macie2

package
v1.1.4 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 20, 2026 License: MIT Imports: 23 Imported by: 0

README

Macie

Parity grade: A · SDK aws-sdk-go-v2/service/macie2@v1.51.4 · last audited 2026-07-12 (82c8a1c8)

Coverage

Metric Value
Operations audited 82 (78 ok, 4 partial)
Feature families 2 (2 ok)
Known gaps 5
Deferred items 2
Resource leaks clean
Known gaps
  • ListMembers ignores onlyAssociated/maxResults/nextToken query params; always returns all members in one page regardless of onlyAssociated (real AWS default is onlyAssociated=true, i.e. DISASSOCIATED members hidden by default)
  • ListClassificationJobs ignores filterCriteria and maxResults/nextToken; always returns every job in one page
  • TagResource/UntagResource/ListTagsForResource (isKnownARN) do not recognize classification-job ARNs, so a real client cannot tag a job post-creation via TagResource even though CreateClassificationJob now stores a real jobArn
  • CustomDataIdentifier is missing 'deleted' and 'severityLevels' fields present on the real GetCustomDataIdentifierOutput/BatchGetCustomDataIdentifierSummary shapes; BatchGetCustomDataIdentifiers also silently excludes soft-deleted identifiers instead of returning them with deleted:true (real AWS soft-delete semantics)
  • DescribeOrganizationConfiguration is missing the maxAccountLimitReached field
Deferred
  • Full field-by-field audit of ClassificationJob's ~20 optional detail fields (bucketCriteria, bucketDefinitions, statistics, userPausedDetails, managedDataIdentifierSelector, etc.) against DescribeClassificationJobOutput
  • Finding struct full field audit against real Finding shape (resourcesAffected, classificationDetails, policyDetails, etc.) -- CreateSampleFindings/GetFindings currently populate only a reduced field set

More

Documentation

Index

Constants

This section is empty.

Variables

View Source
var (
	// ErrNotEnabled is returned when Macie is not enabled.
	ErrNotEnabled = awserr.New(errMacieNotEnabled, awserr.ErrNotFound)
	// ErrAllowListNotFound is returned when an allow list does not exist.
	ErrAllowListNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrSessionAlreadyExists is returned when Macie is already enabled.
	ErrSessionAlreadyExists = awserr.New(errConflictException, awserr.ErrConflict)
	// ErrAllowListAlreadyExists is returned when an allow list already exists.
	ErrAllowListAlreadyExists = awserr.New(errConflictException, awserr.ErrConflict)
	// ErrCustomDataIDNotFound is returned when a custom data identifier does not exist.
	ErrCustomDataIDNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrFindingsFilterNotFound is returned when a findings filter does not exist.
	ErrFindingsFilterNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrFindingNotFound is returned when a finding does not exist.
	ErrFindingNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrTaggedResourceNotFound is returned when a tag operation targets an unknown resource ARN.
	ErrTaggedResourceNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrValidation is returned on invalid input.
	ErrValidation = awserr.New(errValidation, awserr.ErrInvalidParameter)
)
View Source
var (
	// ErrClassificationJobNotFound is returned when a classification job does not exist.
	ErrClassificationJobNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrMemberNotFound is returned when a member does not exist.
	ErrMemberNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrMemberAlreadyExists is returned when a member already exists.
	ErrMemberAlreadyExists = awserr.New(errConflictException, awserr.ErrConflict)
	// ErrInvitationNotFound is returned when an invitation does not exist.
	ErrInvitationNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrOrgAdminNotFound is returned when an org admin account does not exist.
	ErrOrgAdminNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrClassificationScopeNotFound is returned when a classification scope does not exist.
	ErrClassificationScopeNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
	// ErrSensitivityTemplateNotFound is returned when a sensitivity inspection template does not exist.
	ErrSensitivityTemplateNotFound = awserr.New(errResourceNotFound, awserr.ErrNotFound)
)
View Source
var ErrNilAppContext = errors.New("macie2: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

Functions

This section is empty.

Types

type AdministratorAccount

type AdministratorAccount struct {
	AccountID          string    `json:"accountId"`
	InvitationID       string    `json:"invitationId"`
	InvitedAt          time.Time `json:"invitedAt"`
	RelationshipStatus string    `json:"relationshipStatus"`
}

AdministratorAccount represents the administrator account relationship.

type AllowListCriteria

type AllowListCriteria struct {
	Regex       *string      `json:"regex,omitempty"`
	S3WordsList *S3WordsList `json:"s3WordsList,omitempty"`
}

AllowListCriteria holds criteria for an allow list.

type AllowListDetail

type AllowListDetail struct {
	CreatedAt   time.Time         `json:"createdAt"`
	UpdatedAt   time.Time         `json:"updatedAt"`
	Tags        map[string]string `json:"tags,omitempty"`
	Criteria    AllowListCriteria `json:"criteria"`
	Status      AllowListStatus   `json:"status"`
	Arn         string            `json:"arn"`
	Description string            `json:"description,omitempty"`
	ID          string            `json:"id"`
	Name        string            `json:"name"`
}

AllowListDetail is the full detail view of an allow list.

type AllowListStatus

type AllowListStatus struct {
	Code        string `json:"code"`
	Description string `json:"description,omitempty"`
}

AllowListStatus describes the status of an allow list.

type AllowListSummary

type AllowListSummary struct {
	CreatedAt   time.Time         `json:"createdAt"`
	UpdatedAt   time.Time         `json:"updatedAt"`
	Tags        map[string]string `json:"tags,omitempty"`
	Arn         string            `json:"arn"`
	Description string            `json:"description,omitempty"`
	ID          string            `json:"id"`
	Name        string            `json:"name"`
}

AllowListSummary is the summary view of an allow list.

type AutoDiscoveryAccount

type AutoDiscoveryAccount struct {
	AccountID string `json:"accountId"`
	Email     string `json:"email,omitempty"`
	Status    string `json:"status"`
}

AutoDiscoveryAccount holds automated discovery status for an account.

type AutoDiscoveryAccountUpdate

type AutoDiscoveryAccountUpdate struct {
	AccountID string `json:"accountId"`
	Status    string `json:"status"`
}

AutoDiscoveryAccountUpdate is a requested status change for an account.

type AutoDiscoveryConfig

type AutoDiscoveryConfig struct {
	AutoEnableOrganizationMembers string `json:"autoEnableOrganizationMembers,omitempty"`
	Status                        string `json:"status"`
}

AutoDiscoveryConfig holds automated discovery configuration.

type ClassificationExportConfig

type ClassificationExportConfig struct {
	S3Destination *ClassificationExportS3Dest `json:"s3Destination,omitempty"`
}

ClassificationExportConfig holds classification result export configuration.

type ClassificationExportS3Dest

type ClassificationExportS3Dest struct {
	BucketName string `json:"bucketName"`
	KeyPrefix  string `json:"keyPrefix,omitempty"`
	KmsKeyArn  string `json:"kmsKeyArn,omitempty"`
}

ClassificationExportS3Dest holds S3 destination details.

type ClassificationJob

type ClassificationJob struct {
	Tags               map[string]string `json:"tags,omitempty"`
	S3JobDefinition    map[string]any    `json:"s3JobDefinition,omitempty"`
	ScheduleFrequency  map[string]any    `json:"scheduleFrequency,omitempty"`
	LastRunTime        *time.Time        `json:"lastRunTime,omitempty"`
	CreatedAt          time.Time         `json:"createdAt"`
	Arn                string            `json:"jobArn"`
	ClientToken        string            `json:"clientToken,omitempty"`
	Description        string            `json:"description,omitempty"`
	JobID              string            `json:"jobId"`
	JobStatus          string            `json:"jobStatus"`
	JobType            string            `json:"jobType"`
	Name               string            `json:"name"`
	SamplingPercentage int32             `json:"samplingPercentage"`
	InitialRun         bool              `json:"initialRun"`
}

ClassificationJob represents a Macie classification job.

type ClassificationJobSummary

type ClassificationJobSummary struct {
	Tags        map[string]string `json:"tags,omitempty"`
	LastRunTime *time.Time        `json:"lastRunTime,omitempty"`
	CreatedAt   time.Time         `json:"createdAt"`
	Description string            `json:"description,omitempty"`
	JobID       string            `json:"jobId"`
	JobStatus   string            `json:"jobStatus"`
	JobType     string            `json:"jobType"`
	Name        string            `json:"name"`
}

ClassificationJobSummary is the list-view of a classification job.

type ClassificationScope

type ClassificationScope struct {
	Tags      map[string]string      `json:"tags,omitempty"`
	S3        *ClassificationScopeS3 `json:"s3,omitempty"`
	CreatedAt time.Time              `json:"createdAt"`
	UpdatedAt time.Time              `json:"updatedAt"`
	ID        string                 `json:"id"`
	Name      string                 `json:"name"`
}

ClassificationScope represents a classification scope resource.

type ClassificationScopeS3

type ClassificationScopeS3 struct {
	Excludes map[string]any `json:"excludes,omitempty"`
}

ClassificationScopeS3 holds S3 exclusion criteria.

type ClassificationScopeSummary

type ClassificationScopeSummary struct {
	ID   string `json:"id"`
	Name string `json:"name"`
}

ClassificationScopeSummary is the list-view of a classification scope.

type CustomDataIdentifier

type CustomDataIdentifier struct {
	CreatedAt            time.Time         `json:"createdAt"`
	Tags                 map[string]string `json:"tags,omitempty"`
	Arn                  string            `json:"arn"`
	Description          string            `json:"description,omitempty"`
	ID                   string            `json:"id"`
	Name                 string            `json:"name"`
	Regex                string            `json:"regex"`
	IgnoreWords          []string          `json:"ignoreWords,omitempty"`
	Keywords             []string          `json:"keywords,omitempty"`
	MaximumMatchDistance int32             `json:"maximumMatchDistance"`
}

CustomDataIdentifier represents a custom data identifier.

type CustomDataIdentifierSummary

type CustomDataIdentifierSummary struct {
	Arn         string    `json:"arn"`
	CreatedAt   time.Time `json:"createdAt"`
	Description string    `json:"description,omitempty"`
	ID          string    `json:"id"`
	Name        string    `json:"name"`
}

CustomDataIdentifierSummary is the summary view of a custom data identifier.

type Finding

type Finding struct {
	CreatedAt   time.Time `json:"createdAt"`
	UpdatedAt   time.Time `json:"updatedAt"`
	AccountID   string    `json:"accountId"`
	Category    string    `json:"category"`
	Description string    `json:"description"`
	ID          string    `json:"id"`
	Region      string    `json:"region"`
	Title       string    `json:"title"`
	Type        string    `json:"type"`
	Severity    Severity  `json:"severity"`
	Archived    bool      `json:"archived"`
}

Finding represents a Macie finding.

type FindingStatisticsGroup

type FindingStatisticsGroup struct {
	GroupKey string `json:"groupKey"`
	Count    int64  `json:"count"`
}

FindingStatisticsGroup holds a group of finding statistics.

type FindingType

type FindingType string

FindingType represents the type of a finding.

type FindingsFilterDetail

type FindingsFilterDetail struct {
	FindingCriteria map[string]any    `json:"findingCriteria,omitempty"`
	Tags            map[string]string `json:"tags,omitempty"`
	Action          string            `json:"action"`
	Arn             string            `json:"arn"`
	Description     string            `json:"description,omitempty"`
	ID              string            `json:"id"`
	Name            string            `json:"name"`
	Position        int32             `json:"position"`
}

FindingsFilterDetail is the full detail of a findings filter.

type FindingsFilterSummary

type FindingsFilterSummary struct {
	Tags        map[string]string `json:"tags,omitempty"`
	Action      string            `json:"action"`
	Arn         string            `json:"arn"`
	Description string            `json:"description,omitempty"`
	ID          string            `json:"id"`
	Name        string            `json:"name"`
	Position    int32             `json:"position"`
}

FindingsFilterSummary is the summary view of a findings filter.

type FindingsPublicationConfig

type FindingsPublicationConfig struct {
	SecurityHubConfiguration      *SecurityHubConfig `json:"securityHubConfiguration,omitempty"`
	ClientToken                   string             `json:"clientToken,omitempty"`
	PublishClassificationFindings bool               `json:"publishClassificationFindings"`
	PublishPolicyFindings         bool               `json:"publishPolicyFindings"`
}

FindingsPublicationConfig holds findings publication configuration.

type Handler

type Handler struct {
	Backend StorageBackend
}

Handler handles Macie2 HTTP requests.

func NewHandler

func NewHandler(b StorageBackend) *Handler

NewHandler constructs a new Handler.

func (*Handler) ExtractOperation

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the request.

func (*Handler) ExtractResource

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource identifier from the request.

func (*Handler) GetSupportedOperations

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported operations.

func (*Handler) Handler

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function.

func (*Handler) MatchPriority

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset

func (h *Handler) Reset()

Reset resets the backend.

func (*Handler) Restore

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Macie2 requests by path prefix.

func (*Handler) Snapshot

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

Handler did not previously implement Snapshot/Restore at all, even though InMemoryBackend already did: cli.go's generic setupPersistence type-asserts the service.Registerable returned by Provider.Init (the *Handler, not the backend) against a persistable interface, so without this delegate Macie2 was never registered with the persistence manager and its state was silently dropped across restarts/demo reloads. This is the codecommit/codepipeline/emr dead-wiring fix, applied here.

type InMemoryBackend

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend implements StorageBackend using in-memory maps.

func NewInMemoryBackend

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend constructs a new InMemoryBackend.

func (*InMemoryBackend) AcceptInvitation

func (b *InMemoryBackend) AcceptInvitation(administratorAccountID, invitationID string) error

AcceptInvitation accepts a Macie invitation.

func (*InMemoryBackend) AccountID

func (b *InMemoryBackend) AccountID() string

AccountID returns the account ID.

func (*InMemoryBackend) AddS3Bucket

func (b *InMemoryBackend) AddS3Bucket(bucket S3BucketMetadata)

AddS3Bucket seeds an S3 bucket into the backend for DescribeBuckets.

func (*InMemoryBackend) BatchGetCustomDataIdentifiers

func (b *InMemoryBackend) BatchGetCustomDataIdentifiers(ids []string) ([]*CustomDataIdentifier, error)

BatchGetCustomDataIdentifiers returns full details for the given IDs.

func (*InMemoryBackend) BatchUpdateAutomatedDiscoveryAccounts

func (b *InMemoryBackend) BatchUpdateAutomatedDiscoveryAccounts(updates []AutoDiscoveryAccountUpdate) error

BatchUpdateAutomatedDiscoveryAccounts updates automated discovery status for multiple accounts.

func (*InMemoryBackend) CreateAllowList

func (b *InMemoryBackend) CreateAllowList(
	name, description string,
	criteria AllowListCriteria,
	tags map[string]string,
) (*AllowListSummary, error)

CreateAllowList creates a new allow list.

func (*InMemoryBackend) CreateClassificationJob

func (b *InMemoryBackend) CreateClassificationJob(
	name, description, jobType, clientToken string,
	s3JobDefinition, scheduleFrequency map[string]any,
	tags map[string]string,
	samplingPercentage int32,
	initialRun bool,
) (string, string, error)

CreateClassificationJob creates a new classification job.

func (*InMemoryBackend) CreateCustomDataIdentifier

func (b *InMemoryBackend) CreateCustomDataIdentifier(
	name, description, regex string,
	ignoreWords, keywords []string,
	maxMatchDistance *int32,
	tags map[string]string,
) (string, error)

CreateCustomDataIdentifier creates a new custom data identifier.

func (*InMemoryBackend) CreateFindingsFilter

func (b *InMemoryBackend) CreateFindingsFilter(
	name, description, action string,
	position *int32,
	criteria map[string]any,
	tags map[string]string,
) (*FindingsFilterSummary, error)

CreateFindingsFilter creates a new findings filter.

func (*InMemoryBackend) CreateInvitations

func (b *InMemoryBackend) CreateInvitations(
	accountIDs []string, _ string, _ bool,
) ([]UnprocessedAccount, error)

CreateInvitations creates invitations for the given account IDs.

func (*InMemoryBackend) CreateMember

func (b *InMemoryBackend) CreateMember(accountID, email string, tags map[string]string) error

CreateMember creates a new member account relationship.

func (*InMemoryBackend) CreateSampleFindings

func (b *InMemoryBackend) CreateSampleFindings(findingTypes []string) error

CreateSampleFindings creates sample findings.

func (*InMemoryBackend) DeclineInvitations

func (b *InMemoryBackend) DeclineInvitations(accountIDs []string) ([]UnprocessedAccount, error)

DeclineInvitations marks invitations from the given accounts as declined.

func (*InMemoryBackend) DeleteAllowList

func (b *InMemoryBackend) DeleteAllowList(id string) error

DeleteAllowList deletes an allow list.

func (*InMemoryBackend) DeleteCustomDataIdentifier

func (b *InMemoryBackend) DeleteCustomDataIdentifier(id string) error

DeleteCustomDataIdentifier soft-deletes a custom data identifier.

func (*InMemoryBackend) DeleteFindingsFilter

func (b *InMemoryBackend) DeleteFindingsFilter(id string) error

DeleteFindingsFilter deletes a findings filter.

func (*InMemoryBackend) DeleteInvitations

func (b *InMemoryBackend) DeleteInvitations(accountIDs []string) ([]UnprocessedAccount, error)

DeleteInvitations removes invitations from the given accounts.

func (*InMemoryBackend) DeleteMember

func (b *InMemoryBackend) DeleteMember(accountID string) error

DeleteMember removes a member account.

func (*InMemoryBackend) DescribeBuckets

func (b *InMemoryBackend) DescribeBuckets(criteria map[string]any) ([]map[string]any, error)

DescribeBuckets returns S3 bucket metadata, filtered by criteria.

func (*InMemoryBackend) DescribeClassificationJob

func (b *InMemoryBackend) DescribeClassificationJob(jobID string) (*ClassificationJob, error)

DescribeClassificationJob returns a classification job by ID.

func (*InMemoryBackend) DescribeOrganizationConfiguration

func (b *InMemoryBackend) DescribeOrganizationConfiguration() (*OrgConfig, error)

DescribeOrganizationConfiguration returns the org-level Macie configuration.

func (*InMemoryBackend) DisableMacie

func (b *InMemoryBackend) DisableMacie() error

DisableMacie disables Macie for the account.

func (*InMemoryBackend) DisableOrganizationAdminAccount

func (b *InMemoryBackend) DisableOrganizationAdminAccount(accountID string) error

DisableOrganizationAdminAccount removes the org admin designation.

func (*InMemoryBackend) DisassociateFromAdministratorAccount

func (b *InMemoryBackend) DisassociateFromAdministratorAccount() error

DisassociateFromAdministratorAccount removes the administrator relationship.

func (*InMemoryBackend) DisassociateFromMasterAccount

func (b *InMemoryBackend) DisassociateFromMasterAccount() error

DisassociateFromMasterAccount is the legacy alias.

func (*InMemoryBackend) DisassociateMember

func (b *InMemoryBackend) DisassociateMember(accountID string) error

DisassociateMember sets a member's relationship status to DISASSOCIATED.

func (*InMemoryBackend) EnableMacie

func (b *InMemoryBackend) EnableMacie(_, frequency, status string) error

EnableMacie enables Macie for the account.

func (*InMemoryBackend) EnableOrganizationAdminAccount

func (b *InMemoryBackend) EnableOrganizationAdminAccount(accountID string) error

EnableOrganizationAdminAccount designates an account as org admin.

func (*InMemoryBackend) GetAdministratorAccount

func (b *InMemoryBackend) GetAdministratorAccount() (*AdministratorAccount, error)

GetAdministratorAccount returns the administrator account relationship.

func (*InMemoryBackend) GetAllowList

func (b *InMemoryBackend) GetAllowList(id string) (*AllowListDetail, error)

GetAllowList retrieves an allow list by ID.

func (*InMemoryBackend) GetAutomatedDiscoveryConfiguration

func (b *InMemoryBackend) GetAutomatedDiscoveryConfiguration() (*AutoDiscoveryConfig, error)

GetAutomatedDiscoveryConfiguration returns the automated discovery config.

func (*InMemoryBackend) GetBucketStatistics

func (b *InMemoryBackend) GetBucketStatistics(_ string) (map[string]any, error)

GetBucketStatistics returns aggregate S3 statistics computed from stored buckets.

func (*InMemoryBackend) GetClassificationExportConfiguration

func (b *InMemoryBackend) GetClassificationExportConfiguration() (*ClassificationExportConfig, error)

GetClassificationExportConfiguration returns the export config.

func (*InMemoryBackend) GetClassificationScope

func (b *InMemoryBackend) GetClassificationScope(scopeID string) (*ClassificationScope, error)

GetClassificationScope returns a classification scope by ID.

func (*InMemoryBackend) GetCustomDataIdentifier

func (b *InMemoryBackend) GetCustomDataIdentifier(id string) (*CustomDataIdentifier, error)

GetCustomDataIdentifier retrieves a custom data identifier.

func (*InMemoryBackend) GetFindingStatistics

func (b *InMemoryBackend) GetFindingStatistics(groupBy string, _ map[string]any) ([]FindingStatisticsGroup, error)

GetFindingStatistics returns statistics grouped by the given field.

func (*InMemoryBackend) GetFindings

func (b *InMemoryBackend) GetFindings(findingIDs []string) ([]*Finding, error)

GetFindings retrieves findings by ID.

func (*InMemoryBackend) GetFindingsFilter

func (b *InMemoryBackend) GetFindingsFilter(id string) (*FindingsFilterDetail, error)

GetFindingsFilter retrieves a findings filter.

func (*InMemoryBackend) GetFindingsPublicationConfiguration

func (b *InMemoryBackend) GetFindingsPublicationConfiguration() (*FindingsPublicationConfig, error)

GetFindingsPublicationConfiguration returns the findings publication config.

func (*InMemoryBackend) GetInvitationsCount

func (b *InMemoryBackend) GetInvitationsCount() (int64, error)

GetInvitationsCount returns the number of active invitations.

func (*InMemoryBackend) GetMasterAccount

func (b *InMemoryBackend) GetMasterAccount() (*AdministratorAccount, error)

GetMasterAccount is the legacy alias for GetAdministratorAccount.

func (*InMemoryBackend) GetMember

func (b *InMemoryBackend) GetMember(accountID string) (*Member, error)

GetMember returns a member account by account ID.

func (*InMemoryBackend) GetResourceProfile

func (b *InMemoryBackend) GetResourceProfile(resourceARN string) (*ResourceProfile, error)

GetResourceProfile returns a bucket's sensitivity profile.

func (*InMemoryBackend) GetRevealConfiguration

func (b *InMemoryBackend) GetRevealConfiguration() (*RevealConfiguration, error)

GetRevealConfiguration returns the sensitive data reveal configuration.

func (*InMemoryBackend) GetSensitiveDataOccurrences

func (b *InMemoryBackend) GetSensitiveDataOccurrences(findingID string) (map[string]any, error)

GetSensitiveDataOccurrences returns redacted occurrences for a finding.

func (*InMemoryBackend) GetSensitiveDataOccurrencesAvailability

func (b *InMemoryBackend) GetSensitiveDataOccurrencesAvailability(findingID string) (string, []string, error)

GetSensitiveDataOccurrencesAvailability reports reveal availability for a finding.

func (*InMemoryBackend) GetSensitivityInspectionTemplate

func (b *InMemoryBackend) GetSensitivityInspectionTemplate(templateID string) (*SensitivityInspectionTemplate, error)

GetSensitivityInspectionTemplate returns a sensitivity inspection template by ID.

func (*InMemoryBackend) GetSession

func (b *InMemoryBackend) GetSession() *Session

GetSession returns the current Macie session (may be nil if not enabled).

func (*InMemoryBackend) GetUsageStatistics

func (b *InMemoryBackend) GetUsageStatistics(
	_ []map[string]any, _ int, _ string, _ string,
) ([]UsageRecord, string, error)

GetUsageStatistics returns usage statistics (empty — no billing data in emulator).

func (*InMemoryBackend) GetUsageTotals

func (b *InMemoryBackend) GetUsageTotals(_ string) ([]UsageTotal, error)

GetUsageTotals returns aggregated usage totals (all zero).

func (*InMemoryBackend) ListAllowLists

func (b *InMemoryBackend) ListAllowLists(limit int, token string) ([]*AllowListSummary, string, error)

ListAllowLists returns summaries of all allow lists.

func (*InMemoryBackend) ListAutomatedDiscoveryAccounts

func (b *InMemoryBackend) ListAutomatedDiscoveryAccounts() ([]*AutoDiscoveryAccount, error)

ListAutomatedDiscoveryAccounts returns accounts with automated discovery status.

func (*InMemoryBackend) ListClassificationJobs

func (b *InMemoryBackend) ListClassificationJobs(
	_ map[string]any, _ int, _ string,
) ([]*ClassificationJobSummary, string, error)

ListClassificationJobs returns summaries of all classification jobs.

func (*InMemoryBackend) ListClassificationScopes

func (b *InMemoryBackend) ListClassificationScopes() ([]*ClassificationScopeSummary, error)

ListClassificationScopes returns all classification scopes.

func (*InMemoryBackend) ListCustomDataIdentifiers

func (b *InMemoryBackend) ListCustomDataIdentifiers(
	limit int,
	token string,
) ([]*CustomDataIdentifierSummary, string, error)

ListCustomDataIdentifiers returns summaries of all non-deleted custom data identifiers.

func (*InMemoryBackend) ListFindings

func (b *InMemoryBackend) ListFindings(criteria map[string]any, limit int, token string) ([]string, string, error)

ListFindings returns finding IDs (optionally filtered).

func (*InMemoryBackend) ListFindingsFilters

func (b *InMemoryBackend) ListFindingsFilters(limit int, token string) ([]*FindingsFilterSummary, string, error)

ListFindingsFilters returns summaries of all findings filters.

func (*InMemoryBackend) ListInvitations

func (b *InMemoryBackend) ListInvitations() ([]*Invitation, error)

ListInvitations returns all active invitations.

func (*InMemoryBackend) ListManagedDataIdentifiers

func (b *InMemoryBackend) ListManagedDataIdentifiers() ([]ManagedDataIdentifier, error)

ListManagedDataIdentifiers returns the built-in Macie data identifiers.

func (*InMemoryBackend) ListMembers

func (b *InMemoryBackend) ListMembers(onlyAssociated bool) ([]*Member, error)

ListMembers returns all member accounts.

func (*InMemoryBackend) ListOrganizationAdminAccounts

func (b *InMemoryBackend) ListOrganizationAdminAccounts() ([]*OrgAdminAccount, error)

ListOrganizationAdminAccounts returns all org admin accounts.

func (*InMemoryBackend) ListResourceProfileArtifacts

func (b *InMemoryBackend) ListResourceProfileArtifacts(_ string) ([]ResourceProfileArtifact, error)

ListResourceProfileArtifacts returns classified artifacts for a bucket (always empty).

func (*InMemoryBackend) ListResourceProfileDetections

func (b *InMemoryBackend) ListResourceProfileDetections(resourceARN string) ([]ResourceProfileDetection, error)

ListResourceProfileDetections returns data identifier detections for a bucket.

func (*InMemoryBackend) ListSensitivityInspectionTemplates

func (b *InMemoryBackend) ListSensitivityInspectionTemplates() ([]*SensitivityInspectionTemplateSummary, error)

ListSensitivityInspectionTemplates returns all templates.

func (*InMemoryBackend) ListTagsForResource

func (b *InMemoryBackend) ListTagsForResource(resourceARN string) (map[string]string, error)

ListTagsForResource returns the tags for a resource.

func (*InMemoryBackend) PutClassificationExportConfiguration

func (b *InMemoryBackend) PutClassificationExportConfiguration(cfg *ClassificationExportConfig) error

PutClassificationExportConfiguration stores the export config.

func (*InMemoryBackend) PutFindingsPublicationConfiguration

func (b *InMemoryBackend) PutFindingsPublicationConfiguration(cfg *FindingsPublicationConfig) error

PutFindingsPublicationConfiguration stores the findings publication config.

func (*InMemoryBackend) Region

func (b *InMemoryBackend) Region() string

Region returns the region.

func (*InMemoryBackend) Reset

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) Restore

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore deserializes backend state from JSON. It implements persistence.Persistable.

func (*InMemoryBackend) SearchResources

func (b *InMemoryBackend) SearchResources(_ map[string]any, _ int, _ string) ([]map[string]any, string, error)

SearchResources searches S3 resources (always returns empty — no real S3 scanning).

func (*InMemoryBackend) Snapshot

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serializes backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) TagResource

func (b *InMemoryBackend) TagResource(resourceARN string, tags map[string]string) error

TagResource adds or updates tags on a resource.

func (*InMemoryBackend) TestCustomDataIdentifier

func (b *InMemoryBackend) TestCustomDataIdentifier(
	regex string,
	ignoreWords, keywords []string,
	maxMatchDistance *int32,
	sampleText string,
) (int32, error)

TestCustomDataIdentifier tests a regex against sample text.

func (*InMemoryBackend) UntagResource

func (b *InMemoryBackend) UntagResource(resourceARN string, tagKeys []string) error

UntagResource removes tags from a resource.

func (*InMemoryBackend) UpdateAllowList

func (b *InMemoryBackend) UpdateAllowList(
	id, name, description string,
	criteria AllowListCriteria,
) (*AllowListSummary, error)

UpdateAllowList updates an existing allow list.

func (*InMemoryBackend) UpdateAutomatedDiscoveryConfiguration

func (b *InMemoryBackend) UpdateAutomatedDiscoveryConfiguration(autoEnableMembers, status string) error

UpdateAutomatedDiscoveryConfiguration updates the automated discovery config.

func (*InMemoryBackend) UpdateClassificationJob

func (b *InMemoryBackend) UpdateClassificationJob(jobID, status string) error

UpdateClassificationJob updates a job's status.

func (*InMemoryBackend) UpdateClassificationScope

func (b *InMemoryBackend) UpdateClassificationScope(scopeID string, s3 *ClassificationScopeS3) error

UpdateClassificationScope updates a scope's S3 settings.

func (*InMemoryBackend) UpdateFindingsFilter

func (b *InMemoryBackend) UpdateFindingsFilter(
	id, name, description, action string,
	position *int32,
	criteria map[string]any,
) (*FindingsFilterSummary, error)

UpdateFindingsFilter updates an existing findings filter.

func (*InMemoryBackend) UpdateMacieSession

func (b *InMemoryBackend) UpdateMacieSession(frequency, status string) error

UpdateMacieSession updates the Macie session configuration.

func (*InMemoryBackend) UpdateMemberSession

func (b *InMemoryBackend) UpdateMemberSession(accountID, status string) error

UpdateMemberSession updates the status of a member's Macie session.

func (*InMemoryBackend) UpdateOrganizationConfiguration

func (b *InMemoryBackend) UpdateOrganizationConfiguration(autoEnable bool) error

UpdateOrganizationConfiguration updates the org-level configuration.

func (*InMemoryBackend) UpdateResourceProfile

func (b *InMemoryBackend) UpdateResourceProfile(resourceARN string, sensitivityScore int32) error

UpdateResourceProfile sets a bucket's sensitivity score override.

func (*InMemoryBackend) UpdateResourceProfileDetections

func (b *InMemoryBackend) UpdateResourceProfileDetections(
	resourceARN string, suppressDataIdentifiers []map[string]any,
) error

UpdateResourceProfileDetections updates suppression status of detections.

func (*InMemoryBackend) UpdateRevealConfiguration

func (b *InMemoryBackend) UpdateRevealConfiguration(kmsKeyID, status string) error

UpdateRevealConfiguration stores the reveal configuration.

func (*InMemoryBackend) UpdateSensitivityInspectionTemplate

func (b *InMemoryBackend) UpdateSensitivityInspectionTemplate(
	templateID, name, description string,
	excludes, includes map[string]any,
) error

UpdateSensitivityInspectionTemplate updates a template.

type Invitation

type Invitation struct {
	AccountID          string    `json:"accountId"`
	InvitationID       string    `json:"invitationId"`
	InvitedAt          time.Time `json:"invitedAt"`
	RelationshipStatus string    `json:"relationshipStatus"`
}

Invitation represents a Macie invitation.

type ManagedDataIdentifier

type ManagedDataIdentifier struct {
	Category string `json:"category"`
	ID       string `json:"id"`
}

ManagedDataIdentifier describes a built-in Macie data identifier.

type Member

type Member struct {
	Tags                   map[string]string `json:"tags,omitempty"`
	InvitedAt              time.Time         `json:"invitedAt"`
	UpdatedAt              time.Time         `json:"updatedAt"`
	Arn                    string            `json:"arn"`
	AccountID              string            `json:"accountId"`
	AdministratorAccountID string            `json:"administratorAccountId,omitempty"`
	Email                  string            `json:"email"`
	MasteredBy             string            `json:"masterAccountId,omitempty"`
	RelationshipStatus     string            `json:"relationshipStatus"`
}

Member represents a Macie member account.

type OrgAdminAccount

type OrgAdminAccount struct {
	AccountID string `json:"accountId"`
	Status    string `json:"status"`
}

OrgAdminAccount represents an organization admin account.

type OrgConfig

type OrgConfig struct {
	DataSources            map[string]any   `json:"dataSources,omitempty"`
	Features               []map[string]any `json:"features,omitempty"`
	AutoEnable             bool             `json:"autoEnable"`
	MaxAccountLimitReached bool             `json:"maxAccountLimitReached"`
}

OrgConfig holds organization-level Macie configuration.

type Provider

type Provider struct{}

Provider implements service.Provider for Amazon Macie2.

func (*Provider) Init

Init initializes the Macie2 service backend and handler.

func (*Provider) Name

func (p *Provider) Name() string

Name returns the provider name.

type ResourceProfile

type ResourceProfile struct {
	Statistics               *ResourceStatistics `json:"statistics,omitempty"`
	ResourceArn              string              `json:"resourceArn"`
	SensitivityScore         int32               `json:"sensitivityScore"`
	SensitivityScoreOverride bool                `json:"sensitivityScoreOverride"`
}

ResourceProfile holds sensitivity profile data for a bucket.

type ResourceProfileArtifact

type ResourceProfileArtifact struct {
	Arn       string `json:"arn"`
	Type      string `json:"type,omitempty"`
	Sensitive bool   `json:"sensitive"`
}

ResourceProfileArtifact is a single artifact in a resource profile.

type ResourceProfileDetection

type ResourceProfileDetection struct {
	Arn        string `json:"arn,omitempty"`
	ID         string `json:"id,omitempty"`
	Name       string `json:"name,omitempty"`
	Type       string `json:"type,omitempty"`
	Count      int64  `json:"count"`
	Suppressed bool   `json:"suppressed"`
}

ResourceProfileDetection is a data identifier detection result.

type ResourceStatistics

type ResourceStatistics struct {
	LastRunErroredAt                   *time.Time `json:"lastRunErroredAt,omitempty"`
	LastRunAt                          *time.Time `json:"lastRunAt,omitempty"`
	TotalBytesClassified               int64      `json:"totalBytesClassified"`
	TotalDetections                    int64      `json:"totalDetections"`
	TotalDetectionsWithoutSuppression  int64      `json:"totalDetectionsWithoutSuppression"`
	TotalItemsClassified               int64      `json:"totalItemsClassified"`
	TotalItemsSkipped                  int64      `json:"totalItemsSkipped"`
	TotalItemsSkippedInvalidEncryption int64      `json:"totalItemsSkippedInvalidEncryption"`
	TotalItemsSkippedInvalidKms        int64      `json:"totalItemsSkippedInvalidKms"`
	TotalItemsSkippedPermissionError   int64      `json:"totalItemsSkippedPermissionError"`
}

ResourceStatistics holds classification result counts for a bucket.

type RevealConfiguration

type RevealConfiguration struct {
	KmsKeyID string `json:"kmsKeyId,omitempty"`
	Status   string `json:"status"`
}

RevealConfiguration holds sensitive data reveal configuration.

type S3BucketMetadata

type S3BucketMetadata struct {
	AccountID               string           `json:"accountId"`
	BucketArn               string           `json:"bucketArn"`
	BucketName              string           `json:"bucketName"`
	Region                  string           `json:"region"`
	PublicAccess            string           `json:"publicAccess"`
	EncryptionType          string           `json:"encryptionType"`
	SharedAccess            string           `json:"sharedAccess"`
	Tags                    []map[string]any `json:"tags,omitempty"`
	ClassifiableObjectCount int64            `json:"classifiableObjectCount"`
	ClassifiableSizeInBytes int64            `json:"classifiableSizeInBytes"`
	ObjectCount             int64            `json:"objectCount"`
	SizeInBytes             int64            `json:"sizeInBytes"`
}

S3BucketMetadata holds Macie's view of an S3 bucket for DescribeBuckets.

type S3WordsList

type S3WordsList struct {
	BucketName string `json:"bucketName"`
	ObjectKey  string `json:"objectKey"`
}

S3WordsList references an S3 object containing ignore words.

type SecurityHubConfig

type SecurityHubConfig struct {
	PublishClassificationFindings bool `json:"publishClassificationFindings"`
	PublishPolicyFindings         bool `json:"publishPolicyFindings"`
}

SecurityHubConfig holds Security Hub integration settings.

type SensitivityInspectionTemplate

type SensitivityInspectionTemplate struct {
	Excludes    map[string]any `json:"excludes,omitempty"`
	Includes    map[string]any `json:"includes,omitempty"`
	ID          string         `json:"id"`
	Name        string         `json:"name"`
	Description string         `json:"description,omitempty"`
}

SensitivityInspectionTemplate holds template configuration.

type SensitivityInspectionTemplateSummary

type SensitivityInspectionTemplateSummary struct {
	ID   string `json:"id"`
	Name string `json:"name"`
}

SensitivityInspectionTemplateSummary is the list-view of a template.

type Session

type Session struct {
	CreatedAt                  time.Time `json:"createdAt"`
	UpdatedAt                  time.Time `json:"updatedAt"`
	FindingPublishingFrequency string    `json:"findingPublishingFrequency"`
	ServiceRole                string    `json:"serviceRole"`
	Status                     string    `json:"status"`
	Enabled                    bool      `json:"-"`
}

Session represents the Macie account state.

type Severity

type Severity struct {
	Description string  `json:"description"`
	Score       float64 `json:"score"`
}

Severity holds finding severity details.

type StorageBackend

type StorageBackend interface {
	// Session management
	GetSession() *Session
	EnableMacie(clientToken, frequency, status string) error
	DisableMacie() error
	UpdateMacieSession(frequency, status string) error

	// Classification job operations
	CreateClassificationJob(
		name, description, jobType, clientToken string,
		s3JobDefinition, scheduleFrequency map[string]any,
		tags map[string]string,
		samplingPercentage int32,
		initialRun bool,
	) (id, jobArn string, err error)
	DescribeClassificationJob(jobID string) (*ClassificationJob, error)
	ListClassificationJobs(
		filterCriteria map[string]any,
		maxResults int,
		nextToken string,
	) ([]*ClassificationJobSummary, string, error)
	UpdateClassificationJob(jobID, status string) error

	// Member operations
	CreateMember(accountID, email string, tags map[string]string) error
	GetMember(accountID string) (*Member, error)
	DeleteMember(accountID string) error
	ListMembers(onlyAssociated bool) ([]*Member, error)
	DisassociateMember(accountID string) error
	UpdateMemberSession(accountID, status string) error

	// Invitation operations
	CreateInvitations(
		accountIDs []string,
		message string,
		disableEmail bool,
	) ([]UnprocessedAccount, error)
	AcceptInvitation(administratorAccountID, invitationID string) error
	DeclineInvitations(accountIDs []string) ([]UnprocessedAccount, error)
	DeleteInvitations(accountIDs []string) ([]UnprocessedAccount, error)
	GetInvitationsCount() (int64, error)
	ListInvitations() ([]*Invitation, error)

	// Administrator / master account operations
	GetAdministratorAccount() (*AdministratorAccount, error)
	GetMasterAccount() (*AdministratorAccount, error)
	DisassociateFromAdministratorAccount() error
	DisassociateFromMasterAccount() error

	// Organization admin operations
	EnableOrganizationAdminAccount(accountID string) error
	DisableOrganizationAdminAccount(accountID string) error
	ListOrganizationAdminAccounts() ([]*OrgAdminAccount, error)

	// Organization configuration
	DescribeOrganizationConfiguration() (*OrgConfig, error)
	UpdateOrganizationConfiguration(autoEnable bool) error

	// Automated discovery operations
	GetAutomatedDiscoveryConfiguration() (*AutoDiscoveryConfig, error)
	UpdateAutomatedDiscoveryConfiguration(autoEnableMembers, status string) error
	ListAutomatedDiscoveryAccounts() ([]*AutoDiscoveryAccount, error)
	BatchUpdateAutomatedDiscoveryAccounts(updates []AutoDiscoveryAccountUpdate) error

	// Bucket operations
	DescribeBuckets(criteria map[string]any) ([]map[string]any, error)
	GetBucketStatistics(accountID string) (map[string]any, error)

	// Batch custom data identifier
	BatchGetCustomDataIdentifiers(ids []string) ([]*CustomDataIdentifier, error)

	// Classification export configuration
	GetClassificationExportConfiguration() (*ClassificationExportConfig, error)
	PutClassificationExportConfiguration(cfg *ClassificationExportConfig) error

	// Classification scope operations
	GetClassificationScope(scopeID string) (*ClassificationScope, error)
	ListClassificationScopes() ([]*ClassificationScopeSummary, error)
	UpdateClassificationScope(scopeID string, s3 *ClassificationScopeS3) error

	// Findings publication configuration
	GetFindingsPublicationConfiguration() (*FindingsPublicationConfig, error)
	PutFindingsPublicationConfiguration(cfg *FindingsPublicationConfig) error

	// Resource profile operations
	GetResourceProfile(resourceARN string) (*ResourceProfile, error)
	UpdateResourceProfile(resourceARN string, sensitivityScore int32) error
	ListResourceProfileArtifacts(resourceARN string) ([]ResourceProfileArtifact, error)
	ListResourceProfileDetections(resourceARN string) ([]ResourceProfileDetection, error)
	UpdateResourceProfileDetections(
		resourceARN string,
		suppressDataIdentifiers []map[string]any,
	) error

	// Reveal configuration
	GetRevealConfiguration() (*RevealConfiguration, error)
	UpdateRevealConfiguration(kmsKeyID, status string) error

	// Sensitive data occurrences
	GetSensitiveDataOccurrences(findingID string) (map[string]any, error)
	GetSensitiveDataOccurrencesAvailability(findingID string) (string, []string, error)

	// Sensitivity inspection template operations
	GetSensitivityInspectionTemplate(templateID string) (*SensitivityInspectionTemplate, error)
	ListSensitivityInspectionTemplates() ([]*SensitivityInspectionTemplateSummary, error)
	UpdateSensitivityInspectionTemplate(
		templateID, name, description string,
		excludes, includes map[string]any,
	) error

	// Usage operations
	GetUsageStatistics(
		filterBy []map[string]any,
		maxResults int,
		nextToken, sortBy string,
	) ([]UsageRecord, string, error)
	GetUsageTotals(timeRange string) ([]UsageTotal, error)

	// Managed data identifiers
	ListManagedDataIdentifiers() ([]ManagedDataIdentifier, error)

	// Search resources
	SearchResources(
		bucketCriteria map[string]any,
		maxResults int,
		nextToken string,
	) ([]map[string]any, string, error)

	// Allow list operations
	CreateAllowList(
		name, description string,
		criteria AllowListCriteria,
		tags map[string]string,
	) (*AllowListSummary, error)
	GetAllowList(id string) (*AllowListDetail, error)
	UpdateAllowList(
		id, name, description string,
		criteria AllowListCriteria,
	) (*AllowListSummary, error)
	DeleteAllowList(id string) error
	ListAllowLists(limit int, token string) ([]*AllowListSummary, string, error)

	// Custom data identifier operations
	CreateCustomDataIdentifier(
		name, description, regex string,
		ignoreWords, keywords []string,
		maxMatchDistance *int32,
		tags map[string]string,
	) (string, error)
	GetCustomDataIdentifier(id string) (*CustomDataIdentifier, error)
	DeleteCustomDataIdentifier(id string) error
	ListCustomDataIdentifiers(limit int, token string) ([]*CustomDataIdentifierSummary, string, error)
	TestCustomDataIdentifier(
		regex string,
		ignoreWords, keywords []string,
		maxMatchDistance *int32,
		sampleText string,
	) (int32, error)

	// Findings filter operations
	CreateFindingsFilter(
		name, description, action string,
		position *int32,
		criteria map[string]any,
		tags map[string]string,
	) (*FindingsFilterSummary, error)
	GetFindingsFilter(id string) (*FindingsFilterDetail, error)
	UpdateFindingsFilter(
		id, name, description, action string,
		position *int32,
		criteria map[string]any,
	) (*FindingsFilterSummary, error)
	DeleteFindingsFilter(id string) error
	ListFindingsFilters(limit int, token string) ([]*FindingsFilterSummary, string, error)

	// Finding operations
	GetFindings(findingIDs []string) ([]*Finding, error)
	ListFindings(
		criteria map[string]any,
		maxResults int,
		nextToken string,
	) ([]string, string, error)
	CreateSampleFindings(findingTypes []string) error
	GetFindingStatistics(groupBy string, criteria map[string]any) ([]FindingStatisticsGroup, error)

	// Tag operations
	TagResource(resourceARN string, tags map[string]string) error
	UntagResource(resourceARN string, tagKeys []string) error
	ListTagsForResource(resourceARN string) (map[string]string, error)

	// Lifecycle
	AccountID() string
	Region() string
	Reset()
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend is the interface for Macie2 storage operations.

type UnprocessedAccount

type UnprocessedAccount struct {
	AccountID    string `json:"accountId"`
	ErrorCode    string `json:"errorCode"`
	ErrorMessage string `json:"errorMessage"`
}

UnprocessedAccount describes an account that could not be processed.

type UsageByAccount

type UsageByAccount struct {
	Currency      string         `json:"currency,omitempty"`
	EstimatedCost string         `json:"estimatedCost,omitempty"`
	ServiceLimit  map[string]any `json:"serviceLimit,omitempty"`
	Type          string         `json:"type,omitempty"`
}

UsageByAccount holds usage data for one type.

type UsageRecord

type UsageRecord struct {
	AccountID                            string           `json:"accountId"`
	AutomatedDiscoveryFreeTrialStartDate *time.Time       `json:"automatedDiscoveryFreeTrialStartDate,omitempty"`
	FreeTrialStartDate                   *time.Time       `json:"freeTrialStartDate,omitempty"`
	Usage                                []UsageByAccount `json:"usage,omitempty"`
}

UsageRecord holds usage data for a single account.

type UsageTotal

type UsageTotal struct {
	Currency      string `json:"currency,omitempty"`
	EstimatedCost string `json:"estimatedCost,omitempty"`
	Type          string `json:"type,omitempty"`
}

UsageTotal holds aggregated usage totals.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL