AWS Security Agent

{'deleted': {'maxTaskHours': 'double'}}

Deletes one or more pentests from an agent space.

See also: AWS API Documentation

Request Syntax

client.batch_delete_pentests(
    pentestIds=[
        'string',
    ],
    agentSpaceId='string'
)

type pentestIds:

list

param pentestIds:

[REQUIRED]

The list of pentest identifiers to delete.

• (string) --

type agentSpaceId:

string

param agentSpaceId:

[REQUIRED]

The unique identifier of the agent space that contains the pentests to delete.

rtype:

dict

returns:

Response Syntax

{
    'deleted': [
        {
            'pentestId': 'string',
            'agentSpaceId': 'string',
            'title': 'string',
            'assets': {
                'endpoints': [
                    {
                        'uri': 'string'
                    },
                ],
                'actors': [
                    {
                        'identifier': 'string',
                        'uris': [
                            'string',
                        ],
                        'authentication': {
                            'providerType': 'SECRETS_MANAGER'|'AWS_LAMBDA'|'AWS_IAM_ROLE'|'AWS_INTERNAL',
                            'value': 'string'
                        },
                        'description': 'string',
                        'enableEmailMfa': True|False,
                        'mfaForwardingAddress': 'string'
                    },
                ],
                'documents': [
                    {
                        's3Location': 'string',
                        'artifactId': 'string',
                        'integratedDocument': {
                            'integrationId': 'string',
                            'resourceId': 'string'
                        }
                    },
                ],
                'sourceCode': [
                    {
                        's3Location': 'string'
                    },
                ],
                'integratedRepositories': [
                    {
                        'integrationId': 'string',
                        'providerResourceId': 'string',
                        'branch': 'string'
                    },
                ]
            },
            'excludeRiskTypes': [
                'CROSS_SITE_SCRIPTING'|'DEFAULT_CREDENTIALS'|'INSECURE_DIRECT_OBJECT_REFERENCE'|'PRIVILEGE_ESCALATION'|'SERVER_SIDE_TEMPLATE_INJECTION'|'COMMAND_INJECTION'|'CODE_INJECTION'|'SQL_INJECTION'|'ARBITRARY_FILE_UPLOAD'|'INSECURE_DESERIALIZATION'|'LOCAL_FILE_INCLUSION'|'INFORMATION_DISCLOSURE'|'PATH_TRAVERSAL'|'SERVER_SIDE_REQUEST_FORGERY'|'JSON_WEB_TOKEN_VULNERABILITIES'|'XML_EXTERNAL_ENTITY'|'FILE_DELETION'|'OTHER'|'GRAPHQL_VULNERABILITIES'|'BUSINESS_LOGIC_VULNERABILITIES'|'CRYPTOGRAPHIC_VULNERABILITIES'|'DENIAL_OF_SERVICE'|'FILE_ACCESS'|'FILE_CREATION'|'DATABASE_MODIFICATION'|'DATABASE_ACCESS'|'OUTBOUND_SERVICE_REQUEST'|'UNKNOWN',
            ],
            'serviceRole': 'string',
            'logConfig': {
                'logGroup': 'string',
                'logStream': 'string'
            },
            'vpcConfig': {
                'vpcArn': 'string',
                'securityGroupArns': [
                    'string',
                ],
                'subnetArns': [
                    'string',
                ]
            },
            'networkTrafficConfig': {
                'rules': [
                    {
                        'effect': 'ALLOW'|'DENY',
                        'pattern': 'string',
                        'networkTrafficRuleType': 'URL'
                    },
                ],
                'customHeaders': [
                    {
                        'name': 'string',
                        'value': 'string'
                    },
                ]
            },
            'codeRemediationStrategy': 'AUTOMATIC'|'DISABLED',
            'cleanUpStrategy': 'BEST_EFFORT_DELETE'|'RETAIN_ALL',
            'disableManagedSkills': [
                'FINDING_PERSONALIZATION'|'LOGIN_OPTIMIZATION',
            ],
            'maxTaskHours': 123.0,
            'createdAt': datetime(2015, 1, 1),
            'updatedAt': datetime(2015, 1, 1)
        },
    ],
    'failed': [
        {
            'pentestId': 'string',
            'reason': 'string'
        },
    ]
}

Response Structure

• (dict) --

  Output for the BatchDeletePentests operation.

  • deleted (list) --

    The list of pentests that were successfully deleted.

    • (dict) --

      Represents a pentest configuration that defines the parameters for security testing, including target assets, risk type exclusions, and infrastructure settings.

      • pentestId (string) --

        The unique identifier of the pentest.

      • agentSpaceId (string) --

        The unique identifier of the agent space that contains the pentest.

      • title (string) --

        The title of the pentest.

      • assets (dict) --

        The assets included in the pentest.

        • endpoints (list) --

          The list of endpoints to test during the pentest.

          • (dict) --

            Represents a target endpoint for penetration testing.

            • uri (string) --

              The URI of the endpoint.

        • actors (list) --

          The list of actors used during penetration testing.

          • (dict) --

            Represents an actor used during penetration testing. An actor defines a user or entity that interacts with the target application, including authentication credentials and target URIs.

            • identifier (string) --

              The unique identifier for the actor.

            • uris (list) --

              The list of URIs that the actor targets during testing.

              • (string) --

            • authentication (dict) --

              The authentication configuration for the actor.

              • providerType (string) --

                The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.

              • value (string) --

                The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.

            • description (string) --

              A description of the actor.

            • enableEmailMfa (boolean) --

              Whether email-based MFA is enabled for this actor.

            • mfaForwardingAddress (string) --

              Server-generated email forwarding address for receiving MFA codes.

        • documents (list) --

          The list of documents that provide context for the pentest.

          • (dict) --

            Represents a document that provides context for security testing.

            • s3Location (string) --

              The Amazon S3 location of the document.

            • artifactId (string) --

              The unique identifier of the artifact associated with the document.

            • integratedDocument (dict) --

              A reference to a document in an integrated third-party provider.

              • integrationId (string) --

                The identifier of the integration that provides access to the document.

              • resourceId (string) --

                The provider-specific resource identifier for the document.

        • sourceCode (list) --

          The list of source code repositories to analyze during the pentest.

          • (dict) --

            Represents a source code repository used for security analysis during a pentest.

            • s3Location (string) --

              The Amazon S3 location of the source code repository archive.

        • integratedRepositories (list) --

          The list of integrated repositories associated with the pentest.

          • (dict) --

            Represents a code repository that is integrated with the service through a third-party provider.

            • integrationId (string) --

              The unique identifier of the integration that provides access to the repository.

            • providerResourceId (string) --

              The provider-specific resource identifier for the repository.

            • branch (string) --

              An optional override for the repository branch.

      • excludeRiskTypes (list) --

        The list of risk types excluded from the pentest.

        • (string) --

          Type of security risk.

      • serviceRole (string) --

        The IAM service role used for the pentest.

      • logConfig (dict) --

        The CloudWatch Logs configuration for the pentest.

        • logGroup (string) --

          The name of the CloudWatch log group.

        • logStream (string) --

          The name of the CloudWatch log stream.

      • vpcConfig (dict) --

        The VPC configuration for the pentest.

        • vpcArn (string) --

          The Amazon Resource Name (ARN) of the VPC.

        • securityGroupArns (list) --

          The Amazon Resource Names (ARNs) of the security groups for the VPC configuration.

          • (string) --

            ARN or ID of a security group.

        • subnetArns (list) --

          The Amazon Resource Names (ARNs) of the subnets for the VPC configuration.

          • (string) --

            ARN or ID of a subnet.

      • networkTrafficConfig (dict) --

        The network traffic configuration for the pentest.

        • rules (list) --

          The list of network traffic rules that control which URLs are allowed or denied during testing.

          • (dict) --

            A rule that controls network traffic during penetration testing by allowing or denying traffic to specific URL patterns.

            • effect (string) --

              The effect of the rule. Valid values are ALLOW and DENY.

            • pattern (string) --

              The URL pattern to match for the rule.

            • networkTrafficRuleType (string) --

              The type of the network traffic rule. Currently, only URL is supported.

        • customHeaders (list) --

          The list of custom HTTP headers to include in network traffic during testing.

          • (dict) --

            A custom HTTP header to include in network traffic during penetration testing.

            • name (string) --

              The name of the custom header.

            • value (string) --

              The value of the custom header.

      • codeRemediationStrategy (string) --

        The code remediation strategy for the pentest.

      • cleanUpStrategy (string) --

        Strategy for cleaning up resources after pentest job completion.

      • disableManagedSkills (list) --

        A list of managed skills to disable for this pentest. Valid values include FINDING_PERSONALIZATION and LOGIN_OPTIMIZATION.

        • (string) --

          Type of managed skill that can be enabled or disabled for a pentest.

      • maxTaskHours (float) --

        The maximum number of billable task hours allowed for jobs started from this pentest. If a job reaches the configured limit, it is gracefully stopped. If not set, jobs run to completion with no budget cap.

      • createdAt (datetime) --

        The date and time the pentest was created, in UTC format.

      • updatedAt (datetime) --

        The date and time the pentest was last updated, in UTC format.

  • failed (list) --

    The list of pentests that failed to delete, including the reason for each failure.

    • (dict) --

      Contains information about a pentest that failed to delete.

      • pentestId (string) --

        The unique identifier of the pentest that failed to delete.

      • reason (string) --

        The reason the pentest failed to delete.

{'codeReviewJobs': {'maxTaskHours': 'double'}}

Retrieves information about one or more code review jobs in an agent space.

See also: AWS API Documentation

Request Syntax

client.batch_get_code_review_jobs(
    codeReviewJobIds=[
        'string',
    ],
    agentSpaceId='string'
)

type codeReviewJobIds:

list

param codeReviewJobIds:

[REQUIRED]

The list of code review job identifiers to retrieve.

• (string) --

type agentSpaceId:

string

param agentSpaceId:

[REQUIRED]

The unique identifier of the agent space that contains the code review jobs.

rtype:

dict

returns:

Response Syntax

{
    'codeReviewJobs': [
        {
            'codeReviewJobId': 'string',
            'codeReviewId': 'string',
            'title': 'string',
            'overview': 'string',
            'status': 'IN_PROGRESS'|'STOPPING'|'STOPPED'|'FAILED'|'COMPLETED',
            'documents': [
                {
                    's3Location': 'string',
                    'artifactId': 'string',
                    'integratedDocument': {
                        'integrationId': 'string',
                        'resourceId': 'string'
                    }
                },
            ],
            'sourceCode': [
                {
                    's3Location': 'string'
                },
            ],
            'steps': [
                {
                    'name': 'PREFLIGHT'|'STATIC_ANALYSIS'|'PENTEST'|'FINALIZING'|'VALIDATION',
                    'status': 'NOT_STARTED'|'IN_PROGRESS'|'COMPLETED'|'FAILED'|'STOPPED',
                    'createdAt': datetime(2015, 1, 1),
                    'updatedAt': datetime(2015, 1, 1)
                },
            ],
            'executionContext': [
                {
                    'contextType': 'ERROR'|'CLIENT_ERROR'|'WARNING'|'INFO',
                    'context': 'string',
                    'timestamp': datetime(2015, 1, 1)
                },
            ],
            'serviceRole': 'string',
            'logConfig': {
                'logGroup': 'string',
                'logStream': 'string'
            },
            'errorInformation': {
                'code': 'CLIENT_ERROR'|'INTERNAL_ERROR'|'STOPPED_BY_USER',
                'message': 'string'
            },
            'integratedRepositories': [
                {
                    'integrationId': 'string',
                    'providerResourceId': 'string',
                    'branch': 'string'
                },
            ],
            'codeRemediationStrategy': 'AUTOMATIC'|'DISABLED',
            'maxTaskHours': 123.0,
            'createdAt': datetime(2015, 1, 1),
            'updatedAt': datetime(2015, 1, 1)
        },
    ],
    'notFound': [
        'string',
    ]
}

Response Structure

• (dict) --

  Output for the BatchGetCodeReviewJobs operation.

  • codeReviewJobs (list) --

    The list of code review jobs that were found.

    • (dict) --

      Represents a code review job, which is an execution instance of a code review. A code review job progresses through preflight, static analysis, and finalizing steps.

      • codeReviewJobId (string) --

        The unique identifier of the code review job.

      • codeReviewId (string) --

        The unique identifier of the code review associated with the job.

      • title (string) --

        The title of the code review job.

      • overview (string) --

        An overview of the code review job results.

      • status (string) --

        The current status of the code review job.

      • documents (list) --

        The list of documents providing context for the code review job.

        • (dict) --

          Represents a document that provides context for security testing.

          • s3Location (string) --

            The Amazon S3 location of the document.

          • artifactId (string) --

            The unique identifier of the artifact associated with the document.

          • integratedDocument (dict) --

            A reference to a document in an integrated third-party provider.

            • integrationId (string) --

              The identifier of the integration that provides access to the document.

            • resourceId (string) --

              The provider-specific resource identifier for the document.

      • sourceCode (list) --

        The list of source code repositories analyzed during the code review job.

        • (dict) --

          Represents a source code repository used for security analysis during a pentest.

          • s3Location (string) --

            The Amazon S3 location of the source code repository archive.

      • steps (list) --

        The list of steps in the code review job execution.

        • (dict) --

          Represents a step in the pentest job execution pipeline. Steps include preflight, static analysis, pentest, and finalizing.

          • name (string) --

            The name of the step. Valid values include PREFLIGHT, STATIC_ANALYSIS, PENTEST, VALIDATION, and FINALIZING.

          • status (string) --

            The current status of the step.

          • createdAt (datetime) --

            The date and time the step was created, in UTC format.

          • updatedAt (datetime) --

            The date and time the step was last updated, in UTC format.

      • executionContext (list) --

        The execution context messages for the code review job.

        • (dict) --

          Contains contextual information about the execution of a pentest job, such as errors, warnings, or informational messages.

          • contextType (string) --

            The type of context. Valid values include ERROR, CLIENT_ERROR, WARNING, and INFO.

          • context (string) --

            The context message.

          • timestamp (datetime) --

            The date and time the context was recorded, in UTC format.

      • serviceRole (string) --

        The IAM service role used for the code review job.

      • logConfig (dict) --

        The CloudWatch Logs configuration for the code review job.

        • logGroup (string) --

          The name of the CloudWatch log group.

        • logStream (string) --

          The name of the CloudWatch log stream.

      • errorInformation (dict) --

        Error information if the code review job encountered an error.

        • code (string) --

          The error code. Valid values include CLIENT_ERROR, INTERNAL_ERROR, and STOPPED_BY_USER.

        • message (string) --

          A message describing the error.

      • integratedRepositories (list) --

        The list of integrated repositories associated with the code review job.

        • (dict) --

          Represents a code repository that is integrated with the service through a third-party provider.

          • integrationId (string) --

            The unique identifier of the integration that provides access to the repository.

          • providerResourceId (string) --

            The provider-specific resource identifier for the repository.

          • branch (string) --

            An optional override for the repository branch.

      • codeRemediationStrategy (string) --

        The code remediation strategy for the code review job.

      • maxTaskHours (float) --

        The maximum number of billable task hours allowed for this code review job. If the cumulative task hours reach this limit, the job is gracefully stopped.

      • createdAt (datetime) --

        The date and time the code review job was created, in UTC format.

      • updatedAt (datetime) --

        The date and time the code review job was last updated, in UTC format.

  • notFound (list) --

    The list of code review job identifiers that were not found.

    • (string) --

{'codeReviews': {'maxTaskHours': 'double'}}

Retrieves information about one or more code reviews in an agent space.

See also: AWS API Documentation

Request Syntax

client.batch_get_code_reviews(
    codeReviewIds=[
        'string',
    ],
    agentSpaceId='string'
)

type codeReviewIds:

list

param codeReviewIds:

[REQUIRED]

The list of code review identifiers to retrieve.

• (string) --

type agentSpaceId:

string

param agentSpaceId:

[REQUIRED]

The unique identifier of the agent space that contains the code reviews.

rtype:

dict

returns:

Response Syntax

{
    'codeReviews': [
        {
            'codeReviewId': 'string',
            'agentSpaceId': 'string',
            'title': 'string',
            'assets': {
                'endpoints': [
                    {
                        'uri': 'string'
                    },
                ],
                'actors': [
                    {
                        'identifier': 'string',
                        'uris': [
                            'string',
                        ],
                        'authentication': {
                            'providerType': 'SECRETS_MANAGER'|'AWS_LAMBDA'|'AWS_IAM_ROLE'|'AWS_INTERNAL',
                            'value': 'string'
                        },
                        'description': 'string',
                        'enableEmailMfa': True|False,
                        'mfaForwardingAddress': 'string'
                    },
                ],
                'documents': [
                    {
                        's3Location': 'string',
                        'artifactId': 'string',
                        'integratedDocument': {
                            'integrationId': 'string',
                            'resourceId': 'string'
                        }
                    },
                ],
                'sourceCode': [
                    {
                        's3Location': 'string'
                    },
                ],
                'integratedRepositories': [
                    {
                        'integrationId': 'string',
                        'providerResourceId': 'string',
                        'branch': 'string'
                    },
                ]
            },
            'serviceRole': 'string',
            'logConfig': {
                'logGroup': 'string',
                'logStream': 'string'
            },
            'codeRemediationStrategy': 'AUTOMATIC'|'DISABLED',
            'validationMode': 'DISABLED'|'SIMULATED',
            'maxTaskHours': 123.0,
            'createdAt': datetime(2015, 1, 1),
            'updatedAt': datetime(2015, 1, 1)
        },
    ],
    'notFound': [
        'string',
    ]
}

Response Structure

• (dict) --

  Output for the BatchGetCodeReviews operation.

  • codeReviews (list) --

    The list of code reviews that were found.

    • (dict) --

      Represents a code review configuration that defines the parameters for automated security-focused code analysis, including target assets and logging configuration.

      • codeReviewId (string) --

        The unique identifier of the code review.

      • agentSpaceId (string) --

        The unique identifier of the agent space that contains the code review.

      • title (string) --

        The title of the code review.

      • assets (dict) --

        The assets included in the code review.

        • endpoints (list) --

          The list of endpoints to test during the pentest.

          • (dict) --

            Represents a target endpoint for penetration testing.

            • uri (string) --

              The URI of the endpoint.

        • actors (list) --

          The list of actors used during penetration testing.

          • (dict) --

            Represents an actor used during penetration testing. An actor defines a user or entity that interacts with the target application, including authentication credentials and target URIs.

            • identifier (string) --

              The unique identifier for the actor.

            • uris (list) --

              The list of URIs that the actor targets during testing.

              • (string) --

            • authentication (dict) --

              The authentication configuration for the actor.

              • providerType (string) --

                The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.

              • value (string) --

                The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.

            • description (string) --

              A description of the actor.

            • enableEmailMfa (boolean) --

              Whether email-based MFA is enabled for this actor.

            • mfaForwardingAddress (string) --

              Server-generated email forwarding address for receiving MFA codes.

        • documents (list) --

          The list of documents that provide context for the pentest.

          • (dict) --

            Represents a document that provides context for security testing.

            • s3Location (string) --

              The Amazon S3 location of the document.

            • artifactId (string) --

              The unique identifier of the artifact associated with the document.

            • integratedDocument (dict) --

              A reference to a document in an integrated third-party provider.

              • integrationId (string) --

                The identifier of the integration that provides access to the document.

              • resourceId (string) --

                The provider-specific resource identifier for the document.

        • sourceCode (list) --

          The list of source code repositories to analyze during the pentest.

          • (dict) --

            Represents a source code repository used for security analysis during a pentest.

            • s3Location (string) --

              The Amazon S3 location of the source code repository archive.

        • integratedRepositories (list) --

          The list of integrated repositories associated with the pentest.

          • (dict) --

            Represents a code repository that is integrated with the service through a third-party provider.

            • integrationId (string) --

              The unique identifier of the integration that provides access to the repository.

            • providerResourceId (string) --

              The provider-specific resource identifier for the repository.

            • branch (string) --

              An optional override for the repository branch.

      • serviceRole (string) --

        The IAM service role used for the code review.

      • logConfig (dict) --

        The CloudWatch Logs configuration for the code review.

        • logGroup (string) --

          The name of the CloudWatch log group.

        • logStream (string) --

          The name of the CloudWatch log stream.

      • codeRemediationStrategy (string) --

        The code remediation strategy for the code review.

      • validationMode (string) --

        The validation mode for the code review. Valid values are SIMULATED and DISABLED.

      • maxTaskHours (float) --

        The maximum number of billable task hours allowed for jobs started from this code review. If a job reaches the configured limit, it is gracefully stopped. If not set, jobs run to completion with no budget cap.

      • createdAt (datetime) --

        The date and time the code review was created, in UTC format.

      • updatedAt (datetime) --

        The date and time the code review was last updated, in UTC format.

  • notFound (list) --

    The list of code review identifiers that were not found.

    • (string) --

{'findings': {'originalFindingId': 'string', 'revalidationJobIds': ['string']}}

Retrieves information about one or more security findings in an agent space.

See also: AWS API Documentation

Request Syntax

client.batch_get_findings(
    findingIds=[
        'string',
    ],
    agentSpaceId='string'
)

type findingIds:

list

param findingIds:

[REQUIRED]

The list of finding identifiers to retrieve.

• (string) --

type agentSpaceId:

string

param agentSpaceId:

[REQUIRED]

The unique identifier of the agent space that contains the findings.

rtype:

dict

returns:

Response Syntax

{
    'findings': [
        {
            'findingId': 'string',
            'agentSpaceId': 'string',
            'pentestId': 'string',
            'pentestJobId': 'string',
            'codeReviewId': 'string',
            'codeReviewJobId': 'string',
            'taskId': 'string',
            'name': 'string',
            'description': 'string',
            'status': 'ACTIVE'|'RESOLVED'|'ACCEPTED'|'FALSE_POSITIVE',
            'riskType': 'string',
            'riskLevel': 'UNKNOWN'|'INFORMATIONAL'|'LOW'|'MEDIUM'|'HIGH'|'CRITICAL',
            'riskScore': 'string',
            'reasoning': 'string',
            'confidence': 'FALSE_POSITIVE'|'UNCONFIRMED'|'LOW'|'MEDIUM'|'HIGH',
            'validationStatus': 'CONFIRMED'|'NOT_REPRODUCED'|'VALIDATION_FAILED'|'VALIDATING'|'NOT_VALIDATED',
            'attackScript': 'string',
            'codeRemediationTask': {
                'status': 'IN_PROGRESS'|'COMPLETED'|'FAILED',
                'statusReason': 'string',
                'taskDetails': [
                    {
                        'repoName': 'string',
                        'codeDiffLink': 'string',
                        'pullRequestLink': 'string'
                    },
                ]
            },
            'lastUpdatedBy': 'string',
            'customerNote': 'string',
            'codeLocations': [
                {
                    'filePath': 'string',
                    'lineStart': 123,
                    'lineEnd': 123,
                    'label': 'string'
                },
            ],
            'verificationScript': {
                'scriptType': 'string',
                'scriptUrl': 'string',
                'instructions': 'string',
                'envVars': [
                    {
                        'name': 'string',
                        'value': 'string'
                    },
                ]
            },
            'alignmentRationale': 'string',
            'revalidationJobIds': [
                'string',
            ],
            'originalFindingId': 'string',
            'createdAt': datetime(2015, 1, 1),
            'updatedAt': datetime(2015, 1, 1)
        },
    ],
    'notFound': [
        'string',
    ]
}

Response Structure

• (dict) --

  Output for the BatchGetFindings operation.

  • findings (list) --

    The list of findings that were found.

    • (dict) --

      Represents a security finding discovered during a pentest job. A finding contains details about a vulnerability, including its risk level, confidence, and remediation status.

      • findingId (string) --

        The unique identifier of the finding.

      • agentSpaceId (string) --

        The unique identifier of the agent space associated with the finding.

      • pentestId (string) --

        The unique identifier of the pentest associated with the finding.

      • pentestJobId (string) --

        The unique identifier of the pentest job that produced the finding.

      • codeReviewId (string) --

        The unique identifier of the code review associated with the finding.

      • codeReviewJobId (string) --

        The unique identifier of the code review job that produced the finding.

      • taskId (string) --

        The unique identifier of the task that produced the finding.

      • name (string) --

        The name of the finding.

      • description (string) --

        A description of the finding.

      • status (string) --

        The current status of the finding. Valid values include ACTIVE, RESOLVED, ACCEPTED, and FALSE_POSITIVE.

      • riskType (string) --

        The type of security risk identified by the finding.

      • riskLevel (string) --

        The risk level of the finding. Valid values include UNKNOWN, INFORMATIONAL, LOW, MEDIUM, HIGH, and CRITICAL.

      • riskScore (string) --

        The numerical risk score of the finding.

      • reasoning (string) --

        The reasoning behind the finding, explaining why it was identified as a vulnerability.

      • confidence (string) --

        The confidence level of the finding. Valid values include FALSE_POSITIVE, UNCONFIRMED, LOW, MEDIUM, and HIGH.

      • validationStatus (string) --

        The simulated validation status of the finding. Valid values are NOT_VALIDATED, VALIDATING, CONFIRMED, NOT_REPRODUCED, and VALIDATION_FAILED.

      • attackScript (string) --

        The attack script used to reproduce the finding.

      • codeRemediationTask (dict) --

        The code remediation task associated with the finding, if code remediation was initiated.

        • status (string) --

          The current status of the code remediation task.

        • statusReason (string) --

          The reason for the current status of the code remediation task.

        • taskDetails (list) --

          The list of details for the code remediation task, including repository name, code diff link, and pull request link.

          • (dict) --

            Contains details about a code remediation task, including links to the code diff and pull request.

            • repoName (string) --

              The name of the repository where the remediation was applied.

            • codeDiffLink (string) --

              The link to the code diff for the remediation.

            • pullRequestLink (string) --

              The link to the pull request created for the remediation.

      • lastUpdatedBy (string) --

        The identifier of the entity that last updated the finding.

      • customerNote (string) --

        A customer-provided note on the finding.

      • codeLocations (list) --

        The file locations involved in the vulnerability, as reported by the code scanner.

        • (dict) --

          Represents a location in source code associated with a security finding.

          • filePath (string) --

            The absolute path to the file containing the code location.

          • lineStart (integer) --

            The starting line number of the code location.

          • lineEnd (integer) --

            The ending line number of the code location.

          • label (string) --

            The role of this location in the vulnerability, such as source or sink.

      • verificationScript (dict) --

        The verification script metadata for reproducing the finding, including download URL, instructions, and required environment variables.

        • scriptType (string) --

          The type of script. Valid values are python and bash.

        • scriptUrl (string) --

          URL to download the verification script.

        • instructions (string) --

          Instructions for running the verification script, including prerequisites and how to interpret results.

        • envVars (list) --

          The list of environment variables required to run the verification script.

          • (dict) --

            Represents an environment variable required to run a verification script.

            • name (string) --

              The name of the environment variable.

            • value (string) --

              The value of the environment variable.

      • alignmentRationale (string) --

        The rationale provided by the alignment agent explaining how the finding was adjusted based on customer preferences.

      • revalidationJobIds (list) --

        The list of pentest job identifiers for revalidation jobs that retested this finding.

        • (string) --

      • originalFindingId (string) --

        The identifier of the original finding that this revalidation finding was produced from.

      • createdAt (datetime) --

        The date and time the finding was created, in UTC format.

      • updatedAt (datetime) --

        The date and time the finding was last updated, in UTC format.

  • notFound (list) --

    The list of finding identifiers that were not found.

    • (string) --

{'pentestJobs': {'jobType': 'FULL | REVALIDATION',
                 'maxTaskHours': 'double',
                 'selectedFindingIds': ['string']}}

Retrieves information about one or more pentest jobs in an agent space.

See also: AWS API Documentation

Request Syntax

client.batch_get_pentest_jobs(
    pentestJobIds=[
        'string',
    ],
    agentSpaceId='string'
)

type pentestJobIds:

list

param pentestJobIds:

[REQUIRED]

The list of pentest job identifiers to retrieve.

• (string) --

type agentSpaceId:

string

param agentSpaceId:

[REQUIRED]

The unique identifier of the agent space that contains the pentest jobs.

rtype:

dict

returns:

Response Syntax

{
    'pentestJobs': [
        {
            'pentestJobId': 'string',
            'pentestId': 'string',
            'title': 'string',
            'overview': 'string',
            'status': 'IN_PROGRESS'|'STOPPING'|'STOPPED'|'FAILED'|'COMPLETED',
            'endpoints': [
                {
                    'uri': 'string'
                },
            ],
            'actors': [
                {
                    'identifier': 'string',
                    'uris': [
                        'string',
                    ],
                    'authentication': {
                        'providerType': 'SECRETS_MANAGER'|'AWS_LAMBDA'|'AWS_IAM_ROLE'|'AWS_INTERNAL',
                        'value': 'string'
                    },
                    'description': 'string',
                    'enableEmailMfa': True|False,
                    'mfaForwardingAddress': 'string'
                },
            ],
            'documents': [
                {
                    's3Location': 'string',
                    'artifactId': 'string',
                    'integratedDocument': {
                        'integrationId': 'string',
                        'resourceId': 'string'
                    }
                },
            ],
            'sourceCode': [
                {
                    's3Location': 'string'
                },
            ],
            'excludePaths': [
                {
                    'uri': 'string'
                },
            ],
            'allowedDomains': [
                {
                    'uri': 'string'
                },
            ],
            'excludeRiskTypes': [
                'CROSS_SITE_SCRIPTING'|'DEFAULT_CREDENTIALS'|'INSECURE_DIRECT_OBJECT_REFERENCE'|'PRIVILEGE_ESCALATION'|'SERVER_SIDE_TEMPLATE_INJECTION'|'COMMAND_INJECTION'|'CODE_INJECTION'|'SQL_INJECTION'|'ARBITRARY_FILE_UPLOAD'|'INSECURE_DESERIALIZATION'|'LOCAL_FILE_INCLUSION'|'INFORMATION_DISCLOSURE'|'PATH_TRAVERSAL'|'SERVER_SIDE_REQUEST_FORGERY'|'JSON_WEB_TOKEN_VULNERABILITIES'|'XML_EXTERNAL_ENTITY'|'FILE_DELETION'|'OTHER'|'GRAPHQL_VULNERABILITIES'|'BUSINESS_LOGIC_VULNERABILITIES'|'CRYPTOGRAPHIC_VULNERABILITIES'|'DENIAL_OF_SERVICE'|'FILE_ACCESS'|'FILE_CREATION'|'DATABASE_MODIFICATION'|'DATABASE_ACCESS'|'OUTBOUND_SERVICE_REQUEST'|'UNKNOWN',
            ],
            'steps': [
                {
                    'name': 'PREFLIGHT'|'STATIC_ANALYSIS'|'PENTEST'|'FINALIZING'|'VALIDATION',
                    'status': 'NOT_STARTED'|'IN_PROGRESS'|'COMPLETED'|'FAILED'|'STOPPED',
                    'createdAt': datetime(2015, 1, 1),
                    'updatedAt': datetime(2015, 1, 1)
                },
            ],
            'executionContext': [
                {
                    'contextType': 'ERROR'|'CLIENT_ERROR'|'WARNING'|'INFO',
                    'context': 'string',
                    'timestamp': datetime(2015, 1, 1)
                },
            ],
            'serviceRole': 'string',
            'logConfig': {
                'logGroup': 'string',
                'logStream': 'string'
            },
            'vpcConfig': {
                'vpcArn': 'string',
                'securityGroupArns': [
                    'string',
                ],
                'subnetArns': [
                    'string',
                ]
            },
            'networkTrafficConfig': {
                'rules': [
                    {
                        'effect': 'ALLOW'|'DENY',
                        'pattern': 'string',
                        'networkTrafficRuleType': 'URL'
                    },
                ],
                'customHeaders': [
                    {
                        'name': 'string',
                        'value': 'string'
                    },
                ]
            },
            'errorInformation': {
                'code': 'CLIENT_ERROR'|'INTERNAL_ERROR'|'STOPPED_BY_USER',
                'message': 'string'
            },
            'integratedRepositories': [
                {
                    'integrationId': 'string',
                    'providerResourceId': 'string',
                    'branch': 'string'
                },
            ],
            'codeRemediationStrategy': 'AUTOMATIC'|'DISABLED',
            'cleanUpStrategy': 'BEST_EFFORT_DELETE'|'RETAIN_ALL',
            'disableManagedSkills': [
                'FINDING_PERSONALIZATION'|'LOGIN_OPTIMIZATION',
            ],
            'maxTaskHours': 123.0,
            'jobType': 'FULL'|'REVALIDATION',
            'selectedFindingIds': [
                'string',
            ],
            'createdAt': datetime(2015, 1, 1),
            'updatedAt': datetime(2015, 1, 1)
        },
    ],
    'notFound': [
        'string',
    ]
}

Response Structure

• (dict) --

  Output for the BatchGetPentestJobs operation.

  • pentestJobs (list) --

    The list of pentest jobs that were found.

    • (dict) --

      Represents a pentest job, which is an execution instance of a pentest. A pentest job progresses through preflight, static analysis, pentest, and finalizing steps.

      • pentestJobId (string) --

        The unique identifier of the pentest job.

      • pentestId (string) --

        The unique identifier of the pentest associated with the job.

      • title (string) --

        The title of the pentest job.

      • overview (string) --

        An overview of the pentest job results.

      • status (string) --

        The current status of the pentest job.

      • endpoints (list) --

        The list of endpoints being tested in the pentest job.

        • (dict) --

          Represents a target endpoint for penetration testing.

          • uri (string) --

            The URI of the endpoint.

      • actors (list) --

        The list of actors used during the pentest job.

        • (dict) --

          Represents an actor used during penetration testing. An actor defines a user or entity that interacts with the target application, including authentication credentials and target URIs.

          • identifier (string) --

            The unique identifier for the actor.

          • uris (list) --

            The list of URIs that the actor targets during testing.

            • (string) --

          • authentication (dict) --

            The authentication configuration for the actor.

            • providerType (string) --

              The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.

            • value (string) --

              The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.

          • description (string) --

            A description of the actor.

          • enableEmailMfa (boolean) --

            Whether email-based MFA is enabled for this actor.

          • mfaForwardingAddress (string) --

            Server-generated email forwarding address for receiving MFA codes.

      • documents (list) --

        The list of documents providing context for the pentest job.

        • (dict) --

          Represents a document that provides context for security testing.

          • s3Location (string) --

            The Amazon S3 location of the document.

          • artifactId (string) --

            The unique identifier of the artifact associated with the document.

          • integratedDocument (dict) --

            A reference to a document in an integrated third-party provider.

            • integrationId (string) --

              The identifier of the integration that provides access to the document.

            • resourceId (string) --

              The provider-specific resource identifier for the document.

      • sourceCode (list) --

        The list of source code repositories analyzed during the pentest job.

        • (dict) --

          Represents a source code repository used for security analysis during a pentest.

          • s3Location (string) --

            The Amazon S3 location of the source code repository archive.

      • excludePaths (list) --

        The list of paths excluded from the pentest job.

        • (dict) --

          Represents a target endpoint for penetration testing.

          • uri (string) --

            The URI of the endpoint.

      • allowedDomains (list) --

        The list of domains allowed during the pentest job.

        • (dict) --

          Represents a target endpoint for penetration testing.

          • uri (string) --

            The URI of the endpoint.

      • excludeRiskTypes (list) --

        The list of risk types excluded from the pentest job.

        • (string) --

          Type of security risk.

      • steps (list) --

        The list of steps in the pentest job execution.

        • (dict) --

          Represents a step in the pentest job execution pipeline. Steps include preflight, static analysis, pentest, and finalizing.

          • name (string) --

            The name of the step. Valid values include PREFLIGHT, STATIC_ANALYSIS, PENTEST, VALIDATION, and FINALIZING.

          • status (string) --

            The current status of the step.

          • createdAt (datetime) --

            The date and time the step was created, in UTC format.

          • updatedAt (datetime) --

            The date and time the step was last updated, in UTC format.

      • executionContext (list) --

        The execution context messages for the pentest job.

        • (dict) --

          Contains contextual information about the execution of a pentest job, such as errors, warnings, or informational messages.

          • contextType (string) --

            The type of context. Valid values include ERROR, CLIENT_ERROR, WARNING, and INFO.

          • context (string) --

            The context message.

          • timestamp (datetime) --

            The date and time the context was recorded, in UTC format.

      • serviceRole (string) --

        The IAM service role used for the pentest job.

      • logConfig (dict) --

        The CloudWatch Logs configuration for the pentest job.

        • logGroup (string) --

          The name of the CloudWatch log group.

        • logStream (string) --

          The name of the CloudWatch log stream.

      • vpcConfig (dict) --

        The VPC configuration for the pentest job.

        • vpcArn (string) --

          The Amazon Resource Name (ARN) of the VPC.

        • securityGroupArns (list) --

          The Amazon Resource Names (ARNs) of the security groups for the VPC configuration.

          • (string) --

            ARN or ID of a security group.

        • subnetArns (list) --

          The Amazon Resource Names (ARNs) of the subnets for the VPC configuration.

          • (string) --

            ARN or ID of a subnet.

      • networkTrafficConfig (dict) --

        The network traffic configuration for the pentest job.

        • rules (list) --

          The list of network traffic rules that control which URLs are allowed or denied during testing.

          • (dict) --

            A rule that controls network traffic during penetration testing by allowing or denying traffic to specific URL patterns.

            • effect (string) --

              The effect of the rule. Valid values are ALLOW and DENY.

            • pattern (string) --

              The URL pattern to match for the rule.

            • networkTrafficRuleType (string) --

              The type of the network traffic rule. Currently, only URL is supported.

        • customHeaders (list) --

          The list of custom HTTP headers to include in network traffic during testing.

          • (dict) --

            A custom HTTP header to include in network traffic during penetration testing.

            • name (string) --

              The name of the custom header.

            • value (string) --

              The value of the custom header.

      • errorInformation (dict) --

        Error information if the pentest job encountered an error.

        • code (string) --

          The error code. Valid values include CLIENT_ERROR, INTERNAL_ERROR, and STOPPED_BY_USER.

        • message (string) --

          A message describing the error.

      • integratedRepositories (list) --

        The list of integrated repositories associated with the pentest job.

        • (dict) --

          Represents a code repository that is integrated with the service through a third-party provider.

          • integrationId (string) --

            The unique identifier of the integration that provides access to the repository.

          • providerResourceId (string) --

            The provider-specific resource identifier for the repository.

          • branch (string) --

            An optional override for the repository branch.

      • codeRemediationStrategy (string) --

        The code remediation strategy for the pentest job.

      • cleanUpStrategy (string) --

        Strategy for cleaning up resources after pentest job completion.

      • disableManagedSkills (list) --

        A list of managed skills disabled for this pentest job. Valid values include FINDING_PERSONALIZATION and LOGIN_OPTIMIZATION.

        • (string) --

          Type of managed skill that can be enabled or disabled for a pentest.

      • maxTaskHours (float) --

        The maximum number of billable task hours allowed for this pentest job. If the cumulative task hours reach this limit, the job is gracefully stopped.

      • jobType (string) --

        The type of the pentest job. Valid values are FULL and REVALIDATION.

      • selectedFindingIds (list) --

        The list of finding identifiers selected for revalidation. Present only when jobType is REVALIDATION.

        • (string) --

      • createdAt (datetime) --

        The date and time the pentest job was created, in UTC format.

      • updatedAt (datetime) --

        The date and time the pentest job was last updated, in UTC format.

  • notFound (list) --

    The list of pentest job identifiers that were not found.

    • (string) --

{'pentests': {'maxTaskHours': 'double'}}

Retrieves information about one or more pentests in an agent space.

See also: AWS API Documentation

Request Syntax

client.batch_get_pentests(
    pentestIds=[
        'string',
    ],
    agentSpaceId='string'
)

type pentestIds:

list

param pentestIds:

[REQUIRED]

The list of pentest identifiers to retrieve.

• (string) --

type agentSpaceId:

string

param agentSpaceId:

[REQUIRED]

The unique identifier of the agent space that contains the pentests.

rtype:

dict

returns:

Response Syntax

{
    'pentests': [
        {
            'pentestId': 'string',
            'agentSpaceId': 'string',
            'title': 'string',
            'assets': {
                'endpoints': [
                    {
                        'uri': 'string'
                    },
                ],
                'actors': [
                    {
                        'identifier': 'string',
                        'uris': [
                            'string',
                        ],
                        'authentication': {
                            'providerType': 'SECRETS_MANAGER'|'AWS_LAMBDA'|'AWS_IAM_ROLE'|'AWS_INTERNAL',
                            'value': 'string'
                        },
                        'description': 'string',
                        'enableEmailMfa': True|False,
                        'mfaForwardingAddress': 'string'
                    },
                ],
                'documents': [
                    {
                        's3Location': 'string',
                        'artifactId': 'string',
                        'integratedDocument': {
                            'integrationId': 'string',
                            'resourceId': 'string'
                        }
                    },
                ],
                'sourceCode': [
                    {
                        's3Location': 'string'
                    },
                ],
                'integratedRepositories': [
                    {
                        'integrationId': 'string',
                        'providerResourceId': 'string',
                        'branch': 'string'
                    },
                ]
            },
            'excludeRiskTypes': [
                'CROSS_SITE_SCRIPTING'|'DEFAULT_CREDENTIALS'|'INSECURE_DIRECT_OBJECT_REFERENCE'|'PRIVILEGE_ESCALATION'|'SERVER_SIDE_TEMPLATE_INJECTION'|'COMMAND_INJECTION'|'CODE_INJECTION'|'SQL_INJECTION'|'ARBITRARY_FILE_UPLOAD'|'INSECURE_DESERIALIZATION'|'LOCAL_FILE_INCLUSION'|'INFORMATION_DISCLOSURE'|'PATH_TRAVERSAL'|'SERVER_SIDE_REQUEST_FORGERY'|'JSON_WEB_TOKEN_VULNERABILITIES'|'XML_EXTERNAL_ENTITY'|'FILE_DELETION'|'OTHER'|'GRAPHQL_VULNERABILITIES'|'BUSINESS_LOGIC_VULNERABILITIES'|'CRYPTOGRAPHIC_VULNERABILITIES'|'DENIAL_OF_SERVICE'|'FILE_ACCESS'|'FILE_CREATION'|'DATABASE_MODIFICATION'|'DATABASE_ACCESS'|'OUTBOUND_SERVICE_REQUEST'|'UNKNOWN',
            ],
            'serviceRole': 'string',
            'logConfig': {
                'logGroup': 'string',
                'logStream': 'string'
            },
            'vpcConfig': {
                'vpcArn': 'string',
                'securityGroupArns': [
                    'string',
                ],
                'subnetArns': [
                    'string',
                ]
            },
            'networkTrafficConfig': {
                'rules': [
                    {
                        'effect': 'ALLOW'|'DENY',
                        'pattern': 'string',
                        'networkTrafficRuleType': 'URL'
                    },
                ],
                'customHeaders': [
                    {
                        'name': 'string',
                        'value': 'string'
                    },
                ]
            },
            'codeRemediationStrategy': 'AUTOMATIC'|'DISABLED',
            'cleanUpStrategy': 'BEST_EFFORT_DELETE'|'RETAIN_ALL',
            'disableManagedSkills': [
                'FINDING_PERSONALIZATION'|'LOGIN_OPTIMIZATION',
            ],
            'maxTaskHours': 123.0,
            'createdAt': datetime(2015, 1, 1),
            'updatedAt': datetime(2015, 1, 1)
        },
    ],
    'notFound': [
        'string',
    ]
}

Response Structure

• (dict) --

  Output for the BatchGetPentests operation.

  • pentests (list) --

    The list of pentests that were found.

    • (dict) --

      Represents a pentest configuration that defines the parameters for security testing, including target assets, risk type exclusions, and infrastructure settings.

      • pentestId (string) --

        The unique identifier of the pentest.

      • agentSpaceId (string) --

        The unique identifier of the agent space that contains the pentest.

      • title (string) --

        The title of the pentest.

      • assets (dict) --

        The assets included in the pentest.

        • endpoints (list) --

          The list of endpoints to test during the pentest.

          • (dict) --

            Represents a target endpoint for penetration testing.

            • uri (string) --

              The URI of the endpoint.

        • actors (list) --

          The list of actors used during penetration testing.

          • (dict) --

            Represents an actor used during penetration testing. An actor defines a user or entity that interacts with the target application, including authentication credentials and target URIs.

            • identifier (string) --

              The unique identifier for the actor.

            • uris (list) --

              The list of URIs that the actor targets during testing.

              • (string) --

            • authentication (dict) --

              The authentication configuration for the actor.

              • providerType (string) --

                The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.

              • value (string) --

                The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.

            • description (string) --

              A description of the actor.

            • enableEmailMfa (boolean) --

              Whether email-based MFA is enabled for this actor.

            • mfaForwardingAddress (string) --

              Server-generated email forwarding address for receiving MFA codes.

        • documents (list) --

          The list of documents that provide context for the pentest.

          • (dict) --

            Represents a document that provides context for security testing.

            • s3Location (string) --

              The Amazon S3 location of the document.

            • artifactId (string) --

              The unique identifier of the artifact associated with the document.

            • integratedDocument (dict) --

              A reference to a document in an integrated third-party provider.

              • integrationId (string) --

                The identifier of the integration that provides access to the document.

              • resourceId (string) --

                The provider-specific resource identifier for the document.

        • sourceCode (list) --

          The list of source code repositories to analyze during the pentest.

          • (dict) --

            Represents a source code repository used for security analysis during a pentest.

            • s3Location (string) --

              The Amazon S3 location of the source code repository archive.

        • integratedRepositories (list) --

          The list of integrated repositories associated with the pentest.

          • (dict) --

            Represents a code repository that is integrated with the service through a third-party provider.

            • integrationId (string) --

              The unique identifier of the integration that provides access to the repository.

            • providerResourceId (string) --

              The provider-specific resource identifier for the repository.

            • branch (string) --

              An optional override for the repository branch.

      • excludeRiskTypes (list) --

        The list of risk types excluded from the pentest.

        • (string) --

          Type of security risk.

      • serviceRole (string) --

        The IAM service role used for the pentest.

      • logConfig (dict) --

        The CloudWatch Logs configuration for the pentest.

        • logGroup (string) --

          The name of the CloudWatch log group.

        • logStream (string) --

          The name of the CloudWatch log stream.

      • vpcConfig (dict) --

        The VPC configuration for the pentest.

        • vpcArn (string) --

          The Amazon Resource Name (ARN) of the VPC.

        • securityGroupArns (list) --

          The Amazon Resource Names (ARNs) of the security groups for the VPC configuration.

          • (string) --

            ARN or ID of a security group.

        • subnetArns (list) --

          The Amazon Resource Names (ARNs) of the subnets for the VPC configuration.

          • (string) --

            ARN or ID of a subnet.

      • networkTrafficConfig (dict) --

        The network traffic configuration for the pentest.

        • rules (list) --

          The list of network traffic rules that control which URLs are allowed or denied during testing.

          • (dict) --

            A rule that controls network traffic during penetration testing by allowing or denying traffic to specific URL patterns.

            • effect (string) --

              The effect of the rule. Valid values are ALLOW and DENY.

            • pattern (string) --

              The URL pattern to match for the rule.

            • networkTrafficRuleType (string) --

              The type of the network traffic rule. Currently, only URL is supported.

        • customHeaders (list) --

          The list of custom HTTP headers to include in network traffic during testing.

          • (dict) --

            A custom HTTP header to include in network traffic during penetration testing.

            • name (string) --

              The name of the custom header.

            • value (string) --

              The value of the custom header.

      • codeRemediationStrategy (string) --

        The code remediation strategy for the pentest.

      • cleanUpStrategy (string) --

        Strategy for cleaning up resources after pentest job completion.

      • disableManagedSkills (list) --

        A list of managed skills to disable for this pentest. Valid values include FINDING_PERSONALIZATION and LOGIN_OPTIMIZATION.

        • (string) --

          Type of managed skill that can be enabled or disabled for a pentest.

      • maxTaskHours (float) --

        The maximum number of billable task hours allowed for jobs started from this pentest. If a job reaches the configured limit, it is gracefully stopped. If not set, jobs run to completion with no budget cap.

      • createdAt (datetime) --

        The date and time the pentest was created, in UTC format.

      • updatedAt (datetime) --

        The date and time the pentest was last updated, in UTC format.

  • notFound (list) --

    The list of pentest identifiers that were not found.

    • (string) --

{'maxTaskHours': 'double'}

Creates a new code review configuration in an agent space. A code review defines the parameters for automated security-focused code analysis.

See also: AWS API Documentation

Request Syntax

client.create_code_review(
    title='string',
    agentSpaceId='string',
    assets={
        'endpoints': [
            {
                'uri': 'string'
            },
        ],
        'actors': [
            {
                'identifier': 'string',
                'uris': [
                    'string',
                ],
                'authentication': {
                    'providerType': 'SECRETS_MANAGER'|'AWS_LAMBDA'|'AWS_IAM_ROLE'|'AWS_INTERNAL',
                    'value': 'string'
                },
                'description': 'string',
                'enableEmailMfa': True|False,
                'mfaForwardingAddress': 'string'
            },
        ],
        'documents': [
            {
                's3Location': 'string',
                'artifactId': 'string',
                'integratedDocument': {
                    'integrationId': 'string',
                    'resourceId': 'string'
                }
            },
        ],
        'sourceCode': [
            {
                's3Location': 'string'
            },
        ],
        'integratedRepositories': [
            {
                'integrationId': 'string',
                'providerResourceId': 'string',
                'branch': 'string'
            },
        ]
    },
    serviceRole='string',
    logConfig={
        'logGroup': 'string',
        'logStream': 'string'
    },
    codeRemediationStrategy='AUTOMATIC'|'DISABLED',
    validationMode='DISABLED'|'SIMULATED',
    maxTaskHours=123.0
)

type title:

string

param title:

[REQUIRED]

The title of the code review.

type agentSpaceId:

string

param agentSpaceId:

[REQUIRED]

The unique identifier of the agent space to create the code review in.

type assets:

dict

param assets:

[REQUIRED]

The assets to include in the code review, such as documents and source code.

• endpoints (list) --

  The list of endpoints to test during the pentest.

  • (dict) --

    Represents a target endpoint for penetration testing.

    • uri (string) --

      The URI of the endpoint.

• actors (list) --

  The list of actors used during penetration testing.

  • (dict) --

    Represents an actor used during penetration testing. An actor defines a user or entity that interacts with the target application, including authentication credentials and target URIs.

    • identifier (string) --

      The unique identifier for the actor.

    • uris (list) --

      The list of URIs that the actor targets during testing.

      • (string) --

    • authentication (dict) --

      The authentication configuration for the actor.

      • providerType (string) --

        The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.

      • value (string) --

        The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.

    • description (string) --

      A description of the actor.

    • enableEmailMfa (boolean) --

      Whether email-based MFA is enabled for this actor.

    • mfaForwardingAddress (string) --

      Server-generated email forwarding address for receiving MFA codes.

• documents (list) --

  The list of documents that provide context for the pentest.

  • (dict) --

    Represents a document that provides context for security testing.

    • s3Location (string) --

      The Amazon S3 location of the document.

    • artifactId (string) --

      The unique identifier of the artifact associated with the document.

    • integratedDocument (dict) --

      A reference to a document in an integrated third-party provider.

      • integrationId (string) -- [REQUIRED]

        The identifier of the integration that provides access to the document.

      • resourceId (string) -- [REQUIRED]

        The provider-specific resource identifier for the document.

• sourceCode (list) --

  The list of source code repositories to analyze during the pentest.

  • (dict) --

    Represents a source code repository used for security analysis during a pentest.

    • s3Location (string) --

      The Amazon S3 location of the source code repository archive.

• integratedRepositories (list) --

  The list of integrated repositories associated with the pentest.

  • (dict) --

    Represents a code repository that is integrated with the service through a third-party provider.

    • integrationId (string) -- [REQUIRED]

      The unique identifier of the integration that provides access to the repository.

    • providerResourceId (string) -- [REQUIRED]

      The provider-specific resource identifier for the repository.

    • branch (string) --

      An optional override for the repository branch.

type serviceRole:

string

param serviceRole:

The IAM service role to use for the code review.

type logConfig:

dict

param logConfig:

The CloudWatch Logs configuration for the code review.

• logGroup (string) --

  The name of the CloudWatch log group.

• logStream (string) --

  The name of the CloudWatch log stream.

type codeRemediationStrategy:

string

param codeRemediationStrategy:

The code remediation strategy for the code review. Valid values are AUTOMATIC and DISABLED.

type validationMode:

string

param validationMode:

The validation mode for the code review. Valid values are SIMULATED and DISABLED.

type maxTaskHours:

float

param maxTaskHours:

The maximum number of billable task hours allowed for jobs started from this code review. Must be a positive number. If not set, jobs run to completion with no budget cap.

rtype:

dict

returns:

Response Syntax

{
    'codeReviewId': 'string',
    'title': 'string',
    'createdAt': datetime(2015, 1, 1),
    'updatedAt': datetime(2015, 1, 1),
    'assets': {
        'endpoints': [
            {
                'uri': 'string'
            },
        ],
        'actors': [
            {
                'identifier': 'string',
                'uris': [
                    'string',
                ],
                'authentication': {
                    'providerType': 'SECRETS_MANAGER'|'AWS_LAMBDA'|'AWS_IAM_ROLE'|'AWS_INTERNAL',
                    'value': 'string'
                },
                'description': 'string',
                'enableEmailMfa': True|False,
                'mfaForwardingAddress': 'string'
            },
        ],
        'documents': [
            {
                's3Location': 'string',
                'artifactId': 'string',
                'integratedDocument': {
                    'integrationId': 'string',
                    'resourceId': 'string'
                }
            },
        ],
        'sourceCode': [
            {
                's3Location': 'string'
            },
        ],
        'integratedRepositories': [
            {
                'integrationId': 'string',
                'providerResourceId': 'string',
                'branch': 'string'
            },
        ]
    },
    'serviceRole': 'string',
    'logConfig': {
        'logGroup': 'string',
        'logStream': 'string'
    },
    'agentSpaceId': 'string',
    'codeRemediationStrategy': 'AUTOMATIC'|'DISABLED',
    'validationMode': 'DISABLED'|'SIMULATED',
    'maxTaskHours': 123.0
}

Response Structure

• (dict) --

  Output for the CreateCodeReview operation.

  • codeReviewId (string) --

    The unique identifier of the created code review.

  • title (string) --

    The title of the code review.

  • createdAt (datetime) --

    The date and time the code review was created, in UTC format.

  • updatedAt (datetime) --

    The date and time the code review was last updated, in UTC format.

  • assets (dict) --

    The assets included in the code review.

    • endpoints (list) --

      The list of endpoints to test during the pentest.

      • (dict) --

        Represents a target endpoint for penetration testing.

        • uri (string) --

          The URI of the endpoint.

    • actors (list) --

      The list of actors used during penetration testing.

      • (dict) --

        Represents an actor used during penetration testing. An actor defines a user or entity that interacts with the target application, including authentication credentials and target URIs.

        • identifier (string) --

          The unique identifier for the actor.

        • uris (list) --

          The list of URIs that the actor targets during testing.

          • (string) --

        • authentication (dict) --

          The authentication configuration for the actor.

          • providerType (string) --

            The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.

          • value (string) --

            The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.

        • description (string) --

          A description of the actor.

        • enableEmailMfa (boolean) --

          Whether email-based MFA is enabled for this actor.

        • mfaForwardingAddress (string) --

          Server-generated email forwarding address for receiving MFA codes.

    • documents (list) --

      The list of documents that provide context for the pentest.

      • (dict) --

        Represents a document that provides context for security testing.

        • s3Location (string) --

          The Amazon S3 location of the document.

        • artifactId (string) --

          The unique identifier of the artifact associated with the document.

        • integratedDocument (dict) --

          A reference to a document in an integrated third-party provider.

          • integrationId (string) --

            The identifier of the integration that provides access to the document.

          • resourceId (string) --

            The provider-specific resource identifier for the document.

    • sourceCode (list) --

      The list of source code repositories to analyze during the pentest.

      • (dict) --

        Represents a source code repository used for security analysis during a pentest.

        • s3Location (string) --

          The Amazon S3 location of the source code repository archive.

    • integratedRepositories (list) --

      The list of integrated repositories associated with the pentest.

      • (dict) --

        Represents a code repository that is integrated with the service through a third-party provider.

        • integrationId (string) --

          The unique identifier of the integration that provides access to the repository.

        • providerResourceId (string) --

          The provider-specific resource identifier for the repository.

        • branch (string) --

          An optional override for the repository branch.

  • serviceRole (string) --

    The IAM service role used for the code review.

  • logConfig (dict) --

    The CloudWatch Logs configuration for the code review.

    • logGroup (string) --

      The name of the CloudWatch log group.

    • logStream (string) --

      The name of the CloudWatch log stream.

  • agentSpaceId (string) --

    The unique identifier of the agent space that contains the code review.

  • codeRemediationStrategy (string) --

    The code remediation strategy for the code review.

  • validationMode (string) --

    The validation mode for the code review.

  • maxTaskHours (float) --

    The maximum number of billable task hours configured for jobs started from this code review. Null if no budget cap is set.

{'maxTaskHours': 'double'}

Creates a new pentest configuration in an agent space. A pentest defines the security test parameters, including target assets, risk type exclusions, and logging configuration.

See also: AWS API Documentation

Request Syntax

client.create_pentest(
    title='string',
    agentSpaceId='string',
    assets={
        'endpoints': [
            {
                'uri': 'string'
            },
        ],
        'actors': [
            {
                'identifier': 'string',
                'uris': [
                    'string',
                ],
                'authentication': {
                    'providerType': 'SECRETS_MANAGER'|'AWS_LAMBDA'|'AWS_IAM_ROLE'|'AWS_INTERNAL',
                    'value': 'string'
                },
                'description': 'string',
                'enableEmailMfa': True|False,
                'mfaForwardingAddress': 'string'
            },
        ],
        'documents': [
            {
                's3Location': 'string',
                'artifactId': 'string',
                'integratedDocument': {
                    'integrationId': 'string',
                    'resourceId': 'string'
                }
            },
        ],
        'sourceCode': [
            {
                's3Location': 'string'
            },
        ],
        'integratedRepositories': [
            {
                'integrationId': 'string',
                'providerResourceId': 'string',
                'branch': 'string'
            },
        ]
    },
    excludeRiskTypes=[
        'CROSS_SITE_SCRIPTING'|'DEFAULT_CREDENTIALS'|'INSECURE_DIRECT_OBJECT_REFERENCE'|'PRIVILEGE_ESCALATION'|'SERVER_SIDE_TEMPLATE_INJECTION'|'COMMAND_INJECTION'|'CODE_INJECTION'|'SQL_INJECTION'|'ARBITRARY_FILE_UPLOAD'|'INSECURE_DESERIALIZATION'|'LOCAL_FILE_INCLUSION'|'INFORMATION_DISCLOSURE'|'PATH_TRAVERSAL'|'SERVER_SIDE_REQUEST_FORGERY'|'JSON_WEB_TOKEN_VULNERABILITIES'|'XML_EXTERNAL_ENTITY'|'FILE_DELETION'|'OTHER'|'GRAPHQL_VULNERABILITIES'|'BUSINESS_LOGIC_VULNERABILITIES'|'CRYPTOGRAPHIC_VULNERABILITIES'|'DENIAL_OF_SERVICE'|'FILE_ACCESS'|'FILE_CREATION'|'DATABASE_MODIFICATION'|'DATABASE_ACCESS'|'OUTBOUND_SERVICE_REQUEST'|'UNKNOWN',
    ],
    serviceRole='string',
    logConfig={
        'logGroup': 'string',
        'logStream': 'string'
    },
    vpcConfig={
        'vpcArn': 'string',
        'securityGroupArns': [
            'string',
        ],
        'subnetArns': [
            'string',
        ]
    },
    networkTrafficConfig={
        'rules': [
            {
                'effect': 'ALLOW'|'DENY',
                'pattern': 'string',
                'networkTrafficRuleType': 'URL'
            },
        ],
        'customHeaders': [
            {
                'name': 'string',
                'value': 'string'
            },
        ]
    },
    codeRemediationStrategy='AUTOMATIC'|'DISABLED',
    disableManagedSkills=[
        'FINDING_PERSONALIZATION'|'LOGIN_OPTIMIZATION',
    ],
    maxTaskHours=123.0
)

type title:

string

param title:

[REQUIRED]

The title of the pentest.

type agentSpaceId:

string

param agentSpaceId:

[REQUIRED]

The unique identifier of the agent space to create the pentest in.

type assets:

dict

param assets:

The assets to include in the pentest, such as endpoints, actors, documents, and source code.

• endpoints (list) --

  The list of endpoints to test during the pentest.

  • (dict) --

    Represents a target endpoint for penetration testing.

    • uri (string) --

      The URI of the endpoint.

• actors (list) --

  The list of actors used during penetration testing.

  • (dict) --

    Represents an actor used during penetration testing. An actor defines a user or entity that interacts with the target application, including authentication credentials and target URIs.

    • identifier (string) --

      The unique identifier for the actor.

    • uris (list) --

      The list of URIs that the actor targets during testing.

      • (string) --

    • authentication (dict) --

      The authentication configuration for the actor.

      • providerType (string) --

        The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.

      • value (string) --

        The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.

    • description (string) --

      A description of the actor.

    • enableEmailMfa (boolean) --

      Whether email-based MFA is enabled for this actor.

    • mfaForwardingAddress (string) --

      Server-generated email forwarding address for receiving MFA codes.

• documents (list) --

  The list of documents that provide context for the pentest.

  • (dict) --

    Represents a document that provides context for security testing.

    • s3Location (string) --

      The Amazon S3 location of the document.

    • artifactId (string) --

      The unique identifier of the artifact associated with the document.

    • integratedDocument (dict) --

      A reference to a document in an integrated third-party provider.

      • integrationId (string) -- [REQUIRED]

        The identifier of the integration that provides access to the document.

      • resourceId (string) -- [REQUIRED]

        The provider-specific resource identifier for the document.

• sourceCode (list) --

  The list of source code repositories to analyze during the pentest.

  • (dict) --

    Represents a source code repository used for security analysis during a pentest.

    • s3Location (string) --

      The Amazon S3 location of the source code repository archive.

• integratedRepositories (list) --

  The list of integrated repositories associated with the pentest.

  • (dict) --

    Represents a code repository that is integrated with the service through a third-party provider.

    • integrationId (string) -- [REQUIRED]

      The unique identifier of the integration that provides access to the repository.

    • providerResourceId (string) -- [REQUIRED]

      The provider-specific resource identifier for the repository.

    • branch (string) --

      An optional override for the repository branch.

type excludeRiskTypes:

list

param excludeRiskTypes:

The list of risk types to exclude from the pentest.

• (string) --

  Type of security risk.

type serviceRole:

string

param serviceRole:

The IAM service role to use for the pentest.

type logConfig:

dict

param logConfig:

The CloudWatch Logs configuration for the pentest.

• logGroup (string) --

  The name of the CloudWatch log group.

• logStream (string) --

  The name of the CloudWatch log stream.

type vpcConfig:

dict

param vpcConfig:

The VPC configuration for the pentest.

• vpcArn (string) --

  The Amazon Resource Name (ARN) of the VPC.

• securityGroupArns (list) --

  The Amazon Resource Names (ARNs) of the security groups for the VPC configuration.

  • (string) --

    ARN or ID of a security group.

• subnetArns (list) --

  The Amazon Resource Names (ARNs) of the subnets for the VPC configuration.

  • (string) --

    ARN or ID of a subnet.

type networkTrafficConfig:

dict

param networkTrafficConfig:

The network traffic configuration for the pentest, including custom headers and traffic rules.

• rules (list) --

  The list of network traffic rules that control which URLs are allowed or denied during testing.

  • (dict) --

    A rule that controls network traffic during penetration testing by allowing or denying traffic to specific URL patterns.

    • effect (string) --

      The effect of the rule. Valid values are ALLOW and DENY.

    • pattern (string) --

      The URL pattern to match for the rule.

    • networkTrafficRuleType (string) --

      The type of the network traffic rule. Currently, only URL is supported.

• customHeaders (list) --

  The list of custom HTTP headers to include in network traffic during testing.

  • (dict) --

    A custom HTTP header to include in network traffic during penetration testing.

    • name (string) --

      The name of the custom header.

    • value (string) --

      The value of the custom header.

type codeRemediationStrategy:

string

param codeRemediationStrategy:

The code remediation strategy for the pentest. Valid values are AUTOMATIC and DISABLED.

type disableManagedSkills:

list

param disableManagedSkills:

A list of managed skills to disable for this pentest. Valid values include FINDING_PERSONALIZATION and LOGIN_OPTIMIZATION.

• (string) --

  Type of managed skill that can be enabled or disabled for a pentest.

type maxTaskHours:

float

param maxTaskHours:

The maximum number of billable task hours allowed for jobs started from this pentest. Must be a positive number. If not set, jobs run to completion with no budget cap.

rtype:

dict

returns:

Response Syntax

{
    'pentestId': 'string',
    'title': 'string',
    'createdAt': datetime(2015, 1, 1),
    'updatedAt': datetime(2015, 1, 1),
    'assets': {
        'endpoints': [
            {
                'uri': 'string'
            },
        ],
        'actors': [
            {
                'identifier': 'string',
                'uris': [
                    'string',
                ],
                'authentication': {
                    'providerType': 'SECRETS_MANAGER'|'AWS_LAMBDA'|'AWS_IAM_ROLE'|'AWS_INTERNAL',
                    'value': 'string'
                },
                'description': 'string',
                'enableEmailMfa': True|False,
                'mfaForwardingAddress': 'string'
            },
        ],
        'documents': [
            {
                's3Location': 'string',
                'artifactId': 'string',
                'integratedDocument': {
                    'integrationId': 'string',
                    'resourceId': 'string'
                }
            },
        ],
        'sourceCode': [
            {
                's3Location': 'string'
            },
        ],
        'integratedRepositories': [
            {
                'integrationId': 'string',
                'providerResourceId': 'string',
                'branch': 'string'
            },
        ]
    },
    'excludeRiskTypes': [
        'CROSS_SITE_SCRIPTING'|'DEFAULT_CREDENTIALS'|'INSECURE_DIRECT_OBJECT_REFERENCE'|'PRIVILEGE_ESCALATION'|'SERVER_SIDE_TEMPLATE_INJECTION'|'COMMAND_INJECTION'|'CODE_INJECTION'|'SQL_INJECTION'|'ARBITRARY_FILE_UPLOAD'|'INSECURE_DESERIALIZATION'|'LOCAL_FILE_INCLUSION'|'INFORMATION_DISCLOSURE'|'PATH_TRAVERSAL'|'SERVER_SIDE_REQUEST_FORGERY'|'JSON_WEB_TOKEN_VULNERABILITIES'|'XML_EXTERNAL_ENTITY'|'FILE_DELETION'|'OTHER'|'GRAPHQL_VULNERABILITIES'|'BUSINESS_LOGIC_VULNERABILITIES'|'CRYPTOGRAPHIC_VULNERABILITIES'|'DENIAL_OF_SERVICE'|'FILE_ACCESS'|'FILE_CREATION'|'DATABASE_MODIFICATION'|'DATABASE_ACCESS'|'OUTBOUND_SERVICE_REQUEST'|'UNKNOWN',
    ],
    'serviceRole': 'string',
    'logConfig': {
        'logGroup': 'string',
        'logStream': 'string'
    },
    'agentSpaceId': 'string'
}

Response Structure

• (dict) --

  Output for the CreatePentest operation.

  • pentestId (string) --

    The unique identifier of the created pentest.

  • title (string) --

    The title of the pentest.

  • createdAt (datetime) --

    The date and time the pentest was created, in UTC format.

  • updatedAt (datetime) --

    The date and time the pentest was last updated, in UTC format.

  • assets (dict) --

    The assets included in the pentest.

    • endpoints (list) --

      The list of endpoints to test during the pentest.

      • (dict) --

        Represents a target endpoint for penetration testing.

        • uri (string) --

          The URI of the endpoint.

    • actors (list) --

      The list of actors used during penetration testing.

      • (dict) --

        Represents an actor used during penetration testing. An actor defines a user or entity that interacts with the target application, including authentication credentials and target URIs.

        • identifier (string) --

          The unique identifier for the actor.

        • uris (list) --

          The list of URIs that the actor targets during testing.

          • (string) --

        • authentication (dict) --

          The authentication configuration for the actor.

          • providerType (string) --

            The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.

          • value (string) --

            The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.

        • description (string) --

          A description of the actor.

        • enableEmailMfa (boolean) --

          Whether email-based MFA is enabled for this actor.

        • mfaForwardingAddress (string) --

          Server-generated email forwarding address for receiving MFA codes.

    • documents (list) --

      The list of documents that provide context for the pentest.

      • (dict) --

        Represents a document that provides context for security testing.

        • s3Location (string) --

          The Amazon S3 location of the document.

        • artifactId (string) --

          The unique identifier of the artifact associated with the document.

        • integratedDocument (dict) --

          A reference to a document in an integrated third-party provider.

          • integrationId (string) --

            The identifier of the integration that provides access to the document.

          • resourceId (string) --

            The provider-specific resource identifier for the document.

    • sourceCode (list) --

      The list of source code repositories to analyze during the pentest.

      • (dict) --

        Represents a source code repository used for security analysis during a pentest.

        • s3Location (string) --

          The Amazon S3 location of the source code repository archive.

    • integratedRepositories (list) --

      The list of integrated repositories associated with the pentest.

      • (dict) --

        Represents a code repository that is integrated with the service through a third-party provider.

        • integrationId (string) --

          The unique identifier of the integration that provides access to the repository.

        • providerResourceId (string) --

          The provider-specific resource identifier for the repository.

        • branch (string) --

          An optional override for the repository branch.

  • excludeRiskTypes (list) --

    The list of risk types excluded from the pentest.

    • (string) --

      Type of security risk.

  • serviceRole (string) --

    The IAM service role used for the pentest.

  • logConfig (dict) --

    The CloudWatch Logs configuration for the pentest.

    • logGroup (string) --

      The name of the CloudWatch log group.

    • logStream (string) --

      The name of the CloudWatch log stream.

  • agentSpaceId (string) --

    The unique identifier of the agent space that contains the pentest.

{'jobType': 'FULL | REVALIDATION', 'selectedFindingIds': ['string']}

Starts a new pentest job for a pentest configuration. The job executes the security tests defined in the pentest.

See also: AWS API Documentation

Request Syntax

client.start_pentest_job(
    agentSpaceId='string',
    pentestId='string',
    jobType='FULL'|'REVALIDATION',
    selectedFindingIds=[
        'string',
    ]
)

type agentSpaceId:

string

param agentSpaceId:

[REQUIRED]

The unique identifier of the agent space.

type pentestId:

string

param pentestId:

[REQUIRED]

The unique identifier of the pentest to start a job for.

type jobType:

string

param jobType:

The type of pentest job to start. Valid values are FULL and REVALIDATION. When set to REVALIDATION, the selectedFindingIds parameter is required.

type selectedFindingIds:

list

param selectedFindingIds:

The list of finding identifiers to revalidate. Required when jobType is REVALIDATION. Each finding must belong to the same agent space and pentest.

• (string) --

rtype:

dict

returns:

Response Syntax

{
    'title': 'string',
    'status': 'IN_PROGRESS'|'STOPPING'|'STOPPED'|'FAILED'|'COMPLETED',
    'createdAt': datetime(2015, 1, 1),
    'updatedAt': datetime(2015, 1, 1),
    'pentestId': 'string',
    'pentestJobId': 'string',
    'agentSpaceId': 'string'
}

Response Structure

• (dict) --

  Output for the StartPentestJob operation.

  • title (string) --

    The title of the pentest job.

  • status (string) --

    The current status of the pentest job.

  • createdAt (datetime) --

    The date and time the pentest job was created, in UTC format.

  • updatedAt (datetime) --

    The date and time the pentest job was last updated, in UTC format.

  • pentestId (string) --

    The unique identifier of the pentest.

  • pentestJobId (string) --

    The unique identifier of the started pentest job.

  • agentSpaceId (string) --

    The unique identifier of the agent space.

{'maxTaskHours': 'double'}

Updates an existing code review configuration.

See also: AWS API Documentation

Request Syntax

client.update_code_review(
    codeReviewId='string',
    agentSpaceId='string',
    title='string',
    assets={
        'endpoints': [
            {
                'uri': 'string'
            },
        ],
        'actors': [
            {
                'identifier': 'string',
                'uris': [
                    'string',
                ],
                'authentication': {
                    'providerType': 'SECRETS_MANAGER'|'AWS_LAMBDA'|'AWS_IAM_ROLE'|'AWS_INTERNAL',
                    'value': 'string'
                },
                'description': 'string',
                'enableEmailMfa': True|False,
                'mfaForwardingAddress': 'string'
            },
        ],
        'documents': [
            {
                's3Location': 'string',
                'artifactId': 'string',
                'integratedDocument': {
                    'integrationId': 'string',
                    'resourceId': 'string'
                }
            },
        ],
        'sourceCode': [
            {
                's3Location': 'string'
            },
        ],
        'integratedRepositories': [
            {
                'integrationId': 'string',
                'providerResourceId': 'string',
                'branch': 'string'
            },
        ]
    },
    serviceRole='string',
    logConfig={
        'logGroup': 'string',
        'logStream': 'string'
    },
    codeRemediationStrategy='AUTOMATIC'|'DISABLED',
    validationMode='DISABLED'|'SIMULATED',
    maxTaskHours=123.0
)

type codeReviewId:

string

param codeReviewId:

[REQUIRED]

The unique identifier of the code review to update.

type agentSpaceId:

string

param agentSpaceId:

[REQUIRED]

The unique identifier of the agent space that contains the code review.

type title:

string

param title:

The updated title of the code review.

type assets:

dict

param assets:

The updated assets for the code review.

• endpoints (list) --

  The list of endpoints to test during the pentest.

  • (dict) --

    Represents a target endpoint for penetration testing.

    • uri (string) --

      The URI of the endpoint.

• actors (list) --

  The list of actors used during penetration testing.

  • (dict) --

    Represents an actor used during penetration testing. An actor defines a user or entity that interacts with the target application, including authentication credentials and target URIs.

    • identifier (string) --

      The unique identifier for the actor.

    • uris (list) --

      The list of URIs that the actor targets during testing.

      • (string) --

    • authentication (dict) --

      The authentication configuration for the actor.

      • providerType (string) --

        The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.

      • value (string) --

        The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.

    • description (string) --

      A description of the actor.

    • enableEmailMfa (boolean) --

      Whether email-based MFA is enabled for this actor.

    • mfaForwardingAddress (string) --

      Server-generated email forwarding address for receiving MFA codes.

• documents (list) --

  The list of documents that provide context for the pentest.

  • (dict) --

    Represents a document that provides context for security testing.

    • s3Location (string) --

      The Amazon S3 location of the document.

    • artifactId (string) --

      The unique identifier of the artifact associated with the document.

    • integratedDocument (dict) --

      A reference to a document in an integrated third-party provider.

      • integrationId (string) -- [REQUIRED]

        The identifier of the integration that provides access to the document.

      • resourceId (string) -- [REQUIRED]

        The provider-specific resource identifier for the document.

• sourceCode (list) --

  The list of source code repositories to analyze during the pentest.

  • (dict) --

    Represents a source code repository used for security analysis during a pentest.

    • s3Location (string) --

      The Amazon S3 location of the source code repository archive.

• integratedRepositories (list) --

  The list of integrated repositories associated with the pentest.

  • (dict) --

    Represents a code repository that is integrated with the service through a third-party provider.

    • integrationId (string) -- [REQUIRED]

      The unique identifier of the integration that provides access to the repository.

    • providerResourceId (string) -- [REQUIRED]

      The provider-specific resource identifier for the repository.

    • branch (string) --

      An optional override for the repository branch.

type serviceRole:

string

param serviceRole:

The updated IAM service role for the code review.

type logConfig:

dict

param logConfig:

The updated CloudWatch Logs configuration for the code review.

• logGroup (string) --

  The name of the CloudWatch log group.

• logStream (string) --

  The name of the CloudWatch log stream.

type codeRemediationStrategy:

string

param codeRemediationStrategy:

The updated code remediation strategy for the code review.

type validationMode:

string

param validationMode:

The updated validation mode for the code review. Valid values are SIMULATED and DISABLED.

type maxTaskHours:

float

param maxTaskHours:

The updated maximum number of billable task hours allowed for jobs started from this code review.

rtype:

dict

returns:

Response Syntax

{
    'codeReviewId': 'string',
    'title': 'string',
    'createdAt': datetime(2015, 1, 1),
    'updatedAt': datetime(2015, 1, 1),
    'assets': {
        'endpoints': [
            {
                'uri': 'string'
            },
        ],
        'actors': [
            {
                'identifier': 'string',
                'uris': [
                    'string',
                ],
                'authentication': {
                    'providerType': 'SECRETS_MANAGER'|'AWS_LAMBDA'|'AWS_IAM_ROLE'|'AWS_INTERNAL',
                    'value': 'string'
                },
                'description': 'string',
                'enableEmailMfa': True|False,
                'mfaForwardingAddress': 'string'
            },
        ],
        'documents': [
            {
                's3Location': 'string',
                'artifactId': 'string',
                'integratedDocument': {
                    'integrationId': 'string',
                    'resourceId': 'string'
                }
            },
        ],
        'sourceCode': [
            {
                's3Location': 'string'
            },
        ],
        'integratedRepositories': [
            {
                'integrationId': 'string',
                'providerResourceId': 'string',
                'branch': 'string'
            },
        ]
    },
    'serviceRole': 'string',
    'logConfig': {
        'logGroup': 'string',
        'logStream': 'string'
    },
    'agentSpaceId': 'string',
    'codeRemediationStrategy': 'AUTOMATIC'|'DISABLED',
    'validationMode': 'DISABLED'|'SIMULATED',
    'maxTaskHours': 123.0
}

Response Structure

• (dict) --

  Output for the UpdateCodeReview operation.

  • codeReviewId (string) --

    The unique identifier of the code review.

  • title (string) --

    The title of the code review.

  • createdAt (datetime) --

    The date and time the code review was created, in UTC format.

  • updatedAt (datetime) --

    The date and time the code review was last updated, in UTC format.

  • assets (dict) --

    The assets included in the code review.

    • endpoints (list) --

      The list of endpoints to test during the pentest.

      • (dict) --

        Represents a target endpoint for penetration testing.

        • uri (string) --

          The URI of the endpoint.

    • actors (list) --

      The list of actors used during penetration testing.

      • (dict) --

        Represents an actor used during penetration testing. An actor defines a user or entity that interacts with the target application, including authentication credentials and target URIs.

        • identifier (string) --

          The unique identifier for the actor.

        • uris (list) --

          The list of URIs that the actor targets during testing.

          • (string) --

        • authentication (dict) --

          The authentication configuration for the actor.

          • providerType (string) --

            The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.

          • value (string) --

            The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.

        • description (string) --

          A description of the actor.

        • enableEmailMfa (boolean) --

          Whether email-based MFA is enabled for this actor.

        • mfaForwardingAddress (string) --

          Server-generated email forwarding address for receiving MFA codes.

    • documents (list) --

      The list of documents that provide context for the pentest.

      • (dict) --

        Represents a document that provides context for security testing.

        • s3Location (string) --

          The Amazon S3 location of the document.

        • artifactId (string) --

          The unique identifier of the artifact associated with the document.

        • integratedDocument (dict) --

          A reference to a document in an integrated third-party provider.

          • integrationId (string) --

            The identifier of the integration that provides access to the document.

          • resourceId (string) --

            The provider-specific resource identifier for the document.

    • sourceCode (list) --

      The list of source code repositories to analyze during the pentest.

      • (dict) --

        Represents a source code repository used for security analysis during a pentest.

        • s3Location (string) --

          The Amazon S3 location of the source code repository archive.

    • integratedRepositories (list) --

      The list of integrated repositories associated with the pentest.

      • (dict) --

        Represents a code repository that is integrated with the service through a third-party provider.

        • integrationId (string) --

          The unique identifier of the integration that provides access to the repository.

        • providerResourceId (string) --

          The provider-specific resource identifier for the repository.

        • branch (string) --

          An optional override for the repository branch.

  • serviceRole (string) --

    The IAM service role used for the code review.

  • logConfig (dict) --

    The CloudWatch Logs configuration for the code review.

    • logGroup (string) --

      The name of the CloudWatch log group.

    • logStream (string) --

      The name of the CloudWatch log stream.

  • agentSpaceId (string) --

    The unique identifier of the agent space that contains the code review.

  • codeRemediationStrategy (string) --

    The code remediation strategy for the code review.

  • validationMode (string) --

    The validation mode for the code review.

  • maxTaskHours (float) --

    The maximum number of billable task hours configured for jobs started from this code review. Null if no budget cap is set.

{'maxTaskHours': 'double'}

Updates an existing pentest configuration.

See also: AWS API Documentation

Request Syntax

client.update_pentest(
    pentestId='string',
    agentSpaceId='string',
    title='string',
    assets={
        'endpoints': [
            {
                'uri': 'string'
            },
        ],
        'actors': [
            {
                'identifier': 'string',
                'uris': [
                    'string',
                ],
                'authentication': {
                    'providerType': 'SECRETS_MANAGER'|'AWS_LAMBDA'|'AWS_IAM_ROLE'|'AWS_INTERNAL',
                    'value': 'string'
                },
                'description': 'string',
                'enableEmailMfa': True|False,
                'mfaForwardingAddress': 'string'
            },
        ],
        'documents': [
            {
                's3Location': 'string',
                'artifactId': 'string',
                'integratedDocument': {
                    'integrationId': 'string',
                    'resourceId': 'string'
                }
            },
        ],
        'sourceCode': [
            {
                's3Location': 'string'
            },
        ],
        'integratedRepositories': [
            {
                'integrationId': 'string',
                'providerResourceId': 'string',
                'branch': 'string'
            },
        ]
    },
    excludeRiskTypes=[
        'CROSS_SITE_SCRIPTING'|'DEFAULT_CREDENTIALS'|'INSECURE_DIRECT_OBJECT_REFERENCE'|'PRIVILEGE_ESCALATION'|'SERVER_SIDE_TEMPLATE_INJECTION'|'COMMAND_INJECTION'|'CODE_INJECTION'|'SQL_INJECTION'|'ARBITRARY_FILE_UPLOAD'|'INSECURE_DESERIALIZATION'|'LOCAL_FILE_INCLUSION'|'INFORMATION_DISCLOSURE'|'PATH_TRAVERSAL'|'SERVER_SIDE_REQUEST_FORGERY'|'JSON_WEB_TOKEN_VULNERABILITIES'|'XML_EXTERNAL_ENTITY'|'FILE_DELETION'|'OTHER'|'GRAPHQL_VULNERABILITIES'|'BUSINESS_LOGIC_VULNERABILITIES'|'CRYPTOGRAPHIC_VULNERABILITIES'|'DENIAL_OF_SERVICE'|'FILE_ACCESS'|'FILE_CREATION'|'DATABASE_MODIFICATION'|'DATABASE_ACCESS'|'OUTBOUND_SERVICE_REQUEST'|'UNKNOWN',
    ],
    serviceRole='string',
    logConfig={
        'logGroup': 'string',
        'logStream': 'string'
    },
    vpcConfig={
        'vpcArn': 'string',
        'securityGroupArns': [
            'string',
        ],
        'subnetArns': [
            'string',
        ]
    },
    networkTrafficConfig={
        'rules': [
            {
                'effect': 'ALLOW'|'DENY',
                'pattern': 'string',
                'networkTrafficRuleType': 'URL'
            },
        ],
        'customHeaders': [
            {
                'name': 'string',
                'value': 'string'
            },
        ]
    },
    codeRemediationStrategy='AUTOMATIC'|'DISABLED',
    disableManagedSkills=[
        'FINDING_PERSONALIZATION'|'LOGIN_OPTIMIZATION',
    ],
    maxTaskHours=123.0
)

type pentestId:

string

param pentestId:

[REQUIRED]

The unique identifier of the pentest to update.

type agentSpaceId:

string

param agentSpaceId:

[REQUIRED]

The unique identifier of the agent space that contains the pentest.

type title:

string

param title:

The updated title of the pentest.

type assets:

dict

param assets:

The updated assets for the pentest.

• endpoints (list) --

  The list of endpoints to test during the pentest.

  • (dict) --

    Represents a target endpoint for penetration testing.

    • uri (string) --

      The URI of the endpoint.

• actors (list) --

  The list of actors used during penetration testing.

  • (dict) --

    Represents an actor used during penetration testing. An actor defines a user or entity that interacts with the target application, including authentication credentials and target URIs.

    • identifier (string) --

      The unique identifier for the actor.

    • uris (list) --

      The list of URIs that the actor targets during testing.

      • (string) --

    • authentication (dict) --

      The authentication configuration for the actor.

      • providerType (string) --

        The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.

      • value (string) --

        The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.

    • description (string) --

      A description of the actor.

    • enableEmailMfa (boolean) --

      Whether email-based MFA is enabled for this actor.

    • mfaForwardingAddress (string) --

      Server-generated email forwarding address for receiving MFA codes.

• documents (list) --

  The list of documents that provide context for the pentest.

  • (dict) --

    Represents a document that provides context for security testing.

    • s3Location (string) --

      The Amazon S3 location of the document.

    • artifactId (string) --

      The unique identifier of the artifact associated with the document.

    • integratedDocument (dict) --

      A reference to a document in an integrated third-party provider.

      • integrationId (string) -- [REQUIRED]

        The identifier of the integration that provides access to the document.

      • resourceId (string) -- [REQUIRED]

        The provider-specific resource identifier for the document.

• sourceCode (list) --

  The list of source code repositories to analyze during the pentest.

  • (dict) --

    Represents a source code repository used for security analysis during a pentest.

    • s3Location (string) --

      The Amazon S3 location of the source code repository archive.

• integratedRepositories (list) --

  The list of integrated repositories associated with the pentest.

  • (dict) --

    Represents a code repository that is integrated with the service through a third-party provider.

    • integrationId (string) -- [REQUIRED]

      The unique identifier of the integration that provides access to the repository.

    • providerResourceId (string) -- [REQUIRED]

      The provider-specific resource identifier for the repository.

    • branch (string) --

      An optional override for the repository branch.

type excludeRiskTypes:

list

param excludeRiskTypes:

The updated list of risk types to exclude from the pentest.

• (string) --

  Type of security risk.

type serviceRole:

string

param serviceRole:

The updated IAM service role for the pentest.

type logConfig:

dict

param logConfig:

The updated CloudWatch Logs configuration for the pentest.

• logGroup (string) --

  The name of the CloudWatch log group.

• logStream (string) --

  The name of the CloudWatch log stream.

type vpcConfig:

dict

param vpcConfig:

The updated VPC configuration for the pentest.

• vpcArn (string) --

  The Amazon Resource Name (ARN) of the VPC.

• securityGroupArns (list) --

  The Amazon Resource Names (ARNs) of the security groups for the VPC configuration.

  • (string) --

    ARN or ID of a security group.

• subnetArns (list) --

  The Amazon Resource Names (ARNs) of the subnets for the VPC configuration.

  • (string) --

    ARN or ID of a subnet.

type networkTrafficConfig:

dict

param networkTrafficConfig:

The updated network traffic configuration for the pentest.

• rules (list) --

  The list of network traffic rules that control which URLs are allowed or denied during testing.

  • (dict) --

    A rule that controls network traffic during penetration testing by allowing or denying traffic to specific URL patterns.

    • effect (string) --

      The effect of the rule. Valid values are ALLOW and DENY.

    • pattern (string) --

      The URL pattern to match for the rule.

    • networkTrafficRuleType (string) --

      The type of the network traffic rule. Currently, only URL is supported.

• customHeaders (list) --

  The list of custom HTTP headers to include in network traffic during testing.

  • (dict) --

    A custom HTTP header to include in network traffic during penetration testing.

    • name (string) --

      The name of the custom header.

    • value (string) --

      The value of the custom header.

type codeRemediationStrategy:

string

param codeRemediationStrategy:

The updated code remediation strategy for the pentest.

type disableManagedSkills:

list

param disableManagedSkills:

The updated list of managed skills to disable for this pentest. Valid values include FINDING_PERSONALIZATION and LOGIN_OPTIMIZATION.

• (string) --

  Type of managed skill that can be enabled or disabled for a pentest.

type maxTaskHours:

float

param maxTaskHours:

The updated maximum number of billable task hours allowed for jobs started from this pentest.

rtype:

dict

returns:

Response Syntax

{
    'pentestId': 'string',
    'title': 'string',
    'createdAt': datetime(2015, 1, 1),
    'updatedAt': datetime(2015, 1, 1),
    'assets': {
        'endpoints': [
            {
                'uri': 'string'
            },
        ],
        'actors': [
            {
                'identifier': 'string',
                'uris': [
                    'string',
                ],
                'authentication': {
                    'providerType': 'SECRETS_MANAGER'|'AWS_LAMBDA'|'AWS_IAM_ROLE'|'AWS_INTERNAL',
                    'value': 'string'
                },
                'description': 'string',
                'enableEmailMfa': True|False,
                'mfaForwardingAddress': 'string'
            },
        ],
        'documents': [
            {
                's3Location': 'string',
                'artifactId': 'string',
                'integratedDocument': {
                    'integrationId': 'string',
                    'resourceId': 'string'
                }
            },
        ],
        'sourceCode': [
            {
                's3Location': 'string'
            },
        ],
        'integratedRepositories': [
            {
                'integrationId': 'string',
                'providerResourceId': 'string',
                'branch': 'string'
            },
        ]
    },
    'excludeRiskTypes': [
        'CROSS_SITE_SCRIPTING'|'DEFAULT_CREDENTIALS'|'INSECURE_DIRECT_OBJECT_REFERENCE'|'PRIVILEGE_ESCALATION'|'SERVER_SIDE_TEMPLATE_INJECTION'|'COMMAND_INJECTION'|'CODE_INJECTION'|'SQL_INJECTION'|'ARBITRARY_FILE_UPLOAD'|'INSECURE_DESERIALIZATION'|'LOCAL_FILE_INCLUSION'|'INFORMATION_DISCLOSURE'|'PATH_TRAVERSAL'|'SERVER_SIDE_REQUEST_FORGERY'|'JSON_WEB_TOKEN_VULNERABILITIES'|'XML_EXTERNAL_ENTITY'|'FILE_DELETION'|'OTHER'|'GRAPHQL_VULNERABILITIES'|'BUSINESS_LOGIC_VULNERABILITIES'|'CRYPTOGRAPHIC_VULNERABILITIES'|'DENIAL_OF_SERVICE'|'FILE_ACCESS'|'FILE_CREATION'|'DATABASE_MODIFICATION'|'DATABASE_ACCESS'|'OUTBOUND_SERVICE_REQUEST'|'UNKNOWN',
    ],
    'serviceRole': 'string',
    'logConfig': {
        'logGroup': 'string',
        'logStream': 'string'
    },
    'agentSpaceId': 'string'
}

Response Structure

• (dict) --

  Output for the UpdatePentest operation.

  • pentestId (string) --

    The unique identifier of the pentest.

  • title (string) --

    The title of the pentest.

  • createdAt (datetime) --

    The date and time the pentest was created, in UTC format.

  • updatedAt (datetime) --

    The date and time the pentest was last updated, in UTC format.

  • assets (dict) --

    The assets included in the pentest.

    • endpoints (list) --

      The list of endpoints to test during the pentest.

      • (dict) --

        Represents a target endpoint for penetration testing.

        • uri (string) --

          The URI of the endpoint.

    • actors (list) --

      The list of actors used during penetration testing.

      • (dict) --

        Represents an actor used during penetration testing. An actor defines a user or entity that interacts with the target application, including authentication credentials and target URIs.

        • identifier (string) --

          The unique identifier for the actor.

        • uris (list) --

          The list of URIs that the actor targets during testing.

          • (string) --

        • authentication (dict) --

          The authentication configuration for the actor.

          • providerType (string) --

            The type of authentication provider. Valid values include SECRETS_MANAGER, AWS_LAMBDA, AWS_IAM_ROLE, and AWS_INTERNAL.

          • value (string) --

            The authentication value, such as a secret ARN, Lambda function ARN, or IAM role ARN, depending on the provider type.

        • description (string) --

          A description of the actor.

        • enableEmailMfa (boolean) --

          Whether email-based MFA is enabled for this actor.

        • mfaForwardingAddress (string) --

          Server-generated email forwarding address for receiving MFA codes.

    • documents (list) --

      The list of documents that provide context for the pentest.

      • (dict) --

        Represents a document that provides context for security testing.

        • s3Location (string) --

          The Amazon S3 location of the document.

        • artifactId (string) --

          The unique identifier of the artifact associated with the document.

        • integratedDocument (dict) --

          A reference to a document in an integrated third-party provider.

          • integrationId (string) --

            The identifier of the integration that provides access to the document.

          • resourceId (string) --

            The provider-specific resource identifier for the document.

    • sourceCode (list) --

      The list of source code repositories to analyze during the pentest.

      • (dict) --

        Represents a source code repository used for security analysis during a pentest.

        • s3Location (string) --

          The Amazon S3 location of the source code repository archive.

    • integratedRepositories (list) --

      The list of integrated repositories associated with the pentest.

      • (dict) --

        Represents a code repository that is integrated with the service through a third-party provider.

        • integrationId (string) --

          The unique identifier of the integration that provides access to the repository.

        • providerResourceId (string) --

          The provider-specific resource identifier for the repository.

        • branch (string) --

          An optional override for the repository branch.

  • excludeRiskTypes (list) --

    The list of risk types excluded from the pentest.

    • (string) --

      Type of security risk.

  • serviceRole (string) --

    The IAM service role used for the pentest.

  • logConfig (dict) --

    The CloudWatch Logs configuration for the pentest.

    • logGroup (string) --

      The name of the CloudWatch log group.

    • logStream (string) --

      The name of the CloudWatch log stream.

  • agentSpaceId (string) --

    The unique identifier of the agent space that contains the pentest.