openapi: 3.1.0
info:
  title: Amazon Web Services accessanalyzer 2012 09 25 Detector API
  description: <p>Identity and Access Management Access Analyzer helps you to set, verify, and refine your IAM policies by providing a suite of capabilities. Its features include findings for external and unused access, basic and custom policy checks for validating policies, and policy generation to generate fine-grained policies. To start using IAM Access Analyzer to identify external or unused access, you first need to create an analyzer.</p> <p> <b>External access analyzers</b> help identify potential risks of accessing resources by enabling you to identify any resource policies that grant access to an external principal. It does this by using logic-based reasoning to analyze resource-based policies in your Amazon Web Services environment. An external principal can be another Amazon Web Services account, a root user, an IAM user or role, a federated user, an Amazon Web Services service, or an anonymous user. You can also use IAM Access Analyzer to preview public and cross-account access to your resources before deploying permissions changes.</p> <p> <b>Unused access analyzers</b> help identify potential identity access risks by enabling you to identify unused IAM roles, unused access keys, unused console passwords, and IAM principals with unused service and action-level permissions.</p> <p>Beyond findings, IAM Access Analyzer provides basic and custom policy checks to validate IAM policies before deploying permissions changes. You can use policy generation to refine permissions by attaching a policy generated using access activity logged in CloudTrail logs. </p> <p>This guide describes the IAM Access Analyzer operations that you can call programmatically. For general information about IAM Access Analyzer, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/what-is-access-analyzer.html">Identity and Access Management Access Analyzer</a> in the <b>IAM User Guide</b>.</p>
tags:
- name: Detector
paths:
  /detector/{detectorId}/administrator:
    GET:
      summary: Amazon Web Services Getadministratoraccount
      description: 'Provides the details of the GuardDuty administrator account associated with the current GuardDuty member account.  If the organization''s management account or a delegated administrator runs this API, it will return success (HTTP 200) but no content. '
      operationId: amazonWebServicesGetAdministratorAccount
      tags:
      - Detector
  /detector/{detectorId}/master:
    GET:
      summary: Amazon Web Services Getmasteraccount
      description: Provides the details for the GuardDuty administrator account associated with the current GuardDuty member account.
      operationId: amazonWebServicesGetMasterAccount
      tags:
      - Detector
  /detector/{detectorId}/findings/archive:
    POST:
      summary: Amazon Web Services Archivefindings
      description: 'Archives GuardDuty findings that are specified by the list of finding IDs.  Only the administrator account can archive findings. Member accounts don''t have permission to archive findings from their accounts. '
      operationId: amazonWebServicesArchiveFindings
      tags:
      - Detector
  /detector:
    GET:
      summary: Amazon Web Services Listdetectors
      description: Lists detectorIds of all the existing Amazon GuardDuty detector resources.
      operationId: amazonWebServicesListDetectors
      tags:
      - Detector
  /detector/{detectorId}/filter:
    GET:
      summary: Amazon Web Services Listfilters
      description: Returns a paginated list of the current filters.
      operationId: amazonWebServicesListFilters
      tags:
      - Detector
  /detector/{detectorId}/ipset:
    GET:
      summary: Amazon Web Services Listipsets
      description: Lists the IPSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the IPSets returned are the IPSets from the associated administrator account.
      operationId: amazonWebServicesListIPSets
      tags:
      - Detector
  /detector/{detectorId}/member:
    GET:
      summary: Amazon Web Services Listmembers
      description: Lists details about all member accounts for the current GuardDuty administrator account.
      operationId: amazonWebServicesListMembers
      tags:
      - Detector
  /detector/{detectorId}/publishingDestination:
    GET:
      summary: Amazon Web Services Listpublishingdestinations
      description: Returns a list of publishing destinations associated with the specified detectorId.
      operationId: amazonWebServicesListPublishingDestinations
      tags:
      - Detector
  /detector/{detectorId}/findings/create:
    POST:
      summary: Amazon Web Services Createsamplefindings
      description: Generates sample findings of types specified by the list of finding types. If 'NULL' is specified for findingTypes, the API generates sample findings of all supported finding types.
      operationId: amazonWebServicesCreateSampleFindings
      tags:
      - Detector
  /detector/{detectorId}/threatintelset:
    GET:
      summary: Amazon Web Services Listthreatintelsets
      description: Lists the ThreatIntelSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the ThreatIntelSets associated with the administrator account are returned.
      operationId: amazonWebServicesListThreatIntelSets
      tags:
      - Detector
  /detector/{detectorId}:
    POST:
      summary: Amazon Web Services Updatedetector
      description: Updates the Amazon GuardDuty detector specified by the detectorId. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.
      operationId: amazonWebServicesUpdateDetector
      tags:
      - Detector
  /detector/{detectorId}/filter/{filterName}:
    POST:
      summary: Amazon Web Services Updatefilter
      description: Updates the filter specified by the filter name.
      operationId: amazonWebServicesUpdateFilter
      tags:
      - Detector
  /detector/{detectorId}/ipset/{ipSetId}:
    POST:
      summary: Amazon Web Services Updateipset
      description: Updates the IPSet specified by the IPSet ID.
      operationId: amazonWebServicesUpdateIPSet
      tags:
      - Detector
  /detector/{detectorId}/member/delete:
    POST:
      summary: Amazon Web Services Deletemembers
      description: Deletes GuardDuty member accounts (to the current GuardDuty administrator account) specified by the account IDs. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty for a member account in your organization.
      operationId: amazonWebServicesDeleteMembers
      tags:
      - Detector
  /detector/{detectorId}/publishingDestination/{destinationId}:
    POST:
      summary: Amazon Web Services Updatepublishingdestination
      description: Updates information about the publishing destination specified by the destinationId.
      operationId: amazonWebServicesUpdatePublishingDestination
      tags:
      - Detector
  /detector/{detectorId}/threatintelset/{threatIntelSetId}:
    POST:
      summary: Amazon Web Services Updatethreatintelset
      description: Updates the ThreatIntelSet specified by the ThreatIntelSet ID.
      operationId: amazonWebServicesUpdateThreatIntelSet
      tags:
      - Detector
  /detector/{detectorId}/malware-scans:
    POST:
      summary: Amazon Web Services Describemalwarescans
      description: Returns a list of malware scans. Each member account can view the malware scans for their own accounts. An administrator can view the malware scans for all the member accounts. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.
      operationId: amazonWebServicesDescribeMalwareScans
      tags:
      - Detector
  /detector/{detectorId}/admin:
    POST:
      summary: Amazon Web Services Updateorganizationconfiguration
      description: Configures the delegated administrator account with the provided values. You must provide a value for either autoEnableOrganizationMembers or autoEnable, but not both.  There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.
      operationId: amazonWebServicesUpdateOrganizationConfiguration
      tags:
      - Detector
  /detector/{detectorId}/administrator/disassociate:
    POST:
      summary: Amazon Web Services Disassociatefromadministratoraccount
      description: Disassociates the current GuardDuty member account from its administrator account. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.  With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disable GuardDuty in a member account.
      operationId: amazonWebServicesDisassociateFromAdministratorAccount
      tags:
      - Detector
  /detector/{detectorId}/master/disassociate:
    POST:
      summary: Amazon Web Services Disassociatefrommasteraccount
      description: Disassociates the current GuardDuty member account from its administrator account. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.
      operationId: amazonWebServicesDisassociateFromMasterAccount
      tags:
      - Detector
  /detector/{detectorId}/member/disassociate:
    POST:
      summary: Amazon Web Services Disassociatemembers
      description: Disassociates GuardDuty member accounts (from the current administrator account) specified by the account IDs. When you disassociate an invited member from a GuardDuty delegated administrator, the member account details obtained from the CreateMembers API, including the associated email addresses, are retained. This is done so that the delegated administrator can invoke the InviteMembers API without the need to invoke the CreateMembers API again. To remove the details associated with a member account, the delegated administrator must invoke the DeleteMembers API.  With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to disassociate a member account before removing them from your organization.
      operationId: amazonWebServicesDisassociateMembers
      tags:
      - Detector
  /detector/{detectorId}/coverage/statistics:
    POST:
      summary: Amazon Web Services Getcoveragestatistics
      description: Retrieves aggregated statistics for your account. If you are a GuardDuty administrator, you can retrieve the statistics for all the resources associated with the active member accounts in your organization who have enabled Runtime Monitoring and have the GuardDuty security agent running on their resources.
      operationId: amazonWebServicesGetCoverageStatistics
      tags:
      - Detector
  /detector/{detectorId}/findings/get:
    POST:
      summary: Amazon Web Services Getfindings
      description: Describes Amazon GuardDuty findings specified by finding IDs.
      operationId: amazonWebServicesGetFindings
      tags:
      - Detector
  /detector/{detectorId}/findings/statistics:
    POST:
      summary: Amazon Web Services Getfindingsstatistics
      description: Lists Amazon GuardDuty findings statistics for the specified detector ID.
      operationId: amazonWebServicesGetFindingsStatistics
      tags:
      - Detector
  /detector/{detectorId}/malware-scan-settings:
    POST:
      summary: Amazon Web Services Updatemalwarescansettings
      description: Updates the malware scan settings. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.
      operationId: amazonWebServicesUpdateMalwareScanSettings
      tags:
      - Detector
  /detector/{detectorId}/member/detector/get:
    POST:
      summary: Amazon Web Services Getmemberdetectors
      description: Describes which data sources are enabled for the member account's detector. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.
      operationId: amazonWebServicesGetMemberDetectors
      tags:
      - Detector
  /detector/{detectorId}/member/get:
    POST:
      summary: Amazon Web Services Getmembers
      description: Retrieves GuardDuty member accounts (of the current GuardDuty administrator account) specified by the account IDs.
      operationId: amazonWebServicesGetMembers
      tags:
      - Detector
  /detector/{detectorId}/freeTrial/daysRemaining:
    POST:
      summary: Amazon Web Services Getremainingfreetrialdays
      description: Provides the number of days left for each data source used in the free trial period.
      operationId: amazonWebServicesGetRemainingFreeTrialDays
      tags:
      - Detector
  /detector/{detectorId}/usage/statistics:
    POST:
      summary: Amazon Web Services Getusagestatistics
      description: Lists Amazon GuardDuty usage statistics over the last 30 days for the specified detector ID. For newly enabled detectors or data sources, the cost returned will include only the usage so far under 30 days. This may differ from the cost metrics in the console, which project usage over 30 days to provide a monthly cost estimate. For more information, see Understanding How Usage Costs are Calculated.
      operationId: amazonWebServicesGetUsageStatistics
      tags:
      - Detector
  /detector/{detectorId}/member/invite:
    POST:
      summary: Amazon Web Services Invitemembers
      description: 'Invites Amazon Web Services accounts to become members of an organization administered by the Amazon Web Services account that invokes this API. If you are using Amazon Web Services Organizations to manage your GuardDuty environment, this step is not needed. For more information, see Managing accounts with organizations. To invite Amazon Web Services accounts, the first step is to ensure that GuardDuty has been enabled in the potential member accounts. You can now invoke this API to add accounts by invitation. The invited accounts can either accept or decline the invitation from their GuardDuty accounts. Each invited Amazon Web Services account can choose to accept the invitation from only one Amazon Web Services account. For more information, see Managing GuardDuty accounts by invitation. After the invite has been accepted and you choose to disassociate a member account (by using DisassociateMembers) from your account, the details of the member account obtained by invoking CreateMembers, including the associated email addresses, will be retained. This is done so that you can invoke InviteMembers without the need to invoke CreateMembers again. To remove the details associated with a member account, you must also invoke DeleteMembers. '
      operationId: amazonWebServicesInviteMembers
      tags:
      - Detector
  /detector/{detectorId}/coverage:
    POST:
      summary: Amazon Web Services Listcoverage
      description: Lists coverage details for your GuardDuty account. If you're a GuardDuty administrator, you can retrieve all resources associated with the active member accounts in your organization. Make sure the accounts have Runtime Monitoring enabled and GuardDuty agent running on their resources.
      operationId: amazonWebServicesListCoverage
      tags:
      - Detector
  /detector/{detectorId}/findings:
    POST:
      summary: Amazon Web Services Listfindings
      description: Lists Amazon GuardDuty findings for the specified detector ID.
      operationId: amazonWebServicesListFindings
      tags:
      - Detector
  /detector/{detectorId}/member/start:
    POST:
      summary: Amazon Web Services Startmonitoringmembers
      description: Turns on GuardDuty monitoring of the specified member accounts. Use this operation to restart monitoring of accounts that you stopped monitoring with the StopMonitoringMembers operation.
      operationId: amazonWebServicesStartMonitoringMembers
      tags:
      - Detector
  /detector/{detectorId}/member/stop:
    POST:
      summary: Amazon Web Services Stopmonitoringmembers
      description: Stops GuardDuty monitoring for the specified member accounts. Use the StartMonitoringMembers operation to restart monitoring for those accounts. With autoEnableOrganizationMembers configuration for your organization set to ALL, you'll receive an error if you attempt to stop monitoring the member accounts in your organization.
      operationId: amazonWebServicesStopMonitoringMembers
      tags:
      - Detector
  /detector/{detectorId}/findings/unarchive:
    POST:
      summary: Amazon Web Services Unarchivefindings
      description: Unarchives GuardDuty findings specified by the findingIds.
      operationId: amazonWebServicesUnarchiveFindings
      tags:
      - Detector
  /detector/{detectorId}/findings/feedback:
    POST:
      summary: Amazon Web Services Updatefindingsfeedback
      description: Marks the specified GuardDuty findings as useful or not useful.
      operationId: amazonWebServicesUpdateFindingsFeedback
      tags:
      - Detector
  /detector/{detectorId}/member/detector/update:
    POST:
      summary: Amazon Web Services Updatememberdetectors
      description: Contains information on member accounts to be updated. There might be regional differences because some data sources might not be available in all the Amazon Web Services Regions where GuardDuty is presently supported. For more information, see Regions and endpoints.
      operationId: amazonWebServicesUpdateMemberDetectors
      tags:
      - Detector