AWS Cloud Control v1.27.0, Apr 14 25

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.27.0 published on Monday, Apr 14, 2025 by Pulumi

pulumi/pulumi-aws-native

aws-native.iot.getAccountAuditConfiguration

Explore with Pulumi AI

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.27.0 published on Monday, Apr 14, 2025 by Pulumi

pulumi/pulumi-aws-native

Using getAccountAuditConfiguration

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getAccountAuditConfiguration(args: GetAccountAuditConfigurationArgs, opts?: InvokeOptions): Promise<GetAccountAuditConfigurationResult>
function getAccountAuditConfigurationOutput(args: GetAccountAuditConfigurationOutputArgs, opts?: InvokeOptions): Output<GetAccountAuditConfigurationResult>

def get_account_audit_configuration(account_id: Optional[str] = None,
                                    opts: Optional[InvokeOptions] = None) -> GetAccountAuditConfigurationResult
def get_account_audit_configuration_output(account_id: Optional[pulumi.Input[str]] = None,
                                    opts: Optional[InvokeOptions] = None) -> Output[GetAccountAuditConfigurationResult]

func LookupAccountAuditConfiguration(ctx *Context, args *LookupAccountAuditConfigurationArgs, opts ...InvokeOption) (*LookupAccountAuditConfigurationResult, error)
func LookupAccountAuditConfigurationOutput(ctx *Context, args *LookupAccountAuditConfigurationOutputArgs, opts ...InvokeOption) LookupAccountAuditConfigurationResultOutput

> Note: This function is named LookupAccountAuditConfiguration in the Go SDK.

public static class GetAccountAuditConfiguration 
{
    public static Task<GetAccountAuditConfigurationResult> InvokeAsync(GetAccountAuditConfigurationArgs args, InvokeOptions? opts = null)
    public static Output<GetAccountAuditConfigurationResult> Invoke(GetAccountAuditConfigurationInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetAccountAuditConfigurationResult> getAccountAuditConfiguration(GetAccountAuditConfigurationArgs args, InvokeOptions options)
public static Output<GetAccountAuditConfigurationResult> getAccountAuditConfiguration(GetAccountAuditConfigurationArgs args, InvokeOptions options)

fn::invoke:
  function: aws-native:iot:getAccountAuditConfiguration
  arguments:
    # arguments dictionary

The following arguments are supported:

AccountId string: Your 12-digit account ID (used as the primary identifier for the CloudFormation resource).

AccountId string: Your 12-digit account ID (used as the primary identifier for the CloudFormation resource).

accountId String: Your 12-digit account ID (used as the primary identifier for the CloudFormation resource).

accountId string: Your 12-digit account ID (used as the primary identifier for the CloudFormation resource).

account_id str: Your 12-digit account ID (used as the primary identifier for the CloudFormation resource).

accountId String: Your 12-digit account ID (used as the primary identifier for the CloudFormation resource).

getAccountAuditConfiguration Result

The following output properties are available:

AuditCheckConfigurations Pulumi.AwsNative.IoT.Outputs.AccountAuditConfigurationAuditCheckConfigurations

Specifies which audit checks are enabled and disabled for this account.

Some data collection might start immediately when certain checks are enabled. When a check is disabled, any data collected so far in relation to the check is deleted. To disable a check, set the value of the Enabled: key to false .

If an enabled check is removed from the template, it will also be disabled.

You can't disable a check if it's used by any scheduled audit. You must delete the check from the scheduled audit or delete the scheduled audit itself to disable the check.

For more information on available audit checks see AWS::IoT::AccountAuditConfiguration AuditCheckConfigurations

AuditNotificationTargetConfigurations Pulumi.AwsNative.IoT.Outputs.AccountAuditConfigurationAuditNotificationTargetConfigurations

Information about the targets to which audit notifications are sent.

RoleArn string

The ARN of the role that grants permission to AWS IoT to access information about your devices, policies, certificates and other items as required when performing an audit.

AuditCheckConfigurations AccountAuditConfigurationAuditCheckConfigurations

Specifies which audit checks are enabled and disabled for this account.

If an enabled check is removed from the template, it will also be disabled.

You can't disable a check if it's used by any scheduled audit. You must delete the check from the scheduled audit or delete the scheduled audit itself to disable the check.

For more information on available audit checks see AWS::IoT::AccountAuditConfiguration AuditCheckConfigurations

AuditNotificationTargetConfigurations AccountAuditConfigurationAuditNotificationTargetConfigurations

Information about the targets to which audit notifications are sent.

RoleArn string

The ARN of the role that grants permission to AWS IoT to access information about your devices, policies, certificates and other items as required when performing an audit.

auditCheckConfigurations AccountAuditConfigurationAuditCheckConfigurations

Specifies which audit checks are enabled and disabled for this account.

If an enabled check is removed from the template, it will also be disabled.

You can't disable a check if it's used by any scheduled audit. You must delete the check from the scheduled audit or delete the scheduled audit itself to disable the check.

For more information on available audit checks see AWS::IoT::AccountAuditConfiguration AuditCheckConfigurations

auditNotificationTargetConfigurations AccountAuditConfigurationAuditNotificationTargetConfigurations

Information about the targets to which audit notifications are sent.

roleArn String

The ARN of the role that grants permission to AWS IoT to access information about your devices, policies, certificates and other items as required when performing an audit.

auditCheckConfigurations AccountAuditConfigurationAuditCheckConfigurations

Specifies which audit checks are enabled and disabled for this account.

If an enabled check is removed from the template, it will also be disabled.

You can't disable a check if it's used by any scheduled audit. You must delete the check from the scheduled audit or delete the scheduled audit itself to disable the check.

For more information on available audit checks see AWS::IoT::AccountAuditConfiguration AuditCheckConfigurations

auditNotificationTargetConfigurations AccountAuditConfigurationAuditNotificationTargetConfigurations

Information about the targets to which audit notifications are sent.

roleArn string

The ARN of the role that grants permission to AWS IoT to access information about your devices, policies, certificates and other items as required when performing an audit.

audit_check_configurations AccountAuditConfigurationAuditCheckConfigurations

Specifies which audit checks are enabled and disabled for this account.

If an enabled check is removed from the template, it will also be disabled.

You can't disable a check if it's used by any scheduled audit. You must delete the check from the scheduled audit or delete the scheduled audit itself to disable the check.

For more information on available audit checks see AWS::IoT::AccountAuditConfiguration AuditCheckConfigurations

audit_notification_target_configurations AccountAuditConfigurationAuditNotificationTargetConfigurations

Information about the targets to which audit notifications are sent.

role_arn str

The ARN of the role that grants permission to AWS IoT to access information about your devices, policies, certificates and other items as required when performing an audit.

auditCheckConfigurations Property Map

Specifies which audit checks are enabled and disabled for this account.

If an enabled check is removed from the template, it will also be disabled.

You can't disable a check if it's used by any scheduled audit. You must delete the check from the scheduled audit or delete the scheduled audit itself to disable the check.

For more information on available audit checks see AWS::IoT::AccountAuditConfiguration AuditCheckConfigurations

auditNotificationTargetConfigurations Property Map

Information about the targets to which audit notifications are sent.

roleArn String

The ARN of the role that grants permission to AWS IoT to access information about your devices, policies, certificates and other items as required when performing an audit.

Supporting Types

AccountAuditConfigurationAuditCheckConfiguration

Enabled bool: True if the check is enabled.

Enabled bool: True if the check is enabled.

enabled Boolean: True if the check is enabled.

enabled boolean: True if the check is enabled.

enabled bool: True if the check is enabled.

enabled Boolean: True if the check is enabled.

AccountAuditConfigurationAuditCheckConfigurations

AuthenticatedCognitoRoleOverlyPermissiveCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of an authenticated Amazon Cognito identity pool role. For this check, AWS IoT Device Defender audits all Amazon Cognito identity pools that have been used to connect to the AWS IoT message broker during the 31 days before the audit is performed.
CaCertificateExpiringCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if a CA certificate is expiring. This check applies to CA certificates expiring within 30 days or that have expired.
CaCertificateKeyQualityCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the CA certificate key. The quality checks if the key is in a valid format, not expired, and if the key meets a minimum required size. This check applies to CA certificates that are ACTIVE or PENDING_TRANSFER .
ConflictingClientIdsCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple devices connect using the same client ID.
DeviceCertificateAgeCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationDeviceCertAgeAuditCheckConfiguration: Checks when a device certificate has been active for a number of days greater than or equal to the number you specify.
DeviceCertificateExpiringCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationDeviceCertExpirationAuditCheckConfiguration: Checks if a device certificate is expiring. By default, this check applies to device certificates expiring within 30 days or that have expired. You can modify this threshold by configuring the DeviceCertExpirationAuditCheckConfiguration.
DeviceCertificateKeyQualityCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the device certificate key. The quality checks if the key is in a valid format, not expired, signed by a registered certificate authority, and if the key meets a minimum required size.
DeviceCertificateSharedCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT .
IntermediateCaRevokedForActiveDeviceCertificatesCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if device certificates are still active despite being revoked by an intermediate CA.
IoTPolicyPotentialMisConfigurationCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if an AWS IoT policy is potentially misconfigured. Misconfigured policies, including overly permissive policies, can cause security incidents like allowing devices access to unintended resources. This check is a warning for you to make sure that only intended actions are allowed before updating the policy.
IotPolicyOverlyPermissiveCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role.
IotRoleAliasAllowsAccessToUnusedServicesCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year.
IotRoleAliasOverlyPermissiveCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive.
LoggingDisabledCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if AWS IoT logs are disabled.
RevokedCaCertificateStillActiveCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked CA certificate is still active.
RevokedDeviceCertificateStillActiveCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked device certificate is still active.
UnauthenticatedCognitoRoleOverlyPermissiveCheck Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditCheckConfiguration: Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive.

AuthenticatedCognitoRoleOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of an authenticated Amazon Cognito identity pool role. For this check, AWS IoT Device Defender audits all Amazon Cognito identity pools that have been used to connect to the AWS IoT message broker during the 31 days before the audit is performed.
CaCertificateExpiringCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a CA certificate is expiring. This check applies to CA certificates expiring within 30 days or that have expired.
CaCertificateKeyQualityCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the CA certificate key. The quality checks if the key is in a valid format, not expired, and if the key meets a minimum required size. This check applies to CA certificates that are ACTIVE or PENDING_TRANSFER .
ConflictingClientIdsCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple devices connect using the same client ID.
DeviceCertificateAgeCheck AccountAuditConfigurationDeviceCertAgeAuditCheckConfiguration: Checks when a device certificate has been active for a number of days greater than or equal to the number you specify.
DeviceCertificateExpiringCheck AccountAuditConfigurationDeviceCertExpirationAuditCheckConfiguration: Checks if a device certificate is expiring. By default, this check applies to device certificates expiring within 30 days or that have expired. You can modify this threshold by configuring the DeviceCertExpirationAuditCheckConfiguration.
DeviceCertificateKeyQualityCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the device certificate key. The quality checks if the key is in a valid format, not expired, signed by a registered certificate authority, and if the key meets a minimum required size.
DeviceCertificateSharedCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT .
IntermediateCaRevokedForActiveDeviceCertificatesCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if device certificates are still active despite being revoked by an intermediate CA.
IoTPolicyPotentialMisConfigurationCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if an AWS IoT policy is potentially misconfigured. Misconfigured policies, including overly permissive policies, can cause security incidents like allowing devices access to unintended resources. This check is a warning for you to make sure that only intended actions are allowed before updating the policy.
IotPolicyOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role.
IotRoleAliasAllowsAccessToUnusedServicesCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year.
IotRoleAliasOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive.
LoggingDisabledCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if AWS IoT logs are disabled.
RevokedCaCertificateStillActiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked CA certificate is still active.
RevokedDeviceCertificateStillActiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked device certificate is still active.
UnauthenticatedCognitoRoleOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive.

authenticatedCognitoRoleOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of an authenticated Amazon Cognito identity pool role. For this check, AWS IoT Device Defender audits all Amazon Cognito identity pools that have been used to connect to the AWS IoT message broker during the 31 days before the audit is performed.
caCertificateExpiringCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a CA certificate is expiring. This check applies to CA certificates expiring within 30 days or that have expired.
caCertificateKeyQualityCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the CA certificate key. The quality checks if the key is in a valid format, not expired, and if the key meets a minimum required size. This check applies to CA certificates that are ACTIVE or PENDING_TRANSFER .
conflictingClientIdsCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple devices connect using the same client ID.
deviceCertificateAgeCheck AccountAuditConfigurationDeviceCertAgeAuditCheckConfiguration: Checks when a device certificate has been active for a number of days greater than or equal to the number you specify.
deviceCertificateExpiringCheck AccountAuditConfigurationDeviceCertExpirationAuditCheckConfiguration: Checks if a device certificate is expiring. By default, this check applies to device certificates expiring within 30 days or that have expired. You can modify this threshold by configuring the DeviceCertExpirationAuditCheckConfiguration.
deviceCertificateKeyQualityCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the device certificate key. The quality checks if the key is in a valid format, not expired, signed by a registered certificate authority, and if the key meets a minimum required size.
deviceCertificateSharedCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT .
intermediateCaRevokedForActiveDeviceCertificatesCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if device certificates are still active despite being revoked by an intermediate CA.
ioTPolicyPotentialMisConfigurationCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if an AWS IoT policy is potentially misconfigured. Misconfigured policies, including overly permissive policies, can cause security incidents like allowing devices access to unintended resources. This check is a warning for you to make sure that only intended actions are allowed before updating the policy.
iotPolicyOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role.
iotRoleAliasAllowsAccessToUnusedServicesCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year.
iotRoleAliasOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive.
loggingDisabledCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if AWS IoT logs are disabled.
revokedCaCertificateStillActiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked CA certificate is still active.
revokedDeviceCertificateStillActiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked device certificate is still active.
unauthenticatedCognitoRoleOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive.

authenticatedCognitoRoleOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of an authenticated Amazon Cognito identity pool role. For this check, AWS IoT Device Defender audits all Amazon Cognito identity pools that have been used to connect to the AWS IoT message broker during the 31 days before the audit is performed.
caCertificateExpiringCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a CA certificate is expiring. This check applies to CA certificates expiring within 30 days or that have expired.
caCertificateKeyQualityCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the CA certificate key. The quality checks if the key is in a valid format, not expired, and if the key meets a minimum required size. This check applies to CA certificates that are ACTIVE or PENDING_TRANSFER .
conflictingClientIdsCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple devices connect using the same client ID.
deviceCertificateAgeCheck AccountAuditConfigurationDeviceCertAgeAuditCheckConfiguration: Checks when a device certificate has been active for a number of days greater than or equal to the number you specify.
deviceCertificateExpiringCheck AccountAuditConfigurationDeviceCertExpirationAuditCheckConfiguration: Checks if a device certificate is expiring. By default, this check applies to device certificates expiring within 30 days or that have expired. You can modify this threshold by configuring the DeviceCertExpirationAuditCheckConfiguration.
deviceCertificateKeyQualityCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the device certificate key. The quality checks if the key is in a valid format, not expired, signed by a registered certificate authority, and if the key meets a minimum required size.
deviceCertificateSharedCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT .
intermediateCaRevokedForActiveDeviceCertificatesCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if device certificates are still active despite being revoked by an intermediate CA.
ioTPolicyPotentialMisConfigurationCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if an AWS IoT policy is potentially misconfigured. Misconfigured policies, including overly permissive policies, can cause security incidents like allowing devices access to unintended resources. This check is a warning for you to make sure that only intended actions are allowed before updating the policy.
iotPolicyOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role.
iotRoleAliasAllowsAccessToUnusedServicesCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year.
iotRoleAliasOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive.
loggingDisabledCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if AWS IoT logs are disabled.
revokedCaCertificateStillActiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked CA certificate is still active.
revokedDeviceCertificateStillActiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked device certificate is still active.
unauthenticatedCognitoRoleOverlyPermissiveCheck AccountAuditConfigurationAuditCheckConfiguration: Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive.

authenticated_cognito_role_overly_permissive_check AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of an authenticated Amazon Cognito identity pool role. For this check, AWS IoT Device Defender audits all Amazon Cognito identity pools that have been used to connect to the AWS IoT message broker during the 31 days before the audit is performed.
ca_certificate_expiring_check AccountAuditConfigurationAuditCheckConfiguration: Checks if a CA certificate is expiring. This check applies to CA certificates expiring within 30 days or that have expired.
ca_certificate_key_quality_check AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the CA certificate key. The quality checks if the key is in a valid format, not expired, and if the key meets a minimum required size. This check applies to CA certificates that are ACTIVE or PENDING_TRANSFER .
conflicting_client_ids_check AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple devices connect using the same client ID.
device_certificate_age_check AccountAuditConfigurationDeviceCertAgeAuditCheckConfiguration: Checks when a device certificate has been active for a number of days greater than or equal to the number you specify.
device_certificate_expiring_check AccountAuditConfigurationDeviceCertExpirationAuditCheckConfiguration: Checks if a device certificate is expiring. By default, this check applies to device certificates expiring within 30 days or that have expired. You can modify this threshold by configuring the DeviceCertExpirationAuditCheckConfiguration.
device_certificate_key_quality_check AccountAuditConfigurationAuditCheckConfiguration: Checks the quality of the device certificate key. The quality checks if the key is in a valid format, not expired, signed by a registered certificate authority, and if the key meets a minimum required size.
device_certificate_shared_check AccountAuditConfigurationAuditCheckConfiguration: Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT .
intermediate_ca_revoked_for_active_device_certificates_check AccountAuditConfigurationAuditCheckConfiguration: Checks if device certificates are still active despite being revoked by an intermediate CA.
io_t_policy_potential_mis_configuration_check AccountAuditConfigurationAuditCheckConfiguration: Checks if an AWS IoT policy is potentially misconfigured. Misconfigured policies, including overly permissive policies, can cause security incidents like allowing devices access to unintended resources. This check is a warning for you to make sure that only intended actions are allowed before updating the policy.
iot_policy_overly_permissive_check AccountAuditConfigurationAuditCheckConfiguration: Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role.
iot_role_alias_allows_access_to_unused_services_check AccountAuditConfigurationAuditCheckConfiguration: Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year.
iot_role_alias_overly_permissive_check AccountAuditConfigurationAuditCheckConfiguration: Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive.
logging_disabled_check AccountAuditConfigurationAuditCheckConfiguration: Checks if AWS IoT logs are disabled.
revoked_ca_certificate_still_active_check AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked CA certificate is still active.
revoked_device_certificate_still_active_check AccountAuditConfigurationAuditCheckConfiguration: Checks if a revoked device certificate is still active.
unauthenticated_cognito_role_overly_permissive_check AccountAuditConfigurationAuditCheckConfiguration: Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive.

authenticatedCognitoRoleOverlyPermissiveCheck Property Map: Checks the permissiveness of an authenticated Amazon Cognito identity pool role. For this check, AWS IoT Device Defender audits all Amazon Cognito identity pools that have been used to connect to the AWS IoT message broker during the 31 days before the audit is performed.
caCertificateExpiringCheck Property Map: Checks if a CA certificate is expiring. This check applies to CA certificates expiring within 30 days or that have expired.
caCertificateKeyQualityCheck Property Map: Checks the quality of the CA certificate key. The quality checks if the key is in a valid format, not expired, and if the key meets a minimum required size. This check applies to CA certificates that are ACTIVE or PENDING_TRANSFER .
conflictingClientIdsCheck Property Map: Checks if multiple devices connect using the same client ID.
deviceCertificateAgeCheck Property Map: Checks when a device certificate has been active for a number of days greater than or equal to the number you specify.
deviceCertificateExpiringCheck Property Map: Checks if a device certificate is expiring. By default, this check applies to device certificates expiring within 30 days or that have expired. You can modify this threshold by configuring the DeviceCertExpirationAuditCheckConfiguration.
deviceCertificateKeyQualityCheck Property Map: Checks the quality of the device certificate key. The quality checks if the key is in a valid format, not expired, signed by a registered certificate authority, and if the key meets a minimum required size.
deviceCertificateSharedCheck Property Map: Checks if multiple concurrent connections use the same X.509 certificate to authenticate with AWS IoT .
intermediateCaRevokedForActiveDeviceCertificatesCheck Property Map: Checks if device certificates are still active despite being revoked by an intermediate CA.
ioTPolicyPotentialMisConfigurationCheck Property Map: Checks if an AWS IoT policy is potentially misconfigured. Misconfigured policies, including overly permissive policies, can cause security incidents like allowing devices access to unintended resources. This check is a warning for you to make sure that only intended actions are allowed before updating the policy.
iotPolicyOverlyPermissiveCheck Property Map: Checks the permissiveness of a policy attached to an authenticated Amazon Cognito identity pool role.
iotRoleAliasAllowsAccessToUnusedServicesCheck Property Map: Checks if a role alias has access to services that haven't been used for the AWS IoT device in the last year.
iotRoleAliasOverlyPermissiveCheck Property Map: Checks if the temporary credentials provided by AWS IoT role aliases are overly permissive.
loggingDisabledCheck Property Map: Checks if AWS IoT logs are disabled.
revokedCaCertificateStillActiveCheck Property Map: Checks if a revoked CA certificate is still active.
revokedDeviceCertificateStillActiveCheck Property Map: Checks if a revoked device certificate is still active.
unauthenticatedCognitoRoleOverlyPermissiveCheck Property Map: Checks if policy attached to an unauthenticated Amazon Cognito identity pool role is too permissive.

AccountAuditConfigurationAuditNotificationTarget

Enabled bool: True if notifications to the target are enabled.
RoleArn string: The ARN of the role that grants permission to send notifications to the target.
TargetArn string: The ARN of the target (SNS topic) to which audit notifications are sent.

Enabled bool: True if notifications to the target are enabled.
RoleArn string: The ARN of the role that grants permission to send notifications to the target.
TargetArn string: The ARN of the target (SNS topic) to which audit notifications are sent.

enabled Boolean: True if notifications to the target are enabled.
roleArn String: The ARN of the role that grants permission to send notifications to the target.
targetArn String: The ARN of the target (SNS topic) to which audit notifications are sent.

enabled boolean: True if notifications to the target are enabled.
roleArn string: The ARN of the role that grants permission to send notifications to the target.
targetArn string: The ARN of the target (SNS topic) to which audit notifications are sent.

enabled bool: True if notifications to the target are enabled.
role_arn str: The ARN of the role that grants permission to send notifications to the target.
target_arn str: The ARN of the target (SNS topic) to which audit notifications are sent.

enabled Boolean: True if notifications to the target are enabled.
roleArn String: The ARN of the role that grants permission to send notifications to the target.
targetArn String: The ARN of the target (SNS topic) to which audit notifications are sent.

AccountAuditConfigurationAuditNotificationTargetConfigurations

Sns Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationAuditNotificationTarget: The Sns notification target.

Sns AccountAuditConfigurationAuditNotificationTarget: The Sns notification target.

sns AccountAuditConfigurationAuditNotificationTarget: The Sns notification target.

sns AccountAuditConfigurationAuditNotificationTarget: The Sns notification target.

sns AccountAuditConfigurationAuditNotificationTarget: The Sns notification target.

sns Property Map: The Sns notification target.

AccountAuditConfigurationCertAgeCheckCustomConfiguration

CertAgeThresholdInDays string: The number of days that defines when a device certificate is considered to have aged. The check will report a finding if a certificate has been active for a number of days greater than or equal to this threshold value.

CertAgeThresholdInDays string: The number of days that defines when a device certificate is considered to have aged. The check will report a finding if a certificate has been active for a number of days greater than or equal to this threshold value.

certAgeThresholdInDays String: The number of days that defines when a device certificate is considered to have aged. The check will report a finding if a certificate has been active for a number of days greater than or equal to this threshold value.

certAgeThresholdInDays string: The number of days that defines when a device certificate is considered to have aged. The check will report a finding if a certificate has been active for a number of days greater than or equal to this threshold value.

cert_age_threshold_in_days str: The number of days that defines when a device certificate is considered to have aged. The check will report a finding if a certificate has been active for a number of days greater than or equal to this threshold value.

certAgeThresholdInDays String: The number of days that defines when a device certificate is considered to have aged. The check will report a finding if a certificate has been active for a number of days greater than or equal to this threshold value.

AccountAuditConfigurationCertExpirationCheckCustomConfiguration

CertExpirationThresholdInDays string: The number of days before expiration that defines when a device certificate is considered to be approaching expiration. The check will report a finding if a certificate will expire within this number of days.

CertExpirationThresholdInDays string: The number of days before expiration that defines when a device certificate is considered to be approaching expiration. The check will report a finding if a certificate will expire within this number of days.

certExpirationThresholdInDays String: The number of days before expiration that defines when a device certificate is considered to be approaching expiration. The check will report a finding if a certificate will expire within this number of days.

certExpirationThresholdInDays string: The number of days before expiration that defines when a device certificate is considered to be approaching expiration. The check will report a finding if a certificate will expire within this number of days.

cert_expiration_threshold_in_days str: The number of days before expiration that defines when a device certificate is considered to be approaching expiration. The check will report a finding if a certificate will expire within this number of days.

certExpirationThresholdInDays String: The number of days before expiration that defines when a device certificate is considered to be approaching expiration. The check will report a finding if a certificate will expire within this number of days.

AccountAuditConfigurationDeviceCertAgeAuditCheckConfiguration

Configuration Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationCertAgeCheckCustomConfiguration: Configuration settings for the device certificate age check, including the threshold in days for certificate age. This configuration is of type CertAgeCheckCustomConfiguration .
Enabled bool: True if the check is enabled.

Configuration AccountAuditConfigurationCertAgeCheckCustomConfiguration: Configuration settings for the device certificate age check, including the threshold in days for certificate age. This configuration is of type CertAgeCheckCustomConfiguration .
Enabled bool: True if the check is enabled.

configuration AccountAuditConfigurationCertAgeCheckCustomConfiguration: Configuration settings for the device certificate age check, including the threshold in days for certificate age. This configuration is of type CertAgeCheckCustomConfiguration .
enabled Boolean: True if the check is enabled.

configuration AccountAuditConfigurationCertAgeCheckCustomConfiguration: Configuration settings for the device certificate age check, including the threshold in days for certificate age. This configuration is of type CertAgeCheckCustomConfiguration .
enabled boolean: True if the check is enabled.

configuration AccountAuditConfigurationCertAgeCheckCustomConfiguration: Configuration settings for the device certificate age check, including the threshold in days for certificate age. This configuration is of type CertAgeCheckCustomConfiguration .
enabled bool: True if the check is enabled.

configuration Property Map: Configuration settings for the device certificate age check, including the threshold in days for certificate age. This configuration is of type CertAgeCheckCustomConfiguration .
enabled Boolean: True if the check is enabled.

AccountAuditConfigurationDeviceCertExpirationAuditCheckConfiguration

Configuration Pulumi.AwsNative.IoT.Inputs.AccountAuditConfigurationCertExpirationCheckCustomConfiguration: Configuration settings for the device certificate expiration check, including the threshold in days before expiration. This configuration is of type CertExpirationCheckCustomConfiguration
Enabled bool: True if the check is enabled.

Configuration AccountAuditConfigurationCertExpirationCheckCustomConfiguration: Configuration settings for the device certificate expiration check, including the threshold in days before expiration. This configuration is of type CertExpirationCheckCustomConfiguration
Enabled bool: True if the check is enabled.

configuration AccountAuditConfigurationCertExpirationCheckCustomConfiguration: Configuration settings for the device certificate expiration check, including the threshold in days before expiration. This configuration is of type CertExpirationCheckCustomConfiguration
enabled Boolean: True if the check is enabled.

configuration AccountAuditConfigurationCertExpirationCheckCustomConfiguration: Configuration settings for the device certificate expiration check, including the threshold in days before expiration. This configuration is of type CertExpirationCheckCustomConfiguration
enabled boolean: True if the check is enabled.

configuration AccountAuditConfigurationCertExpirationCheckCustomConfiguration: Configuration settings for the device certificate expiration check, including the threshold in days before expiration. This configuration is of type CertExpirationCheckCustomConfiguration
enabled bool: True if the check is enabled.

configuration Property Map: Configuration settings for the device certificate expiration check, including the threshold in days before expiration. This configuration is of type CertExpirationCheckCustomConfiguration
enabled Boolean: True if the check is enabled.

Package Details

Repository: AWS Native pulumi/pulumi-aws-native
License: Apache-2.0

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.27.0 published on Monday, Apr 14, 2025 by Pulumi

pulumi/pulumi-aws-native

aws-native.iot.getAccountAuditConfiguration

On this page

On this page

Using getAccountAuditConfiguration

getAccountAuditConfiguration Result

Supporting Types

AccountAuditConfigurationAuditCheckConfiguration

AccountAuditConfigurationAuditCheckConfigurations

AccountAuditConfigurationAuditNotificationTarget

AccountAuditConfigurationAuditNotificationTargetConfigurations

AccountAuditConfigurationCertAgeCheckCustomConfiguration

AccountAuditConfigurationCertExpirationCheckCustomConfiguration

AccountAuditConfigurationDeviceCertAgeAuditCheckConfiguration

AccountAuditConfigurationDeviceCertExpirationAuditCheckConfiguration

Package Details

On this page

On this page