2026/05/26 - AWS Backup - 1 new4 updated api methods
Changes Launching S3 PITR malware scanning support for AWS Backup
Returns the malware scan results for a specified point in time within a continuous (point-in-time recovery) backup.
See also: AWS API Documentation
Request Syntax
client.get_pitr_malware_scan_results(
RecoveryPointArn='string',
BackupVaultName='string',
ScanEndTime=datetime(2015, 1, 1),
MalwareScanner='GUARDDUTY'
)
string
[REQUIRED]
An ARN that uniquely identifies the target recovery point for scanning; for example, arn:aws:backup:us-east-1:123456789012:recovery-point:1EB3B5E7-9EB0-435A-A80B-108B488B0D45.
string
[REQUIRED]
The name of a logical container where backups are stored. Backup vaults are identified by names that are unique to the account used to create them and the Amazon Web Services Region where they are created.
datetime
[REQUIRED]
The point in time within the continuous backup to examine for malware scan results.
string
[REQUIRED]
The scanning engine used for the corresponding scan job. Currently only GUARDDUTY is supported.
dict
Response Syntax
{
'ScanEndTime': datetime(2015, 1, 1),
'ScanResult': {
'ScanResultStatus': 'NO_THREATS_FOUND'|'THREATS_FOUND'|'UNKNOWN'
},
'LastScanJobTime': datetime(2015, 1, 1),
'ScanId': 'string',
'ScanMode': 'FULL_SCAN'|'INCREMENTAL_SCAN'
}
Response Structure
(dict) --
ScanEndTime (datetime) --
The point in time that was queried. This echoes back the time specified in the request.
ScanResult (dict) --
Contains the ScanResultStatus for the scan and returns THREATS_FOUND, NO_THREATS_FOUND, or UNKNOWN.
ScanResultStatus (string) --
The status of the scan results.
Valid values: THREATS_FOUND | NO_THREATS_FOUND | UNKNOWN.
LastScanJobTime (datetime) --
The completion time of the most recent scan job that covered the specified point in time.
ScanId (string) --
The scan ID generated by Amazon GuardDuty for the corresponding Scan Job ID request from Backup.
ScanMode (string) --
Specifies the scan type used for the scan job.
{'ContinuousScanEndTime': 'timestamp',
'ContinuousScanStartTime': 'timestamp',
'ScanResult': {'ScanResultStatus': {'UNKNOWN'}}}
Returns scan job details for the specified ScanJobID.
See also: AWS API Documentation
Request Syntax
client.describe_scan_job(
ScanJobId='string'
)
string
[REQUIRED]
Uniquely identifies a request to Backup to scan a resource.
dict
Response Syntax
{
'AccountId': 'string',
'BackupVaultArn': 'string',
'BackupVaultName': 'string',
'CompletionDate': datetime(2015, 1, 1),
'ContinuousScanEndTime': datetime(2015, 1, 1),
'ContinuousScanStartTime': datetime(2015, 1, 1),
'CreatedBy': {
'BackupPlanArn': 'string',
'BackupPlanId': 'string',
'BackupPlanVersion': 'string',
'BackupRuleId': 'string'
},
'CreationDate': datetime(2015, 1, 1),
'IamRoleArn': 'string',
'MalwareScanner': 'GUARDDUTY',
'RecoveryPointArn': 'string',
'ResourceArn': 'string',
'ResourceName': 'string',
'ResourceType': 'EBS'|'EC2'|'S3',
'ScanBaseRecoveryPointArn': 'string',
'ScanId': 'string',
'ScanJobId': 'string',
'ScanMode': 'FULL_SCAN'|'INCREMENTAL_SCAN',
'ScanResult': {
'ScanResultStatus': 'NO_THREATS_FOUND'|'THREATS_FOUND'|'UNKNOWN'
},
'ScannerRoleArn': 'string',
'State': 'CANCELED'|'COMPLETED'|'COMPLETED_WITH_ISSUES'|'CREATED'|'FAILED'|'RUNNING',
'StatusMessage': 'string'
}
Response Structure
(dict) --
AccountId (string) --
Returns the account ID that owns the scan job.
Pattern: ^[0-9]{12}$
BackupVaultArn (string) --
An Amazon Resource Name (ARN) that uniquely identifies a backup vault; for example, arn:aws:backup:us-east-1:123456789012:backup-vault:aBackupVault
BackupVaultName (string) --
The name of a logical container where backups are stored. Backup vaults are identified by names that are unique to the account used to create them and the Amazon Web Services Region where they are created.
Pattern: ^[a-zA-Z0-9\-\_\.]{2,50}$
CompletionDate (datetime) --
The date and time that a backup index finished creation, in Unix format and Coordinated Universal Time (UTC). The value of CompletionDate is accurate to milliseconds. For example, the value 1516925490.087 represents Friday, January 26, 2018 12:11:30.087 AM.
ContinuousScanEndTime (datetime) --
The point in time the scan job scanned up to for a continuous backup.
ContinuousScanStartTime (datetime) --
The point in time the scan job started scan from for a continuous backup.
CreatedBy (dict) --
Contains identifying information about the creation of a scan job, including the backup plan and rule that initiated the scan.
BackupPlanArn (string) --
An Amazon Resource Name (ARN) that uniquely identifies a backup plan; for example, arn:aws:backup:us-east-1:123456789012:plan:8F81F553-3A74-4A3F-B93D-B3360DC80C50.
BackupPlanId (string) --
The ID of the backup plan.
BackupPlanVersion (string) --
Unique, randomly generated, Unicode, UTF-8 encoded strings that are at most 1,024 bytes long. Version IDs cannot be edited.
BackupRuleId (string) --
Uniquely identifies the backup rule that initiated the scan job.
CreationDate (datetime) --
The date and time that a backup index finished creation, in Unix format and Coordinated Universal Time (UTC). The value of CreationDate is accurate to milliseconds. For example, the value 1516925490.087 represents Friday, January 26, 2018 12:11:30.087 AM.
IamRoleArn (string) --
An Amazon Resource Name (ARN) that uniquely identifies a backup vault; for example, arn:aws:iam::123456789012:role/S3Access.
MalwareScanner (string) --
The scanning engine used for the corresponding scan job. Currently only GUARDUTY is supported.
RecoveryPointArn (string) --
An ARN that uniquely identifies the target recovery point for scanning.; for example, arn:aws:backup:us-east-1:123456789012:recovery-point:1EB3B5E7-9EB0-435A-A80B-108B488B0D45.
ResourceArn (string) --
An ARN that uniquely identifies the source resource of the corresponding recovery point ARN.
ResourceName (string) --
The non-unique name of the resource that belongs to the specified backup.
ResourceType (string) --
The type of Amazon Web Services Resource to be backed up; for example, an Amazon Elastic Block Store (Amazon EBS) volume.
Pattern: ^[a-zA-Z0-9\-\_\.]{1,50}$
ScanBaseRecoveryPointArn (string) --
An ARN that uniquely identifies the base recovery point for scanning. This field will only be populated when an incremental scan job has taken place.
ScanId (string) --
The scan ID generated by Amazon GuardDuty for the corresponding Scan Job ID request from Backup.
ScanJobId (string) --
The scan job ID that uniquely identified the request to Backup.
ScanMode (string) --
Specifies the scan type used for the scan job.
ScanResult (dict) --
Contains the ScanResultsStatus for the scanning job and returns THREATS_FOUND or NO_THREATS_FOUND for completed jobs.
ScanResultStatus (string) --
The status of the scan results.
Valid values: THREATS_FOUND | NO_THREATS_FOUND | UNKNOWN.
ScannerRoleArn (string) --
Specifies the scanner IAM role ARN used to for the scan job.
State (string) --
The current state of a scan job.
StatusMessage (string) --
A detailed message explaining the status of the job to back up a resource.
{'ScanResultStatus': {'UNKNOWN'}}
Response {'ScanJobSummaries': {'ScanResultStatus': {'UNKNOWN'}}}
This is a request for a summary of scan jobs created or running within the most recent 30 days.
See also: AWS API Documentation
Request Syntax
client.list_scan_job_summaries(
AccountId='string',
ResourceType='string',
MalwareScanner='GUARDDUTY',
ScanResultStatus='NO_THREATS_FOUND'|'THREATS_FOUND'|'UNKNOWN',
State='CREATED'|'COMPLETED'|'COMPLETED_WITH_ISSUES'|'RUNNING'|'FAILED'|'CANCELED'|'AGGREGATE_ALL'|'ANY',
AggregationPeriod='ONE_DAY'|'SEVEN_DAYS'|'FOURTEEN_DAYS',
MaxResults=123,
NextToken='string'
)
string
Returns the job count for the specified account.
If the request is sent from a member account or an account not part of Amazon Web Services Organizations, jobs within requestor's account will be returned.
Root, admin, and delegated administrator accounts can use the value ANY to return job counts from every account in the organization.
AGGREGATE_ALL aggregates job counts from all accounts within the authenticated organization, then returns the sum.
string
Returns the job count for the specified resource type. Use request GetSupportedResourceTypes to obtain strings for supported resource types.
The the value ANY returns count of all resource types.
AGGREGATE_ALL aggregates job counts for all resource types and returns the sum.
string
Returns only the scan jobs for the specified malware scanner. Currently the only MalwareScanner is GUARDDUTY. But the field also supports ANY, and AGGREGATE_ALL.
string
Returns only the scan jobs for the specified scan results.
string
Returns only the scan jobs for the specified scanning job state.
string
The period for the returned results.
``ONE_DAY``The daily job count for the prior 1 day.
``SEVEN_DAYS``The daily job count for the prior 7 days.
``FOURTEEN_DAYS``The daily job count for the prior 14 days.
integer
The maximum number of items to be returned.
The value is an integer. Range of accepted values is from 1 to 500.
string
The next item following a partial list of returned items. For example, if a request is made to return MaxResults number of items, NextToken allows you to return more items in your list starting at the location pointed to by the next token.
dict
Response Syntax
{
'ScanJobSummaries': [
{
'Region': 'string',
'AccountId': 'string',
'State': 'CREATED'|'COMPLETED'|'COMPLETED_WITH_ISSUES'|'RUNNING'|'FAILED'|'CANCELED'|'AGGREGATE_ALL'|'ANY',
'ResourceType': 'string',
'Count': 123,
'StartTime': datetime(2015, 1, 1),
'EndTime': datetime(2015, 1, 1),
'MalwareScanner': 'GUARDDUTY',
'ScanResultStatus': 'NO_THREATS_FOUND'|'THREATS_FOUND'|'UNKNOWN'
},
],
'AggregationPeriod': 'string',
'NextToken': 'string'
}
Response Structure
(dict) --
ScanJobSummaries (list) --
The summary information.
(dict) --
Contains summary information about scan jobs, including counts and metadata for a specific time period and criteria.
Region (string) --
The Amazon Web Services Region where the scan jobs were executed.
AccountId (string) --
The account ID that owns the scan jobs included in this summary.
State (string) --
The state of the scan jobs included in this summary.
Valid values: CREATED | RUNNING | COMPLETED | COMPLETED_WITH_ISSUES | FAILED | CANCELED.
ResourceType (string) --
The type of Amazon Web Services resource for the scan jobs included in this summary.
Count (integer) --
The number of scan jobs that match the specified criteria.
StartTime (datetime) --
The value of time in number format of a job start time.
This value is the time in Unix format, Coordinated Universal Time (UTC), and accurate to milliseconds. For example, the value 1516925490.087 represents Friday, January 26, 2018 12:11:30.087 AM.
EndTime (datetime) --
The value of time in number format of a job end time.
This value is the time in Unix format, Coordinated Universal Time (UTC), and accurate to milliseconds. For example, the value 1516925490.087 represents Friday, January 26, 2018 12:11:30.087 AM.
MalwareScanner (string) --
Specifies the malware scanner used during the scan job. Currently only supports GUARDDUTY.
ScanResultStatus (string) --
The scan result status for the scan jobs included in this summary.
Valid values: THREATS_FOUND | NO_THREATS_FOUND.
AggregationPeriod (string) --
The period for the returned results.
``ONE_DAY``The daily job count for the prior 1 day.
``SEVEN_DAYS``The daily job count for the prior 7 days.
``FOURTEEN_DAYS``The daily job count for the prior 14 days.
Valid Values: 'ONE_DAY' | 'SEVEN_DAYS' | 'FOURTEEN_DAYS'
NextToken (string) --
The next item following a partial list of returned items. For example, if a request is made to return MaxResults number of items, NextToken allows you to return more items in your list starting at the location pointed to by the next token.
{'ByScanResultStatus': {'UNKNOWN'}}
Response {'ScanJobs': {'ContinuousScanEndTime': 'timestamp',
'ContinuousScanStartTime': 'timestamp',
'ScanResult': {'ScanResultStatus': {'UNKNOWN'}}}}
Returns a list of existing scan jobs for an authenticated account for the last 30 days.
See also: AWS API Documentation
Request Syntax
client.list_scan_jobs(
ByAccountId='string',
ByBackupVaultName='string',
ByCompleteAfter=datetime(2015, 1, 1),
ByCompleteBefore=datetime(2015, 1, 1),
ByMalwareScanner='GUARDDUTY',
ByRecoveryPointArn='string',
ByResourceArn='string',
ByResourceType='EBS'|'EC2'|'S3',
ByScanResultStatus='NO_THREATS_FOUND'|'THREATS_FOUND'|'UNKNOWN',
ByState='CANCELED'|'COMPLETED'|'COMPLETED_WITH_ISSUES'|'CREATED'|'FAILED'|'RUNNING',
MaxResults=123,
NextToken='string'
)
string
The account ID to list the jobs from. Returns only backup jobs associated with the specified account ID.
If used from an Amazon Web Services Organizations management account, passing * returns all jobs across the organization.
Pattern: ^[0-9]{12}$
string
Returns only scan jobs that will be stored in the specified backup vault. Backup vaults are identified by names that are unique to the account used to create them and the Amazon Web Services Region where they are created.
Pattern: ^[a-zA-Z0-9\-\_\.]{2,50}$
datetime
Returns only scan jobs completed after a date expressed in Unix format and Coordinated Universal Time (UTC).
datetime
Returns only backup jobs completed before a date expressed in Unix format and Coordinated Universal Time (UTC).
string
Returns only the scan jobs for the specified malware scanner. Currently only supports GUARDDUTY.
string
Returns only the scan jobs that are ran against the specified recovery point.
string
Returns only scan jobs that match the specified resource Amazon Resource Name (ARN).
string
Returns restore testing selections by the specified restore testing plan name.
``EBS``for Amazon Elastic Block Store
``EC2``for Amazon Elastic Compute Cloud
``S3``for Amazon Simple Storage Service (Amazon S3)
Pattern: ^[a-zA-Z0-9\-\_\.]{1,50}$
string
Returns only the scan jobs for the specified scan results:
THREATS_FOUND
NO_THREATS_FOUND
string
Returns only the scan jobs for the specified scanning job state.
integer
The maximum number of items to be returned.
Valid Range: Minimum value of 1. Maximum value of 1000.
string
The next item following a partial list of returned items. For example, if a request is made to return MaxResults number of items, NextToken allows you to return more items in your list starting at the location pointed to by the next token.
dict
Response Syntax
{
'NextToken': 'string',
'ScanJobs': [
{
'AccountId': 'string',
'BackupVaultArn': 'string',
'BackupVaultName': 'string',
'CompletionDate': datetime(2015, 1, 1),
'ContinuousScanEndTime': datetime(2015, 1, 1),
'ContinuousScanStartTime': datetime(2015, 1, 1),
'CreatedBy': {
'BackupPlanArn': 'string',
'BackupPlanId': 'string',
'BackupPlanVersion': 'string',
'BackupRuleId': 'string'
},
'CreationDate': datetime(2015, 1, 1),
'IamRoleArn': 'string',
'MalwareScanner': 'GUARDDUTY',
'RecoveryPointArn': 'string',
'ResourceArn': 'string',
'ResourceName': 'string',
'ResourceType': 'EBS'|'EC2'|'S3',
'ScanBaseRecoveryPointArn': 'string',
'ScanId': 'string',
'ScanJobId': 'string',
'ScanMode': 'FULL_SCAN'|'INCREMENTAL_SCAN',
'ScanResult': {
'ScanResultStatus': 'NO_THREATS_FOUND'|'THREATS_FOUND'|'UNKNOWN'
},
'ScannerRoleArn': 'string',
'State': 'CANCELED'|'COMPLETED'|'COMPLETED_WITH_ISSUES'|'CREATED'|'FAILED'|'RUNNING',
'StatusMessage': 'string'
},
]
}
Response Structure
(dict) --
NextToken (string) --
The next item following a partial list of returned items. For example, if a request is made to return MaxResults number of items, NextToken allows you to return more items in your list starting at the location pointed to by the next token.
ScanJobs (list) --
An array of structures containing metadata about your scan jobs returned in JSON format.
(dict) --
Contains metadata about a scan job, including information about the scanning process, results, and associated resources.
AccountId (string) --
The account ID that owns the scan job.
BackupVaultArn (string) --
An Amazon Resource Name (ARN) that uniquely identifies a backup vault; for example, arn:aws:backup:us-east-1:123456789012:backup-vault:aBackupVault.
BackupVaultName (string) --
The name of a logical container where backups are stored. Backup vaults are identified by names that are unique to the account used to create them and the Amazon Web Services Region where they are created.
CompletionDate (datetime) --
The date and time that a scan job is completed, in Unix format and Coordinated Universal Time (UTC). The value of CompletionDate is accurate to milliseconds. For example, the value 1516925490.087 represents Friday, January 26, 2018 12:11:30.087 AM.
ContinuousScanEndTime (datetime) --
The point in time the scan job scanned up to for a continuous backup.
ContinuousScanStartTime (datetime) --
The point in time the scan job started scan from for a continuous backup.
CreatedBy (dict) --
Contains identifying information about the creation of a scan job.
BackupPlanArn (string) --
An Amazon Resource Name (ARN) that uniquely identifies a backup plan; for example, arn:aws:backup:us-east-1:123456789012:plan:8F81F553-3A74-4A3F-B93D-B3360DC80C50.
BackupPlanId (string) --
The ID of the backup plan.
BackupPlanVersion (string) --
Unique, randomly generated, Unicode, UTF-8 encoded strings that are at most 1,024 bytes long. Version IDs cannot be edited.
BackupRuleId (string) --
Uniquely identifies the backup rule that initiated the scan job.
CreationDate (datetime) --
The date and time that a scan job is created, in Unix format and Coordinated Universal Time (UTC). The value of CreationDate is accurate to milliseconds. For example, the value 1516925490.087 represents Friday, January 26, 2018 12:11:30.087 AM.
IamRoleArn (string) --
Specifies the IAM role ARN used to create the scan job; for example, arn:aws:iam::123456789012:role/S3Access.
MalwareScanner (string) --
The scanning engine used for the scan job. Currently only GUARDDUTY is supported.
RecoveryPointArn (string) --
An ARN that uniquely identifies the recovery point being scanned; for example, arn:aws:backup:us-east-1:123456789012:recovery-point:1EB3B5E7-9EB0-435A-A80B-108B488B0D45.
ResourceArn (string) --
An ARN that uniquely identifies the source resource of the recovery point being scanned.
ResourceName (string) --
The non-unique name of the resource that belongs to the specified backup.
ResourceType (string) --
The type of Amazon Web Services resource being scanned; for example, an Amazon Elastic Block Store (Amazon EBS) volume or an Amazon Relational Database Service (Amazon RDS) database.
ScanBaseRecoveryPointArn (string) --
An ARN that uniquely identifies the base recovery point for scanning. This field is populated when an incremental scan job has taken place.
ScanId (string) --
The scan ID generated by the malware scanner for the corresponding scan job.
ScanJobId (string) --
The unique identifier that identifies the scan job request to Backup.
ScanMode (string) --
Specifies the scan type use for the scan job.
Includes:
FULL_SCAN will scan the entire data lineage within the backup.
INCREMENTAL_SCAN will scan the data difference between the target recovery point and base recovery point ARN.
ScanResult (dict) --
Contains the scan results information, including the status of threats found during scanning.
ScanResultStatus (string) --
The status of the scan results.
Valid values: THREATS_FOUND | NO_THREATS_FOUND | UNKNOWN.
ScannerRoleArn (string) --
Specifies the scanner IAM role ARN used for the scan job.
State (string) --
The current state of the scan job.
Valid values: CREATED | RUNNING | COMPLETED | COMPLETED_WITH_ISSUES | FAILED | CANCELED.
StatusMessage (string) --
A detailed message explaining the status of the scan job.
{'ContinuousScanEndTime': 'timestamp'}
Starts scanning jobs for specific resources.
See also: AWS API Documentation
Request Syntax
client.start_scan_job(
BackupVaultName='string',
ContinuousScanEndTime=datetime(2015, 1, 1),
IamRoleArn='string',
IdempotencyToken='string',
MalwareScanner='GUARDDUTY',
RecoveryPointArn='string',
ScanBaseRecoveryPointArn='string',
ScanMode='FULL_SCAN'|'INCREMENTAL_SCAN',
ScannerRoleArn='string'
)
string
[REQUIRED]
The name of a logical container where backups are stored. Backup vaults are identified by names that are unique to the account used to create them and the Amazon Web Services Region where they are created.
Pattern: ^[a-zA-Z0-9\-\_]{2,50}$
datetime
The point in time the scan job will scan up to for a continuous backup.
string
[REQUIRED]
Specifies the IAM role ARN used to create the target recovery point; for example, arn:aws:iam::123456789012:role/S3Access.
string
A customer-chosen string that you can use to distinguish between otherwise identical calls to StartScanJob. Retrying a successful request with the same idempotency token results in a success message with no action taken.
string
[REQUIRED]
Specifies the malware scanner used during the scan job. Currently only supports GUARDDUTY.
string
[REQUIRED]
An Amazon Resource Name (ARN) that uniquely identifies a recovery point. This is your target recovery point for a full scan. If you are running an incremental scan, this will be your a recovery point which has been created after your base recovery point selection.
string
An ARN that uniquely identifies the base recovery point to be used for incremental scanning.
string
[REQUIRED]
Specifies the scan type use for the scan job.
Includes:
FULL_SCAN will scan the entire data lineage within the backup.
INCREMENTAL_SCAN will scan the data difference between the target recovery point and base recovery point ARN.
string
[REQUIRED]
Specified the IAM scanner role ARN.
dict
Response Syntax
{
'CreationDate': datetime(2015, 1, 1),
'ScanJobId': 'string'
}
Response Structure
(dict) --
CreationDate (datetime) --
The date and time that a backup job is created, in Unix format and Coordinated Universal Time (UTC). The value of CreationDate is accurate to milliseconds. For example, the value 1516925490.087 represents Friday, January 26, 2018 12:11:30.087 AM.
ScanJobId (string) --
Uniquely identifies a request to Backup to back up a resource.