AWS cli documentation change
Summary
Updated AWS CLI version reference from 2.34.32 to 2.34.34, added 'Default: NOOP' note, and significantly expanded the documentation for the FindingCriteria parameter to include a comprehensive list of filterable fields across various AWS services and security contexts.
Security assessment
This change enhances documentation for GuardDuty's filtering capabilities by providing a detailed list of filterable fields across multiple AWS services (EC2, S3, RDS, EKS, Lambda, Kubernetes, etc.) and security contexts (access keys, network connections, malware scans, threat intelligence). While this improves security monitoring capabilities by documenting what can be filtered, there's no evidence in the diff that this addresses a specific security vulnerability or incident. The change appears to be routine documentation improvement for a security service.
Diff
diff --git a/cli/latest/reference/guardduty/update-filter.md b/cli/latest/reference/guardduty/update-filter.md index 73f6bb414..5475293c4 100644 --- a//cli/latest/reference/guardduty/update-filter.md +++ b//cli/latest/reference/guardduty/update-filter.md @@ -15 +15 @@ - * [AWS CLI 2.34.32 Command Reference](../../index.html) » + * [AWS CLI 2.34.34 Command Reference](../../index.html) » @@ -129,0 +130,2 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd +> Default: NOOP +> @@ -157 +159,642 @@ See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/guardd -> Represents the criteria to be used in the filter for querying findings. +> Represents the criteria to be used in the filter for querying findings. The following fields are available for filtering: +> +> * accountId +> * arn +> * associatedAttackSequenceArn +> * confidence +> * createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 +> * description +> * id +> * partition +> * region +> * resource.accessKeyDetails.accessKeyId +> * resource.accessKeyDetails.principalId +> * resource.accessKeyDetails.userIdentity.accessKeyId +> * resource.accessKeyDetails.userIdentity.accountId +> * resource.accessKeyDetails.userIdentity.arn +> * resource.accessKeyDetails.userIdentity.principalId +> * resource.accessKeyDetails.userIdentity.sessionContext.attributes.mfaAuthenticated +> * resource.accessKeyDetails.userIdentity.sessionContext.ec2RoleDelivery +> * resource.accessKeyDetails.userIdentity.sessionContext.invokedBy +> * resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.accountId +> * resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.arn +> * resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.principalId +> * resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.type +> * resource.accessKeyDetails.userIdentity.sessionContext.sessionIssuer.userName +> * resource.accessKeyDetails.userIdentity.sessionContext.sourceIdentity +> * resource.accessKeyDetails.userIdentity.sessionContext.webIdFederationData.attributes +> * resource.accessKeyDetails.userIdentity.sessionContext.webIdFederationData.federatedProvider +> * resource.accessKeyDetails.userIdentity.type +> * resource.accessKeyDetails.userIdentity.userName +> * resource.accessKeyDetails.userName +> * resource.accessKeyDetails.userType +> * resource.bedrockGuardrailDetails.guardrailArn +> * resource.bedrockGuardrailDetails.guardrailVersion +> * resource.containerDetails.containerRuntime +> * resource.containerDetails.id +> * resource.containerDetails.image +> * resource.containerDetails.imagePrefix +> * resource.containerDetails.name +> * resource.containerDetails.securityContext.allowPrivilegeEscalation +> * resource.containerDetails.securityContext.privileged +> * resource.containerDetails.volumeMounts.mountPath +> * resource.containerDetails.volumeMounts.name +> * resource.ebsSnapshotDetails.snapshotArn +> * resource.ebsVolumeDetails.scannedVolumeDetails.deviceName +> * resource.ebsVolumeDetails.scannedVolumeDetails.encryptionType +> * resource.ebsVolumeDetails.scannedVolumeDetails.kmsKeyArn +> * resource.ebsVolumeDetails.scannedVolumeDetails.snapshotArn +> * resource.ebsVolumeDetails.scannedVolumeDetails.volumeArn +> * resource.ebsVolumeDetails.scannedVolumeDetails.volumeSizeInGB +> * resource.ebsVolumeDetails.scannedVolumeDetails.volumeType +> * resource.ebsVolumeDetails.skippedVolumeDetails.deviceName +> * resource.ebsVolumeDetails.skippedVolumeDetails.encryptionType +> * resource.ebsVolumeDetails.skippedVolumeDetails.kmsKeyArn +> * resource.ebsVolumeDetails.skippedVolumeDetails.snapshotArn +> * resource.ebsVolumeDetails.skippedVolumeDetails.volumeArn +> * resource.ebsVolumeDetails.skippedVolumeDetails.volumeSizeInGB +> * resource.ebsVolumeDetails.skippedVolumeDetails.volumeType +> * resource.ec2ImageDetails.imageArn +> * resource.ecsClusterDetails.activeServicesCount +> * resource.ecsClusterDetails.arn +> * resource.ecsClusterDetails.name +> * resource.ecsClusterDetails.registeredContainerInstancesCount +> * resource.ecsClusterDetails.runningTasksCount +> * resource.ecsClusterDetails.status +> * resource.ecsClusterDetails.tags.key +> * resource.ecsClusterDetails.tags.value +> * resource.ecsClusterDetails.taskDetails.arn +> * resource.ecsClusterDetails.taskDetails.containers.containerRuntime +> * resource.ecsClusterDetails.taskDetails.containers.id +> * resource.ecsClusterDetails.taskDetails.containers.image +> * resource.ecsClusterDetails.taskDetails.containers.imagePrefix +> * resource.ecsClusterDetails.taskDetails.containers.name +> * resource.ecsClusterDetails.taskDetails.containers.securityContext.allowPrivilegeEscalation +> * resource.ecsClusterDetails.taskDetails.containers.securityContext.privileged +> * resource.ecsClusterDetails.taskDetails.containers.volumeMounts.mountPath +> * resource.ecsClusterDetails.taskDetails.containers.volumeMounts.name +> * resource.ecsClusterDetails.taskDetails.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 +> * resource.ecsClusterDetails.taskDetails.definitionArn +> * resource.ecsClusterDetails.taskDetails.group +> * resource.ecsClusterDetails.taskDetails.launchType +> * resource.ecsClusterDetails.taskDetails.startedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 +> * resource.ecsClusterDetails.taskDetails.startedBy +> * resource.ecsClusterDetails.taskDetails.tags.key +> * resource.ecsClusterDetails.taskDetails.tags.value +> * resource.ecsClusterDetails.taskDetails.version +> * resource.ecsClusterDetails.taskDetails.volumes.hostPath.path +> * resource.ecsClusterDetails.taskDetails.volumes.name +> * resource.eksClusterDetails.arn +> * resource.eksClusterDetails.createdAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 +> * resource.eksClusterDetails.name +> * resource.eksClusterDetails.status +> * resource.eksClusterDetails.tags.key +> * resource.eksClusterDetails.tags.value +> * resource.eksClusterDetails.vpcId +> * resource.instanceDetails.availabilityZone +> * resource.instanceDetails.iamInstanceProfile.arn +> * resource.instanceDetails.iamInstanceProfile.id +> * resource.instanceDetails.imageDescription +> * resource.instanceDetails.imageId +> * resource.instanceDetails.instanceId +> * resource.instanceDetails.instanceState +> * resource.instanceDetails.instanceType +> * resource.instanceDetails.launchTime Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 +> * resource.instanceDetails.networkInterfaces.ipv6Addresses +> * resource.instanceDetails.networkInterfaces.networkInterfaceId +> * resource.instanceDetails.networkInterfaces.privateDnsName +> * resource.instanceDetails.networkInterfaces.privateIpAddress +> * resource.instanceDetails.networkInterfaces.privateIpAddresses.privateDnsName +> * resource.instanceDetails.networkInterfaces.privateIpAddresses.privateIpAddress +> * resource.instanceDetails.networkInterfaces.publicDnsName +> * resource.instanceDetails.networkInterfaces.publicIp +> * resource.instanceDetails.networkInterfaces.securityGroups.groupId +> * resource.instanceDetails.networkInterfaces.securityGroups.groupName +> * resource.instanceDetails.networkInterfaces.subnetId +> * resource.instanceDetails.networkInterfaces.vpcId +> * resource.instanceDetails.outpostArn +> * resource.instanceDetails.platform +> * resource.instanceDetails.productCodes.productCodeId +> * resource.instanceDetails.productCodes.productCodeType +> * resource.instanceDetails.tags.key +> * resource.instanceDetails.tags.value +> * resource.kubernetesDetails.kubernetesUserDetails.groups +> * resource.kubernetesDetails.kubernetesUserDetails.impersonatedUser.groups +> * resource.kubernetesDetails.kubernetesUserDetails.impersonatedUser.username +> * resource.kubernetesDetails.kubernetesUserDetails.sessionName +> * resource.kubernetesDetails.kubernetesUserDetails.uid +> * resource.kubernetesDetails.kubernetesUserDetails.username +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.containerRuntime +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.id +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.image +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.imagePrefix +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.name +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.securityContext.allowPrivilegeEscalation +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.securityContext.privileged +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.volumeMounts.mountPath +> * resource.kubernetesDetails.kubernetesWorkloadDetails.containers.volumeMounts.name +> * resource.kubernetesDetails.kubernetesWorkloadDetails.hostIpc +> * resource.kubernetesDetails.kubernetesWorkloadDetails.hostNetwork +> * resource.kubernetesDetails.kubernetesWorkloadDetails.hostPid +> * resource.kubernetesDetails.kubernetesWorkloadDetails.name +> * resource.kubernetesDetails.kubernetesWorkloadDetails.namespace +> * resource.kubernetesDetails.kubernetesWorkloadDetails.serviceAccountName +> * resource.kubernetesDetails.kubernetesWorkloadDetails.type +> * resource.kubernetesDetails.kubernetesWorkloadDetails.uid +> * resource.kubernetesDetails.kubernetesWorkloadDetails.volumes.hostPath.path +> * resource.kubernetesDetails.kubernetesWorkloadDetails.volumes.name +> * resource.lambdaDetails.description +> * resource.lambdaDetails.functionArn +> * resource.lambdaDetails.functionName +> * resource.lambdaDetails.functionVersion +> * resource.lambdaDetails.lastModifiedAt Type: Timestamp in Unix Epoch millisecond format. Ex: 1486685375000 +> * resource.lambdaDetails.revisionId +> * resource.lambdaDetails.role +> * resource.lambdaDetails.tags.key +> * resource.lambdaDetails.tags.value +> * resource.lambdaDetails.vpcConfig.securityGroups.groupId +> * resource.lambdaDetails.vpcConfig.securityGroups.groupName +> * resource.lambdaDetails.vpcConfig.subnetIds +> * resource.lambdaDetails.vpcConfig.vpcId +> * resource.rdsDbInstanceDetails.dbClusterIdentifier +> * resource.rdsDbInstanceDetails.dbInstanceArn +> * resource.rdsDbInstanceDetails.dbInstanceIdentifier +> * resource.rdsDbInstanceDetails.dbSecurityGroups.name +> * resource.rdsDbInstanceDetails.dbSecurityGroups.status +> * resource.rdsDbInstanceDetails.dbiResourceId +> * resource.rdsDbInstanceDetails.engine +> * resource.rdsDbInstanceDetails.engineVersion +> * resource.rdsDbInstanceDetails.iamDatabaseAuthenticationEnabled +> * resource.rdsDbInstanceDetails.publiclyAccessible +> * resource.rdsDbInstanceDetails.tags.key +> * resource.rdsDbInstanceDetails.tags.value +> * resource.rdsDbInstanceDetails.vpcId +> * resource.rdsDbInstanceDetails.vpcSecurityGroups.status +> * resource.rdsDbInstanceDetails.vpcSecurityGroups.vpcSecurityGroupId +> * resource.rdsDbUserDetails.application +> * resource.rdsDbUserDetails.authMethod +> * resource.rdsDbUserDetails.database +> * resource.rdsDbUserDetails.ssl +> * resource.rdsDbUserDetails.user +> * resource.rdsLimitlessDbDetails.dbClusterIdentifier +> * resource.rdsLimitlessDbDetails.dbShardGroupArn +> * resource.rdsLimitlessDbDetails.dbShardGroupIdentifier +> * resource.rdsLimitlessDbDetails.dbShardGroupResourceId +> * resource.rdsLimitlessDbDetails.engine +> * resource.rdsLimitlessDbDetails.engineVersion +> * resource.rdsLimitlessDbDetails.tags.key +> * resource.rdsLimitlessDbDetails.tags.value