AWS API Changes

2025/02/25 - AWS IoT - 2 updated api methods

Changes AWS IoT - AWS IoT Device Defender adds support for a new Device Defender Audit Check that monitors device certificate age and custom threshold configurations for both the new device certificate age check and existing device certificate expiry check.

DescribeAccountAuditConfiguration (updated)

Link ¶
Changes (response)

{'auditCheckConfigurations': {'configuration': {'CERT_AGE_THRESHOLD_IN_DAYS | CERT_EXPIRATION_THRESHOLD_IN_DAYS': 'string'}}}

Gets information about the Device Defender audit settings for this account. Settings include how audit notifications are sent and which audit checks are enabled or disabled.

Requires permission to access the DescribeAccountAuditConfiguration action.

See also: AWS API Documentation

Request Syntax

client.describe_account_audit_configuration()

rtype:

dict

returns:

Response Syntax

{
    'roleArn': 'string',
    'auditNotificationTargetConfigurations': {
        'string': {
            'targetArn': 'string',
            'roleArn': 'string',
            'enabled': True|False
        }
    },
    'auditCheckConfigurations': {
        'string': {
            'enabled': True|False,
            'configuration': {
                'string': 'string'
            }
        }
    }
}

Response Structure

(dict) --
- roleArn (string) --
  
  The ARN of the role that grants permission to IoT to access information about your devices, policies, certificates, and other items as required when performing an audit.
  
  On the first call to UpdateAccountAuditConfiguration, this parameter is required.
- auditNotificationTargetConfigurations (dict) --
  
  Information about the targets to which audit notifications are sent for this account.
  - (string) --
    - (dict) --
      
      Information about the targets to which audit notifications are sent.
      - targetArn (string) --
        
        The ARN of the target (SNS topic) to which audit notifications are sent.
      - roleArn (string) --
        
        The ARN of the role that grants permission to send notifications to the target.
      - enabled (boolean) --
        
        True if notifications to the target are enabled.
- auditCheckConfigurations (dict) --
  
  Which audit checks are enabled and disabled for this account.
  - (string) --
    
    An audit check name. Checks must be enabled for your account. (Use DescribeAccountAuditConfiguration to see the list of all checks, including those that are enabled or use UpdateAccountAuditConfiguration to select which checks are enabled.)
    - (dict) --
      
      Which audit checks are enabled and disabled for this account.
      - enabled (boolean) --
        
        True if this audit check is enabled for this account.
      - configuration (dict) --
        
        A structure containing the configName and corresponding configValue for configuring audit checks.
        
        (string) --
        
        (string) --

UpdateAccountAuditConfiguration (updated)

Link ¶
Changes (request)

{'auditCheckConfigurations': {'configuration': {'CERT_AGE_THRESHOLD_IN_DAYS | CERT_EXPIRATION_THRESHOLD_IN_DAYS': 'string'}}}

Configures or reconfigures the Device Defender audit settings for this account. Settings include how audit notifications are sent and which audit checks are enabled or disabled.

Requires permission to access the UpdateAccountAuditConfiguration action.

See also: AWS API Documentation

Request Syntax

client.update_account_audit_configuration(
    roleArn='string',
    auditNotificationTargetConfigurations={
        'string': {
            'targetArn': 'string',
            'roleArn': 'string',
            'enabled': True|False
        }
    },
    auditCheckConfigurations={
        'string': {
            'enabled': True|False,
            'configuration': {
                'string': 'string'
            }
        }
    }
)

type roleArn:

string

param roleArn:

The Amazon Resource Name (ARN) of the role that grants permission to IoT to access information about your devices, policies, certificates, and other items as required when performing an audit.

type auditNotificationTargetConfigurations:

dict

param auditNotificationTargetConfigurations:

Information about the targets to which audit notifications are sent.

(string) --
- (dict) --
  
  Information about the targets to which audit notifications are sent.
  - targetArn (string) --
    
    The ARN of the target (SNS topic) to which audit notifications are sent.
  - roleArn (string) --
    
    The ARN of the role that grants permission to send notifications to the target.
  - enabled (boolean) --
    
    True if notifications to the target are enabled.

type auditCheckConfigurations:

dict

param auditCheckConfigurations:

Specifies which audit checks are enabled and disabled for this account. Use DescribeAccountAuditConfiguration to see the list of all checks, including those that are currently enabled.

Some data collection might start immediately when certain checks are enabled. When a check is disabled, any data collected so far in relation to the check is deleted.

You cannot disable a check if it's used by any scheduled audit. You must first delete the check from the scheduled audit or delete the scheduled audit itself.

On the first call to UpdateAccountAuditConfiguration, this parameter is required and must specify at least one enabled check.

(string) --

An audit check name. Checks must be enabled for your account. (Use DescribeAccountAuditConfiguration to see the list of all checks, including those that are enabled or use UpdateAccountAuditConfiguration to select which checks are enabled.)
- (dict) --
  
  Which audit checks are enabled and disabled for this account.
  - enabled (boolean) --
    
    True if this audit check is enabled for this account.
  - configuration (dict) --
    
    A structure containing the configName and corresponding configValue for configuring audit checks.
    - (string) --
      - (string) --

rtype:

dict

returns:

Response Syntax

{}

Response Structure

(dict) --