2026/07/08 - AWS Resilience Hub V2 - 8 updated api methods
Changes Next Generation Resilience Hub now supports filtering and sorting failure mode assessments, resource type filtering in ListResources, cross-region and cross-account topology edges, data recovery achievability status, and more granular dependency discovery progress tracking.
{'service': {'achievability': {'dataRecoveryTimeBetweenBackups': 'ACHIEVABLE | '
'NOT_ACHIEVABLE'},
'dependencyDiscovery': {'eligibleResourceCount': 'integer',
'message': 'string'}}}
Creates a service.
See also: AWS API Documentation
Request Syntax
client.create_service(
name='string',
description='string',
associatedSystems=[
{
'systemArn': 'string',
'systemName': 'string',
'userJourneyIds': [
'string',
]
},
],
policyArn='string',
regions=[
'string',
],
permissionModel={
'invokerRoleName': 'string',
'crossAccountRoles': [
{
'crossAccountRoleArn': 'string',
'externalId': 'string'
},
]
},
dependencyDiscovery='ENABLED'|'DISABLED',
reportConfiguration={
'reportOutputs': [
{
's3': {
'bucketPath': 'string',
'bucketOwner': 'string'
}
},
]
},
kmsKeyId='string',
tags={
'string': 'string'
},
clientToken='string'
)
string
[REQUIRED]
Resource name (used in ARN — no spaces allowed).
string
Resource description for services and policies.
list
The systems to associate with the service.
(dict) --
Represents a system associated with a service.
systemArn (string) -- [REQUIRED]
ARN identifier.
systemName (string) --
Resource name (used in ARN — no spaces allowed).
userJourneyIds (list) --
The list of user journey identifiers that associate this system with the service.
(string) --
string
ARN identifier.
list
[REQUIRED]
The AWS Regions where the service operates.
(string) --
dict
[REQUIRED]
The permission model for the service.
invokerRoleName (string) -- [REQUIRED]
IAM role name (supports up to 64 characters per IAM limits).
crossAccountRoles (list) --
The list of cross-account IAM role ARNs.
(dict) --
Specifies a cross-account IAM role ARN and optional external ID.
crossAccountRoleArn (string) -- [REQUIRED]
ARN of the IAM Role for the profile. Null if the permission profile is the 'Admin' profile.
externalId (string) --
The external ID used for assuming the cross-account role.
string
Caller-settable values for dependency discovery. INITIALIZING is system-managed.
dict
Configuration for automatic report generation on a Service.
reportOutputs (list) -- [REQUIRED]
Output destinations for generated reports.
(dict) --
Configuration for a report output destination.
s3 (dict) --
S3 configuration for report output.
bucketPath (string) -- [REQUIRED]
S3 bucket path where reports will be written (e.g., my-bucket/ngrh-reports/).
bucketOwner (string) -- [REQUIRED]
Account ID of the bucket owner for cross-account access verification.
string
KMS key identifier — accepts key ID, key ARN, alias name, or alias ARN.
dict
Resource tags.
(string) --
Tag key.
(string) --
Tag value.
string
Idempotency token.
This field is autopopulated if not provided.
dict
Response Syntax
{
'service': {
'serviceArn': 'string',
'name': 'string',
'description': 'string',
'associatedSystems': [
{
'systemArn': 'string',
'systemName': 'string',
'userJourneyIds': [
'string',
]
},
],
'policyArn': 'string',
'regions': [
'string',
],
'permissionModel': {
'invokerRoleName': 'string',
'crossAccountRoles': [
{
'crossAccountRoleArn': 'string',
'externalId': 'string'
},
]
},
'dependencyDiscovery': {
'status': 'ENABLED'|'INITIALIZING'|'DISABLED',
'updatedAt': datetime(2015, 1, 1),
'eligibleResourceCount': 123,
'message': 'string'
},
'effectivePolicyValues': {
'availabilitySlo': {
'value': 123.0,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiAzRto': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiAzRpo': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiAzDrApproach': {
'value': 'string',
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiRegionRto': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiRegionRpo': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiRegionDrApproach': {
'value': 'string',
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'dataRecoveryTimeBetweenBackups': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
}
},
'achievability': {
'availabilitySlo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'multiAzRtoRpo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'multiRegionRtoRpo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'dataRecoveryTimeBetweenBackups': 'ACHIEVABLE'|'NOT_ACHIEVABLE'
},
'reportConfiguration': {
'reportOutputs': [
{
's3': {
'bucketPath': 'string',
'bucketOwner': 'string'
}
},
]
},
'kmsKeyId': 'string',
'tags': {
'string': 'string'
},
'estimatedAssessmentCost': {
'amount': 123.0,
'currency': 'USD'
},
'resourceDiscovery': {
'status': 'RUNNING'|'SUCCEEDED'|'FAILED'|'COMPLETED_WITH_FAILURES'|'NOT_STARTED',
'lastRunAt': datetime(2015, 1, 1),
'errorCode': 'INVALID_PERMISSIONS'|'STACK_NOT_FOUND'|'CLUSTER_NOT_FOUND'|'STATE_FILE_NOT_FOUND'|'ACCESS_DENIED'|'UNSUPPORTED_CLUSTER'|'INTERNAL_ERROR',
'errorMessage': 'string'
},
'assessmentStatus': 'NOT_STARTED'|'PENDING'|'IN_PROGRESS'|'FAILED'|'SUCCESS',
'rerunAssessment': True|False,
'openFindingsCount': 123,
'resolvedFindingsCount': 123,
'organizationId': 'string',
'ouId': 'string',
'accountId': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
service (dict) --
The created service.
serviceArn (string) --
ARN identifier.
name (string) --
Resource name (used in ARN — no spaces allowed).
description (string) --
Resource description for services and policies.
associatedSystems (list) --
The systems associated with the service.
(dict) --
Represents a system associated with a service.
systemArn (string) --
ARN identifier.
systemName (string) --
Resource name (used in ARN — no spaces allowed).
userJourneyIds (list) --
The list of user journey identifiers that associate this system with the service.
(string) --
policyArn (string) --
ARN identifier.
regions (list) --
The AWS Regions where the service operates.
(string) --
permissionModel (dict) --
The permission model for the service.
invokerRoleName (string) --
IAM role name (supports up to 64 characters per IAM limits).
crossAccountRoles (list) --
The list of cross-account IAM role ARNs.
(dict) --
Specifies a cross-account IAM role ARN and optional external ID.
crossAccountRoleArn (string) --
ARN of the IAM Role for the profile. Null if the permission profile is the 'Admin' profile.
externalId (string) --
The external ID used for assuming the cross-account role.
dependencyDiscovery (dict) --
The dependency discovery configuration for the service.
status (string) --
The current status of dependency discovery.
updatedAt (datetime) --
The timestamp when dependency discovery was last updated.
eligibleResourceCount (integer) --
The count of resources eligible for dependency attribution.
message (string) --
A status message for dependency discovery, displayed during the initialization state.
effectivePolicyValues (dict) --
The effective policy values for the service.
availabilitySlo (dict) --
The effective availability SLO value for the service.
value (float) --
The availability SLO percentage value.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiAzRto (dict) --
The effective multi-AZ RTO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiAzRpo (dict) --
The effective multi-AZ RPO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiAzDrApproach (dict) --
The effective multi-AZ disaster recovery approach for the service.
value (string) --
The disaster recovery approach value.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiRegionRto (dict) --
The effective multi-Region RTO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiRegionRpo (dict) --
The effective multi-Region RPO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiRegionDrApproach (dict) --
The effective multi-Region disaster recovery approach for the service.
value (string) --
The disaster recovery approach value.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
dataRecoveryTimeBetweenBackups (dict) --
The effective data recovery time between backups value for the service.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
achievability (dict) --
The achievability status of the service's resilience targets.
availabilitySlo (string) --
The achievability status of the availability SLO target for the service.
multiAzRtoRpo (string) --
The achievability status of the multi-AZ RTO and RPO targets for the service.
multiRegionRtoRpo (string) --
The achievability status of the multi-Region RTO and RPO targets for the service.
dataRecoveryTimeBetweenBackups (string) --
The achievability status of the data recovery time between backups for the service.
reportConfiguration (dict) --
Configuration for automatic report generation on a Service.
reportOutputs (list) --
Output destinations for generated reports.
(dict) --
Configuration for a report output destination.
s3 (dict) --
S3 configuration for report output.
bucketPath (string) --
S3 bucket path where reports will be written (e.g., my-bucket/ngrh-reports/).
bucketOwner (string) --
Account ID of the bucket owner for cross-account access verification.
kmsKeyId (string) --
KMS key identifier — accepts key ID, key ARN, alias name, or alias ARN.
tags (dict) --
Resource tags.
(string) --
Tag key.
(string) --
Tag value.
estimatedAssessmentCost (dict) --
The estimated cost of running an assessment on the service.
amount (float) --
The cost amount for the assessment.
currency (string) --
The currency of the assessment cost.
resourceDiscovery (dict) --
The resource discovery status for the service.
status (string) --
The current status of resource discovery.
lastRunAt (datetime) --
The timestamp of the last resource discovery run.
errorCode (string) --
The error code if resource discovery failed.
errorMessage (string) --
A message describing the error if resource discovery failed.
assessmentStatus (string) --
The current assessment status of the service.
rerunAssessment (boolean) --
Indicates whether the assessment should be rerun.
openFindingsCount (integer) --
The number of open findings for the service.
resolvedFindingsCount (integer) --
The number of resolved findings for the service.
organizationId (string) --
The AWS Organizations identifier for the service.
ouId (string) --
The organizational unit (OU) identifier for the service.
accountId (string) --
The AWS account ID that owns the service.
createdAt (datetime) --
The timestamp when the service was created.
updatedAt (datetime) --
The timestamp when the service was last updated.
{'service': {'achievability': {'dataRecoveryTimeBetweenBackups': 'ACHIEVABLE | '
'NOT_ACHIEVABLE'},
'dependencyDiscovery': {'eligibleResourceCount': 'integer',
'message': 'string'}}}
Retrieves a service by ARN.
See also: AWS API Documentation
Request Syntax
client.get_service(
serviceArn='string'
)
string
[REQUIRED]
ARN identifier.
dict
Response Syntax
{
'service': {
'serviceArn': 'string',
'name': 'string',
'description': 'string',
'associatedSystems': [
{
'systemArn': 'string',
'systemName': 'string',
'userJourneyIds': [
'string',
]
},
],
'policyArn': 'string',
'regions': [
'string',
],
'permissionModel': {
'invokerRoleName': 'string',
'crossAccountRoles': [
{
'crossAccountRoleArn': 'string',
'externalId': 'string'
},
]
},
'dependencyDiscovery': {
'status': 'ENABLED'|'INITIALIZING'|'DISABLED',
'updatedAt': datetime(2015, 1, 1),
'eligibleResourceCount': 123,
'message': 'string'
},
'effectivePolicyValues': {
'availabilitySlo': {
'value': 123.0,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiAzRto': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiAzRpo': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiAzDrApproach': {
'value': 'string',
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiRegionRto': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiRegionRpo': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiRegionDrApproach': {
'value': 'string',
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'dataRecoveryTimeBetweenBackups': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
}
},
'achievability': {
'availabilitySlo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'multiAzRtoRpo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'multiRegionRtoRpo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'dataRecoveryTimeBetweenBackups': 'ACHIEVABLE'|'NOT_ACHIEVABLE'
},
'reportConfiguration': {
'reportOutputs': [
{
's3': {
'bucketPath': 'string',
'bucketOwner': 'string'
}
},
]
},
'kmsKeyId': 'string',
'tags': {
'string': 'string'
},
'estimatedAssessmentCost': {
'amount': 123.0,
'currency': 'USD'
},
'resourceDiscovery': {
'status': 'RUNNING'|'SUCCEEDED'|'FAILED'|'COMPLETED_WITH_FAILURES'|'NOT_STARTED',
'lastRunAt': datetime(2015, 1, 1),
'errorCode': 'INVALID_PERMISSIONS'|'STACK_NOT_FOUND'|'CLUSTER_NOT_FOUND'|'STATE_FILE_NOT_FOUND'|'ACCESS_DENIED'|'UNSUPPORTED_CLUSTER'|'INTERNAL_ERROR',
'errorMessage': 'string'
},
'assessmentStatus': 'NOT_STARTED'|'PENDING'|'IN_PROGRESS'|'FAILED'|'SUCCESS',
'rerunAssessment': True|False,
'openFindingsCount': 123,
'resolvedFindingsCount': 123,
'organizationId': 'string',
'ouId': 'string',
'accountId': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
service (dict) --
The requested service.
serviceArn (string) --
ARN identifier.
name (string) --
Resource name (used in ARN — no spaces allowed).
description (string) --
Resource description for services and policies.
associatedSystems (list) --
The systems associated with the service.
(dict) --
Represents a system associated with a service.
systemArn (string) --
ARN identifier.
systemName (string) --
Resource name (used in ARN — no spaces allowed).
userJourneyIds (list) --
The list of user journey identifiers that associate this system with the service.
(string) --
policyArn (string) --
ARN identifier.
regions (list) --
The AWS Regions where the service operates.
(string) --
permissionModel (dict) --
The permission model for the service.
invokerRoleName (string) --
IAM role name (supports up to 64 characters per IAM limits).
crossAccountRoles (list) --
The list of cross-account IAM role ARNs.
(dict) --
Specifies a cross-account IAM role ARN and optional external ID.
crossAccountRoleArn (string) --
ARN of the IAM Role for the profile. Null if the permission profile is the 'Admin' profile.
externalId (string) --
The external ID used for assuming the cross-account role.
dependencyDiscovery (dict) --
The dependency discovery configuration for the service.
status (string) --
The current status of dependency discovery.
updatedAt (datetime) --
The timestamp when dependency discovery was last updated.
eligibleResourceCount (integer) --
The count of resources eligible for dependency attribution.
message (string) --
A status message for dependency discovery, displayed during the initialization state.
effectivePolicyValues (dict) --
The effective policy values for the service.
availabilitySlo (dict) --
The effective availability SLO value for the service.
value (float) --
The availability SLO percentage value.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiAzRto (dict) --
The effective multi-AZ RTO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiAzRpo (dict) --
The effective multi-AZ RPO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiAzDrApproach (dict) --
The effective multi-AZ disaster recovery approach for the service.
value (string) --
The disaster recovery approach value.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiRegionRto (dict) --
The effective multi-Region RTO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiRegionRpo (dict) --
The effective multi-Region RPO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiRegionDrApproach (dict) --
The effective multi-Region disaster recovery approach for the service.
value (string) --
The disaster recovery approach value.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
dataRecoveryTimeBetweenBackups (dict) --
The effective data recovery time between backups value for the service.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
achievability (dict) --
The achievability status of the service's resilience targets.
availabilitySlo (string) --
The achievability status of the availability SLO target for the service.
multiAzRtoRpo (string) --
The achievability status of the multi-AZ RTO and RPO targets for the service.
multiRegionRtoRpo (string) --
The achievability status of the multi-Region RTO and RPO targets for the service.
dataRecoveryTimeBetweenBackups (string) --
The achievability status of the data recovery time between backups for the service.
reportConfiguration (dict) --
Configuration for automatic report generation on a Service.
reportOutputs (list) --
Output destinations for generated reports.
(dict) --
Configuration for a report output destination.
s3 (dict) --
S3 configuration for report output.
bucketPath (string) --
S3 bucket path where reports will be written (e.g., my-bucket/ngrh-reports/).
bucketOwner (string) --
Account ID of the bucket owner for cross-account access verification.
kmsKeyId (string) --
KMS key identifier — accepts key ID, key ARN, alias name, or alias ARN.
tags (dict) --
Resource tags.
(string) --
Tag key.
(string) --
Tag value.
estimatedAssessmentCost (dict) --
The estimated cost of running an assessment on the service.
amount (float) --
The cost amount for the assessment.
currency (string) --
The currency of the assessment cost.
resourceDiscovery (dict) --
The resource discovery status for the service.
status (string) --
The current status of resource discovery.
lastRunAt (datetime) --
The timestamp of the last resource discovery run.
errorCode (string) --
The error code if resource discovery failed.
errorMessage (string) --
A message describing the error if resource discovery failed.
assessmentStatus (string) --
The current assessment status of the service.
rerunAssessment (boolean) --
Indicates whether the assessment should be rerun.
openFindingsCount (integer) --
The number of open findings for the service.
resolvedFindingsCount (integer) --
The number of resolved findings for the service.
organizationId (string) --
The AWS Organizations identifier for the service.
ouId (string) --
The organizational unit (OU) identifier for the service.
accountId (string) --
The AWS account ID that owns the service.
createdAt (datetime) --
The timestamp when the service was created.
updatedAt (datetime) --
The timestamp when the service was last updated.
{'service': {'achievability': {'dataRecoveryTimeBetweenBackups': 'ACHIEVABLE | '
'NOT_ACHIEVABLE'},
'dependencyDiscovery': {'eligibleResourceCount': 'integer',
'message': 'string'}}}
Imports a V1 app into the V2 resource model, creating a service with the same name.
See also: AWS API Documentation
Request Syntax
client.import_app(
v1AppArn='string',
policyArn='string',
kmsKeyId='string',
skipManuallyAddedResources=True|False,
associatedSystems=[
{
'systemArn': 'string',
'systemName': 'string',
'userJourneyIds': [
'string',
]
},
],
tags={
'string': 'string'
},
clientToken='string'
)
string
[REQUIRED]
ARN identifier.
string
ARN identifier.
string
KMS key identifier — accepts key ID, key ARN, alias name, or alias ARN.
boolean
Whether to skip manually added resources during import.
list
The systems to associate with the imported service.
(dict) --
Represents a system associated with a service.
systemArn (string) -- [REQUIRED]
ARN identifier.
systemName (string) --
Resource name (used in ARN — no spaces allowed).
userJourneyIds (list) --
The list of user journey identifiers that associate this system with the service.
(string) --
dict
Resource tags.
(string) --
Tag key.
(string) --
Tag value.
string
Idempotency token.
This field is autopopulated if not provided.
dict
Response Syntax
{
'service': {
'serviceArn': 'string',
'name': 'string',
'description': 'string',
'associatedSystems': [
{
'systemArn': 'string',
'systemName': 'string',
'userJourneyIds': [
'string',
]
},
],
'policyArn': 'string',
'regions': [
'string',
],
'permissionModel': {
'invokerRoleName': 'string',
'crossAccountRoles': [
{
'crossAccountRoleArn': 'string',
'externalId': 'string'
},
]
},
'dependencyDiscovery': {
'status': 'ENABLED'|'INITIALIZING'|'DISABLED',
'updatedAt': datetime(2015, 1, 1),
'eligibleResourceCount': 123,
'message': 'string'
},
'effectivePolicyValues': {
'availabilitySlo': {
'value': 123.0,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiAzRto': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiAzRpo': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiAzDrApproach': {
'value': 'string',
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiRegionRto': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiRegionRpo': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiRegionDrApproach': {
'value': 'string',
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'dataRecoveryTimeBetweenBackups': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
}
},
'achievability': {
'availabilitySlo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'multiAzRtoRpo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'multiRegionRtoRpo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'dataRecoveryTimeBetweenBackups': 'ACHIEVABLE'|'NOT_ACHIEVABLE'
},
'reportConfiguration': {
'reportOutputs': [
{
's3': {
'bucketPath': 'string',
'bucketOwner': 'string'
}
},
]
},
'kmsKeyId': 'string',
'tags': {
'string': 'string'
},
'estimatedAssessmentCost': {
'amount': 123.0,
'currency': 'USD'
},
'resourceDiscovery': {
'status': 'RUNNING'|'SUCCEEDED'|'FAILED'|'COMPLETED_WITH_FAILURES'|'NOT_STARTED',
'lastRunAt': datetime(2015, 1, 1),
'errorCode': 'INVALID_PERMISSIONS'|'STACK_NOT_FOUND'|'CLUSTER_NOT_FOUND'|'STATE_FILE_NOT_FOUND'|'ACCESS_DENIED'|'UNSUPPORTED_CLUSTER'|'INTERNAL_ERROR',
'errorMessage': 'string'
},
'assessmentStatus': 'NOT_STARTED'|'PENDING'|'IN_PROGRESS'|'FAILED'|'SUCCESS',
'rerunAssessment': True|False,
'openFindingsCount': 123,
'resolvedFindingsCount': 123,
'organizationId': 'string',
'ouId': 'string',
'accountId': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
service (dict) --
The imported service.
serviceArn (string) --
ARN identifier.
name (string) --
Resource name (used in ARN — no spaces allowed).
description (string) --
Resource description for services and policies.
associatedSystems (list) --
The systems associated with the service.
(dict) --
Represents a system associated with a service.
systemArn (string) --
ARN identifier.
systemName (string) --
Resource name (used in ARN — no spaces allowed).
userJourneyIds (list) --
The list of user journey identifiers that associate this system with the service.
(string) --
policyArn (string) --
ARN identifier.
regions (list) --
The AWS Regions where the service operates.
(string) --
permissionModel (dict) --
The permission model for the service.
invokerRoleName (string) --
IAM role name (supports up to 64 characters per IAM limits).
crossAccountRoles (list) --
The list of cross-account IAM role ARNs.
(dict) --
Specifies a cross-account IAM role ARN and optional external ID.
crossAccountRoleArn (string) --
ARN of the IAM Role for the profile. Null if the permission profile is the 'Admin' profile.
externalId (string) --
The external ID used for assuming the cross-account role.
dependencyDiscovery (dict) --
The dependency discovery configuration for the service.
status (string) --
The current status of dependency discovery.
updatedAt (datetime) --
The timestamp when dependency discovery was last updated.
eligibleResourceCount (integer) --
The count of resources eligible for dependency attribution.
message (string) --
A status message for dependency discovery, displayed during the initialization state.
effectivePolicyValues (dict) --
The effective policy values for the service.
availabilitySlo (dict) --
The effective availability SLO value for the service.
value (float) --
The availability SLO percentage value.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiAzRto (dict) --
The effective multi-AZ RTO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiAzRpo (dict) --
The effective multi-AZ RPO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiAzDrApproach (dict) --
The effective multi-AZ disaster recovery approach for the service.
value (string) --
The disaster recovery approach value.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiRegionRto (dict) --
The effective multi-Region RTO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiRegionRpo (dict) --
The effective multi-Region RPO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiRegionDrApproach (dict) --
The effective multi-Region disaster recovery approach for the service.
value (string) --
The disaster recovery approach value.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
dataRecoveryTimeBetweenBackups (dict) --
The effective data recovery time between backups value for the service.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
achievability (dict) --
The achievability status of the service's resilience targets.
availabilitySlo (string) --
The achievability status of the availability SLO target for the service.
multiAzRtoRpo (string) --
The achievability status of the multi-AZ RTO and RPO targets for the service.
multiRegionRtoRpo (string) --
The achievability status of the multi-Region RTO and RPO targets for the service.
dataRecoveryTimeBetweenBackups (string) --
The achievability status of the data recovery time between backups for the service.
reportConfiguration (dict) --
Configuration for automatic report generation on a Service.
reportOutputs (list) --
Output destinations for generated reports.
(dict) --
Configuration for a report output destination.
s3 (dict) --
S3 configuration for report output.
bucketPath (string) --
S3 bucket path where reports will be written (e.g., my-bucket/ngrh-reports/).
bucketOwner (string) --
Account ID of the bucket owner for cross-account access verification.
kmsKeyId (string) --
KMS key identifier — accepts key ID, key ARN, alias name, or alias ARN.
tags (dict) --
Resource tags.
(string) --
Tag key.
(string) --
Tag value.
estimatedAssessmentCost (dict) --
The estimated cost of running an assessment on the service.
amount (float) --
The cost amount for the assessment.
currency (string) --
The currency of the assessment cost.
resourceDiscovery (dict) --
The resource discovery status for the service.
status (string) --
The current status of resource discovery.
lastRunAt (datetime) --
The timestamp of the last resource discovery run.
errorCode (string) --
The error code if resource discovery failed.
errorMessage (string) --
A message describing the error if resource discovery failed.
assessmentStatus (string) --
The current assessment status of the service.
rerunAssessment (boolean) --
Indicates whether the assessment should be rerun.
openFindingsCount (integer) --
The number of open findings for the service.
resolvedFindingsCount (integer) --
The number of resolved findings for the service.
organizationId (string) --
The AWS Organizations identifier for the service.
ouId (string) --
The organizational unit (OU) identifier for the service.
accountId (string) --
The AWS account ID that owns the service.
createdAt (datetime) --
The timestamp when the service was created.
updatedAt (datetime) --
The timestamp when the service was last updated.
{'assessmentStatuses': ['NOT_STARTED | PENDING | IN_PROGRESS | FAILED | '
'SUCCESS'],
'endedBefore': 'timestamp',
'sortBy': 'STARTED_AT',
'sortOrder': 'ASC | DESC',
'startedAfter': 'timestamp'}
Response {'assessmentSummaries': {'achievability': {'dataRecoveryTimeBetweenBackups': 'ACHIEVABLE '
'| '
'NOT_ACHIEVABLE'},
'assessmentStep': {'DESIGN_ANALYSIS',
'FAILURE_MODE_FINDINGS_CONSOLIDATION',
'FAILURE_MODE_FINDINGS_ENRICHMENT',
'INPUT_VALIDATION',
'POLICY_VALIDATION',
'TOPOLOGY_GENERATION'}}}
Lists failure mode assessments.
See also: AWS API Documentation
Request Syntax
client.list_failure_mode_assessments(
serviceArn='string',
assessmentStatuses=[
'NOT_STARTED'|'PENDING'|'IN_PROGRESS'|'FAILED'|'SUCCESS',
],
startedAfter=datetime(2015, 1, 1),
endedBefore=datetime(2015, 1, 1),
sortBy='STARTED_AT',
sortOrder='ASC'|'DESC',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
ARN identifier.
list
Specifies the assessment statuses to include in the results.
(string) --
datetime
Specifies that only assessments that started at or after this timestamp appear in the results.
datetime
Specifies that only assessments that ended at or before this timestamp appear in the results.
string
The field to use for sorting failure mode assessments.
string
The sort order for results.
integer
Pagination page size.
string
Pagination token.
dict
Response Syntax
{
'assessmentSummaries': [
{
'assessmentId': 'string',
'serviceArn': 'string',
'assessmentStatus': 'NOT_STARTED'|'PENDING'|'IN_PROGRESS'|'FAILED'|'SUCCESS',
'assessmentStep': 'TOPOLOGY_GENERATION'|'INPUT_VALIDATION'|'DESIGN_ANALYSIS'|'TOPOLOGY_ENHANCEMENT'|'SERVICE_FUNCTION_GENERATION'|'POLICY_VALIDATION'|'RESILIENCE_ASSESSMENT'|'FAILURE_MODE_FINDINGS_CONSOLIDATION'|'FAILURE_MODE_FINDINGS_ENRICHMENT',
'totalFindings': 123,
'startedAt': datetime(2015, 1, 1),
'endedAt': datetime(2015, 1, 1),
'errorMessage': 'string',
'errorCode': 'INVALID_PERMISSIONS'|'CMK_ACCESS_DENIED'|'AGENT_ERROR'|'INTERNAL_ERROR'|'DESIGN_FILE_ACCESS_DENIED',
'assessmentCost': {
'amount': 123.0,
'currency': 'USD'
},
'billableAssessmentUnitCount': 123,
'achievability': {
'availabilitySlo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'multiAzRtoRpo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'multiRegionRtoRpo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'dataRecoveryTimeBetweenBackups': 'ACHIEVABLE'|'NOT_ACHIEVABLE'
}
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
assessmentSummaries (list) --
The list of assessment summaries.
(dict) --
Contains summary information about a failure mode assessment.
assessmentId (string) --
The unique identifier of the assessment.
serviceArn (string) --
ARN identifier.
assessmentStatus (string) --
The current status of the assessment.
assessmentStep (string) --
The current step of the assessment process.
totalFindings (integer) --
The total number of findings generated by the assessment.
startedAt (datetime) --
The timestamp when the assessment started.
endedAt (datetime) --
The timestamp when the assessment ended.
errorMessage (string) --
A message describing the error if the assessment failed.
errorCode (string) --
The error code if the assessment failed.
assessmentCost (dict) --
The cost of the assessment.
amount (float) --
The cost amount for the assessment.
currency (string) --
The currency of the assessment cost.
billableAssessmentUnitCount (integer) --
The number of billable assessment units consumed by the assessment.
achievability (dict) --
The achievability results from the assessment.
availabilitySlo (string) --
The achievability status of the availability SLO target for the service.
multiAzRtoRpo (string) --
The achievability status of the multi-AZ RTO and RPO targets for the service.
multiRegionRtoRpo (string) --
The achievability status of the multi-Region RTO and RPO targets for the service.
dataRecoveryTimeBetweenBackups (string) --
The achievability status of the data recovery time between backups for the service.
nextToken (string) --
Pagination token.
{'billable': 'boolean', 'resourceTypes': ['string']}
List resources.
See also: AWS API Documentation
Request Syntax
client.list_resources(
serviceArn='string',
serviceFunctionId='string',
awsRegion='string',
resourceTypes=[
'string',
],
billable=True|False,
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
ARN identifier.
string
Filter resources by service function identifier.
string
Filter resources by AWS Region.
list
The CloudFormation resource types to include in the response.
(string) --
boolean
Specifies whether to filter non-billable resources. When true (the default), the operation returns only billable resources.
integer
Pagination page size.
string
Pagination token.
dict
Response Syntax
{
'serviceFunctionId': 'string',
'serviceResources': [
{
'resourceIdentifier': 'string',
'inputSource': {
'identifier': 'string',
'type': 'CFN_STACK'|'TAGS'|'EKS'|'TERRAFORM'|'DESIGN_FILE'|'MONITORING'
},
'resource': {
'identifier': 'string',
'awsRegion': 'string',
'awsAccountId': 'string',
'resourceType': 'string'
}
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
serviceFunctionId (string) --
The service function identifier for the returned resources.
serviceResources (list) --
The list of service resources.
(dict) --
Represents a resource associated with a service.
resourceIdentifier (string) --
The identifier of the resource.
inputSource (dict) --
The input source that discovered the resource.
identifier (string) --
The identifier of the input source.
type (string) --
The type of the input source.
resource (dict) --
The resource details.
identifier (string) --
The identifier of the resource.
awsRegion (string) --
The AWS Region where the resource is located.
awsAccountId (string) --
The AWS account ID that owns the resource.
resourceType (string) --
The type of the resource.
nextToken (string) --
Pagination token.
{'serviceTopologyEdgeSummaries': {'destinationAccount': 'string',
'destinationRegion': 'string',
'sourceAccount': 'string',
'sourceRegion': 'string'}}
Lists topology edges for a service.
See also: AWS API Documentation
Request Syntax
client.list_service_topology_edges(
serviceArn='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
ARN identifier.
integer
Pagination page size.
string
Pagination token.
dict
Response Syntax
{
'serviceTopologyEdgeSummaries': [
{
'sourceResourceIdentifier': 'string',
'destinationResourceIdentifier': 'string',
'sourceRegion': 'string',
'destinationRegion': 'string',
'sourceAccount': 'string',
'destinationAccount': 'string',
'properties': [
{
'topologyType': 'CONTAINMENT'|'DATA_FLOW'|'OBSERVABILITY'|'PERMISSIONS',
'label': 'string'
},
]
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
serviceTopologyEdgeSummaries (list) --
The list of service topology edge summaries.
(dict) --
Contains summary information about a service topology edge.
sourceResourceIdentifier (string) --
The identifier of the source resource.
destinationResourceIdentifier (string) --
The identifier of the destination resource.
sourceRegion (string) --
The AWS Region of the source resource.
destinationRegion (string) --
The AWS Region of the destination resource.
sourceAccount (string) --
The AWS account ID of the source resource.
destinationAccount (string) --
The AWS account ID of the destination resource.
properties (list) --
The properties of the topology edge.
(dict) --
Contains property information for a service topology edge.
topologyType (string) --
The topology type of the edge.
label (string) --
Human-readable relationship description. Only present for LLM-inferred edges.
nextToken (string) --
Pagination token.
{'serviceSummaries': {'achievability': {'dataRecoveryTimeBetweenBackups': 'ACHIEVABLE '
'| '
'NOT_ACHIEVABLE'},
'dependencyDiscovery': {'eligibleResourceCount': 'integer',
'message': 'string'}}}
Lists services.
See also: AWS API Documentation
Request Syntax
client.list_services(
systemArn='string',
userJourneyId='string',
ouId='string',
accountId='string',
assessmentStatus='NOT_STARTED'|'PENDING'|'IN_PROGRESS'|'FAILED'|'SUCCESS',
policyArn='string',
maxResults=123,
nextToken='string'
)
string
ARN identifier.
string
Filter services by user journey identifier.
string
Filter services by organizational unit (OU) identifier.
string
Filter services by AWS account ID.
string
Filter services by assessment status.
string
ARN identifier.
integer
Pagination page size.
string
Pagination token.
dict
Response Syntax
{
'serviceSummaries': [
{
'serviceArn': 'string',
'name': 'string',
'associatedSystems': [
{
'systemArn': 'string',
'systemName': 'string',
'userJourneyIds': [
'string',
]
},
],
'regions': [
'string',
],
'policyArn': 'string',
'assessmentStatus': 'NOT_STARTED'|'PENDING'|'IN_PROGRESS'|'FAILED'|'SUCCESS',
'openFindingsCount': 123,
'resolvedFindingsCount': 123,
'dependencyDiscovery': {
'status': 'ENABLED'|'INITIALIZING'|'DISABLED',
'updatedAt': datetime(2015, 1, 1),
'eligibleResourceCount': 123,
'message': 'string'
},
'achievability': {
'availabilitySlo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'multiAzRtoRpo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'multiRegionRtoRpo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'dataRecoveryTimeBetweenBackups': 'ACHIEVABLE'|'NOT_ACHIEVABLE'
},
'organizationId': 'string',
'ouId': 'string',
'accountId': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
},
],
'nextToken': 'string'
}
Response Structure
(dict) --
serviceSummaries (list) --
The list of service summaries.
(dict) --
Contains summary information about a service.
serviceArn (string) --
ARN identifier.
name (string) --
Resource name (used in ARN — no spaces allowed).
associatedSystems (list) --
The systems associated with the service.
(dict) --
Represents a system associated with a service.
systemArn (string) --
ARN identifier.
systemName (string) --
Resource name (used in ARN — no spaces allowed).
userJourneyIds (list) --
The list of user journey identifiers that associate this system with the service.
(string) --
regions (list) --
The AWS Regions where the service operates.
(string) --
policyArn (string) --
ARN identifier.
assessmentStatus (string) --
The current assessment status of the service.
openFindingsCount (integer) --
The number of open findings.
resolvedFindingsCount (integer) --
The number of resolved findings.
dependencyDiscovery (dict) --
The dependency discovery configuration.
status (string) --
The current status of dependency discovery.
updatedAt (datetime) --
The timestamp when dependency discovery was last updated.
eligibleResourceCount (integer) --
The count of resources eligible for dependency attribution.
message (string) --
A status message for dependency discovery, displayed during the initialization state.
achievability (dict) --
The achievability status of the service's resilience targets.
availabilitySlo (string) --
The achievability status of the availability SLO target for the service.
multiAzRtoRpo (string) --
The achievability status of the multi-AZ RTO and RPO targets for the service.
multiRegionRtoRpo (string) --
The achievability status of the multi-Region RTO and RPO targets for the service.
dataRecoveryTimeBetweenBackups (string) --
The achievability status of the data recovery time between backups for the service.
organizationId (string) --
Displayed only if caller has access.
ouId (string) --
Displayed only if caller has access.
accountId (string) --
Displayed only if caller has access.
createdAt (datetime) --
The timestamp when the service was created.
updatedAt (datetime) --
The timestamp when the service was last updated.
nextToken (string) --
Pagination token.
{'service': {'achievability': {'dataRecoveryTimeBetweenBackups': 'ACHIEVABLE | '
'NOT_ACHIEVABLE'},
'dependencyDiscovery': {'eligibleResourceCount': 'integer',
'message': 'string'}}}
Updates an existing service.
See also: AWS API Documentation
Request Syntax
client.update_service(
serviceArn='string',
description='string',
associatedSystems=[
{
'systemArn': 'string',
'systemName': 'string',
'userJourneyIds': [
'string',
]
},
],
policyArn='string',
regions=[
'string',
],
permissionModel={
'invokerRoleName': 'string',
'crossAccountRoles': [
{
'crossAccountRoleArn': 'string',
'externalId': 'string'
},
]
},
dependencyDiscovery='ENABLED'|'DISABLED',
reportConfiguration={
'reportOutputs': [
{
's3': {
'bucketPath': 'string',
'bucketOwner': 'string'
}
},
]
}
)
string
[REQUIRED]
ARN identifier.
string
Resource description for services and policies.
list
The updated systems to associate with the service.
(dict) --
Represents a system associated with a service.
systemArn (string) -- [REQUIRED]
ARN identifier.
systemName (string) --
Resource name (used in ARN — no spaces allowed).
userJourneyIds (list) --
The list of user journey identifiers that associate this system with the service.
(string) --
string
ARN identifier.
list
The updated AWS Regions where the service operates.
(string) --
dict
The updated permission model for the service.
invokerRoleName (string) -- [REQUIRED]
IAM role name (supports up to 64 characters per IAM limits).
crossAccountRoles (list) --
The list of cross-account IAM role ARNs.
(dict) --
Specifies a cross-account IAM role ARN and optional external ID.
crossAccountRoleArn (string) -- [REQUIRED]
ARN of the IAM Role for the profile. Null if the permission profile is the 'Admin' profile.
externalId (string) --
The external ID used for assuming the cross-account role.
string
Caller-settable values for dependency discovery. INITIALIZING is system-managed.
dict
Configuration for automatic report generation on a Service.
reportOutputs (list) -- [REQUIRED]
Output destinations for generated reports.
(dict) --
Configuration for a report output destination.
s3 (dict) --
S3 configuration for report output.
bucketPath (string) -- [REQUIRED]
S3 bucket path where reports will be written (e.g., my-bucket/ngrh-reports/).
bucketOwner (string) -- [REQUIRED]
Account ID of the bucket owner for cross-account access verification.
dict
Response Syntax
{
'service': {
'serviceArn': 'string',
'name': 'string',
'description': 'string',
'associatedSystems': [
{
'systemArn': 'string',
'systemName': 'string',
'userJourneyIds': [
'string',
]
},
],
'policyArn': 'string',
'regions': [
'string',
],
'permissionModel': {
'invokerRoleName': 'string',
'crossAccountRoles': [
{
'crossAccountRoleArn': 'string',
'externalId': 'string'
},
]
},
'dependencyDiscovery': {
'status': 'ENABLED'|'INITIALIZING'|'DISABLED',
'updatedAt': datetime(2015, 1, 1),
'eligibleResourceCount': 123,
'message': 'string'
},
'effectivePolicyValues': {
'availabilitySlo': {
'value': 123.0,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiAzRto': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiAzRpo': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiAzDrApproach': {
'value': 'string',
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiRegionRto': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiRegionRpo': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'multiRegionDrApproach': {
'value': 'string',
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
},
'dataRecoveryTimeBetweenBackups': {
'value': 123,
'policyName': 'string',
'source': 'SELF'|'CROSS_ACCOUNT'
}
},
'achievability': {
'availabilitySlo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'multiAzRtoRpo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'multiRegionRtoRpo': 'ACHIEVABLE'|'NOT_ACHIEVABLE',
'dataRecoveryTimeBetweenBackups': 'ACHIEVABLE'|'NOT_ACHIEVABLE'
},
'reportConfiguration': {
'reportOutputs': [
{
's3': {
'bucketPath': 'string',
'bucketOwner': 'string'
}
},
]
},
'kmsKeyId': 'string',
'tags': {
'string': 'string'
},
'estimatedAssessmentCost': {
'amount': 123.0,
'currency': 'USD'
},
'resourceDiscovery': {
'status': 'RUNNING'|'SUCCEEDED'|'FAILED'|'COMPLETED_WITH_FAILURES'|'NOT_STARTED',
'lastRunAt': datetime(2015, 1, 1),
'errorCode': 'INVALID_PERMISSIONS'|'STACK_NOT_FOUND'|'CLUSTER_NOT_FOUND'|'STATE_FILE_NOT_FOUND'|'ACCESS_DENIED'|'UNSUPPORTED_CLUSTER'|'INTERNAL_ERROR',
'errorMessage': 'string'
},
'assessmentStatus': 'NOT_STARTED'|'PENDING'|'IN_PROGRESS'|'FAILED'|'SUCCESS',
'rerunAssessment': True|False,
'openFindingsCount': 123,
'resolvedFindingsCount': 123,
'organizationId': 'string',
'ouId': 'string',
'accountId': 'string',
'createdAt': datetime(2015, 1, 1),
'updatedAt': datetime(2015, 1, 1)
}
}
Response Structure
(dict) --
service (dict) --
The updated service.
serviceArn (string) --
ARN identifier.
name (string) --
Resource name (used in ARN — no spaces allowed).
description (string) --
Resource description for services and policies.
associatedSystems (list) --
The systems associated with the service.
(dict) --
Represents a system associated with a service.
systemArn (string) --
ARN identifier.
systemName (string) --
Resource name (used in ARN — no spaces allowed).
userJourneyIds (list) --
The list of user journey identifiers that associate this system with the service.
(string) --
policyArn (string) --
ARN identifier.
regions (list) --
The AWS Regions where the service operates.
(string) --
permissionModel (dict) --
The permission model for the service.
invokerRoleName (string) --
IAM role name (supports up to 64 characters per IAM limits).
crossAccountRoles (list) --
The list of cross-account IAM role ARNs.
(dict) --
Specifies a cross-account IAM role ARN and optional external ID.
crossAccountRoleArn (string) --
ARN of the IAM Role for the profile. Null if the permission profile is the 'Admin' profile.
externalId (string) --
The external ID used for assuming the cross-account role.
dependencyDiscovery (dict) --
The dependency discovery configuration for the service.
status (string) --
The current status of dependency discovery.
updatedAt (datetime) --
The timestamp when dependency discovery was last updated.
eligibleResourceCount (integer) --
The count of resources eligible for dependency attribution.
message (string) --
A status message for dependency discovery, displayed during the initialization state.
effectivePolicyValues (dict) --
The effective policy values for the service.
availabilitySlo (dict) --
The effective availability SLO value for the service.
value (float) --
The availability SLO percentage value.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiAzRto (dict) --
The effective multi-AZ RTO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiAzRpo (dict) --
The effective multi-AZ RPO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiAzDrApproach (dict) --
The effective multi-AZ disaster recovery approach for the service.
value (string) --
The disaster recovery approach value.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiRegionRto (dict) --
The effective multi-Region RTO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiRegionRpo (dict) --
The effective multi-Region RPO value for the service, in minutes.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
multiRegionDrApproach (dict) --
The effective multi-Region disaster recovery approach for the service.
value (string) --
The disaster recovery approach value.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
dataRecoveryTimeBetweenBackups (dict) --
The effective data recovery time between backups value for the service.
value (integer) --
The RTO or RPO value in minutes.
policyName (string) --
Resource name (used in ARN — no spaces allowed).
source (string) --
Indicates whether the value comes from the service's own account or a cross-account policy.
achievability (dict) --
The achievability status of the service's resilience targets.
availabilitySlo (string) --
The achievability status of the availability SLO target for the service.
multiAzRtoRpo (string) --
The achievability status of the multi-AZ RTO and RPO targets for the service.
multiRegionRtoRpo (string) --
The achievability status of the multi-Region RTO and RPO targets for the service.
dataRecoveryTimeBetweenBackups (string) --
The achievability status of the data recovery time between backups for the service.
reportConfiguration (dict) --
Configuration for automatic report generation on a Service.
reportOutputs (list) --
Output destinations for generated reports.
(dict) --
Configuration for a report output destination.
s3 (dict) --
S3 configuration for report output.
bucketPath (string) --
S3 bucket path where reports will be written (e.g., my-bucket/ngrh-reports/).
bucketOwner (string) --
Account ID of the bucket owner for cross-account access verification.
kmsKeyId (string) --
KMS key identifier — accepts key ID, key ARN, alias name, or alias ARN.
tags (dict) --
Resource tags.
(string) --
Tag key.
(string) --
Tag value.
estimatedAssessmentCost (dict) --
The estimated cost of running an assessment on the service.
amount (float) --
The cost amount for the assessment.
currency (string) --
The currency of the assessment cost.
resourceDiscovery (dict) --
The resource discovery status for the service.
status (string) --
The current status of resource discovery.
lastRunAt (datetime) --
The timestamp of the last resource discovery run.
errorCode (string) --
The error code if resource discovery failed.
errorMessage (string) --
A message describing the error if resource discovery failed.
assessmentStatus (string) --
The current assessment status of the service.
rerunAssessment (boolean) --
Indicates whether the assessment should be rerun.
openFindingsCount (integer) --
The number of open findings for the service.
resolvedFindingsCount (integer) --
The number of resolved findings for the service.
organizationId (string) --
The AWS Organizations identifier for the service.
ouId (string) --
The organizational unit (OU) identifier for the service.
accountId (string) --
The AWS account ID that owns the service.
createdAt (datetime) --
The timestamp when the service was created.
updatedAt (datetime) --
The timestamp when the service was last updated.