Table: aws_shield_drt_access - Query AWS Shield Advanced SRT Access settings using SQL

AWS Shield Advanced is a DDoS protection service from AWS. The SRT Access settings allow you to configure the access permissions for the AWS Shield Advanced Shield Response Team (SRT) to the resources in your account.

Table Usage Guide

The aws_shield_drt_access table in Steampipe allows you to query the AWS Shield Advanced SRT Access settings and retrieve information about the IAM role and S3 Buckets the SRT should have access to. For more details about the individual fields, please refer to the AWS Shield Advanced API documentation.

Examples

Basic info

select
  role_arn,
  log_bucket_list
from
  aws_shield_drt_access;

select
  role_arn,
  log_bucket_list
from
  aws_shield_drt_access;

Check if the SRT role has the correct permissions

select
  role.arn,
  role.name,
  trust_policy_statement -> 'Principal' -> 'Service' ? 'drt.shield.amazonaws.com' as can_be_assumed_by_shield,
  role.attached_policy_arns ? 'arn:aws:iam::aws:policy/service-role/AWSShieldDRTAccessPolicy' as has_shield_drt_access_policy
from
  aws_shield_drt_access
  join aws_iam_role as role on role.arn = aws_shield_drt_access.role_arn,
  jsonb_array_elements(role.assume_role_policy_std -> 'Statement') as trust_policy_statement;

select
  role.arn,
  role.name,
  trust_policy_statement -> 'Principal' -> 'Service' ? 'drt.shield.amazonaws.com' as can_be_assumed_by_shield,
  role.attached_policy_arns ? 'arn:aws:iam::aws:policy/service-role/AWSShieldDRTAccessPolicy' as has_shield_drt_access_policy
from
  aws_shield_drt_access
  join aws_iam_role as role on role.arn = aws_shield_drt_access.role_arn,
  json_each(role.assume_role_policy_std -> 'Statement') as trust_policy_statement;

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- aws

You can pass the configuration to the command with the --config argument:

steampipe_export_aws --config '<your_config>' aws_shield_drt_access