Amazon Web Services MCP connector

• List List all Amazon Web Services organizations accounts Every account in the organization, in one global sweep — never fan out per region. Account.Paths materialises grouping_path at zero extra cost, so the recursive ListParents climb is only a fallback. Map state from Account.State, not Account.Status, which retires 2026-09-09 and has no CLOSED value. JoinedTimestamp is the org-join date, not the creation date. An empty page is not a terminator: loop until NextToken is null. A standalone account returns AWSOrganizationsNotInUseException (400).
• List List all Amazon Web Services organizations roots The organization root. Exactly one call ever — the quota 'Roots in an organization: 1' is not adjustable, and the throttle is 1 req/s. Root has no Path field (only OUs do), so synthesize o-/r-/. No created_at exists on Root.
• List List all Amazon Web Services organizations ous Organizational units under one parent, walked breadth-first. Nesting is capped at 5 levels and is not adjustable, so recursion is bounded and needs no cycle guard. Preferred over ListChildren because it returns {Arn, Id, Name, Path} inline and avoids a DescribeOrganizationalUnit per OU at a 2 req/s throttle. No created_at exists on OrganizationalUnit either.
• List List all Amazon Web Services organizations policies Service control policies. Filter is required and single-valued, so RCPs are a second call with Filter=RESOURCE_CONTROL_POLICY. Management account or delegated administrator only. Filter out the AWS-managed p-FullAWSAccess or target counts are dominated by noise.
• Get Get single Amazon Web Services organizations policy by ID One SCP with its document. Policy.Content is plain JSON and must NOT be URL-decoded — the opposite of IAM's GetPolicyVersion. Applying the IAM decode here mangles the policy.
• List List all Amazon Web Services organizations policy targets Where one SCP is directly attached. Returns direct attachments only; inheritance must be computed from the OU tree because DescribeEffectivePolicy explicitly excludes SCPs — its PolicyType enum has no SERVICE_CONTROL_POLICY entry.
• List List all Amazon Web Services iam account authorization details The primary IAM collector. One paginated sweep returns every user, group, role and policy with GroupList, AttachedManagedPolicies, inline policy documents, Tags and PermissionsBoundary — replacing four of the eight per-user calls. It does NOT cover access keys, MFA devices or login profiles. IAM policy documents here are URL-encoded (RFC 3986): decode only if the string contains %7B, never if it starts with {.
• List List all Amazon Web Services iam users IAM users. Returns UserId, UserName, Arn, Path, CreateDate and PasswordLastUsed only — no Tags, no PermissionsBoundary. IAM users have no email and no display name anywhere in the API. PasswordLastUsed is console sign-in only, records at most one sign-in per 5-minute window, began 2014-10-20, and has a documented gap from 2018-05-03 22:50 PDT to 2018-05-23 14:08 PDT. A key-only user reports no_information forever — that is not 'never signed in'.
• List List all Amazon Web Services iam roles IAM roles. ListRoles DOES return AssumeRolePolicyDocument — the omission list names only PermissionsBoundary, RoleLastUsed and Tags — so GetRole is needed only for last_used_at, boundary and tags. Roles have no long-term credentials and no API lists any, so has_static_keys is structurally false and key_count structurally 0.
• List List all Amazon Web Services iam policies Managed policies. Scope=Local means customer-managed (is_custom). The response already carries DefaultVersionId, so GetPolicy can be skipped and GetPolicyVersion called directly. AttachmentCount (grants) and PermissionsBoundaryUsageCount (restricts) are separate numbers — summing them destroys a security-relevant distinction.
• Get Get single Amazon Web Services iam account password policy by ID The account password policy. A 404 NoSuchEntity here means no policy is configured, so AWS defaults apply — a WEAKER posture. Render it as 'not configured', never as 'unknown', and never as a pass. IAM has no lockout threshold and no breached-password list at all.
• Create Create a Amazon Web Services iam generate credential report Starts the credential report job. WARNING: iam:GenerateCredentialReport is access level Write in the Service Authorization Reference, so it will not appear in a policy built by filtering for read access. Without it GetCredentialReport returns 410. Enabling this is a deliberate decision, not a default.
• Get Get single Amazon Web Services iam credential report by ID The credential report: base64 CSV with sentinels N/A, no_information, not_supported and uppercase TRUE/FALSE. Returns 410 if nobody generated one. It caps at the first two access keys per user and omits service-specific credentials entirely, so it is not the source of truth for static_credentials.
• List List all Amazon Web Services iam access keys Access keys for one user, max 2. Access keys never expire — expires_at is structurally null, not unknown. last_used_at needs a separate GetAccessKeyLastUsed call per key; access keys are the only credential type that has last-used data at all.
• List List all Amazon Web Services iam MFA devices MFA devices for one user. The response carries NO device type — type must be inferred from the SerialNumber shape, and FIDO/passkey vs TOTP is not cleanly distinguishable. Mark any mfa_methods value as derived.
• Get Get single Amazon Web Services iam login profile by ID Console password metadata for one user. A 404 NoSuchEntity is the ANSWER, not an error: it means has_console_access is false. Surfacing it as an integration error turns every programmatic-only user into noise.
• List List all Amazon Web Services iam oidc providers OIDC identity providers in the account. Returns ARNs only — the issuer URL and audience list need GetOpenIDConnectProvider per ARN. Not paginated.
• Get Get single Amazon Web Services iam oidc provider by ID One OIDC provider. Url is stored WITHOUT the https:// scheme while trust-policy condition keys use the bare host — normalise both sides before joining. ClientIDList is the registered audience and can disagree with the :aud condition key; the trust policy is what actually gates the assume. A role trusting this provider with no :sub condition can be assumed by any subject from the issuer — model 'no sub condition' as its own state, never as an empty list.
• List List all Amazon Web Services iam saml providers SAML identity providers in the account. Returns ARNs, ValidUntil and CreateDate. Not paginated. A federated trust to one of these is an external-trust edge on any role whose trust policy names it under Principal.Federated.
• List List all Amazon Web Services securityhub findings ASFF findings. Check ListFindingAggregators FIRST: if cross-region aggregation is on, calling the aggregation region returns everything and fanning out duplicates it all. Compliance.Status has only PASSED|WARNING|FAILED|NOT_AVAILABLE — there is NO NOT_APPLICABLE, and NOT_AVAILABLE conflates 'not applicable' with 'could not check'. Findings whose Config evaluation returned NOT_APPLICABLE are auto-archived after 3 days, so RecordState must explicitly include ARCHIVED or they vanish. Archived findings are permanently deleted after 30 days. Findings over 240 KB have Resource.Details silently stripped.
• List List all Amazon Web Services securityhub enabled standards Standards enabled in this region. enabled_standards is a Security Hub concept only — the other seven AWS security services have no notion of a compliance standard, and their feature toggles must not be forced into this field. standardVersion is not a field: the version is embedded in the standard ARN (.../cis-aws-foundations-benchmark/v/1.2.0) and must be string-parsed.
• Get Get single Amazon Web Services securityhub hub by ID Whether Security Hub is enabled in this region, and which field mapping applies. A 404 or 401 here is DATA — Security Hub is simply not enabled — not an integration failure. ControlFindingGenerator branches the whole finding mapping: SECURITY_CONTROL uses Compliance.SecurityControlId and Compliance.AssociatedStandards; STANDARD_CONTROL has those absent and needs ProductFields.StandardsArn or StandardsGuideArn and ProductFields.ControlId or RuleId. SubscribedAt is enablement time, not an evaluation time — it must not be mapped to last_evaluated_at.
• List List all Amazon Web Services securityhub security controls Control metadata, fetched once per collection and cached — never per finding. This is the only source of SeverityRating, the control's inherent risk. Severity.Label on a finding is INFORMATIONAL on every PASSED finding because it describes the outcome, not the control.
• List List all Amazon Web Services guardduty detectors Detector ids in this region — one detector per region per account. Returns ids only.
• List List all Amazon Web Services guardduty list findings Finding ids, max 50 per page. This returns ids ONLY — GetFindings is mandatory to hydrate them. ListFindings defaults to returning archived and unarchived findings mixed together; decide explicitly rather than inheriting the default.
• Get Get single Amazon Web Services guardduty get finding by ID Hydrates a batch of up to 50 finding ids. severity is a Double with no severityLabel field anywhere — emit the raw number and mark any band as derived. There is no state field; the closest is service.archived, and service itself is optional. title is optional — fall back to type. resource has no single path: resource.resourceType discriminates about 20 mutually exclusive sub-objects, some of them arrays.
• Get Get single Amazon Web Services guardduty detector by ID One detector's configuration. status is the enablement signal. updatedAt is a configuration-change timestamp, NOT an evaluation timestamp — mapping it into last_evaluated_at would be a lie to the consumer.
• List List all Amazon Web Services inspector 2 account status Inspector v2 enablement per account. state.status is the enablement signal. There is NO timestamp anywhere in this response, so last_evaluated_at is unreadable for Inspector — record it as such rather than substituting a config timestamp.
• List List all Amazon Web Services inspector 2 coverage statistics Scan coverage counts per resource type. NOTE: this operation is NOT in the verified aws-operations.md reference — it is the only plausible source for scan_coverages and must be confirmed against the live API before this method is trusted.
• List List all Amazon Web Services inspector 2 findings Vulnerability findings. NOTE: this operation is NOT in the verified aws-operations.md reference — it is the only plausible source for vulnerability_findings and must be confirmed against the live API before this method is trusted.
• List List all Amazon Web Services config recorders Configuration recorders in this region. NOT paginated. NoSuchConfigurationRecorderException is DATA — AWS Config is off — not a failure. The operation now accepts only one recorder per request.
• List List all Amazon Web Services config recorder status Whether the recorder is actually recording. AWS Config is one of only two of the eight security services with a real last_evaluated_at: lastStatusChangeTime and configSnapshotDeliveryInfo.lastSuccessfulTime. NOT paginated.
• List List all Amazon Web Services config aggregate compliance Per-(rule, account, region) compliance across the whole organization in one paged call, with no AssumeRole per account — Limit up to 1000. Counts arrive as {CappedCount, CapExceeded}, not an integer: when CapExceeded is true the count is a CEILING, and mapping it as exact publishes wrong numbers on exactly the largest rules. INSUFFICIENT_DATA is returned but cannot be used as a filter value, and the aggregate variant accepts only COMPLIANT and NON_COMPLIANT as filters despite the enum listing four.
• List List all Amazon Web Services config rule evaluation status The ONLY source of real Config timestamps. DescribeComplianceByConfigRule carries no timestamp at all, so pairing is mandatory — substituting our own fetch time would be exactly the staleness lie this model exists to prevent. Use LastSuccessfulEvaluationTime (evaluation), not LastSuccessfulInvocationTime (invocation).
• List List all Amazon Web Services accessanalyzer analyzers IAM Access Analyzer analyzers. status == ACTIVE is the enablement signal, and this is one of only two of the eight security services with a genuine last_evaluated_at: lastResourceAnalyzedAt.
• Get Get single Amazon Web Services macie session by ID Macie v2 enablement. Two traps: Macie returns HTTP 200 with an EMPTY BODY when it is not enabled and reached via AWS Config, so an empty 200 means not-enabled; and status PAUSED means enabled-but-suspended, not disabled.
• List List all Amazon Web Services identitystore users Identity Center users. ListUsers returns complete User objects — UserId, UserName, DisplayName, Emails, UserStatus and CreatedAt — so DescribeUser adds nothing for bulk sync. MFA registration state is NOT AVAILABLE through any public API (the console uses an undocumented sso-directory operation with no published wire contract). last_sign_in_at is NOT AVAILABLE either — only CloudTrail UserAuthentication events carry it. has_static_credentials and has_console_access are IAM-only concepts here.
• List List all Amazon Web Services SSO instances Identity Center instances — the bootstrap for IdentityStoreId, InstanceArn, PrimaryRegion and Regions. Capped at 10 instances; do not blindly take [0]. Calling in the WRONG region returns an empty list, not an error, which is indistinguishable from 'the customer does not use Identity Center' — sweep candidate regions rather than trusting one empty result. Note the host is sso..amazonaws.com, not sso-admin.*.
• List List all Amazon Web Services s 3 buckets All buckets. Pagination is MANDATORY, not an optimisation: unpaginated requests are rejected outright for accounts with a bucket quota above 10,000, and BucketRegion is only returned on paginated requests — without it every bucket needs an extra GetBucketLocation. BucketArn is now returned; use it as provider_ref rather than constructing arn:aws:s3:::, which is wrong outside the aws partition. Directory buckets (S3 Express) are invisible here — a disjoint namespace under s3express-control.
• List List all Amazon Web Services s 3 bucket public access block Bucket-level Block Public Access. NoSuchPublicAccessBlockConfiguration (404) means not configured — all four flags false — and must not be read as blocked. BlockPublicAcls and BlockPublicPolicy are WRITE-TIME GUARDS ONLY: AWS states enabling them does not affect existing policies or ACLs. Only IgnorePublicAcls and RestrictPublicBuckets change effective read access, so computing exposure from the two Block flags produces false clean results. Effective BPA is the account setting OR the bucket setting, per flag. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket policy status Whether the bucket policy grants public access. This is the ONLY policy-derived signal available cross-account: GetBucketPolicy returns 405 Method Not Allowed for a caller outside the bucket owner's account regardless of IAM. Returns an empty document rather than erroring when there is no policy. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket policy The bucket policy document. NoSuchBucketPolicy (404) means no policy, not a failure. Cross-account this returns 405 Method Not Allowed regardless of IAM — map 405 to permission_denied, never to 'no policy'. The document is plain JSON, NOT URL-encoded. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket acl Bucket ACL grants. Public means a Grantee.URI of http://acs.amazonaws.com/groups/global/AllUsers or .../global/AuthenticatedUsers. .../s3/LogDelivery is benign — do not flag it. AuthenticatedUsers is not anonymous (requests must be signed) but means any AWS account on earth, so keep it distinguishable rather than folding it into anonymous access. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket encryption Default encryption. Since January 2023 SSE-S3 is applied to every bucket by default, so 'no default encryption' is an obsolete control and this rarely 404s — the real control is SSEAlgorithm == AES256, i.e. not a customer-managed key. SSEAlgorithm has FOUR values: AES256, aws:kms, aws:kms:dsse, aws:fsx. KMSMasterKeyID may be a key id, an ARN or an ALIAS — store the raw string with a discriminator. The docs are internally inconsistent (KMSMasterKeyID vs KMSKeyID); parse both. ServerSideEncryptionConfigurationNotFoundError has no documented Errors section, so treat an unrecognised 404 as not_collected, never as a pass. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket versioning Versioning state. Returns an EMPTY document with no Status element at all when versioning was never enabled — absent is not the same as Suspended. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket object lock Object Lock. Returns only ObjectLockEnabled (single valid value Enabled) and an optional default rule. retention_locked is NOT a real S3 field: the closest honest mapping is Mode == COMPLIANCE, which is a default for FUTURE objects and says nothing about what is in the bucket now. Legal holds and per-object retention are per object version and would need unbounded per-object calls. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket lifecycle Lifecycle rules. NoSuchLifecycleConfiguration (404) means no rules, not a failure. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket logging Server access logging. Returns an EMPTY document with no LoggingEnabled element when logging is off, rather than erroring. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket replication Replication rules and destination buckets. ReplicationConfigurationNotFoundError has no documented Errors section, so an unrecognised 404 must degrade to not_collected, never to a pass. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket tagging Bucket tags. The not-configured error code is NoSuchTagSet — singular, NOT NoSuchTagSetError — and means no tags, not a failure. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket ownership controls Object ownership / ACL posture. OwnershipControlsNotFoundError has no documented Errors section, so an unrecognised 404 must degrade to not_collected, never to a pass. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services rds db instances DB instances ONLY — clusters never appear here. DBClusterIdentifier is populated iff the instance belongs to a cluster: emit one row per cluster and one per standalone instance, never both. For Aurora the security posture lives on the CLUSTER (StorageEncrypted, KmsKeyId, BackupRetentionPeriod, DeletionProtection, EnabledCloudwatchLogsExports), so reading them off the instance reports the wrong object. Neptune and DocumentDB come back here too — filter by Engine. Shape asymmetries vs DBCluster: DBSubnetGroup and Endpoint are objects here but bare strings there, and the status field is DBInstanceStatus, not Status. TagList is inline, so ListTagsForResource is redundant.
• List List all Amazon Web Services rds db clusters DB clusters ONLY — Aurora and non-Aurora Multi-AZ. Instances never appear here. high_availability_mode cannot be a boolean: DBInstance.MultiAZ (one hidden standby), DBCluster.MultiAZ (members span AZs) and non-Aurora Multi-AZ clusters (two readable standbys) are three different failure domains. ReadReplicaDBClusterIdentifiers explicitly excludes cross-Region Aurora read replicas, so cross-region replicas are invisible from the source.
• List List all Amazon Web Services rds global clusters Aurora Global Databases only — the one API that returns cross-Region membership directly. Each GlobalClusterMember carries DBClusterArn, whose region segment is the residency answer, plus IsWriter and Readers, covering the writer and every secondary. It does not replace per-region enumeration: a cross-Region replica made with CreateDBCluster and ReplicationSourceIdentifier has no GlobalClusterIdentifier and never appears here, and neither do instance-level cross-Region replicas. Treat it as a cross-check on top of enumeration, not the source of truth.
• List List all Amazon Web Services rds db snapshots INSTANCE snapshots only — Aurora/cluster snapshots never appear here, so calling only this against an Aurora-heavy customer returns empty and would wrongly conclude they have no backups. The encryption field is Encrypted (contrast DBClusterSnapshot's StorageEncrypted). The RDS default is the mirror image of EC2's and is already correct: IncludeShared and IncludePublic both default false — leave them off, or you pull in other people's public snapshots. Automated snapshots cannot be shared at all, so skip the attribute call and set shared_with_accounts [] and is_public false by construction. Do not map location from SourceRegion — it means 'created in OR copied from'; parse the ARN instead.
• List List all Amazon Web Services rds db cluster snapshots CLUSTER snapshots only. The encryption field is StorageEncrypted, NOT Encrypted — one shared mapper reads undefined here and reports every Aurora snapshot as unencrypted, a false-negative security finding at scale. DBClusterSnapshot also has no SourceRegion and no scalar AvailabilityZone. Neither RDS snapshot type carries an owner field: parse source_account_ref from the ARN.
• List List all Amazon Web Services rds snapshot attributes Sharing ACL for one manual instance snapshot. Skip entirely when SnapshotType is automated — automated snapshots cannot be shared, which removes over 90% of the per-item RDS calls. A manual snapshot can be shared with at most 20 accounts, and an encrypted snapshot cannot be made public, so encrypted && is_public is an impossible state worth asserting on.
• List List all Amazon Web Services rds cluster snapshot attributes Sharing ACL for one manual cluster snapshot. Same automated-snapshot skip applies.
• List List all Amazon Web Services rds db parameters Instance parameter group values — the only path to min_tls_version, via a per-engine adapter. Three traps: this returns the GROUP's value, not the running instance's, so check ParameterApplyStatus == in-sync or a static parameter may claim TLS is enforced while the database still accepts plaintext; a parameter never set has NO ParameterValue element at all, so absent is not off and the engine default must be resolved; and enforcing TLS is not the same as setting a version floor. Use the parameter-name filter — it collapses 4-10 paginated calls per group to 1.
• List List all Amazon Web Services rds db cluster parameters Cluster parameter group values. Aurora MySQL exposes tls_version as a comma-separated ALLOW-LIST to parse, not a floor, and has a second invisible audit path (server_audit_logs_upload) that never appears in EnabledCloudwatchLogsExports.
• List List all Amazon Web Services rds subnet groups DB subnet groups, for placing databases into the network graph. Note PubliclyAccessible true does not mean reachable and false does not mean safe — real exposure also needs route tables.
• List List all Amazon Web Services ec 2 regions Regions for the CALLING account only. Not paginated. Enumerate only optInStatus in {opt-in-not-required, opted-in} — calling RDS or EC2 in a not-opted-in region fails. This uses a different enum from account:ListRegions and only ever describes the caller, so keep it as the standalone-account fallback. Never hardcode a region list. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 vpcs VPCs. Account-and-region-wide — there is no per-VPC fan-out anywhere in the EC2 network group. Check blockPublicAccessStates: VPC Block Public Access can override an internet gateway route, so a subnet with an igw- route may still be unreachable. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 subnets Subnets. VPC Flow Logs have NO sampling rate — no such field and no such setting exists. The nearest neighbour is maxAggregationInterval (60 or 600 seconds only), which is a batching window, not a fraction of traffic. flow_log_sampling_rate must be emitted as not_supported_by_provider. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 flow logs Flow logs, returned as one flat list keyed only by resourceId. Flow logs attach at VPC, SUBNET or ENI level, so checking resourceId == subnetId alone gives false negatives for the very common 'one flow log on the VPC' setup. Also gate on flowLogStatus == ACTIVE AND deliverLogsStatus == SUCCESS — a flow log can exist and be silently failing delivery. Flow logs never capture DNS, IMDS, DHCP, ARP or Windows activation traffic by design. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 route tables Route tables. MaxResults is capped at 100 here, not 1000. A subnet not explicitly associated with a route table is IMPLICITLY associated with the VPC main table, and AWS does not return the subnet id for implicit associations — joining only on association.subnetId silently marks every default-configured subnet as having no internet route. Fall back to the main table (association.main == true). Distinguish igw- (true internet) from nat- (outbound only, subnet is private) and eigw- (IPv6 outbound only). All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 network acls Network ACLs — a genuinely different primitive from security groups: stateless, allow AND deny, ORDERED by a real ruleNumber, subnet-attached. NACL protocol is a String holding a NUMBER ("-1", "6", "17"), never a name. NACL entries have no description field at all. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 network interfaces ENIs. This is the ONLY path from security groups to subnets — SecurityGroup carries no list of attached interfaces and the relationship does not exist in AWS's model. Join groupSet -> subnetId, and be honest that this is 'groups observed in use right now', not configuration: an autoscaling event changes it. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 security groups Security groups: stateful, ALLOW-ONLY, unordered, ENI-attached. Four rule fields are synthetic here — action is always allow (no deny exists in the model), priority does not exist (rules are an unordered set evaluated as a union, so any priority is fabricated and array index must not be used), enabled does not exist (a rule exists or is revoked), and logging_enabled does not exist (flow logs are per VPC/subnet/ENI and never name the deciding rule). ipProtocol "-1" means all protocols AND all ports — never default to 0-65535. For icmp, fromPort/toPort are TYPE and CODE, not ports. Batch by region with GroupId.N, not one call per database. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 security group rules Per-rule detail, and the only source of a real per-rule description on security groups. Prefix-list rules carry no CIDRs — resolve them via GetManagedPrefixListEntries. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 prefix lists Managed prefix lists referenced by security-group rules. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 prefix list entries CIDRs behind one prefix list — one of only three genuine per-item calls in the whole network group. Store the list version, or a later diff cannot distinguish our change from Amazon's. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 VPC peering VPC peering connections. allows_transit is STRUCTURALLY always false — AWS does not support transitive peering, full stop — and route_exchange_settings has no equivalent (the only remaining option is allowDnsResolutionFromRemoteVpc, which is DNS, not routing). An active peering does not mean connected: peering exchanges no routes automatically, so cross-check DescribeRouteTables for routes targeting the peering id. Orient by ACCOUNT, not requester/accepter, and dedup inter-region peerings on vpcPeeringConnectionId — the same link is visible from both regions. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 transit gateways Transit gateways. The single highest-signal TGW finding lives here, not on the attachment: defaultRouteTableAssociation and defaultRouteTablePropagation both set to enable is the flat-mesh default where every VPC reaches every other VPC. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 tgw attachments TGW attachments. allows_transit is NOT on this object: the association sub-object carries a single route-table id and propagations are entirely absent. The classic isolation pattern produces attachments that look identical here with completely different blast radii. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 tgw route tables TGW route tables — the anchor for the two association/propagation calls that actually determine reachability. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 tgw associations Which attachments are ASSOCIATED with one TGW route table. Half of the reachability rule: A reaches B iff B is in propagations[associations-inverse(A)]. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 tgw propagations Which attachments PROPAGATE into one TGW route table. The other half of the reachability rule — without it, transit is unknowable from the attachment alone. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 snapshots EBS snapshots. Owner.1=self is a CORRECTNESS REQUIREMENT, not an optimisation: every AWS account has create-volume permission on every public snapshot, and the default returns everything you can create a volume from — an unscoped call enumerates every public EBS snapshot in all of AWS and paginates effectively forever. (Query name Owner.N, SDK name OwnerIds, CLI --owner-ids: three spellings, one parameter.) The state field is `status`, not `state`, and tags are TagSet, not Tags. There is no sharing field of any kind here, and no region field either — the collector must stamp location on from the endpoint region. AMIs are deliberately excluded: an AMI references snapshot ids already enumerated here, so modelling it double-counts the same bytes. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 snapshot attribute The sharing ACL for ONE snapshot — the only source of shared_with_accounts and is_public, and the most expensive call in the collector: a single scalar SnapshotId with no batch form, one call per snapshot per region. group == "all" (its only legal value) means public; userId entries are the shared accounts. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 snapshot bpa state Regional snapshot Block Public Access, one call per region. This CHANGES how is_public must be read: under block-all-sharing, already-public snapshots are treated as private and are not publicly available, so reporting one as exposed is a false positive. Report both the per-snapshot ACL and the regional posture. All EC2 Describe* actions must be granted on Resource: "*" — AWS states they do not support resource-level permissions, so this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services kms keys Key ids only — {KeyArn, KeyId} and NO metadata at all, so budget 4 calls per key. Pagination is a third dialect: Limit / Marker / NextMarker / Truncated, neither EC2's nor the JSON services' NextToken. This also returns AWS-managed aws/* service keys with no server-side filter, and in a mature account they vastly outnumber customer keys — the DescribeKey cost is paid on every one before KeyManager == CUSTOMER can discard it.
• Get Get single Amazon Web Services kms key by ID Key metadata. Origin has FOUR values, not three: AWS_KMS, EXTERNAL (BYOK), AWS_CLOUDHSM and EXTERNAL_KEY_STORE (XKS). Do not read the deprecated CustomerMasterKeySpec — its documented value list is stale. Carry MultiRegion / MultiRegionConfiguration or the same logical key is reported as N unrelated keys. Call this FIRST and skip GetKeyRotationStatus for anything that is not a symmetric ENCRYPT_DECRYPT key. Works cross-account.
• Get Get single Amazon Web Services kms key rotation by ID Rotation state. All three fields are real — KeyRotationEnabled, RotationPeriodInDays (range 90-2560, default 365) and NextRotationDate — but they are NULL, not false, for asymmetric, HMAC and custom-key-store keys, where rotation is not applicable and false would read as a misconfiguration. AWS-managed keys always rotate and it cannot be changed. Rotation is a shared property of multi-region keys, configured only on the primary. Works cross-account.
• Get Get single Amazon Web Services kms key policy by ID The key policy, as a raw JSON string. Skip ListKeyPolicies entirely — the only valid policy name is 'default'. This does NOT work cross-account, so policy_grants_anyone is unobtainable unless we assume a role into that account. No API answers 'is this key public': naive Principal "*" matching produces FALSE POSITIVES on every normal key, because the standard idiom pairs Principal "*" with a kms:CallerAccount condition. Check for the ABSENCE of a scoping condition (kms:CallerAccount, aws:PrincipalOrgID, aws:PrincipalAccount, kms:ViaService). Grants are a second independent authorization path this does not show. Most KMS reads are also governed by the per-key policy, not just our IAM policy, so partial coverage must surface as permission_denied per key with a count, never as a failed run.
• List List all Amazon Web Services kms aliases Key aliases. Call this ONCE PER REGION, never per key — that is one of the three mitigations that keeps a 500-key, 20-region scan from costing 10,000 requests.
• List List all Amazon Web Services cloudtrail trails Trail configuration. NOT paginated. `enabled` is NOT in this response — a trail can exist, be multi-region, KMS-encrypted and validated while being completely stopped, and this looks identical either way. includeShadowTrails defaults to true, so a naive 20-region sweep returns one multi-region trail 20 times: dedup on TrailARN and treat the record where HomeRegion equals the region called as authoritative. Do NOT set includeShadowTrails false to avoid that — in a member account of an organization trail it returns nothing at all and we would wrongly report the account as unaudited. An absent KmsKeyId means SSE-S3, NOT unencrypted.
• Get Get single Amazon Web Services cloudtrail trail status by ID The ONLY source of whether a trail is actually logging: IsLogging. One extra call per trail per region, not optional. NOT paginated. IsLogging true is still not proof logs arrive — cross-check LatestDeliveryError and LatestDeliveryTime, since a trail writing to a deleted bucket reports true with a stale timestamp.
• Get Get single Amazon Web Services cloudtrail event selector by ID Data-event coverage for one trail. Classic and advanced event selectors are MUTUALLY EXCLUSIVE, so two parsers are needed. Classic is clean: three resource types (AWS::S3::Object, AWS::Lambda::Function, AWS::DynamoDB::Table) with explicit ARN lists. Advanced is a boolean predicate language (Equals/NotEquals/StartsWith/NotStartsWith/EndsWith/NotEndsWith) that no API evaluates for us, where negation can carve arbitrary holes out of a broad match and far more than three resource types are supported — an allowlist of three silently under-reports. Best-effort inference; say so. ExcludeManagementEventSources can carve out kms.amazonaws.com or rdsdata.amazonaws.com, so management coverage is not complete even when IncludeManagementEvents is true.
• List List all Amazon Web Services logs log groups Log groups. limit is 1-50 (small — expect heavy paging) and nextToken EXPIRES AFTER 24 HOURS, so cursors must not be persisted. Do NOT use logGroupNamePattern: when it is set the response contains only arn, creationTime and logGroupName, silently dropping retentionInDays and kmsKeyId, the two fields we need. An absent retentionInDays means NEVER EXPIRE, not zero. An absent kmsKeyId means AWS-owned SSE, not unencrypted. retention_locked does not exist for CloudWatch Logs — anyone with logs:PutRetentionPolicy can shorten retention to 1 day, and deletionProtectionEnabled protects the group from deletion, not the retention period. logGroupClass DELIVERY keeps events one day only regardless of retention.

No tools match your search.