Amazon Web Services MCP connector

• List List all Amazon Web Services organizations accounts Every account in the organization, in one global sweep — never fan out per region. Account.Paths materialises grouping_path at zero extra cost, so the recursive ListParents climb is only a fallback. Map state from Account.State, not Account.Status, which retires 2026-09-09 and has no CLOSED value. JoinedTimestamp is the org-join date, not the creation date. An empty page is not a terminator: loop until NextToken is null. A standalone account returns AWSOrganizationsNotInUseException (400).
• List List all Amazon Web Services organizations roots The organization root. Exactly one call ever — the quota 'Roots in an organization: 1' is not adjustable, and the throttle is 1 req/s. Root has no Path field (only OUs do), so synthesize o-<orgId>/r-<rootId>/. No created_at exists on Root.
• List List all Amazon Web Services organizations ous Organizational units under one parent, walked breadth-first. Nesting is capped at 5 levels and is not adjustable, so recursion is bounded and needs no cycle guard. Preferred over ListChildren because it returns {Arn, Id, Name, Path} inline and avoids a DescribeOrganizationalUnit per OU at a 2 req/s throttle. No created_at exists on OrganizationalUnit either.
• List List all Amazon Web Services organizations parents The direct parent (an OU or the root) of one account or OU, given as child_id. Every account or OU has exactly one parent, so this always returns a single-element list -- chain calls (feeding the returned Id back in as the next child_id) to walk up to the root instead of expecting a full ancestor chain in one call. Requires the caller to already know a starting child_id (from organizations-accounts or organizations-ous); there is no reverse lookup by name.
• List List all Amazon Web Services organizations accounts for parent Accounts directly under one root or OU, given as parent_id -- the org-tree-scoped counterpart to organizations-accounts (which lists every account in the org in one global sweep). Returns only direct children: accounts nested under a child OU of this parent are not included and need a separate call per child OU. Same Account shape as organizations-accounts, including the State vs deprecated Status distinction.
• List List all Amazon Web Services organizations policies Service control policies. Filter is required and single-valued, so RCPs are a second call with Filter=RESOURCE_CONTROL_POLICY. Management account or delegated administrator only. Filter out the AWS-managed p-FullAWSAccess or target counts are dominated by noise.
• Get Get single Amazon Web Services organizations policy by ID One SCP with its document. Policy.Content is plain JSON and must NOT be URL-decoded — the opposite of IAM's GetPolicyVersion. Applying the IAM decode here mangles the policy.
• List List all Amazon Web Services organizations policy targets Where one SCP is directly attached. Returns direct attachments only; inheritance must be computed from the OU tree because DescribeEffectivePolicy explicitly excludes SCPs — its PolicyType enum has no SERVICE_CONTROL_POLICY entry.
• List List all Amazon Web Services iam account authorization details The primary IAM collector. One paginated sweep returns every user, group, role and policy with GroupList, AttachedManagedPolicies, inline policy documents, Tags and PermissionsBoundary — replacing four of the eight per-user calls. It does NOT cover access keys, MFA devices or login profiles. IAM policy documents here are URL-encoded (RFC 3986): decode only if the string contains %7B, never if it starts with {.
• List List all Amazon Web Services iam users IAM users. Returns UserId, UserName, Arn, Path, CreateDate and PasswordLastUsed only — no Tags, no PermissionsBoundary. IAM users have no email and no display name anywhere in the API. PasswordLastUsed is console sign-in only, records at most one sign-in per 5-minute window, began 2014-10-20, and has a documented gap from 2018-05-03 22:50 PDT to 2018-05-23 14:08 PDT. A key-only user reports no_information forever — that is not 'never signed in'.
• List List all Amazon Web Services iam roles IAM roles. ListRoles DOES return AssumeRolePolicyDocument — the omission list names only PermissionsBoundary, RoleLastUsed and Tags — so GetRole is needed only for last_used_at, boundary and tags. Roles have no long-term credentials and no API lists any, so has_static_keys is structurally false and key_count structurally 0.
• List List all Amazon Web Services iam policies Managed policies. Scope=Local means customer-managed (is_custom). The response already carries DefaultVersionId, so GetPolicy can be skipped and GetPolicyVersion called directly. AttachmentCount (grants) and PermissionsBoundaryUsageCount (restricts) are separate numbers — summing them destroys a security-relevant distinction.
• Get Get single Amazon Web Services iam account password policy by ID The account password policy. A 404 NoSuchEntity here means no policy is configured, so AWS defaults apply — a WEAKER posture. Render it as 'not configured', never as 'unknown', and never as a pass. IAM has no lockout threshold and no breached-password list at all.
• Create Create a Amazon Web Services iam generate credential report Starts the credential report job. WARNING: iam:GenerateCredentialReport is access level Write in the Service Authorization Reference, so it will not appear in a policy built by filtering for read access. Without it GetCredentialReport returns 410. Enabling this is a deliberate decision, not a default.
• Get Get single Amazon Web Services iam credential report by ID The credential report: base64 CSV with sentinels N/A, no_information, not_supported and uppercase TRUE/FALSE. Returns 410 if nobody generated one. It caps at the first two access keys per user and omits service-specific credentials entirely, so it is not the source of truth for static_credentials.
• List List all Amazon Web Services iam access keys Access keys for one user, max 2. Access keys never expire — expires_at is structurally null, not unknown. last_used_at needs a separate GetAccessKeyLastUsed call per key; access keys are the only credential type that has last-used data at all.
• List List all Amazon Web Services iam MFA devices MFA devices for one user. The response carries NO device type — type must be inferred from the SerialNumber shape, and FIDO/passkey vs TOTP is not cleanly distinguishable. Mark any mfa_methods value as derived.
• Get Get single Amazon Web Services iam login profile by ID Console password metadata for one user. A 404 NoSuchEntity is the ANSWER, not an error: it means has_console_access is false. Surfacing it as an integration error turns every programmatic-only user into noise.
• List List all Amazon Web Services iam oidc providers OIDC identity providers in the account. Returns ARNs only — the issuer URL and audience list need GetOpenIDConnectProvider per ARN. Not paginated.
• Get Get single Amazon Web Services iam oidc provider by ID One OIDC provider. Url is stored WITHOUT the https:// scheme while trust-policy condition keys use the bare host — normalise both sides before joining. ClientIDList is the registered audience and can disagree with the :aud condition key; the trust policy is what actually gates the assume. A role trusting this provider with no :sub condition can be assumed by any subject from the issuer — model 'no sub condition' as its own state, never as an empty list.
• List List all Amazon Web Services iam saml providers SAML identity providers in the account. Returns ARNs, ValidUntil and CreateDate. Not paginated. A federated trust to one of these is an external-trust edge on any role whose trust policy names it under Principal.Federated.
• List List all Amazon Web Services securityhub findings Lists ASFF findings via AWS Security Hub GetFindings (POST /findings). No required params beyond region/account_id; optional truto_time_filter narrows results server-side. Paginated (limit, next_cursor; AWS MaxResults capped at 100). A 404 here (or the underlying InvalidAccessException, originally HTTP 401) means Security Hub is not enabled for this account/region — that is normal DATA, not an integration failure. Check ListFindingAggregators first: if cross-region aggregation is on, calling the aggregation region returns everything and fanning out duplicates it all. Compliance.Status has only PASSED|WARNING|FAILED|NOT_AVAILABLE — there is NO NOT_APPLICABLE, and NOT_AVAILABLE conflates 'not applicable' with 'could not check'. Findings whose Config evaluation returned NOT_APPLICABLE are auto-archived after 3 days, so RecordState must explicitly include ARCHIVED (this method's fixed Filters already does) or they vanish; archived findings are permanently deleted after 30 days. Findings over 240 KB have Resource.Details silently stripped.
• List List all Amazon Web Services securityhub enabled standards Lists standards enabled in this region/account via AWS Security Hub GetEnabledStandards (POST /standards/get). No required params beyond region/account_id. Paginated (limit, next_cursor; AWS MaxResults capped at 100). A 404 (or the underlying InvalidAccessException, originally HTTP 401) means Security Hub is not enabled here — that is normal DATA, not an integration failure. enabled_standards is a Security Hub-only concept — the other seven AWS security services have no notion of a compliance standard, and their feature toggles must not be forced into this field. standardVersion is not a field: the version is embedded in the StandardsArn (.../cis-aws-foundations-benchmark/v/1.2.0) and must be string-parsed.
• Get Get single Amazon Web Services securityhub hub by ID Reports whether Security Hub is enabled in this region/account and which finding mapping applies, via AWS Security Hub DescribeHub (GET /accounts). No required params beyond region/account_id. A 404 here (or the underlying InvalidAccessException, originally HTTP 401) is DATA — Security Hub is simply not enabled here — not an integration failure. ControlFindingGenerator branches the whole finding mapping: SECURITY_CONTROL uses Compliance.SecurityControlId and Compliance.AssociatedStandards; STANDARD_CONTROL has those absent and needs ProductFields.StandardsArn or StandardsGuideArn and ProductFields.ControlId or RuleId. SubscribedAt is enablement time, not an evaluation time — it must not be mapped to last_evaluated_at.
• List List all Amazon Web Services securityhub security controls Fetches control metadata via AWS Security Hub BatchGetSecurityControls (POST /securityControls/batchGet), fetched once per collection and cached — never per finding. Required: security_control_ids, one control id like 'IAM.1' (AWS's own API accepts 1-25 ids as an array). Known limitation, verified live: this proxy method currently interpolates security_control_ids as a literal string into the request body, so AWS rejects every input — a single id, a comma-separated list, or a JSON array string — with 400 InvalidInputException ('Expected an array, value was ...'). Calls to this method fail regardless of input until the config is fixed to parse the value into a JSON array. A 404 (or InvalidAccessException) instead means Security Hub itself is not enabled. This is the only source of SeverityRating, the control's inherent risk; a finding's own Severity.Label is INFORMATIONAL on every PASSED finding because it describes the outcome, not the control.
• List List all Amazon Web Services guardduty detectors Detector ids in this region via AWS GuardDuty ListDetectors — one detector per region per account. Returns ids only, not detector objects; hydrate each id with guardduty-detector get. No required params beyond region/account_id. Live-verified: swept 14 regions on the sandbox account and every region returned an empty list (GuardDuty is not enabled anywhere on this account) — the call itself succeeds (200, empty array), so treat an empty result as "GuardDuty not enabled here", not a failure. GuardDuty is regional: sweep every region you care about rather than assuming one region's presence or absence tells you about another.
• List List all Amazon Web Services guardduty list findings Finding ids, max 50 per page, via AWS GuardDuty ListFindings. Requires detector_id from guardduty-detectors. Returns ids ONLY — GetFindings (guardduty-get-findings) is mandatory to hydrate them. ListFindings defaults to returning archived and unarchived findings mixed together; decide explicitly via truto_time_filter rather than inheriting the default. The optional `truto_time_filter` query param is a JSON-encoded object merged directly into the request body ($truto_merge, confirmed by tracing @truto/replace-placeholders to produce a clean merge) — pass the whole body fragment AWS expects at the root, i.e. {"findingCriteria": {"criterion": {...}}}. CRITICAL, live-verified against the sandbox account (with a syntactically-valid but not-owned detector id, so the request reaches AWS's body parser before failing on detectorId ownership): field names must be lowerCamelCase exactly as GuardDuty's JSON REST API defines them (findingCriteria, criterion, gte/eq/...) — {"findingCriteria":{"criterion":{"severity":{"gte":7}}}} and {"findingCriteria":{"criterion":{"type":{"eq":[...]}}}} both parsed correctly and reached the expected detectorId error; PascalCase (FindingCriteria/Criterion/MaxResults) is silently rejected by AWS with the generic "JSON could not be processed" instead. No live detector was found on the sandbox account (see guardduty-detectors) to confirm a real non-empty ListFindings call end-to-end with actual results.
• Get Get single Amazon Web Services guardduty get finding by ID Hydrates a batch of up to 50 finding ids via AWS GuardDuty GetFindings. Requires detector_id (from guardduty-detectors) and finding_ids (from guardduty-list-findings). CONFIG BUG, confirmed by tracing the placeholder resolver (@truto/replace-placeholders): the request body template is `{"findingIds": ["{{query.finding_ids}}"]}`. A single `finding_ids` query value resolves correctly to `["abc123"]`, but passing `finding_ids` more than once (the normal way to send several ids) resolves to a lodash.toString array-join, producing `["abc123,def456"]` — one comma-joined string inside a single array slot, not one array element per id — which GuardDuty will not accept as multiple ids. Until that config is fixed, call this method once per finding id rather than batching. severity is a Double with no severityLabel field anywhere — emit the raw number and mark any band as derived. There is no state field; the closest is service.archived, and service itself is optional. title is optional — fall back to type. resource has no single path: resource.resourceType discriminates about 20 mutually exclusive sub-objects, some of them arrays.
• Get Get single Amazon Web Services guardduty detector by ID One detector's configuration via AWS GuardDuty GetDetector. Requires the detector id (path `id`) from guardduty-detectors — GetDetector rejects an id from a different account/region with "detectorId is not owned by the current account", so do not reuse an id across regions. status is the enablement signal. updatedAt is a configuration-change timestamp, NOT an evaluation timestamp — mapping it into last_evaluated_at would be a lie to the consumer. Live-verified error paths only (no live detector found in the sandbox account, see guardduty-detectors); the response shape below is from the AWS API reference, not a live response.
• List List all Amazon Web Services inspector 2 account status Inspector v2 enablement per account via AWS Inspector2 BatchGetAccountStatus. The caller-controlled query param `truto_inspector_accounts` (JSON-encoded {"accountIds":[...]}) is OPTIONAL — live-verified: omitting it entirely still returns the calling account's own status (AWS defaults accountIds to the caller's account when empty). Live-verified live on the sandbox account (471112750856) across 14 regions: Inspector2 is DISABLED account-wide in every region tried, for every resource type (ec2, ecr, lambda, lambdaCode, codeRepository). state.status is the top-level enablement signal; resourceState breaks it down per scan type, each with its own status (and, only on error, errorCode/errorMessage). There is NO timestamp anywhere in this response, so last_evaluated_at is unreadable for Inspector — record it as such rather than substituting a config timestamp.
• List List all Amazon Web Services inspector 2 coverage statistics Scan coverage counts per resource type via AWS Inspector2 ListCoverageStatistics, grouped by RESOURCE_TYPE (the config's body is static: groupBy=RESOURCE_TYPE, not caller-controlled). No required params beyond region/account_id. Live-verified: this operation is real and works — called live on the sandbox account across regions and got 200 with an empty array each time (Inspector2 is disabled account-wide, so there is nothing to have coverage over; an empty result here is DATA, not a failure). Counts reflect only resource types Inspector2 actually scans (EC2, ECR, Lambda, Lambda code, code repositories) — a resource type with zero enabled scanning simply has no entry, it is not reported as a zero count.
• List List all Amazon Web Services inspector 2 findings Vulnerability findings via AWS Inspector2 ListFindings. The caller-controlled query param `truto_time_filter` (JSON-encoded object merged into the request body — see the guardduty-list-findings gotcha on the same $truto_merge mechanism) is OPTIONAL; omitting it lists all findings with no filter. No required params beyond region/account_id. Live-verified: this operation is real and works — called live on the sandbox account across regions and got 200 with an empty array each time (Inspector2 is disabled account-wide, so there are no findings; an empty result here is DATA, not a failure). Not paginated by this Truto method beyond following nextToken automatically; severity/status here follow Inspector2's own model (COMPLETE/ACTIVE lifecycle, CRITICAL/HIGH/MEDIUM/LOW/INFORMATIONAL/UNTRIAGED severity) which is unrelated to GuardDuty's raw numeric severity.
• List List all Amazon Web Services config recorders Calls AWS Config DescribeConfigurationRecorders to list configuration recorders in this region. No required params beyond region/account_id. NOT paginated. NoSuchConfigurationRecorderException is DATA — AWS Config is off — not a failure. AWS now allows only one recorder per account/region, so this list has at most one item.
• List List all Amazon Web Services config recorder status Calls AWS Config DescribeConfigurationRecorderStatus for whether the recorder is actually recording. No required params beyond region/account_id. NOT paginated. lastStatusChangeTime is the only real timestamp in this response - there is no configSnapshotDeliveryInfo or delivery-channel data here (that belongs to the separate, legacy DeliveryChannelStatus API, which this resource does not call); do not expect those fields. name and arn can both be absent for a service-linked recorder, which instead carries servicePrincipal.
• List List all Amazon Web Services config aggregate compliance Calls AWS Config DescribeAggregateComplianceByConfigRules. Requires aggregator_name (AWS's ConfigurationAggregatorName) - omit it and AWS Config rejects the literal, unresolved placeholder text as the aggregator name with a ValidationException, not the normal NoSuchConfigurationAggregatorException, which is confusing to debug. Per-(rule, account, region) compliance across the whole organization in one paged call, with no AssumeRole per account - Limit up to 1000, cursor-paginated. Counts arrive as {CappedCount, CapExceeded}, not an integer: when CapExceeded is true the count is a CEILING, and mapping it as exact publishes wrong numbers on exactly the largest rules. INSUFFICIENT_DATA is returned but cannot be used as a filter value, and the aggregate variant accepts only COMPLIANT and NON_COMPLIANT as filters despite the enum listing four.
• List List all Amazon Web Services config rule evaluation status Calls AWS Config DescribeConfigRuleEvaluationStatus. No required params beyond region/account_id. Cursor-paginated, Limit up to 50 rules per page. The ONLY source of real Config timestamps for a rule. DescribeComplianceByConfigRule carries no timestamp at all, so pairing this call in is mandatory - substituting our own fetch time would be exactly the staleness lie this model exists to prevent. Use LastSuccessfulEvaluationTime (evaluation), not LastSuccessfulInvocationTime (invocation). Excludes AWS Config Custom Lambda rules from status reporting entirely - only Managed rules and Custom Policy rules appear here.
• List List all Amazon Web Services accessanalyzer analyzers IAM Access Analyzer analyzers. status == ACTIVE is the enablement signal, and this is one of only two of the eight security services with a genuine last_evaluated_at: lastResourceAnalyzedAt.
• Get Get single Amazon Web Services macie session by ID Reports whether Macie is enabled via AWS Macie GetMacieSession (GET /macie). No required params beyond region/account_id. Verified live across 11 regions: when Macie is not enabled, AWS returns HTTP 403 with body {"message": "Macie is not enabled"} — treat that as absence-of-data, not an integration failure. status PAUSED means enabled-but-suspended, not disabled — do not treat PAUSED as 'not enabled' (per AWS docs; not independently verified live since Macie is not enabled anywhere in this sandbox account).
• List List all Amazon Web Services identitystore users Identity Center users. ListUsers returns complete User objects — UserId, UserName, DisplayName, Emails, UserStatus and CreatedAt — so DescribeUser adds nothing for bulk sync. MFA registration state is NOT AVAILABLE through any public API (the console uses an undocumented sso-directory operation with no published wire contract). last_sign_in_at is NOT AVAILABLE either — only CloudTrail UserAuthentication events carry it. has_static_credentials and has_console_access are IAM-only concepts here.
• List List all Amazon Web Services SSO instances Identity Center instances — the bootstrap for IdentityStoreId, InstanceArn, PrimaryRegion and Regions. Capped at 10 instances; do not blindly take [0]. Calling in the WRONG region returns an empty list, not an error, which is indistinguishable from 'the customer does not use Identity Center' — sweep candidate regions rather than trusting one empty result. Note the host is sso.<region>.amazonaws.com, not sso-admin.*.
• List List all Amazon Web Services s 3 buckets All buckets. Pagination is MANDATORY, not an optimisation: unpaginated requests are rejected outright for accounts with a bucket quota above 10,000, and BucketRegion is only returned on paginated requests — without it every bucket needs an extra GetBucketLocation. BucketArn is now returned; use it as provider_ref rather than constructing arn:aws:s3:::<name>, which is wrong outside the aws partition. Directory buckets (S3 Express) are invisible here — a disjoint namespace under s3express-control.
• List List all Amazon Web Services s 3 bucket public access block Bucket-level Block Public Access. NoSuchPublicAccessBlockConfiguration (404) means not configured — all four flags false — and must not be read as blocked. BlockPublicAcls and BlockPublicPolicy are WRITE-TIME GUARDS ONLY: AWS states enabling them does not affect existing policies or ACLs. Only IgnorePublicAcls and RestrictPublicBuckets change effective read access, so computing exposure from the two Block flags produces false clean results. Effective BPA is the account setting OR the bucket setting, per flag. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket policy status Whether the bucket policy grants public access. This is the ONLY policy-derived signal available cross-account: GetBucketPolicy returns 405 Method Not Allowed for a caller outside the bucket owner's account regardless of IAM. Errors 404 NoSuchBucketPolicy when there is no bucket policy at all — the same error code GetBucketPolicy throws, NOT an empty document (live-verified; corrects an earlier claim here). Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket policy The bucket policy document. NoSuchBucketPolicy (404) means no policy, not a failure. Cross-account this returns 405 Method Not Allowed regardless of IAM — map 405 to permission_denied, never to 'no policy'. The document is plain JSON, NOT URL-encoded. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket acl Bucket ACL grants. Public means a Grantee.URI of http://acs.amazonaws.com/groups/global/AllUsers or .../global/AuthenticatedUsers. .../s3/LogDelivery is benign — do not flag it. AuthenticatedUsers is not anonymous (requests must be signed) but means any AWS account on earth, so keep it distinguishable rather than folding it into anonymous access. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket encryption Default encryption. Since January 2023 SSE-S3 is applied to every bucket by default, so 'no default encryption' is an obsolete control and this rarely 404s — the real control is SSEAlgorithm == AES256, i.e. not a customer-managed key. SSEAlgorithm has FOUR values: AES256, aws:kms, aws:kms:dsse, aws:fsx. KMSMasterKeyID may be a key id, an ARN or an ALIAS — store the raw string with a discriminator. The docs are internally inconsistent (KMSMasterKeyID vs KMSKeyID); parse both. ServerSideEncryptionConfigurationNotFoundError has no documented Errors section, so treat an unrecognised 404 as not_collected, never as a pass. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket versioning Versioning state. Returns an EMPTY document with no Status element at all when versioning was never enabled — absent is not the same as Suspended. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket object lock Object Lock. Returns only ObjectLockEnabled (single valid value Enabled) and an optional default rule. retention_locked is NOT a real S3 field: the closest honest mapping is Mode == COMPLIANCE, which is a default for FUTURE objects and says nothing about what is in the bucket now. Legal holds and per-object retention are per object version and would need unbounded per-object calls. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket lifecycle Lifecycle rules. NoSuchLifecycleConfiguration (404) means no rules, not a failure. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket logging Server access logging. Returns an EMPTY document with no LoggingEnabled element when logging is off, rather than erroring. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket replication Replication rules and destination buckets. ReplicationConfigurationNotFoundError has no documented Errors section, so an unrecognised 404 must degrade to not_collected, never to a pass. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket tagging Bucket tags. The not-configured error code is NoSuchTagSet — singular, NOT NoSuchTagSetError — and means no tags, not a failure. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services s 3 bucket ownership controls Object ownership / ACL posture. OwnershipControlsNotFoundError has no documented Errors section, so an unrecognised 404 must degrade to not_collected, never to a pass. Never map a 403 AccessDenied this way — 'not configured' and 'cannot see' are opposite security conclusions. The collector must be region-sharded: a per-bucket GET sent to the wrong region returns 301, 307, 400 or AuthorizationHeaderMalformed.
• List List all Amazon Web Services rds db instances DB instances ONLY — clusters never appear here. DBClusterIdentifier is populated iff the instance belongs to a cluster: emit one row per cluster and one per standalone instance, never both. For Aurora the security posture lives on the CLUSTER (StorageEncrypted, KmsKeyId, BackupRetentionPeriod, DeletionProtection, EnabledCloudwatchLogsExports), so reading them off the instance reports the wrong object. Neptune and DocumentDB come back here too — filter by Engine. Shape asymmetries vs DBCluster: DBSubnetGroup and Endpoint are objects here but bare strings there, and the status field is DBInstanceStatus, not Status. TagList is inline, so ListTagsForResource is redundant.
• List List all Amazon Web Services rds db clusters DB clusters ONLY — Aurora and non-Aurora Multi-AZ. Instances never appear here. high_availability_mode cannot be a boolean: DBInstance.MultiAZ (one hidden standby), DBCluster.MultiAZ (members span AZs) and non-Aurora Multi-AZ clusters (two readable standbys) are three different failure domains. ReadReplicaDBClusterIdentifiers explicitly excludes cross-Region Aurora read replicas, so cross-region replicas are invisible from the source.
• List List all Amazon Web Services rds global clusters Aurora Global Databases only — the one API that returns cross-Region membership directly. Each GlobalClusterMember carries DBClusterArn, whose region segment is the residency answer, plus IsWriter and Readers, covering the writer and every secondary. It does not replace per-region enumeration: a cross-Region replica made with CreateDBCluster and ReplicationSourceIdentifier has no GlobalClusterIdentifier and never appears here, and neither do instance-level cross-Region replicas. Treat it as a cross-check on top of enumeration, not the source of truth.
• List List all Amazon Web Services rds db snapshots INSTANCE snapshots only — Aurora/cluster snapshots never appear here, so calling only this against an Aurora-heavy customer returns empty and would wrongly conclude they have no backups. The encryption field is Encrypted (contrast DBClusterSnapshot's StorageEncrypted). The RDS default is the mirror image of EC2's and is already correct: IncludeShared and IncludePublic both default false — leave them off, or you pull in other people's public snapshots. Automated snapshots cannot be shared at all, so skip the attribute call and set shared_with_accounts [] and is_public false by construction. Do not map location from SourceRegion — it means 'created in OR copied from'; parse the ARN instead.
• List List all Amazon Web Services rds db cluster snapshots CLUSTER snapshots only. The encryption field is StorageEncrypted, NOT Encrypted — one shared mapper reads undefined here and reports every Aurora snapshot as unencrypted, a false-negative security finding at scale. DBClusterSnapshot also has no SourceRegion and no scalar AvailabilityZone. Neither RDS snapshot type carries an owner field: parse source_account_ref from the ARN.
• List List all Amazon Web Services rds snapshot attributes Sharing ACL for one manual instance snapshot. Skip entirely when SnapshotType is automated — automated snapshots cannot be shared, which removes over 90% of the per-item RDS calls. A manual snapshot can be shared with at most 20 accounts, and an encrypted snapshot cannot be made public, so encrypted && is_public is an impossible state worth asserting on.
• List List all Amazon Web Services rds cluster snapshot attributes Sharing ACL for one manual cluster snapshot. Same automated-snapshot skip applies.
• List List all Amazon Web Services rds db parameters Instance parameter group values — the only path to min_tls_version, via a per-engine adapter. Three traps: this returns the GROUP's value, not the running instance's, so check ParameterApplyStatus == in-sync or a static parameter may claim TLS is enforced while the database still accepts plaintext; a parameter never set has NO ParameterValue element at all, so absent is not off and the engine default must be resolved; and enforcing TLS is not the same as setting a version floor. Use the parameter-name filter — it collapses 4-10 paginated calls per group to 1.
• List List all Amazon Web Services rds db cluster parameters Cluster parameter group values. Aurora MySQL exposes tls_version as a comma-separated ALLOW-LIST to parse, not a floor, and has a second invisible audit path (server_audit_logs_upload) that never appears in EnabledCloudwatchLogsExports.
• List List all Amazon Web Services rds subnet groups DB subnet groups, for placing databases into the network graph. Note PubliclyAccessible true does not mean reachable and false does not mean safe — real exposure also needs route tables.
• List List all Amazon Web Services ec 2 regions Calls EC2 DescribeRegions to list AWS regions visible to the calling account. Not paginated — no cursor exists for this call. Filter to optInStatus in {opt-in-not-required, opted-in}; calling EC2 or other services in a not-opted-in region fails. Describes only the connection's own account (contrast with an Organizations-wide region enumeration). Never hardcode a region list — call this instead. All EC2 Describe* actions must be granted on Resource: "*"; this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 vpcs Calls EC2 DescribeVpcs to list VPCs in the given region. Account-and-region-wide, cursor-paginated (NextToken, up to 1000 per page). Check blockPublicAccessStates: VPC Block Public Access can override an internet gateway route, so a subnet with an igw- route may still be unreachable. All EC2 Describe* actions must be granted on Resource: "*"; this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 subnets Calls EC2 DescribeSubnets to list subnets in the given region. Cursor-paginated (NextToken, up to 1000 per page). Each subnet carries its vpcId and availabilityZone; join to ec2-vpcs for the parent VPC. All EC2 Describe* actions must be granted on Resource: "*"; this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 flow logs Calls EC2 DescribeFlowLogs to list VPC Flow Logs in the given region, one flat list keyed only by resourceId. Cursor-paginated (NextToken, up to 1000/page). Flow logs attach at VPC, SUBNET or ENI level, so checking resourceId == subnetId alone gives false negatives for the common "one flow log on the VPC" setup. Gate on flowLogStatus == ACTIVE AND deliverLogsStatus == SUCCESS — delivery can fail silently. Flow logs never capture DNS, IMDS, DHCP, ARP or Windows activation traffic. EC2 Describe* actions require Resource: "*"; cannot be IAM-scoped per VPC.
• List List all Amazon Web Services ec 2 route tables Calls EC2 DescribeRouteTables to list route tables in the given region. Cursor-paginated (NextToken; MaxResults capped at 100 here, not 1000). A subnet not explicitly associated is IMPLICITLY tied to the VPC main table, and AWS omits the subnet id for implicit associations — joining only on association.subnetId marks every default-configured subnet as having no route; fall back to the main table (association.main == true). Distinguish igw- (internet), nat- (outbound only) and eigw- (IPv6 outbound only) gateway ids in routeSet. EC2 Describe* actions require Resource: "*"; cannot be IAM-scoped per VPC.
• List List all Amazon Web Services ec 2 network acls Calls EC2 DescribeNetworkAcls to list network ACLs in the given region. Cursor-paginated (NextToken, up to 1000 per page). A genuinely different primitive from security groups: stateless, allow AND deny, ORDERED by a real ruleNumber, subnet-attached via associationSet. entrySet.protocol is a String holding a NUMBER ("-1", "6", "17"), never a protocol name, and NACL entries have no description field at all. All EC2 Describe* actions must be granted on Resource: "*"; this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 network interfaces Calls EC2 DescribeNetworkInterfaces to list elastic network interfaces (ENIs) in the given region. Cursor-paginated (NextToken, up to 1000 per page). This is the ONLY path from security groups to subnets — SecurityGroup carries no list of attached interfaces and the relationship does not exist in AWS's model. Join groups.item.groupId -> subnetId, and be honest that this is "groups observed in use right now", not configuration: an autoscaling event changes it. All EC2 Describe* actions must be granted on Resource: "*"; this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 security groups Calls EC2 DescribeSecurityGroups to list security groups in the given region. Cursor-paginated (NextToken, up to 1000/page). Stateful, ALLOW-ONLY, unordered, ENI-attached. Rules nested in ipPermissions/ipPermissionsEgress have no action, priority, enabled or logging_enabled fields — those don't exist in this model (contrast ec2-network-acls). ipProtocol "-1" means all protocols AND all ports — never default to 0-65535; for icmp, fromPort/toPort are TYPE and CODE, not ports. EC2 Describe* actions require Resource: "*"; cannot be IAM-scoped per VPC.
• List List all Amazon Web Services ec 2 security group rules Calls EC2 DescribeSecurityGroupRules to list individual security-group rules in the given region — the only source of a real per-rule description and a stable securityGroupRuleId (ec2-security-groups only nests rules inline, unaddressable). Cursor-paginated (NextToken, up to 1000/page). Prefix-list rules (no referencedGroupInfo, no cidrIpv4/cidrIpv6) carry no CIDRs directly — resolve via ec2-prefix-lists / GetManagedPrefixListEntries using prefixListId. EC2 Describe* actions require Resource: "*"; cannot be IAM-scoped per VPC.
• List List all Amazon Web Services ec 2 prefix lists Calls EC2 DescribeManagedPrefixLists to list managed prefix lists (both AWS-owned, e.g. com.amazonaws.<region>.s3, and customer-managed) referenced by security-group and route-table rules in the given region. Cursor-paginated (NextToken, up to 1000 per page). Resolve the actual CIDR entries of a prefix list with GetManagedPrefixListEntries using prefixListId — this call returns only the list's metadata, not its members. All EC2 Describe* actions must be granted on Resource: "*"; this integration cannot be IAM-scoped to a subset of VPCs.
• List List all Amazon Web Services ec 2 prefix list entries CIDR (or ARN) entries behind one managed prefix list, via GetManagedPrefixListEntries. Requires prefix_list_id — get one from ec2-prefix-lists. Store the list's version alongside entries; a later diff can't distinguish our change from Amazon's without it. Paginated via NextToken/MaxResults. All EC2 Describe*/Get* actions must be granted on Resource: "*" — AWS does not support resource-level permissions here.
• List List all Amazon Web Services ec 2 VPC peering VPC peering connections via DescribeVpcPeeringConnections. Transitive peering does not exist in AWS — an active peering only makes routing possible, it does not create it, so cross-check ec2-route-tables for routes targeting the peering id. Dedup on vpcPeeringConnectionId: an inter-region peering appears identically from both regions/accounts. Paginated via NextToken/MaxResults. All EC2 Describe* actions require Resource: "*" — no resource-level IAM scoping.
• List List all Amazon Web Services ec 2 transit gateways Transit gateways via DescribeTransitGateways. The single highest-signal TGW finding lives here: options.defaultRouteTableAssociation/defaultRouteTablePropagation = "enable" is the flat-mesh default where every attached VPC can reach every other VPC. Regional resource — call once per region. Paginated via NextToken/MaxResults. All EC2 Describe* actions require Resource: "*".
• List List all Amazon Web Services ec 2 tgw attachments Attachments to transit gateways (VPCs, VPNs, Direct Connect gateways, peering) via DescribeTransitGatewayAttachments. association.transitGatewayRouteTableId is the ONLY route-table link on this object — propagation is not present here, so two look-alike attachments can have very different blast radii. Paginated via NextToken/MaxResults. All EC2 Describe* actions require Resource: "*".
• List List all Amazon Web Services ec 2 tgw route tables Transit gateway route tables via DescribeTransitGatewayRouteTables — the anchor id for ec2-tgw-associations and ec2-tgw-propagations, which together determine actual reachability. Paginated via NextToken/MaxResults. All EC2 Describe* actions require Resource: "*".
• List List all Amazon Web Services ec 2 tgw associations Attachments ASSOCIATED with one TGW route table, via GetTransitGatewayRouteTableAssociations. Half the reachability rule: A reaches B iff B's attachment is in propagations[associations-inverse(A)]. Requires transit_gateway_route_table_id — get one from ec2-tgw-route-tables. Paginated via NextToken/MaxResults. All EC2 Describe*/Get* actions require Resource: "*".
• List List all Amazon Web Services ec 2 tgw propagations Attachments that PROPAGATE routes into one TGW route table, via GetTransitGatewayRouteTablePropagations. The other half of the reachability rule — without it, transit is unknowable from the attachment alone. Requires transit_gateway_route_table_id — get one from ec2-tgw-route-tables. Paginated via NextToken/MaxResults. All EC2 Describe*/Get* actions require Resource: "*".
• List List all Amazon Web Services ec 2 snapshots EBS snapshots via DescribeSnapshots, scoped Owner.1=self — a correctness requirement, not an optimization: without it AWS returns every public snapshot in existence, paginating effectively forever. The status field (not "state") and tagSet (not "Tags") use non-standard names. No sharing field here — use ec2-snapshot-attribute for that — and no region field; the request region is the snapshot's region. AMIs are excluded (their snapshots already appear here). Paginated via NextToken/MaxResults. All EC2 Describe* actions require Resource: "*".
• List List all Amazon Web Services ec 2 snapshot attribute The sharing ACL for ONE EBS snapshot, via DescribeSnapshotAttribute (Attribute=createVolumePermission) — the only source of shared_with_accounts/is_public, and the most expensive call in this group: no batch form, one call per snapshot per region. The snapshot id is a PATH argument (call as ec2-snapshot-attribute <snapshot-id>), not a query param — get ids from ec2-snapshots. group == "all" (its only legal value) means public; userId entries are the shared account ids. All EC2 Describe* actions require Resource: "*".
• List List all Amazon Web Services ec 2 snapshot bpa state Account+region setting for EBS snapshot Block Public Access, via GetSnapshotBlockPublicAccessState — one call per region, not global. Unlike other "list" methods here, this returns a SINGLE state value, not an array of items. This changes how is_public must be read: under block-all-sharing, already-public snapshots are treated as private and aren't actually exposed, so reporting one as public is a false positive. Report both the per-snapshot ACL (ec2-snapshot-attribute) and this regional posture together. All EC2 Describe*/Get* actions require Resource: "*".
• List List all Amazon Web Services kms keys Key ids only — {KeyArn, KeyId} and NO metadata at all, so budget 4 calls per key. Pagination is a third dialect: Limit / Marker / NextMarker / Truncated, neither EC2's nor the JSON services' NextToken. This also returns AWS-managed aws/* service keys with no server-side filter, and in a mature account they vastly outnumber customer keys — the DescribeKey cost is paid on every one before KeyManager == CUSTOMER can discard it.
• Get Get single Amazon Web Services kms key by ID Key metadata. Origin has FOUR values, not three: AWS_KMS, EXTERNAL (BYOK), AWS_CLOUDHSM and EXTERNAL_KEY_STORE (XKS). Do not read the deprecated CustomerMasterKeySpec — its documented value list is stale. Carry MultiRegion / MultiRegionConfiguration or the same logical key is reported as N unrelated keys. Call this FIRST and skip GetKeyRotationStatus for anything that is not a symmetric ENCRYPT_DECRYPT key. Works cross-account.
• Get Get single Amazon Web Services kms key rotation by ID Rotation state. All three fields are real — KeyRotationEnabled, RotationPeriodInDays (range 90-2560, default 365) and NextRotationDate — but they are NULL, not false, for asymmetric, HMAC and custom-key-store keys, where rotation is not applicable and false would read as a misconfiguration. AWS-managed keys always rotate and it cannot be changed. Rotation is a shared property of multi-region keys, configured only on the primary. Works cross-account.
• Get Get single Amazon Web Services kms key policy by ID The key policy, as a raw JSON string. Skip ListKeyPolicies entirely — the only valid policy name is 'default'. This does NOT work cross-account, so policy_grants_anyone is unobtainable unless we assume a role into that account. No API answers 'is this key public': naive Principal "*" matching produces FALSE POSITIVES on every normal key, because the standard idiom pairs Principal "*" with a kms:CallerAccount condition. Check for the ABSENCE of a scoping condition (kms:CallerAccount, aws:PrincipalOrgID, aws:PrincipalAccount, kms:ViaService). Grants are a second independent authorization path this does not show. Most KMS reads are also governed by the per-key policy, not just our IAM policy, so partial coverage must surface as permission_denied per key with a count, never as a failed run.
• List List all Amazon Web Services kms aliases Key aliases. Call this ONCE PER REGION, never per key — that is one of the three mitigations that keeps a 500-key, 20-region scan from costing 10,000 requests.
• List List all Amazon Web Services cloudtrail trails Lists CloudTrail trails visible in this account/region via AWS CloudTrail DescribeTrails. No required params beyond region/account_id. NOT paginated. `enabled` is NOT in this response — a trail can exist, be multi-region, KMS-encrypted and validated while being completely stopped, and this looks identical either way. includeShadowTrails defaults to true, so a naive multi-region sweep returns one multi-region trail once per region: dedup on TrailARN and treat the record where HomeRegion equals the region called as authoritative. Do NOT set includeShadowTrails false to avoid that — in a member account of an organization trail it returns nothing at all and we would wrongly report the account as unaudited. An absent KmsKeyId means SSE-S3, NOT unencrypted.
• Get Get single Amazon Web Services cloudtrail trail status by ID Calls AWS CloudTrail GetTrailStatus for one trail; pass the trail name or ARN as the id (from cloudtrail-trails), plus region/account_id. The ONLY source of whether a trail is actually logging: IsLogging. One extra call per trail per region, not optional. NOT paginated. IsLogging true is still not proof logs arrive — cross-check LatestDeliveryError and LatestDeliveryTime, since a trail writing to a deleted bucket reports true with a stale timestamp.
• Get Get single Amazon Web Services cloudtrail event selector by ID Calls AWS CloudTrail GetEventSelectors for one trail; pass the trail name or ARN as the id (from cloudtrail-trails), plus region/account_id. Data-event coverage for one trail. Classic and advanced event selectors are MUTUALLY EXCLUSIVE, so two parsers are needed. Classic is clean: three resource types (AWS::S3::Object, AWS::Lambda::Function, AWS::DynamoDB::Table) with explicit ARN lists. Advanced is a boolean predicate language (Equals/NotEquals/StartsWith/NotStartsWith/EndsWith/NotEndsWith) that no API evaluates for us, where negation can carve arbitrary holes out of a broad match and far more than three resource types are supported — an allowlist of three silently under-reports. Best-effort inference; say so. ExcludeManagementEventSources can carve out kms.amazonaws.com or rdsdata.amazonaws.com, so management coverage is not complete even when IncludeManagementEvents is true.
• List List all Amazon Web Services logs log groups Calls AWS CloudWatch Logs DescribeLogGroups. No required params beyond region/account_id. limit is 1-50 (small — expect heavy paging) and Truto's pagination cursor for this method EXPIRES AFTER 24 HOURS, so cursors must not be persisted. Do NOT set log_group_name_pattern: when it is set the response contains only arn, creationTime and logGroupName, silently dropping retentionInDays and kmsKeyId, the two fields we need. An absent retentionInDays means NEVER EXPIRE, not zero. An absent kmsKeyId means AWS-owned SSE, not unencrypted. deletionProtectionEnabled protects the group from deletion, not the retention period — anyone with logs:PutRetentionPolicy can still shorten retention to 1 day. logGroupClass DELIVERY keeps events one day only regardless of retentionInDays.
• List List all Amazon Web Services ec 2 instances EC2 instances, flattened to one row per instance -- DescribeInstances nests instances under reservations, but response_path unwraps reservationSet.item.instancesSet.item so each item here already IS an instance. Region-scoped XML Query API (call once per region); paginates via NextToken, up to 1000/page. XML->JSON: every scalar leaf comes back as {_text: value}, and a nested list (tagSet, groupSet, blockDeviceMapping...) collapses to a bare object instead of a one-item array when there's exactly one entry -- normalize before iterating. Fixture account returned zero instances in every region tested; schema below is derived from the AWS API reference, not a live sample.
• List List all Amazon Web Services ec 2 volumes EBS volumes. DescribeVolumes XML Query API, region-scoped; paginates via NextToken, up to 500/page. The state field is called status (creating|available|in-use|deleting|deleted|error), not state; tags are under tagSet.item, not Tags. Every scalar leaf is wrapped as {_text: value} by XML->JSON conversion, and attachmentSet.item collapses to a bare object (not a one-element array) when the volume has exactly one attachment -- normalize before iterating. Fixture account returned zero volumes in every region tested; schema below is derived from the AWS API reference, not a live sample.
• List List all Amazon Web Services elbv 2 load balancers ALB/NLB/Gateway load balancers. DescribeLoadBalancers -- a different AWS service (elasticloadbalancing) and a different XML array convention than the ec2-* resources in this set: repeated elements use 'member', not 'item'. Region-scoped; paginates via Marker/PageSize, up to 400/page. state is a nested {code, reason} object, not a flat status string. Every scalar leaf is still {_text: value} from the XML->JSON conversion. Fixture account returned zero load balancers in every region tested; schema below is derived from the AWS API reference, not a live sample.
• List List all Amazon Web Services redshift clusters Cluster metadata via DescribeClusters — the AWS Query/XML protocol, NOT JSON. Verified live via source (xml-js compact mode): every leaf field arrives wrapped as {_text: value} after XML-to-JSON conversion, e.g. ClusterIdentifier._text, unlike our JSON-service AWS resources. Optional ClusterIdentifier narrows to one cluster; a nonexistent id 404s with ClusterNotFound (verified live). Cursor pagination via Marker/MaxRecords, max 100. No credentials returned — MasterUserPassword is never in any Redshift read response.
• List List all Amazon Web Services cloudwatch alarms Lists CloudWatch metric alarms in this region via AWS CloudWatch DescribeAlarms (the XML API). No required params beyond region/account_id. The integration config does not wire AWS's AlarmNames, StateValue or ActionPrefix filters, so this always returns every metric alarm in the region, paged internally via NextToken/MaxRecords (up to 100 per page) through Truto's own cursor. Composite alarms (AlarmRule instead of MetricName) are returned mixed in with metric alarms.
• List List all Amazon Web Services ecs clusters ECS cluster ARNs only -- ListClusters returns an array of bare ARN strings, never full cluster objects (no status, running/pending task counts, capacity providers, etc.). Verified live: this fixture account has zero ECS clusters in every region tested, and the call correctly returns an empty array rather than erroring. There is no get/describe method configured for ecs-clusters in this integration, so an ARN returned here cannot be resolved to full details through this proxy. AWS JSON RPC over POST (x-amz-target header, body always {}); region-scoped, paginates via nextToken, up to 100/page.
• List List all Amazon Web Services ecs services ECS service ARNs only -- ListServices returns bare ARN strings, never full objects (no desired/running count, task definition, deployment config, etc.). cluster is optional per the AWS API (falls back to a cluster named 'default'), but no such cluster exists in this fixture account -- confirmed live, omitting it or passing cluster=default both fail with ClusterNotFoundException. Pass a real cluster ARN/name from ecs-clusters. No get/describe method exists for ecs-services. AWS JSON RPC over POST; region-scoped, paginates via nextToken, up to 100/page.
• List List all Amazon Web Services ecr repositories ECR repositories as full objects (ARN, URI, tag mutability, encryption, scan-on-push filters) -- DescribeRepositories, unlike the ARN/name-only list APIs elsewhere in this set (ecs-clusters, ecs-services, eks-clusters, eks-nodegroups). This config's body is always {} with no repositoryNames/registryId filter exposed, so every call returns the whole registry's repositories, unfiltered. AWS JSON RPC over POST; region-scoped, paginates via nextToken, up to 1000/page. Fixture account has zero repositories in every region tested; schema below is derived from the AWS API reference, not a live sample.
• List List all Amazon Web Services secretsmanager secrets ListSecrets — metadata only. SecretString/SecretBinary are NEVER returned here; only GetSecretValue exposes them, and that is not one of our methods, so never describe this as a possible value leak. SortOrder (asc|desc) and IncludePlannedDeletion (bool) pass through live and are AWS-validated (confirmed: bad values 400 with ValidationException/SerializationException). Filters (AWS's {Key,Values} list) is supported by the API but not exposed as a flat query param here. Cursor pagination via NextToken/MaxResults, max 100.
• List List all Amazon Web Services dynamodb tables ListTables. The response is a BARE ARRAY OF TABLE NAME STRINGS (TableNames) — not objects, so there is no ARN, status, billing mode, or item count here. Get those per-table via DescribeTable (a separate call, out of scope for this method). AWS ListTables takes no filter params, only pagination (ExclusiveStartTableName/LastEvaluatedTableName), max page 100.
• List List all Amazon Web Services lambda functions Lambda functions as full configuration objects (ARN, runtime, handler, role, VPC config, layers, environment, logging config, etc.) -- ListFunctions, verified live with real functions. Region-scoped; paginates via Marker/MaxItems, up to 50/page. This fixture account's functions only exist in us-west-2 -- the default us-east-1 and every other region tested returned an empty array, so always pass region explicitly. Many fields are null unless the function uses that feature (VpcConfig, Environment, DeadLetterConfig, KMSKeyArn, ...) -- null means "not configured", not missing data.
• List List all Amazon Web Services eks clusters EKS cluster NAMES only -- ListClusters returns an array of bare strings, never full cluster objects (no ARN, version, status, endpoint, VPC config, etc.), confirmed against the AWS API reference. This account has zero EKS clusters in every region tested, so the empty-array shape was verified live but a populated response wasn't. There is no get/describe method configured for eks-clusters in this integration, so a name returned here cannot be resolved to full details through this proxy. Region-scoped; paginates via nextToken, up to 100/page.
• List List all Amazon Web Services eks nodegroups EKS node group NAMES only -- ListNodegroups returns an array of bare strings, never full objects (no ARN, instance types, scaling config, etc.), confirmed against the AWS API reference. cluster_name is required (path param /clusters/{cluster_name}/node-groups) and must come from eks-clusters' list; this fixture account has zero EKS clusters in any region, so no real cluster_name could be sourced and the response couldn't be verified live. No get/describe method exists for eks-nodegroups. Region-scoped; paginates via nextToken, up to 100/page.
• List List all Amazon Web Services efs file systems EFS file systems. DescribeFileSystems is a plain JSON REST call -- no XML {_text} wrapping, unlike the ec2-*/elbv2-* resources in this set. Region-scoped; paginates via Marker/MaxItems, up to 100/page (the config tolerates an empty-string cursor on the last page). SizeInBytes is an object with Value/Timestamp fields, not a bare number. Fixture account returned zero file systems in every region tested; schema below is derived from the AWS API reference, not a live sample.
• List List all Amazon Web Services iam groups IAM groups in the account (ListGroups). IAM is a global service reached through a single endpoint, so region only affects which credentials/account are used, not where the data lives. Paginated with the classic Marker/IsTruncated cursor, same as iam-users and iam-roles. Does not include a group's attached/inline policies or its members — those need separate IAM calls.
• List List all Amazon Web Services iam attached user policies AWS-managed and customer-managed IAM policies attached directly to one IAM user (ListAttachedUserPolicies). user_name comes from iam-users (UserName). Does not include inline (embedded) user policies (see iam-users' GetUserPolicy) or policies inherited from group membership.
• Get Get single Amazon Web Services iam policy version by ID The full JSON policy document for one version of a customer- or AWS-managed IAM policy (GetPolicyVersion). Pass the policy ARN as the resource id (from iam-policies, Arn) and the version id as version_id (from iam-policies, DefaultVersionId, or IsDefaultVersion=true on this response). Document is returned percent-URL-encoded JSON — URL-decode it before parsing the statements. Callers must percent-encode the ARN before passing it as a path id (it contains ':' and '/').

No tools match your search.