Audit Manager

2 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

AuditManagerAssessment # CLOUD CONTROL · AWS::AuditManager::Assessment

AuditManagerAssessment manages AWS::AuditManager::Assessment through the AWS Cloud Control API.

kubectl get auditmanagerassessments · example on GitHub

Example

# AuditManagerAssessment — Audit Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/auditmanager.html#auditmanagerassessment
apiVersion: aws.konfig.io/v1alpha1
kind: AuditManagerAssessment
metadata:
  name: example-auditmanagerassessment
  namespace: default
spec:
  assessmentReportsDestination:
    destination: example
    destinationType: S3
  awsAccount:
    emailAddress: ops@example.com
    name: example-auditmanagerassessment
  delegations:
  - assessmentName: example-auditmanagerassessment
    comment: Managed by konfig-konector
    createdBy: example
    creationTime: 1
    lastUpdated: 1
    roleArn: arn:aws:iam::123456789012:role/example-role
    roleType: PROCESS_OWNER
    status: IN_PROGRESS
  description: Managed by konfig-konector
  name: example-auditmanagerassessment
  providerRef:
    name: example-auditmanagerassessment
    region: us-east-1
  roles:
  - roleArn: arn:aws:iam::123456789012:role/example-role
    roleType: PROCESS_OWNER
  scope:
    awsAccounts:
    - emailAddress: ops@example.com
      name: example-auditmanagerassessment
    awsServices:
    - serviceName: example-auditmanagerassessment
  status: ACTIVE
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`assessmentReportsDestination`	object	—	AuditManagerAssessmentAssessmentReportsDestination is a nested property type of AWS::AuditManager::Assessment.
`assessmentReportsDestination.destination`	string	—
`assessmentReportsDestination.destinationType`	enum	—	Allowed: `S3`
`awsAccount`	object	—	Create-only in AWS: changing it requires replacing the resource.
`awsAccount.emailAddress`	string	—
`awsAccount.id`	string	—
`awsAccount.name`	string	—
`delegations`	array<object>	—	The list of delegations.
`delegations[].assessmentId`	string	—
`delegations[].assessmentName`	string	—
`delegations[].comment`	string	—
`delegations[].controlSetId`	string	—
`delegations[].createdBy`	string	—
`delegations[].creationTime`	number	—
`delegations[].id`	string	—
`delegations[].lastUpdated`	number	—
`delegations[].roleArn`	string	—
`delegations[].roleType`	enum	—	Allowed: `PROCESS_OWNER, RESOURCE_OWNER`
`delegations[].status`	enum	—	Allowed: `IN_PROGRESS, UNDER_REVIEW, COMPLETE`
`description`	string	—
`frameworkId`	string	—	Create-only in AWS: changing it requires replacing the resource.
`name`	string	—
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`roles`	array<object>	—	The list of roles for the specified assessment.
`roles[].roleArn`	string	—
`roles[].roleType`	enum	—	Allowed: `PROCESS_OWNER, RESOURCE_OWNER`
`scope`	object	—	AuditManagerAssessmentScope is a nested property type of AWS::AuditManager::Assessment.
`scope.awsAccounts`	array<object>	—	The AWS accounts included in scope.
`scope.awsAccounts[].emailAddress`	string	—
`scope.awsAccounts[].id`	string	—
`scope.awsAccounts[].name`	string	—
`scope.awsServices`	array<object>	—	The AWS services included in scope.
`scope.awsServices[].serviceName`	string	—
`status`	enum	—	Allowed: `ACTIVE, INACTIVE`
`tags`	array<object>	—	The tags associated with the assessment.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`assessmentId`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`creationTime`	number	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

AuditManagerAssessmentFramework # CLOUD CONTROL · AWS::AuditManager::AssessmentFramework

AuditManagerAssessmentFramework manages AWS::AuditManager::AssessmentFramework through the AWS Cloud Control API.

kubectl get auditmanagerassessmentframeworks · example on GitHub

Example

# AuditManagerAssessmentFramework — Audit Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/auditmanager.html#auditmanagerassessmentframework
apiVersion: aws.konfig.io/v1alpha1
kind: AuditManagerAssessmentFramework
metadata:
  name: example-auditmanagerassessmentframework
  namespace: default
spec:
  complianceType: example
  controlSets:
  - controls:
    - name: example-controls
    name: example-auditmanagerassessmentframework
  description: Managed by konfig-konector
  name: example-auditmanagerassessmentframework
  providerRef:
    name: example-auditmanagerassessmentframework
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`complianceType`	string	—	The compliance type that the framework supports, such as CIS or HIPAA.
`controlSets`	array<object>	yes	The control sets that are associated with the framework.
`controlSets[].controls`	array<object>	yes	The list of controls within the control set.
`controlSets[].controls[].id`	string	yes	The unique identifier of the control.
`controlSets[].name`	string	yes	The name of the control set.
`description`	string	—	The description of the framework.
`name`	string	yes	The name of the framework.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	The tags associated with the framework.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	The Amazon Resource Name (ARN) of the framework.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	The time when the framework was created.
`createdBy`	string	—	The user or role that created the framework.
`frameworkId`	string	—	The unique identifier for the framework.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedAt`	string	—	The time when the framework was most recently updated.
`lastUpdatedBy`	string	—	The user or role that most recently updated the framework.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`type`	enum	—	The framework type, such as a standard framework or a custom framework. Allowed: `Standard, Custom`