AWS API Changes

2023/09/22 - Amazon GuardDuty - 2 updated api methods

Changes Add `EKS_CLUSTER_NAME` to filter and sort key.

GetCoverageStatistics (updated)

Link ¶
Changes (request)

{'FilterCriteria': {'FilterCriterion': {'CriterionKey': {'EKS_CLUSTER_NAME'}}}}

Retrieves aggregated statistics for your account. If you are a GuardDuty administrator, you can retrieve the statistics for all the resources associated with the active member accounts in your organization who have enabled EKS Runtime Monitoring and have the GuardDuty agent running on their EKS nodes.

See also: AWS API Documentation

Request Syntax

client.get_coverage_statistics(
    DetectorId='string',
    FilterCriteria={
        'FilterCriterion': [
            {
                'CriterionKey': 'ACCOUNT_ID'|'CLUSTER_NAME'|'RESOURCE_TYPE'|'COVERAGE_STATUS'|'ADDON_VERSION'|'MANAGEMENT_TYPE'|'EKS_CLUSTER_NAME',
                'FilterCondition': {
                    'Equals': [
                        'string',
                    ],
                    'NotEquals': [
                        'string',
                    ]
                }
            },
        ]
    },
    StatisticsType=[
        'COUNT_BY_RESOURCE_TYPE'|'COUNT_BY_COVERAGE_STATUS',
    ]
)

type DetectorId

string

param DetectorId

[REQUIRED]

The unique ID of the GuardDuty detector associated to the coverage statistics.

type FilterCriteria

dict

param FilterCriteria

Represents the criteria used to filter the coverage statistics

FilterCriterion (list) --

Represents a condition that when matched will be added to the response of the operation.
- (dict) --
  
  Represents a condition that when matched will be added to the response of the operation.
  - CriterionKey (string) --
    
    An enum value representing possible filter fields.
    
    Note
    
    Replace the enum value CLUSTER_NAME with EKS_CLUSTER_NAME . CLUSTER_NAME has been deprecated.
  - FilterCondition (dict) --
    
    Contains information about the condition.
    - Equals (list) --
      
      Represents an equal condition that is applied to a single field while retrieving the coverage details.
      - (string) --
    - NotEquals (list) --
      
      Represents a not equal condition that is applied to a single field while retrieving the coverage details.
      - (string) --

type StatisticsType

list

param StatisticsType

[REQUIRED]

Represents the statistics type used to aggregate the coverage details.

(string) --

rtype

dict

returns

Response Syntax

{
    'CoverageStatistics': {
        'CountByResourceType': {
            'string': 123
        },
        'CountByCoverageStatus': {
            'string': 123
        }
    }
}

Response Structure

(dict) --
- CoverageStatistics (dict) --
  
  Represents the count aggregated by the statusCode and resourceType .
  - CountByResourceType (dict) --
    
    Represents coverage statistics for EKS clusters aggregated by resource type.
    - (string) --
      - (integer) --
  - CountByCoverageStatus (dict) --
    
    Represents coverage statistics for EKS clusters aggregated by coverage status.
    - (string) --
      - (integer) --

ListCoverage (updated)

Link ¶
Changes (request)

{'FilterCriteria': {'FilterCriterion': {'CriterionKey': {'EKS_CLUSTER_NAME'}}},
 'SortCriteria': {'AttributeName': {'EKS_CLUSTER_NAME'}}}

Lists coverage details for your GuardDuty account. If you're a GuardDuty administrator, you can retrieve all resources associated with the active member accounts in your organization.

Make sure the accounts have EKS Runtime Monitoring enabled and GuardDuty agent running on their EKS nodes.

See also: AWS API Documentation

Request Syntax

client.list_coverage(
    DetectorId='string',
    NextToken='string',
    MaxResults=123,
    FilterCriteria={
        'FilterCriterion': [
            {
                'CriterionKey': 'ACCOUNT_ID'|'CLUSTER_NAME'|'RESOURCE_TYPE'|'COVERAGE_STATUS'|'ADDON_VERSION'|'MANAGEMENT_TYPE'|'EKS_CLUSTER_NAME',
                'FilterCondition': {
                    'Equals': [
                        'string',
                    ],
                    'NotEquals': [
                        'string',
                    ]
                }
            },
        ]
    },
    SortCriteria={
        'AttributeName': 'ACCOUNT_ID'|'CLUSTER_NAME'|'COVERAGE_STATUS'|'ISSUE'|'ADDON_VERSION'|'UPDATED_AT'|'EKS_CLUSTER_NAME',
        'OrderBy': 'ASC'|'DESC'
    }
)

type DetectorId

string

param DetectorId

[REQUIRED]

The unique ID of the detector whose coverage details you want to retrieve.

type NextToken

string

param NextToken

A token to use for paginating results that are returned in the response. Set the value of this parameter to null for the first request to a list action. For subsequent calls, use the NextToken value returned from the previous request to continue listing results after the first page.

type MaxResults

integer

param MaxResults

The maximum number of results to return in the response.

type FilterCriteria

dict

param FilterCriteria

Represents the criteria used to filter the coverage details.

FilterCriterion (list) --

Represents a condition that when matched will be added to the response of the operation.
- (dict) --
  
  Represents a condition that when matched will be added to the response of the operation.
  - CriterionKey (string) --
    
    An enum value representing possible filter fields.
    
    Note
    
    Replace the enum value CLUSTER_NAME with EKS_CLUSTER_NAME . CLUSTER_NAME has been deprecated.
  - FilterCondition (dict) --
    
    Contains information about the condition.
    - Equals (list) --
      
      Represents an equal condition that is applied to a single field while retrieving the coverage details.
      - (string) --
    - NotEquals (list) --
      
      Represents a not equal condition that is applied to a single field while retrieving the coverage details.
      - (string) --

type SortCriteria

dict

param SortCriteria

Represents the criteria used to sort the coverage details.

AttributeName (string) --

Represents the field name used to sort the coverage details.

Note

Replace the enum value CLUSTER_NAME with EKS_CLUSTER_NAME . CLUSTER_NAME has been deprecated.
OrderBy (string) --

The order in which the sorted findings are to be displayed.

rtype

dict

returns

Response Syntax

{
    'Resources': [
        {
            'ResourceId': 'string',
            'DetectorId': 'string',
            'AccountId': 'string',
            'ResourceDetails': {
                'EksClusterDetails': {
                    'ClusterName': 'string',
                    'CoveredNodes': 123,
                    'CompatibleNodes': 123,
                    'AddonDetails': {
                        'AddonVersion': 'string',
                        'AddonStatus': 'string'
                    },
                    'ManagementType': 'AUTO_MANAGED'|'MANUAL'
                },
                'ResourceType': 'EKS'
            },
            'CoverageStatus': 'HEALTHY'|'UNHEALTHY',
            'Issue': 'string',
            'UpdatedAt': datetime(2015, 1, 1)
        },
    ],
    'NextToken': 'string'
}

Response Structure

(dict) --
- Resources (list) --
  
  A list of resources and their attributes providing cluster details.
  - (dict) --
    
    Information about the resource of the GuardDuty account.
    - ResourceId (string) --
      
      The unique ID of the resource.
    - DetectorId (string) --
      
      The unique ID of the GuardDuty detector associated with the resource.
    - AccountId (string) --
      
      The unique ID of the Amazon Web Services account.
    - ResourceDetails (dict) --
      
      Information about the resource for which the coverage statistics are retrieved.
      - EksClusterDetails (dict) --
        
        EKS cluster details involved in the coverage statistics.
        
        ClusterName (string) --
        
        Name of the EKS cluster.
        
        CoveredNodes (integer) --
        
        Represents the nodes within the EKS cluster that have a HEALTHY coverage status.
        
        CompatibleNodes (integer) --
        
        Represents all the nodes within the EKS cluster in your account.
        
        AddonDetails (dict) --
        
        Information about the installed EKS add-on.
        
        AddonVersion (string) --
        
        Version of the installed EKS add-on.
        
        AddonStatus (string) --
        
        Status of the installed EKS add-on.
        
        ManagementType (string) --
        
        Indicates how the Amazon EKS add-on GuardDuty agent is managed for this EKS cluster.
        
        AUTO_MANAGED indicates GuardDuty deploys and manages updates for this resource.
        
        MANUAL indicates that you are responsible to deploy, update, and manage the Amazon EKS add-on GuardDuty agent for this resource.
      - ResourceType (string) --
        
        The type of Amazon Web Services resource.
    - CoverageStatus (string) --
      
      Represents the status of the EKS cluster coverage.
    - Issue (string) --
      
      Represents the reason why a coverage status was UNHEALTHY for the EKS cluster.
    - UpdatedAt (datetime) --
      
      The timestamp at which the coverage details for the resource were last updated. This is in UTC format.
- NextToken (string) --
  
  The pagination parameter to be used on the next list operation to retrieve more items.