internal access analysis rule criteria.
`analyzerConfiguration.unusedAccessConfiguration`	object	—	AccessAnalyzerAnalyzerUnusedAccessConfiguration is a nested property type of AWS::AccessAnalyzer::Analyzer.
`analyzerConfiguration.unusedAccessConfiguration.analysisRule`	object	—	Contains information about rules for the analyzer.
`analyzerConfiguration.unusedAccessConfiguration.analysisRule.exclusions`	array<object>	—	A list of rules for the analyzer containing criteria to exclude from analysis.
`analyzerConfiguration.unusedAccessConfiguration.analysisRule.exclusions[].accountIds`	array<string>	—	A list of AWS account IDs to apply to the analysis rule criteria.
`analyzerConfiguration.unusedAccessConfiguration.analysisRule.exclusions[].resourceTags`	array<array>	—	An array of key-value pairs to match for your resources.
`analyzerConfiguration.unusedAccessConfiguration.unusedAccessAge`	integer	—	The specified access age in days for which to generate findings for unused access.
`analyzerName`	string	—	Analyzer name Create-only in AWS: changing it requires replacing the resource.
`archiveRules`	array<object>	—
`archiveRules[].filter`	array<object>	yes
`archiveRules[].filter[].contains`	array<string>	—
`archiveRules[].filter[].eq`	array<string>	—
`archiveRules[].filter[].exists`	boolean	—
`archiveRules[].filter[].neq`	array<string>	—
`archiveRules[].filter[].property`	string	yes
`archiveRules[].ruleName`	string	yes	The archive rule name
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	An array of key-value pairs to apply to this resource.
`tags[].key`	string	yes
`tags[].value`	string	yes
`type`	string	yes	The type of the analyzer, must be one of ACCOUNT, ORGANIZATION, ACCOUNT_INTERNAL_ACCESS, ORGANIZATION_INTERNAL_ACCESS, ACCOUNT_UNUSED_ACCESS and ORGANIZATION_UNUSED_ACCESS Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`arn`	string	—	Amazon Resource Name (ARN) of the analyzer Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

AccessAnalyzerArchiveRule # CLOUD CONTROL · AWS::AccessAnalyzer::ArchiveRule

AccessAnalyzerArchiveRule manages AWS::AccessAnalyzer::ArchiveRule through the AWS Cloud Control API.

kubectl get accessanalyzerarchiverules · example on GitHub

Example

# AccessAnalyzerArchiveRule — IAM Access Analyzer
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/accessanalyzer.html#accessanalyzerarchiverule
apiVersion: aws.konfig.io/v1alpha1
kind: AccessAnalyzerArchiveRule
metadata:
  name: example-accessanalyzerarchiverule
  namespace: default
spec:
  analyzerName: example-accessanalyzerarchiverule
  filter: {}
  providerRef:
    name: example-accessanalyzerarchiverule
    region: us-east-1
  ruleName: example-accessanalyzerarchiverule

Spec

Field	Type	Required	Description
`analyzerName`	string	yes	The name of the analyzer for the archive rule.
`filter`	map<string>	yes	The criteria for the archive rule.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`ruleName`	string	yes	The name of the archive rule.

Status

Field	Type	Required	Description
`arn`	string	—	The ARN of the archive rule.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The time at which the archive rule was created.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`updatedAt`	string	—	The time at which the archive rule was last updated.