Macie

4 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

MacieAllowList # CLOUD CONTROL · AWS::Macie::AllowList

MacieAllowList manages AWS::Macie::AllowList through the AWS Cloud Control API.

kubectl get macieallowlists · example on GitHub

Example

# MacieAllowList — Macie
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/macie.html#macieallowlist
apiVersion: aws.konfig.io/v1alpha1
kind: MacieAllowList
metadata:
  name: example-macieallowlist
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-macieallowlist
  providerRef:
    name: example-macieallowlist
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`criteria`	object	yes	AllowList criteria.
`description`	string	—	Description of AllowList.
`name`	string	yes	Name of AllowList.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A collection of tags associated with a resource
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	AllowList ARN.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	AllowList ID.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`status`	enum	—	AllowList status. Allowed: `OK, S3_OBJECT_NOT_FOUND, S3_USER_ACCESS_DENIED, S3_OBJECT_ACCESS_DENIED, S3_THROTTLED, S3_OBJECT_OVERSIZE, S3_OBJECT_EMPTY, UNKNOWN_ERROR`

MacieCustomDataIdentifier # CLOUD CONTROL · AWS::Macie::CustomDataIdentifier

MacieCustomDataIdentifier manages AWS::Macie::CustomDataIdentifier through the AWS Cloud Control API.

kubectl get maciecustomdataidentifiers · example on GitHub

Example

# MacieCustomDataIdentifier — Macie
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/macie.html#maciecustomdataidentifier
apiVersion: aws.konfig.io/v1alpha1
kind: MacieCustomDataIdentifier
metadata:
  name: example-maciecustomdataidentifier
  namespace: default
spec:
  description: Managed by konfig-konector
  ignoreWords:
  - example
  keywords:
  - example
  maximumMatchDistance: 1
  name: example-maciecustomdataidentifier
  providerRef:
    name: example-maciecustomdataidentifier
    region: us-east-1
  regex: example
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`description`	string	—	Description of custom data identifier.
`ignoreWords`	array<string>	—	Words to be ignored.
`keywords`	array<string>	—	Keywords to be matched against.
`maximumMatchDistance`	integer	—	Maximum match distance.
`name`	string	yes	Name of custom data identifier.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`regex`	string	yes	Regular expression for custom data identifier.
`tags`	array<object>	—	A collection of tags associated with a resource
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Custom data identifier ARN.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Custom data identifier ID.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

MacieFindingsFilter # CLOUD CONTROL · AWS::Macie::FindingsFilter

MacieFindingsFilter manages AWS::Macie::FindingsFilter through the AWS Cloud Control API.

kubectl get maciefindingsfilters · example on GitHub

Example

# MacieFindingsFilter — Macie
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/macie.html#maciefindingsfilter
apiVersion: aws.konfig.io/v1alpha1
kind: MacieFindingsFilter
metadata:
  name: example-maciefindingsfilter
  namespace: default
spec:
  action: ARCHIVE
  description: Managed by konfig-konector
  findingCriteria:
    criterion: {}
  name: example-maciefindingsfilter
  position: 1
  providerRef:
    name: example-maciefindingsfilter
    region: us-east-1
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`action`	enum	—	Findings filter action. Allowed: `ARCHIVE, NOOP`
`description`	string	—	Findings filter description
`findingCriteria`	object	yes	Findings filter criteria.
`findingCriteria.criterion`	map<string>	—
`name`	string	yes	Findings filter name
`position`	integer	—	Findings filter position.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`tags`	array<object>	—	A collection of tags associated with a resource
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Findings filter ARN.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Findings filter ID.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

MacieSession # CLOUD CONTROL · AWS::Macie::Session ⚠ DESTRUCTIVE SCOPE

Caution, destructive scope: account-wide Macie enablement. Provided for completeness; do not use from application namespaces. Restrict with AWSProvider.allowedNamespaces and RBAC. MacieSession manages AWS::Macie::Session through the AWS Cloud Control API.

kubectl get maciesessions · example on GitHub

Example

# MacieSession — Macie
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/macie.html#maciesession
apiVersion: aws.konfig.io/v1alpha1
kind: MacieSession
metadata:
  name: example-maciesession
  namespace: default
spec:
  findingPublishingFrequency: FIFTEEN_MINUTES
  providerRef:
    name: example-maciesession
    region: us-east-1
  status: ENABLED

Spec

Field	Type	Required	Description
`findingPublishingFrequency`	enum	—	A enumeration value that specifies how frequently finding updates are published. Allowed: `FIFTEEN_MINUTES, ONE_HOUR, SIX_HOURS`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`status`	enum	—	A enumeration value that specifies the status of the Macie Session. Allowed: `ENABLED, PAUSED`

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`automatedDiscoveryStatus`	enum	—	The status of automated sensitive data discovery for the Macie session. Allowed: `ENABLED, DISABLED`
`awsAccountId`	string	—	AWS account ID of customer Read-only: reported by AWS after creation.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.
`serviceRole`	string	—	Service role used by Macie Read-only: reported by AWS after creation.