AWS cli documentation change
Summary
Updated AWS CLI version from 2.34.32 to 2.34.34 and significantly expanded the documentation for the FindingCriteria parameter by adding a comprehensive list of available fields for filtering GuardDuty findings across multiple resource types and service actions.
Security assessment
This change enhances documentation for GuardDuty's filtering capabilities by providing a detailed list of filterable fields across various AWS resources and security events. While this improves security monitoring capabilities by enabling more granular filtering of security findings, there is no evidence in the diff that this change addresses a specific security vulnerability or incident. The change appears to be a routine documentation update to reflect expanded filtering capabilities.
Diff
diff --git a/cli/latest/reference/guardduty/create-filter.md b/cli/latest/reference/guardduty/create-filter.md index f3a8f1593..31d6b00b9 100644 --- a//cli/latest/reference/guardduty/create-filter.md +++ b//cli/latest/reference/guardduty/create-filter.md @@ -15 +15 @@ - * [AWS CLI 2.34.32 Command Reference](../../index.html) » + * [AWS CLI 2.34.34 Command Reference](../../index.html) » @@ -139,0 +140,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd +> Default: NOOP +> @@ -167,3 +169 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd -> Represents the criteria to be used in the filter for querying findings. -> -> You can only use the following attributes to query findings: +> Represents the criteria to be used in the filter for querying findings. The following fields are available for filtering: @@ -171,0 +172,5 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd +> * arn +> * associatedAttackSequenceArn +> * confidence +> * createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 +> * description @@ -172,0 +178 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd +> * partition @@ -174,12 +179,0 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd -> * severity To filter on the basis of severity, the API and CLI use the following input list for the [FindingCriteria](https://docs.aws.amazon.com/guardduty/latest/APIReference/API_FindingCriteria.html) condition: -> * **Low** : `["1", "2", "3"]` -> * **Medium** : `["4", "5", "6"]` -> * **High** : `["7", "8"]` -> * **Critical** : `["9", "10"]` -> - -> -> For more information, see [Findings severity levels](https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings-severity.html) in the _Amazon GuardDuty User Guide_ . -> -> * type -> * updatedAt Type: ISO 8601 string format: YYYY-MM-DDTHH:MM:SS.SSSZ or YYYY-MM-DDTHH:MM:SSZ depending on whether the value contains milliseconds. @@ -187,0 +182,17 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd +> * resource.accessKeyDetails.userIdentity.accessKeyId +> * resource.accessKeyDetails.userIdentity.accountId +> * resource.accessKeyDetails.userIdentity.arn +> * resource.accessKeyDetails.userIdentity.principalId +> * resource.accessKeyDetails.userIdentity.sessionContext.attributes.mfaAuthenticated +> * resource.accessKeyDetails.userIdentity.sessionContext.ec2RoleDelivery +> * resource.accessKeyDetails.userIdentity.sessionContext.invokedBy +> * resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.accountId +> * resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.arn +> * resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.principalId +> * resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.type +> * resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.userName +> * resource.accessKeyDetails.userIdentity.sessionContext.sourceIdentity +> * resource.accessKeyDetails.userIdentity.sessionContext.webIdFederationData.attributes +> * resource.accessKeyDetails.userIdentity.sessionContext.webIdFederationData.federatedProvider +> * resource.accessKeyDetails.userIdentity.type +> * resource.accessKeyDetails.userIdentity.userName @@ -189,0 +201,65 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd +> * resource.bedrockGuardrailDetails.guardrailArn +> * resource.bedrockGuardrailDetails.guardrailVersion +> * resource.containerDetails.containerRuntime +> * resource.containerDetails.id +> * resource.containerDetails.image +> * resource.containerDetails.imagePrefix +> * resource.containerDetails.name +> * resource.containerDetails.securityContext.allowPrivilegeEscalation +> * resource.containerDetails.securityContext.privileged +> * resource.containerDetails.volumeMounts.mountPath +> * resource.containerDetails.volumeMounts.name +> * resource.ebsSnapshotDetails.snapshotArn +> * resource.ebsVolumeDetails.scannedVolumeDetails.deviceName +> * resource.ebsVolumeDetails.scannedVolumeDetails.encryptionType +> * resource.ebsVolumeDetails.scannedVolumeDetails.kmsKeyArn +> * resource.ebsVolumeDetails.scannedVolumeDetails.snapshotArn +> * resource.ebsVolumeDetails.scannedVolumeDetails.volumeArn +> * resource.ebsVolumeDetails.scannedVolumeDetails.volumeSizeInGB +> * resource.ebsVolumeDetails.scannedVolumeDetails.volumeType +> * resource.ebsVolumeDetails.skippedVolumeDetails.deviceName +> * resource.ebsVolumeDetails.skippedVolumeDetails.encryptionType +> * resource.ebsVolumeDetails.skippedVolumeDetails.kmsKeyArn +> * resource.ebsVolumeDetails.skippedVolumeDetails.snapshotArn +> * resource.ebsVolumeDetails.skippedVolumeDetails.volumeArn +> * resource.ebsVolumeDetails.skippedVolumeDetails.volumeSizeInGB +> * resource.ebsVolumeDetails.skippedVolumeDetails.volumeType +> * resource.ec2ImageDetails.imageArn +> * resource.ecsClusterDetails.activeServicesCount +> * resource.ecsClusterDetails.arn +> * resource.ecsClusterDetails.name +> * resource.ecsClusterDetails.registeredContainerInstancesCount +> * resource.ecsClusterDetails.runningTasksCount +> * resource.ecsClusterDetails.status +> * resource.ecsClusterDetails.tags.key +> * resource.ecsClusterDetails.tags.value +> * resource.ecsClusterDetails.taskDetails.arn +> * resource.ecsClusterDetails.taskDetails.containers.containerRuntime +> * resource.ecsClusterDetails.taskDetails.containers.id +> * resource.ecsClusterDetails.taskDetails.containers.image +> * resource.ecsClusterDetails.taskDetails.containers.imagePrefix +> * resource.ecsClusterDetails.taskDetails.containers.name +> * resource.ecsClusterDetails.taskDetails.containers.securityContext.allowPrivilegeEscalation +> * resource.ecsClusterDetails.taskDetails.containers.securityContext.privileged +> * resource.ecsClusterDetails.taskDetails.containers.volumeMounts.mountPath +> * resource.ecsClusterDetails.taskDetails.containers.volumeMounts.name +> * resource.ecsClusterDetails.taskDetails.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 +> * resource.ecsClusterDetails.taskDetails.definitionArn +> * resource.ecsClusterDetails.taskDetails.group +> * resource.ecsClusterDetails.taskDetails.launchType +> * resource.ecsClusterDetails.taskDetails.startedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 +> * resource.ecsClusterDetails.taskDetails.startedBy +> * resource.ecsClusterDetails.taskDetails.tags.key +> * resource.ecsClusterDetails.taskDetails.tags.value +> * resource.ecsClusterDetails.taskDetails.version +> * resource.ecsClusterDetails.taskDetails.volumes.hostPath.path +> * resource.ecsClusterDetails.taskDetails.volumes.name +> * resource.eksClusterDetails.arn +> * resource.eksClusterDetails.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 +> * resource.eksClusterDetails.name +> * resource.eksClusterDetails.status +> * resource.eksClusterDetails.tags.key +> * resource.eksClusterDetails.tags.value +> * resource.eksClusterDetails.vpcId +> * resource.instanceDetails.availabilityZone +> * resource.instanceDetails.iamInstanceProfile.arn @@ -190,0 +267 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd +> * resource.instanceDetails.imageDescription @@ -193,2 +270,3 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd -> * resource.instanceDetails.tags.key -> * resource.instanceDetails.tags.value +> * resource.instanceDetails.instanceState +> * resource.instanceDetails.instanceType +> * resource.instanceDetails.launchTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 @@ -195,0 +274,4 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd +> * resource.instanceDetails.networkInterfaces.networkInterfaceId +> * resource.instanceDetails.networkInterfaces.privateDnsName +> * resource.instanceDetails.networkInterfaces.privateIpAddress +> * resource.instanceDetails.networkInterfaces.privateIpAddresses.privateDnsName @@ -203,0 +286,73 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd +> * resource.instanceDetails.platform +> * resource.instanceDetails.productCodes.productCodeId +> * resource.instanceDetails.productCodes.productCodeType +> * resource.instanceDetails.tags.key +> * resource.instanceDetails.tags.value +> * resource.kubernetesDetails.kubernetesUserDetails.groups +> * resource.kubernetesDetails.kubernetesUserDetails.impersonatedUser.groups +> * resource.kubernetesDetails.kubernetesUserDetails.impersonatedUser.username +> * resource.kubernetesDetails.kubernetesUserDetails.sessionName +> * resource.kubernetesDetails.kubernetesUserDetails.uid +> * resource.kubernetesDetails.kubernetesUserDetails.username +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.containerRuntime +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.id +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.image +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.imagePrefix +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.name +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.securityContext.allowPrivilegeEscalation +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.securityContext.privileged +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.volumeMounts.mountPath +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.volumeMounts.name +> * resource.kubernetesDetails.kubernetesWorkloadDetails.hostIpc +> * resource.kubernetesDetails.kubernetesWorkloadDetails.hostNetwork +> * resource.kubernetesDetails.kubernetesWorkloadDetails.hostPid +> * resource.kubernetesDetails.kubernetesWorkloadDetails.name +> * resource.kubernetesDetails.kubernetesWorkloadDetails.namespace +> * resource.kubernetesDetails.kubernetesWorkloadDetails.serviceAccountName +> * resource.kubernetesDetails.kubernetesWorkloadDetails.type +> * resource.kubernetesDetails.kubernetesWorkloadDetails.uid +> * resource.kubernetesDetails.kubernetesWorkloadDetails.volumes.hostPath.path +> * resource.kubernetesDetails.kubernetesWorkloadDetails.volumes.name +> * resource.lambdaDetails.description +> * resource.lambdaDetails.functionArn +> * resource.lambdaDetails.functionName +> * resource.lambdaDetails.functionVersion +> * resource.lambdaDetails.lastModifiedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 +> * resource.lambdaDetails.revisionId +> * resource.lambdaDetails.role +> * resource.lambdaDetails.tags.key +> * resource.lambdaDetails.tags.value +> * resource.lambdaDetails.vpcConfig.securityGroups.groupId +> * resource.lambdaDetails.vpcConfig.securityGroups.groupName +> * resource.lambdaDetails.vpcConfig.subnetIds +> * resource.lambdaDetails.vpcConfig.vpcId +> * resource.rdsDbInstanceDetails.dbClusterIdentifier +> * resource.rdsDbInstanceDetails.dbInstanceArn +> * resource.rdsDbInstanceDetails.dbInstanceIdentifier +> * resource.rdsDbInstanceDetails.dbSecurityGroups.name +> * resource.rdsDbInstanceDetails.dbSecurityGroups.status +> * resource.rdsDbInstanceDetails.dbiResourceId +> * resource.rdsDbInstanceDetails.engine +> * resource.rdsDbInstanceDetails.engineVersion +> * resource.rdsDbInstanceDetails.iamDatabaseAuthenticationEnabled +> * resource.rdsDbInstanceDetails.publiclyAccessible +> * resource.rdsDbInstanceDetails.tags.key +> * resource.rdsDbInstanceDetails.tags.value +> * resource.rdsDbInstanceDetails.vpcId +> * resource.rdsDbInstanceDetails.vpcSecurityGroups.status +> * resource.rdsDbInstanceDetails.vpcSecurityGroups.vpcSecurityGroupId +> * resource.rdsDbUserDetails.application +> * resource.rdsDbUserDetails.authMethod +> * resource.rdsDbUserDetails.database +> * resource.rdsDbUserDetails.ssl +> * resource.rdsDbUserDetails.user +> * resource.rdsLimitlessDbDetails.dbClusterIdentifier +> * resource.rdsLimitlessDbDetails.dbShardGroupArn +> * resource.rdsLimitlessDbDetails.dbShardGroupIdentifier