Skip to content

Commit 78d809c

Browse files
ParthaIParthaI
authored
Add table aws_inspector2_organization_configuration Closes #2604 (#2608)
1 parent bd48af0 commit 78d809c

File tree

3 files changed

+371
-0
lines changed

3 files changed

+371
-0
lines changed

‎aws/plugin.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -483,6 +483,7 @@ func Plugin(ctx context.Context) *plugin.Plugin {
483483
"aws_inspector2_coverage": tableAwsInspector2Coverage(ctx),
484484
"aws_inspector2_finding": tableAwsInspector2Finding(ctx),
485485
"aws_inspector2_member": tableAwsInspector2Member(ctx),
486+
"aws_inspector2_organization_configuration": tableAwsInspector2OrganizationConfiguration(ctx),
486487
"aws_iot_fleet_metric": tableAwsIoTFleetMetric(ctx),
487488
"aws_iot_thing_group": tableAwsIoTThingGroup(ctx),
488489
"aws_iot_thing_type": tableAwsIoTThingType(ctx),

‎aws/table_aws_inspector2_organization_configuration.go‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
package aws
2+
3+
import (
4+
"context"
5+
"strings"
6+
7+
"github.com/aws/aws-sdk-go-v2/service/inspector2"
8+
9+
"github.com/turbot/steampipe-plugin-sdk/v5/grpc/proto"
10+
"github.com/turbot/steampipe-plugin-sdk/v5/plugin"
11+
"github.com/turbot/steampipe-plugin-sdk/v5/plugin/transform"
12+
)
13+
14+
//// TABLE DEFINITION
15+
16+
func tableAwsInspector2OrganizationConfiguration(_ context.Context) *plugin.Table {
17+
return &plugin.Table{
18+
Name: "aws_inspector2_organization_configuration",
19+
Description: "AWS Inspector2 Organization Configuration",
20+
List: &plugin.ListConfig{
21+
Hydrate: listInspector2OrganizationConfiguration,
22+
Tags: map[string]string{"service": "inspector2", "action": "DescribeOrganizationConfiguration"},
23+
},
24+
GetMatrixItemFunc: SupportedRegionMatrix(AWS_INSPECTOR2_SERVICE_ID),
25+
Columns: awsRegionalColumns([]*plugin.Column{
26+
{
27+
Name: "ec2_auto_enable",
28+
Description: "Represents whether Amazon EC2 scans are automatically enabled for new members of your Amazon Inspector organization.",
29+
Type: proto.ColumnType_BOOL,
30+
Transform: transform.FromField("AutoEnable.Ec2"),
31+
},
32+
{
33+
Name: "ecr_auto_enable",
34+
Description: "Represents whether Amazon ECR scans are automatically enabled for new members of your Amazon Inspector organization.",
35+
Type: proto.ColumnType_BOOL,
36+
Transform: transform.FromField("AutoEnable.Ecr"),
37+
},
38+
{
39+
Name: "lambda_auto_enable",
40+
Description: "Represents whether Amazon Web Services Lambda standard scans are automatically enabled for new members of your Amazon Inspector organization.",
41+
Type: proto.ColumnType_BOOL,
42+
Transform: transform.FromField("AutoEnable.Lambda"),
43+
},
44+
{
45+
Name: "lambda_code_auto_enable",
46+
Description: "Represents whether Lambda code scans are automatically enabled for new members of your Amazon Inspector organization.",
47+
Type: proto.ColumnType_BOOL,
48+
Transform: transform.FromField("AutoEnable.LambdaCode"),
49+
},
50+
{
51+
Name: "max_account_limit_reached",
52+
Description: "Represents whether your organization has reached the maximum Amazon Web Services account limit for Amazon Inspector.",
53+
Type: proto.ColumnType_BOOL,
54+
},
55+
56+
// Steampipe standard columns
57+
{
58+
Name: "title",
59+
Description: resourceInterfaceDescription("title"),
60+
Type: proto.ColumnType_STRING,
61+
Transform: transform.From(getInspector2OrganizationConfigurationTitle),
62+
},
63+
}),
64+
}
65+
}
66+
67+
//// LIST FUNCTION
68+
69+
func listInspector2OrganizationConfiguration(ctx context.Context, d *plugin.QueryData, h *plugin.HydrateData) (interface{}, error) {
70+
// Create service
71+
svc, err := Inspector2Client(ctx, d)
72+
if err != nil {
73+
plugin.Logger(ctx).Error("aws_inspector2_organization_configuration.listInspector2OrganizationConfiguration", "connection_error", err)
74+
return nil, err
75+
}
76+
if svc == nil {
77+
// Unsupported region, return no data
78+
return nil, nil
79+
}
80+
81+
// Build the params
82+
params := &inspector2.DescribeOrganizationConfigurationInput{}
83+
84+
// Get organization configuration
85+
data, err := svc.DescribeOrganizationConfiguration(ctx, params)
86+
if err != nil {
87+
// For the regions where we have not enable it we will receive the rror: aws: operation error Inspector2: DescribeOrganizationConfiguration, https response error StatusCode: 403, RequestID: 8bb92eba-7e8d-4186-a83a-640e98b5621f, AccessDeniedException: Invoking account does not have access to describe the organization configuration.
88+
if strings.Contains(strings.ToLower(err.Error()), strings.ToLower("Invoking account does not have access to describe the organization configuration")) {
89+
return nil, nil
90+
}
91+
plugin.Logger(ctx).Error("aws_inspector2_organization_configuration.listInspector2OrganizationConfiguration", "api_error", err)
92+
return nil, err
93+
}
94+
95+
// Stream the single organization configuration
96+
d.StreamListItem(ctx, data)
97+
98+
return nil, nil
99+
}
100+
101+
//// TRANSFORM FUNCTIONS
102+
103+
func getInspector2OrganizationConfigurationTitle(ctx context.Context, d *transform.TransformData) (interface{}, error) {
104+
region := d.MatrixItem[matrixKeyRegion]
105+
106+
title := region.(string) + " Inspector2 Organization Configuration"
107+
return title, nil
108+
}

‎docs/tables/aws_inspector2_organization_configuration.md‎

Lines changed: 262 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,262 @@
1+
---
2+
title: "Steampipe Table: aws_inspector2_organization_configuration - Query AWS Inspector2 Regional Organization Configuration using SQL"
3+
description: "Allows users to query AWS Inspector2 regional organization configuration, including auto-enable settings for scan types and account limit status per region."
4+
folder: "Inspector2"
5+
---
6+
7+
# Table: aws_inspector2_organization_configuration - Query AWS Inspector2 Regional Organization Configuration using SQL
8+
9+
The AWS Inspector2 Regional Organization Configuration contains settings that determine which scan types are automatically enabled for new members of your organization within a specific region and whether the organization has reached its account limit. These configurations help manage the security posture across your AWS organization on a regional basis.
10+
11+
## Table Usage Guide
12+
13+
The `aws_inspector2_organization_configuration` table in Steampipe provides you with information about the regional organization configuration of Amazon Inspector2. This table allows you, as a cloud administrator, security team member, or compliance officer, to query regional organization settings, including which scan types are automatically enabled for new members and whether the organization has reached its account limit. You can utilize this table to gather insights on regional organization configuration, such as EC2, ECR, Lambda, and Lambda Code scan auto-enablement status, account limit status, and region information. The schema outlines the various attributes of the regional organization configuration for you, including the region, scan type auto-enablement settings, and account limit status.
14+
15+
**Important Notes**
16+
- To query this table, the account must be registered as the delegated administrator. For more details, see: https://docs.aws.amazon.com/inspector/latest/user/admin-member-relationship.html
17+
18+
## Examples
19+
20+
### Basic info
21+
Analyze the regional organization configuration to understand which scan types are automatically enabled for new members and whether the organization has reached its account limit. This is useful for ensuring your security posture is properly configured across regions.
22+
23+
```sql+postgres
24+
select
25+
region,
26+
ec2_auto_enable,
27+
ecr_auto_enable,
28+
lambda_auto_enable,
29+
lambda_code_auto_enable,
30+
max_account_limit_reached,
31+
title
32+
from
33+
aws_inspector2_organization_configuration;
34+
```
35+
36+
```sql+sqlite
37+
select
38+
region,
39+
ec2_auto_enable,
40+
ecr_auto_enable,
41+
lambda_auto_enable,
42+
lambda_code_auto_enable,
43+
max_account_limit_reached,
44+
title
45+
from
46+
aws_inspector2_organization_configuration;
47+
```
48+
49+
### List regions with scan type auto-enablement settings
50+
Identify which scan types are automatically enabled for new members of your organization across all regions. This helps in understanding the default security posture for new accounts.
51+
52+
```sql+postgres
53+
select
54+
region,
55+
ec2_auto_enable,
56+
ecr_auto_enable,
57+
lambda_auto_enable,
58+
lambda_code_auto_enable
59+
from
60+
aws_inspector2_organization_configuration;
61+
```
62+
63+
```sql+sqlite
64+
select
65+
region,
66+
ec2_auto_enable,
67+
ecr_auto_enable,
68+
lambda_auto_enable,
69+
lambda_code_auto_enable
70+
from
71+
aws_inspector2_organization_configuration;
72+
```
73+
74+
### List regions with organization account limit status
75+
Determine whether your organization has reached the maximum AWS account limit for Amazon Inspector across all regions. This is important for capacity planning and understanding organizational constraints.
76+
77+
```sql+postgres
78+
select
79+
region,
80+
max_account_limit_reached,
81+
case
82+
when max_account_limit_reached then 'Organization has reached maximum account limit'
83+
else 'Organization can add more accounts'
84+
end as limit_status
85+
from
86+
aws_inspector2_organization_configuration;
87+
```
88+
89+
```sql+sqlite
90+
select
91+
region,
92+
max_account_limit_reached,
93+
case
94+
when max_account_limit_reached then 'Organization has reached maximum account limit'
95+
else 'Organization can add more accounts'
96+
end as limit_status
97+
from
98+
aws_inspector2_organization_configuration;
99+
```
100+
101+
### List regions with comprehensive scan type coverage
102+
Identify regions that have all scan types (EC2, ECR, Lambda, and Lambda Code) automatically enabled for new members. This indicates a comprehensive security posture across regions.
103+
104+
```sql+postgres
105+
select
106+
region,
107+
ec2_auto_enable,
108+
ecr_auto_enable,
109+
lambda_auto_enable,
110+
lambda_code_auto_enable,
111+
case
112+
when ec2_auto_enable
113+
and ecr_auto_enable
114+
and lambda_auto_enable
115+
and lambda_code_auto_enable
116+
then 'All scan types enabled'
117+
else 'Some scan types disabled'
118+
end as scan_coverage
119+
from
120+
aws_inspector2_organization_configuration;
121+
```
122+
123+
```sql+sqlite
124+
select
125+
region,
126+
ec2_auto_enable,
127+
ecr_auto_enable,
128+
lambda_auto_enable,
129+
lambda_code_auto_enable,
130+
case
131+
when ec2_auto_enable
132+
and ecr_auto_enable
133+
and lambda_auto_enable
134+
and lambda_code_auto_enable
135+
then 'All scan types enabled'
136+
else 'Some scan types disabled'
137+
end as scan_coverage
138+
from
139+
aws_inspector2_organization_configuration;
140+
```
141+
142+
### List regions with EC2 scan auto-enablement status
143+
Focus specifically on EC2 scan configuration to understand if EC2 scans are automatically enabled for new members across regions.
144+
145+
```sql+postgres
146+
select
147+
region,
148+
ec2_auto_enable,
149+
case
150+
when ec2_auto_enable then 'EC2 scans are auto-enabled'
151+
else 'EC2 scans are not auto-enabled'
152+
end as ec2_status
153+
from
154+
aws_inspector2_organization_configuration;
155+
```
156+
157+
```sql+sqlite
158+
select
159+
region,
160+
ec2_auto_enable,
161+
case
162+
when ec2_auto_enable then 'EC2 scans are auto-enabled'
163+
else 'EC2 scans are not auto-enabled'
164+
end as ec2_status
165+
from
166+
aws_inspector2_organization_configuration;
167+
```
168+
169+
### List regions with ECR scan auto-enablement status
170+
Focus specifically on ECR scan configuration to understand if ECR scans are automatically enabled for new members across regions.
171+
172+
```sql+postgres
173+
select
174+
region,
175+
ecr_auto_enable,
176+
case
177+
when ecr_auto_enable then 'ECR scans are auto-enabled'
178+
else 'ECR scans are not auto-enabled'
179+
end as ecr_status
180+
from
181+
aws_inspector2_organization_configuration;
182+
```
183+
184+
```sql+sqlite
185+
select
186+
region,
187+
ecr_auto_enable,
188+
case
189+
when ecr_auto_enable then 'ECR scans are auto-enabled'
190+
else 'ECR scans are not auto-enabled'
191+
end as ecr_status
192+
from
193+
aws_inspector2_organization_configuration;
194+
```
195+
196+
### List regions with Lambda scan auto-enablement status
197+
Focus specifically on Lambda scan configuration to understand if Lambda scans are automatically enabled for new members across regions.
198+
199+
```sql+postgres
200+
select
201+
region,
202+
lambda_auto_enable,
203+
lambda_code_auto_enable,
204+
case
205+
when lambda_auto_enable and lambda_code_auto_enable
206+
then 'Both Lambda and Lambda Code scans are enabled'
207+
when lambda_auto_enable
208+
then 'Only Lambda scans are enabled'
209+
when lambda_code_auto_enable
210+
then 'Only Lambda Code scans are enabled'
211+
else 'No Lambda scans are enabled'
212+
end as lambda_scan_status
213+
from
214+
aws_inspector2_organization_configuration;
215+
```
216+
217+
```sql+sqlite
218+
select
219+
region,
220+
lambda_auto_enable,
221+
lambda_code_auto_enable,
222+
case
223+
when lambda_auto_enable and lambda_code_auto_enable
224+
then 'Both Lambda and Lambda Code scans are enabled'
225+
when lambda_auto_enable
226+
then 'Only Lambda scans are enabled'
227+
when lambda_code_auto_enable
228+
then 'Only Lambda Code scans are enabled'
229+
else 'No Lambda scans are enabled'
230+
end as lambda_scan_status
231+
from
232+
aws_inspector2_organization_configuration;
233+
```
234+
235+
### List complete regional organization configurations
236+
Retrieve the complete organization configuration including all auto-enable settings and account limit status for comprehensive analysis across all regions.
237+
238+
```sql+postgres
239+
select
240+
region,
241+
ec2_auto_enable,
242+
ecr_auto_enable,
243+
lambda_auto_enable,
244+
lambda_code_auto_enable,
245+
max_account_limit_reached,
246+
title
247+
from
248+
aws_inspector2_organization_configuration;
249+
```
250+
251+
```sql+sqlite
252+
select
253+
region,
254+
ec2_auto_enable,
255+
ecr_auto_enable,
256+
lambda_auto_enable,
257+
lambda_code_auto_enable,
258+
max_account_limit_reached,
259+
title
260+
from
261+
aws_inspector2_organization_configuration;
262+
```

0 commit comments

Comments
 (0)