Inspector

6 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

InspectorEnabler # GA

InspectorEnabler is the Schema for managing Amazon Inspector activation.

kubectl get inspectorenablers · example on GitHub

Example

# InspectorEnabler — Inspector
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/inspector2.html#inspectorenabler
apiVersion: aws.konfig.io/v1alpha1
kind: InspectorEnabler
metadata:
  name: example-inspectorenabler
  namespace: default
spec:
  providerRef:
    name: example-inspectorenabler
    region: us-east-1
  resourceTypes:
  - EC2

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceTypes`	array<string>	yes	ResourceTypes are the scan types to enable.

Status

Field	Type	Required	Description
`accountId`	string	—	AccountID is the AWS account whose Inspector status is managed.
`accountStatus`	string	—	AccountStatus is the overall Inspector status for the account.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`resourceStatus`	object	—	ResourceStatus reports the per-resource-type scan status.
`resourceStatus.ec2`	string	—	EC2 scan status.
`resourceStatus.ecr`	string	—	ECR scan status.
`resourceStatus.lambda`	string	—	Lambda scan status.
`resourceStatus.lambdaCode`	string	—	LambdaCode scan status.

InspectorV2CisScanConfiguration # CLOUD CONTROL · AWS::InspectorV2::CisScanConfiguration

InspectorV2CisScanConfiguration manages AWS::InspectorV2::CisScanConfiguration through the AWS Cloud Control API.

kubectl get inspectorv2cisscanconfigurations · example on GitHub

Example

# InspectorV2CisScanConfiguration — Inspector
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/inspector2.html#inspectorv2cisscanconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: InspectorV2CisScanConfiguration
metadata:
  name: example-inspectorv2cisscanconfiguration
  namespace: default
spec:
  providerRef:
    name: example-inspectorv2cisscanconfiguration
    region: us-east-1
  scanName: example-inspectorv2cisscanconfiguration
  securityLevel: LEVEL_1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`scanName`	string	yes	Name of the scan
`schedule`	object	yes
`securityLevel`	enum	yes	Allowed: `LEVEL_1, LEVEL_2`
`tags`	map<string>	—
`targets`	object	yes

Status

Field	Type	Required	Description
`arn`	string	—	CIS Scan configuration unique identifier Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

InspectorV2CodeSecurityIntegration # CLOUD CONTROL · AWS::InspectorV2::CodeSecurityIntegration

InspectorV2CodeSecurityIntegration manages AWS::InspectorV2::CodeSecurityIntegration through the AWS Cloud Control API.

kubectl get inspectorv2codesecurityintegrations · example on GitHub

Example

# InspectorV2CodeSecurityIntegration — Inspector
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/inspector2.html#inspectorv2codesecurityintegration
apiVersion: aws.konfig.io/v1alpha1
kind: InspectorV2CodeSecurityIntegration
metadata:
  name: example-inspectorv2codesecurityintegration
  namespace: default
spec:
  createIntegrationDetails:
    gitlabSelfManaged:
      accessToken: example
      instanceUrl: example
  name: example-inspectorv2codesecurityintegration
  providerRef:
    name: example-inspectorv2codesecurityintegration
    region: us-east-1
  tags:
    environment: dev
    team: platform
  type: GITLAB_SELF_MANAGED
  updateIntegrationDetails:
    github:
      code: example
      installationId: example-id
    gitlabSelfManaged:
      authCode: example

Spec

Field	Type	Required	Description
`createIntegrationDetails`	object	—	Create Integration Details Create-only in AWS: changing it requires replacing the resource.
`createIntegrationDetails.gitlabSelfManaged`	object	yes	InspectorV2CodeSecurityIntegrationCreateGitLabSelfManagedIntegrationDetail is a nested property type of AWS::InspectorV2::CodeSecurityIntegration.
`createIntegrationDetails.gitlabSelfManaged.accessToken`	string	yes
`createIntegrationDetails.gitlabSelfManaged.instanceUrl`	string	yes
`name`	string	—	Code Security Integration name
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—
`type`	enum	—	Integration Type Allowed: `GITLAB_SELF_MANAGED, GITHUB`
`updateIntegrationDetails`	object	—	Update Integration Details
`updateIntegrationDetails.github`	object	—	InspectorV2CodeSecurityIntegrationUpdateGitHubIntegrationDetail is a nested property type of AWS::InspectorV2::CodeSecurityIntegration.
`updateIntegrationDetails.github.code`	string	yes
`updateIntegrationDetails.github.installationId`	string	yes
`updateIntegrationDetails.gitlabSelfManaged`	object	—	InspectorV2CodeSecurityIntegrationUpdateGitLabSelfManagedIntegrationDetail is a nested property type of AWS::InspectorV2::CodeSecurityIntegration.
`updateIntegrationDetails.gitlabSelfManaged.authCode`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Code Security Integration ARN Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`authorizationUrl`	string	—	Authorization URL for OAuth flow Read-only: reported by AWS after creation.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`createdAt`	string	—	Creation timestamp Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedAt`	string	—	Last update timestamp Read-only: reported by AWS after creation.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	Integration Status Read-only: reported by AWS after creation. Allowed: `PENDING, IN_PROGRESS, ACTIVE, INACTIVE, DISABLING`
`statusReason`	string	—	Reason for the current status Read-only: reported by AWS after creation.

InspectorV2CodeSecurityScanConfiguration # CLOUD CONTROL · AWS::InspectorV2::CodeSecurityScanConfiguration

InspectorV2CodeSecurityScanConfiguration manages AWS::InspectorV2::CodeSecurityScanConfiguration through the AWS Cloud Control API.

kubectl get inspectorv2codesecurityscanconfigurations · example on GitHub

Example

# InspectorV2CodeSecurityScanConfiguration — Inspector
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/inspector2.html#inspectorv2codesecurityscanconfiguration
apiVersion: aws.konfig.io/v1alpha1
kind: InspectorV2CodeSecurityScanConfiguration
metadata:
  name: example-inspectorv2codesecurityscanconfiguration
  namespace: default
spec:
  configuration:
    continuousIntegrationScanConfiguration:
      supportedEvents:
      - example
    periodicScanConfiguration:
      frequency: WEEKLY
      frequencyExpression: example
    ruleSetCategories:
    - example
  level: ORGANIZATION
  name: example-inspectorv2codesecurityscanconfiguration
  providerRef:
    name: example-inspectorv2codesecurityscanconfiguration
    region: us-east-1
  scopeSettings:
    projectSelectionScope: ALL
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`configuration`	object	—	Code Security Scan Configuration
`configuration.continuousIntegrationScanConfiguration`	object	—	InspectorV2CodeSecurityScanConfigurationContinuousIntegrationScanConfiguration is a nested property type of AWS::InspectorV2::CodeSecurityScanConfiguration.
`configuration.continuousIntegrationScanConfiguration.supportedEvents`	array<string>	yes
`configuration.periodicScanConfiguration`	object	—	InspectorV2CodeSecurityScanConfigurationPeriodicScanConfiguration is a nested property type of AWS::InspectorV2::CodeSecurityScanConfiguration.
`configuration.periodicScanConfiguration.frequency`	enum	—	Allowed: `WEEKLY, MONTHLY, NEVER`
`configuration.periodicScanConfiguration.frequencyExpression`	string	—
`configuration.ruleSetCategories`	array<string>	yes
`level`	enum	—	Configuration Level Create-only in AWS: changing it requires replacing the resource. Allowed: `ORGANIZATION, ACCOUNT`
`name`	string	—	Code Security Scan Configuration name Create-only in AWS: changing it requires replacing the resource.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`scopeSettings`	object	—	Scope Settings Create-only in AWS: changing it requires replacing the resource.
`scopeSettings.projectSelectionScope`	enum	—	Allowed: `ALL`
`tags`	map<string>	—

Status

Field	Type	Required	Description
`arn`	string	—	Code Security Scan Configuration ARN Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

InspectorV2Connector # CLOUD CONTROL · AWS::InspectorV2::Connector

InspectorV2Connector manages AWS::InspectorV2::Connector through the AWS Cloud Control API.

kubectl get inspectorv2connectors · example on GitHub

Example

# InspectorV2Connector — Inspector
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/inspector2.html#inspectorv2connector
apiVersion: aws.konfig.io/v1alpha1
kind: InspectorV2Connector
metadata:
  name: example-inspectorv2connector
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-inspectorv2connector
  provider: AZURE
  providerConfiguration:
    azure:
      autoInstallVMScanner: false
      awsConfigConnectorArn: arn:aws:iam::123456789012:role/example-role
      azureRegions:
      - example
  providerRef:
    name: example-inspectorv2connector
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`description`	string	—	Optional description of the connector.
`name`	string	yes	Display name for the connector.
`provider`	enum	yes	The cloud provider for this connector. Allowed: `AZURE`
`providerConfiguration`	object	yes	Provider-specific configuration including regions and scope.
`providerConfiguration.azure`	object	yes	InspectorV2ConnectorAzureProviderConfiguration is a nested property type of AWS::InspectorV2::Connector.
`providerConfiguration.azure.autoInstallVMScanner`	boolean	—	Whether to automatically install the VM scanner.
`providerConfiguration.azure.awsConfigConnectorArn`	string	yes	The ARN of the AWS Config connector used for Azure resource discovery.
`providerConfiguration.azure.azureRegions`	array<string>	yes	List of Azure regions to scan.
`providerConfiguration.azure.scopeConfiguration`	object	yes	InspectorV2ConnectorAzureScopeConfigurationMap is a nested property type of AWS::InspectorV2::Connector.
`providerConfiguration.azure.scopeConfiguration.containerImageScanning`	object	—	InspectorV2ConnectorScopeConfiguration is a nested property type of AWS::InspectorV2::Connector.
`providerConfiguration.azure.scopeConfiguration.containerImageScanning.scopeType`	enum	yes	Allowed: `TENANT, SUBSCRIPTION`
`providerConfiguration.azure.scopeConfiguration.containerImageScanning.scopeValues`	array<string>	—	List of subscription IDs.
`providerConfiguration.azure.scopeConfiguration.containerImageScanning.state`	enum	—	Allowed: `ACTIVE, PENDING, ERROR, DISABLED`
`providerConfiguration.azure.scopeConfiguration.containerImageScanning.stateReason`	string	—	Reason for the current scope state.
`providerConfiguration.azure.scopeConfiguration.serverlessScanning`	object	—	InspectorV2ConnectorScopeConfiguration is a nested property type of AWS::InspectorV2::Connector.
`providerConfiguration.azure.scopeConfiguration.serverlessScanning.scopeType`	enum	yes	Allowed: `TENANT, SUBSCRIPTION`
`providerConfiguration.azure.scopeConfiguration.serverlessScanning.scopeValues`	array<string>	—	List of subscription IDs.
`providerConfiguration.azure.scopeConfiguration.serverlessScanning.state`	enum	—	Allowed: `ACTIVE, PENDING, ERROR, DISABLED`
`providerConfiguration.azure.scopeConfiguration.serverlessScanning.stateReason`	string	—	Reason for the current scope state.
`providerConfiguration.azure.scopeConfiguration.vmScanning`	object	—	InspectorV2ConnectorScopeConfiguration is a nested property type of AWS::InspectorV2::Connector.
`providerConfiguration.azure.scopeConfiguration.vmScanning.scopeType`	enum	yes	Allowed: `TENANT, SUBSCRIPTION`
`providerConfiguration.azure.scopeConfiguration.vmScanning.scopeValues`	array<string>	—	List of subscription IDs.
`providerConfiguration.azure.scopeConfiguration.vmScanning.state`	enum	—	Allowed: `ACTIVE, PENDING, ERROR, DISABLED`
`providerConfiguration.azure.scopeConfiguration.vmScanning.stateReason`	string	—	Reason for the current scope state.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	Tags to apply to the connector.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`connectorArn`	string	—	The Amazon Resource Name (ARN) of the connector.
`createdAt`	string	—	Timestamp when the connector was created.
`enablementStatus`	enum	—	The enablement status of the connector. Allowed: `ENABLED, PENDING_ENABLEMENT, FAILED_TO_ENABLE, PENDING_UPDATE, FAILED_TO_UPDATE, PENDING_DELETION, DELETED, FAILED_TO_DELETE`
`enablementStatusReason`	string	—	Reason for the current enablement status, if applicable.
`health`	object	—	Health status of the connector.
`health.connectorStatus`	enum	—	Allowed: `CONNECTED, DEGRADED, FAILED_TO_CONNECT, PENDING_AUTHORIZATION, PENDING_CONFIGURATION, UNKNOWN`
`health.lastCheckedAt`	string	—
`health.message`	string	—
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`lastUpdatedAt`	string	—	Timestamp when the connector was last updated.
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

InspectorV2Filter # CLOUD CONTROL · AWS::InspectorV2::Filter

InspectorV2Filter manages AWS::InspectorV2::Filter through the AWS Cloud Control API.

kubectl get inspectorv2filters · example on GitHub

Example

# InspectorV2Filter — Inspector
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/inspector2.html#inspectorv2filter
apiVersion: aws.konfig.io/v1alpha1
kind: InspectorV2Filter
metadata:
  name: example-inspectorv2filter
  namespace: default
spec:
  description: Managed by konfig-konector
  filterAction: NONE
  filterCriteria:
    awsAccountId:
    - comparison: EQUALS
      value: example
    codeVulnerabilityDetectorName:
    - comparison: EQUALS
      value: example
    codeVulnerabilityDetectorTags:
    - comparison: EQUALS
      value: example
    codeVulnerabilityFilePath:
    - comparison: EQUALS
      value: example
    componentId:
    - comparison: EQUALS
      value: example
    componentType:
    - comparison: EQUALS
      value: example
    ec2InstanceImageId:
    - comparison: EQUALS
      value: example
    ec2InstanceSubnetId:
    - comparison: EQUALS
      value: example
    ec2InstanceVpcId:
    - comparison: EQUALS
      value: example
    ecrImageArchitecture:
    - comparison: EQUALS
      value: example
    ecrImageHash:
    - comparison: EQUALS
      value: example
    ecrImagePushedAt:
    - endInclusive: 1
      startInclusive: 1
    ecrImageRegistry:
    - comparison: EQUALS
      value: example
    ecrImageRepositoryName:
    - comparison: EQUALS
      value: example
    ecrImageTags:
    - comparison: EQUALS
      value: example
    epssScore:
    - lowerInclusive: 1
      upperInclusive: 1
    exploitAvailable:
    - comparison: EQUALS
      value: example
    findingArn:
    - comparison: EQUALS
      value: example
    findingStatus:
    - comparison: EQUALS
      value: example
    findingType:
    - comparison: EQUALS
      value: example
    firstObservedAt:
    - endInclusive: 1
      startInclusive: 1
    fixAvailable:
    - comparison: EQUALS
      value: example
    inspectorScore:
    - lowerInclusive: 1
      upperInclusive: 1
    lambdaFunctionExecutionRoleArn:
    - comparison: EQUALS
      value: example
    lambdaFunctionLastModifiedAt:
    - endInclusive: 1
      startInclusive: 1
    lambdaFunctionLayers:
    - comparison: EQUALS
      value: example
    lambdaFunctionName:
    - comparison: EQUALS
      value: example
    lambdaFunctionRuntime:
    - comparison: EQUALS
      value: example
    lastObservedAt:
    - endInclusive: 1
      startInclusive: 1
    networkProtocol:
    - comparison: EQUALS
      value: example
    portRange:
    - beginInclusive: 1
      endInclusive: 1
    relatedVulnerabilities:
    - comparison: EQUALS
      value: example
    resourceId:
    - comparison: EQUALS
      value: example
    resourceTags:
    - comparison: EQUALS
      key: example
      value: example
    resourceType:
    - comparison: EQUALS
      value: example
    severity:
    - comparison: EQUALS
      value: example
    title:
    - comparison: EQUALS
      value: example
    updatedAt:
    - endInclusive: 1
      startInclusive: 1
    vendorSeverity:
    - comparison: EQUALS
      value: example
    vulnerabilityId:
    - comparison: EQUALS
      value: example
    vulnerabilitySource:
    - comparison: EQUALS
      value: example
  name: example-inspectorv2filter
  providerRef:
    name: example-inspectorv2filter
    region: us-east-1
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`description`	string	—	Findings filter description.
`filterAction`	enum	yes	Findings filter action. Allowed: `NONE, SUPPRESS`
`filterCriteria`	object	yes	Findings filter criteria.
`filterCriteria.awsAccountId`	array<object>	—
`filterCriteria.awsAccountId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.awsAccountId[].value`	string	yes
`filterCriteria.codeVulnerabilityDetectorName`	array<object>	—
`filterCriteria.codeVulnerabilityDetectorName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.codeVulnerabilityDetectorName[].value`	string	yes
`filterCriteria.codeVulnerabilityDetectorTags`	array<object>	—
`filterCriteria.codeVulnerabilityDetectorTags[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.codeVulnerabilityDetectorTags[].value`	string	yes
`filterCriteria.codeVulnerabilityFilePath`	array<object>	—
`filterCriteria.codeVulnerabilityFilePath[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.codeVulnerabilityFilePath[].value`	string	yes
`filterCriteria.componentId`	array<object>	—
`filterCriteria.componentId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.componentId[].value`	string	yes
`filterCriteria.componentType`	array<object>	—
`filterCriteria.componentType[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.componentType[].value`	string	yes
`filterCriteria.ec2InstanceImageId`	array<object>	—
`filterCriteria.ec2InstanceImageId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.ec2InstanceImageId[].value`	string	yes
`filterCriteria.ec2InstanceSubnetId`	array<object>	—
`filterCriteria.ec2InstanceSubnetId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.ec2InstanceSubnetId[].value`	string	yes
`filterCriteria.ec2InstanceVpcId`	array<object>	—
`filterCriteria.ec2InstanceVpcId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.ec2InstanceVpcId[].value`	string	yes
`filterCriteria.ecrImageArchitecture`	array<object>	—
`filterCriteria.ecrImageArchitecture[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.ecrImageArchitecture[].value`	string	yes
`filterCriteria.ecrImageHash`	array<object>	—
`filterCriteria.ecrImageHash[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.ecrImageHash[].value`	string	yes
`filterCriteria.ecrImagePushedAt`	array<object>	—
`filterCriteria.ecrImagePushedAt[].endInclusive`	integer	—
`filterCriteria.ecrImagePushedAt[].startInclusive`	integer	—
`filterCriteria.ecrImageRegistry`	array<object>	—
`filterCriteria.ecrImageRegistry[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.ecrImageRegistry[].value`	string	yes
`filterCriteria.ecrImageRepositoryName`	array<object>	—
`filterCriteria.ecrImageRepositoryName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.ecrImageRepositoryName[].value`	string	yes
`filterCriteria.ecrImageTags`	array<object>	—
`filterCriteria.ecrImageTags[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.ecrImageTags[].value`	string	yes
`filterCriteria.epssScore`	array<object>	—
`filterCriteria.epssScore[].lowerInclusive`	number	—
`filterCriteria.epssScore[].upperInclusive`	number	—
`filterCriteria.exploitAvailable`	array<object>	—
`filterCriteria.exploitAvailable[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.exploitAvailable[].value`	string	yes
`filterCriteria.findingArn`	array<object>	—
`filterCriteria.findingArn[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.findingArn[].value`	string	yes
`filterCriteria.findingStatus`	array<object>	—
`filterCriteria.findingStatus[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.findingStatus[].value`	string	yes
`filterCriteria.findingType`	array<object>	—
`filterCriteria.findingType[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.findingType[].value`	string	yes
`filterCriteria.firstObservedAt`	array<object>	—
`filterCriteria.firstObservedAt[].endInclusive`	integer	—
`filterCriteria.firstObservedAt[].startInclusive`	integer	—
`filterCriteria.fixAvailable`	array<object>	—
`filterCriteria.fixAvailable[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.fixAvailable[].value`	string	yes
`filterCriteria.inspectorScore`	array<object>	—
`filterCriteria.inspectorScore[].lowerInclusive`	number	—
`filterCriteria.inspectorScore[].upperInclusive`	number	—
`filterCriteria.lambdaFunctionExecutionRoleArn`	array<object>	—
`filterCriteria.lambdaFunctionExecutionRoleArn[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.lambdaFunctionExecutionRoleArn[].value`	string	yes
`filterCriteria.lambdaFunctionLastModifiedAt`	array<object>	—
`filterCriteria.lambdaFunctionLastModifiedAt[].endInclusive`	integer	—
`filterCriteria.lambdaFunctionLastModifiedAt[].startInclusive`	integer	—
`filterCriteria.lambdaFunctionLayers`	array<object>	—
`filterCriteria.lambdaFunctionLayers[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.lambdaFunctionLayers[].value`	string	yes
`filterCriteria.lambdaFunctionName`	array<object>	—
`filterCriteria.lambdaFunctionName[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.lambdaFunctionName[].value`	string	yes
`filterCriteria.lambdaFunctionRuntime`	array<object>	—
`filterCriteria.lambdaFunctionRuntime[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.lambdaFunctionRuntime[].value`	string	yes
`filterCriteria.lastObservedAt`	array<object>	—
`filterCriteria.lastObservedAt[].endInclusive`	integer	—
`filterCriteria.lastObservedAt[].startInclusive`	integer	—
`filterCriteria.networkProtocol`	array<object>	—
`filterCriteria.networkProtocol[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.networkProtocol[].value`	string	yes
`filterCriteria.portRange`	array<object>	—
`filterCriteria.portRange[].beginInclusive`	integer	—
`filterCriteria.portRange[].endInclusive`	integer	—
`filterCriteria.relatedVulnerabilities`	array<object>	—
`filterCriteria.relatedVulnerabilities[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.relatedVulnerabilities[].value`	string	yes
`filterCriteria.resourceId`	array<object>	—
`filterCriteria.resourceId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.resourceId[].value`	string	yes
`filterCriteria.resourceTags`	array<object>	—
`filterCriteria.resourceTags[].comparison`	enum	yes	Allowed: `EQUALS`
`filterCriteria.resourceTags[].key`	string	—
`filterCriteria.resourceTags[].value`	string	—
`filterCriteria.resourceType`	array<object>	—
`filterCriteria.resourceType[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.resourceType[].value`	string	yes
`filterCriteria.severity`	array<object>	—
`filterCriteria.severity[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.severity[].value`	string	yes
`filterCriteria.title`	array<object>	—
`filterCriteria.title[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.title[].value`	string	yes
`filterCriteria.updatedAt`	array<object>	—
`filterCriteria.updatedAt[].endInclusive`	integer	—
`filterCriteria.updatedAt[].startInclusive`	integer	—
`filterCriteria.vendorSeverity`	array<object>	—
`filterCriteria.vendorSeverity[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.vendorSeverity[].value`	string	yes
`filterCriteria.vulnerabilityId`	array<object>	—
`filterCriteria.vulnerabilityId[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.vulnerabilityId[].value`	string	yes
`filterCriteria.vulnerabilitySource`	array<object>	—
`filterCriteria.vulnerabilitySource[].comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.vulnerabilitySource[].value`	string	yes
`filterCriteria.vulnerablePackages`	array<object>	—
`filterCriteria.vulnerablePackages[].architecture`	object	—	InspectorV2FilterStringFilter is a nested property type of AWS::InspectorV2::Filter.
`filterCriteria.vulnerablePackages[].architecture.comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.vulnerablePackages[].architecture.value`	string	yes
`filterCriteria.vulnerablePackages[].epoch`	object	—	InspectorV2FilterNumberFilter is a nested property type of AWS::InspectorV2::Filter.
`filterCriteria.vulnerablePackages[].epoch.lowerInclusive`	number	—
`filterCriteria.vulnerablePackages[].epoch.upperInclusive`	number	—
`filterCriteria.vulnerablePackages[].filePath`	object	—	InspectorV2FilterStringFilter is a nested property type of AWS::InspectorV2::Filter.
`filterCriteria.vulnerablePackages[].filePath.comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.vulnerablePackages[].filePath.value`	string	yes
`filterCriteria.vulnerablePackages[].name`	object	—	InspectorV2FilterStringFilter is a nested property type of AWS::InspectorV2::Filter.
`filterCriteria.vulnerablePackages[].name.comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.vulnerablePackages[].name.value`	string	yes
`filterCriteria.vulnerablePackages[].release`	object	—	InspectorV2FilterStringFilter is a nested property type of AWS::InspectorV2::Filter.
`filterCriteria.vulnerablePackages[].release.comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.vulnerablePackages[].release.value`	string	yes
`filterCriteria.vulnerablePackages[].sourceLambdaLayerArn`	object	—	InspectorV2FilterStringFilter is a nested property type of AWS::InspectorV2::Filter.
`filterCriteria.vulnerablePackages[].sourceLambdaLayerArn.comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.vulnerablePackages[].sourceLambdaLayerArn.value`	string	yes
`filterCriteria.vulnerablePackages[].sourceLayerHash`	object	—	InspectorV2FilterStringFilter is a nested property type of AWS::InspectorV2::Filter.
`filterCriteria.vulnerablePackages[].sourceLayerHash.comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.vulnerablePackages[].sourceLayerHash.value`	string	yes
`filterCriteria.vulnerablePackages[].version`	object	—	InspectorV2FilterStringFilter is a nested property type of AWS::InspectorV2::Filter.
`filterCriteria.vulnerablePackages[].version.comparison`	enum	yes	Allowed: `EQUALS, PREFIX, NOT_EQUALS`
`filterCriteria.vulnerablePackages[].version.value`	string	yes
`name`	string	yes	Findings filter name.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	map<string>	—

Status

Field	Type	Required	Description
`arn`	string	—	Findings filter ARN.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.