Retrieving Information About the Specified Finding

Function

This API is used to retrieve information about the specified finding.

Authorization Information

Each account root user has all the permissions required to call all APIs, but IAM users must be assigned the following required identity policy-based permissions. For details about the required permissions, see Permissions Policies and Supported Actions.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
AccessAnalyzer:analyzer:getFinding	Read	analyzer *	g:ResourceTag/<tag-key>	-	-

URI

GET /v5/analyzers/{analyzer_id}/findings/{finding_id}

**Table 1** Path Parameters
Parameter	Mandatory	Type	Description
analyzer_id	Yes	String	Definition: Unique identifier of an analyzer. You can call the ListAnalyzers API to obtain the analyzer ID. The response parameters of this API return an analyzer list. The id field of each analyzer object is the analyzer ID. Range: 1 to 36 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed.
finding_id	Yes	String	Definition: Unique identifier of a finding. You can call the ListFindings API to retrieve the analysis finding list generated by a specified analyzer. The response of this API contains an analysis result list. Each analysis result object in the list contains a unique id field, which is the analysis result ID. Range: 1 to 36 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed.

Request Parameters

None

Response Parameters

Status code: 200

**Table 2** Response body parameters
Parameter	Type	Description
finding	Finding object	Definition: Findings. Range: N/A

**Table 3** Finding
Parameter	Type	Description
action	Array of strings	Definition: Action that can be used by external principals. Range: N/A
analyzed_at	String	Definition: Time when resources were analyzed. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A
condition	Array of FindingCondition objects	Definition: Condition that generates findings in the policy statement. Range: N/A
created_at	String	Definition: Time when the findings were generated. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A
finding_details	Array of FindingDetails objects	Definition: Finding details. Range: N/A
finding_type	String	Definition: Finding type. Range: external_access: external access privilege_escalation: privilege escalation unused_iam_user_access_key: unused access key unused_iam_user_password: unused password unused_permission: unused permission unused_iam_agency: unused agency iam_bp_root_user_has_access_key: an AK/SK pair is bound to the root user iam_bp_access_api_with_password: APIs access using passwords iam_bp_login_protection_disabled: login protection disabled iam_bp_mfa_unconfigured: MFA not added iam_bp_assign_high_risk_sys_policy_or_role_to_user: high-risk system-defined policies or roles attached to users iam_bp_attach_high_risk_sys_identity_policy_to_user: high-risk system-defined identity policies attached to users iam_bp_assign_high_risk_sys_policy_or_role_to_agency: high-risk system-defined policies or roles attached to agencies iam_bp_attach_high_risk_sys_identity_policy_to_agency: high-risk system-defined identity policies attached to agencies
id	String	Definition: Unique identifier of a finding. Range: 1 to 36 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed.
is_public	Boolean	Definition: Whether the policy that generates findings allows public access to resources. Range: N/A
principal	FindingPrincipal object	Definition: External principal that accesses resources in the trusted zone. Range: N/A
resource	String	Definition: Unique identifier of a resource. Range: N/A
resource_id	String	Definition: Unique identifier of a resource. Range: 1 to 36 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed.
resource_owner_account	String	Definition: ID of the account that owns resources. Range: 1 to 36 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed.
resource_project_id	String	Definition: Project ID of a resource. Range: A maximum of 36 characters. Only letters, digits, underscores (_), and hyphens (-) are allowed.
resource_type	String	Definition: Type of a resource. Range: iam:agency: IAM agency iam:user: IAM user kms:cmk: DEW key obs:bucket: OBS bucket swr:repo: SWR image repository cbr:backup: CBR backup ims:image: IMS image
sources	Array of strings	Definition: Source of findings, indicating how to grant access that generates the findings. Range: bucket_acl: bucket ACL bucket_policy: bucket policy
status	String	Definition: Finding status. Range: active archived resolved
updated_at	String	Definition: Time when the findings were updated. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A

**Table 4** FindingDetails
Parameter	Type	Description
external_access_details	ExternalAccessDetails object	Definition: External access findings. Range: N/A
privilege_escalation_details	PrivilegeEscalationDetails object	Definition: Finding details for privilege escalation access. Range: N/A
unused_iam_user_access_key_details	UnusedIamUserAccessKeyDetails object	Definition: Finding details for unused keys. Range: N/A
unused_iam_user_password_details	UnusedIamUserPasswordDetails object	Definition: Finding details for unused user passwords. Range: N/A
unused_permission_details	UnusedPermissionDetails object	Definition: Finding details for unused permissions. Range: N/A
unused_iam_agency_details	UnusedIamAgencyDetails object	Definition: Finding details for unused agencies. Range: N/A
iam_bp_root_user_has_access_key_details	IamBpRootUserHasAccessKeyDetails object	Definition: Finding details for root users who have access keys. Range: N/A
iam_bp_access_api_with_password_details	IamBpAccessApiWithPasswordDetails object	Definition: Finding details for API access with passwords. Range: N/A
iam_bp_login_protection_disabled_details	IamBpLoginProtectionDisabledDetails object	Definition: Finding details for disabled login protection. Range: N/A
iam_bp_mfa_unconfigured_details	IamBpMfaUnconfiguredDetails object	Definition: Finding details for unbound MFA. Range: N/A
iam_bp_assign_high_risk_sys_policy_or_role_to_user_details	IamBpAssignHighRiskSysPolicyOrRoleToUserDetails object	Definition: Finding details for attaching high-risk system permissions or roles to IAM users. Range: N/A
iam_bp_attach_high_risk_sys_identity_policy_to_user_details	IamBpAttachHighRiskSysIdentityPolicyToUserDetails object	Definition: Finding details for attaching high-risk system identity policies to IAM users. Range: N/A
iam_bp_assign_high_risk_sys_policy_or_role_to_agency_details	IamBpAssignHighRiskSysPolicyOrRoleToAgencyDetails object	Definition: Finding details for attaching high-risk system policies or roles to IAM agencies. Range: N/A
iam_bp_attach_high_risk_sys_identity_policy_to_agency_details	IamBpAttachHighRiskSysIdentityPolicyToAgencyDetails object	Definition: Finding details for attaching high-risk system identity policies to IAM agencies. Range: N/A

**Table 5** ExternalAccessDetails
Parameter	Type	Description
action	Array of strings	Definition: Action that can be used by external principals. Range: N/A
condition	Array of FindingCondition objects	Definition: Condition that generates findings in the policy statement. Range: N/A
is_public	Boolean	Definition: Whether the policy that generates findings allows public access to resources. Range: N/A
principal	FindingPrincipal object	Definition: External principal that accesses resources in the trusted zone. Range: N/A
sources	Array of strings	Definition: Source of findings, indicating how to grant access that generates the findings. Range: bucket_acl: bucket ACL bucket_policy: bucket policy

**Table 6** FindingCondition
Parameter	Type	Description
key	String	Definition: Identifier or name of the condition key. Range: N/A
value	String	Definition: Value of the condition key. Range: N/A

**Table 7** PrivilegeEscalationDetails
Parameter	Type	Description
actions	Array of strings	Definition: Specified set of operations to be analyzed. Range: N/A
resource	String	Definition: Unique identifier of a resource. Range: N/A
principal	FindingPrincipal object	Definition: External principal that accesses resources in the trusted zone. Range: N/A
active_action	String	Definition: Operations that can be triggered through privilege escalation access paths. Range: N/A
path	Array of PrivilegeEscalationStep objects	Definition: Step of the privilege escalation access path. Range: N/A

**Table 8** PrivilegeEscalationStep
Parameter	Type	Description
principal	FindingPrincipal object	Definition: External principal that accesses resources in the trusted zone. Range: N/A
resources	Array of strings	Definition: Resources involved in this step. Range: N/A
action	String	Definition: Operations involved in this step. Range: N/A

**Table 9** UnusedIamUserAccessKeyDetails
Parameter	Type	Description
access_key_id	String	Definition: Unique ID of a user access key. Range: N/A
last_accessed	String	Definition: Last access time of a user access key. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A

**Table 10** UnusedIamUserPasswordDetails
Parameter	Type	Description
last_accessed	String	Definition: Last access time of a user password. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A

**Table 11** UnusedPermissionDetails
Parameter	Type	Description
service	String	Definition: Name of the cloud service that the permission belongs to. Range: N/A
last_accessed	String	Definition: Last access time of the cloud service. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A
actions	Array of UnusedAction objects	Definition: Unused actions. Range: N/A

**Table 12** UnusedAction
Parameter	Type	Description
action	String	Definition: Authorization item name. Range: N/A
last_accessed	String	Definition: Last access time of the authorization item. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A
role_sources	Array of strings	Definition: List of role sources accessed through this operation. Range: A maximum of 3 items are supported.
identity_policy_sources	Array of strings	Definition: List of identity policy sources accessed through this operation. Range: A maximum of 3 items are supported.

**Table 13** UnusedIamAgencyDetails
Parameter	Type	Description
last_accessed	String	Definition: Last access time of the agency. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A

**Table 14** IamBpRootUserHasAccessKeyDetails
Parameter	Type	Description
access_key_id	String	Definition: Unique ID of a user access key. Range: 1 to 40 characters.
last_accessed	String	Definition: Last access time of a user access key. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A
created_at	String	Definition: Time when a user access key was created. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A

**Table 15** IamBpAccessApiWithPasswordDetails
Parameter	Type	Description
user_id	String	Definition: Unique ID of the user. Only letters, digits, underscores (_), and hyphens (-) are allowed. Range: 1 to 36 characters.
last_access_api_with_pwd_at	String	Definition: Last time when a user accessed APIs with a password. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A
user_created_at	String	Definition: Time when the user was created. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A

**Table 16** IamBpLoginProtectionDisabledDetails
Parameter	Type	Description
user_id	String	Definition: Unique ID of the user. Only letters, digits, underscores (_), and hyphens (-) are allowed. Range: 1 to 36 characters.
user_created_at	String	Definition: Time when the user was created. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A

**Table 17** IamBpMfaUnconfiguredDetails
Parameter	Type	Description
user_id	String	Definition: Unique ID of the user. Only letters, digits, underscores (_), and hyphens (-) are allowed. Range: 1 to 36 characters.
user_created_at	String	Definition: Time when the user was created. The UTC+0 time zone is used. The format is yyyy-MM-ddTHH:mm:ss.SSSZ, for example, 2023-09-07T07:51:10.502Z. Range: N/A

**Table 18** IamBpAssignHighRiskSysPolicyOrRoleToUserDetails
Parameter	Type	Description
user_id	String	Definition: Unique ID of the user. Only letters, digits, underscores (_), and hyphens (-) are allowed. Range: 1 to 36 characters.
permission_name	String	Definition: Permission name. Range: N/A

**Table 19** IamBpAttachHighRiskSysIdentityPolicyToUserDetails
Parameter	Type	Description
user_id	String	Definition: Unique ID of the user. Only letters, digits, underscores (_), and hyphens (-) are allowed. Range: 1 to 36 characters.
policy_name	String	Definition: Policy name. Range: N/A

**Table 20** IamBpAssignHighRiskSysPolicyOrRoleToAgencyDetails
Parameter	Type	Description
agency_id	String	Definition: Unique ID of the agency. Only letters, digits, underscores (_), and hyphens (-) are allowed. Range: 1 to 36 characters.
permission_name	String	Definition: Permission name. Range: N/A

**Table 21** IamBpAttachHighRiskSysIdentityPolicyToAgencyDetails
Parameter	Type	Description
agency_id	String	Definition: Unique ID of the agency. Only letters, digits, underscores (_), and hyphens (-) are allowed. Range: 1 to 36 characters.
policy_name	String	Definition: Policy name. Range: N/A

**Table 22** FindingPrincipal
Parameter	Type	Description
identifier	String	Definition: Identifier of an external principal. Range: N/A
type	String	Definition: Type of an external principal. Range: all_principal: all external principals account: account all_user_in_account: all users under an account all_agency_in_account: all agencies under an account all_identity_provider_in_account: all identity providers under an account specific_user: specific user specific_agency: specific agency specific_group: specific user group specific_identity_provider: specific identity provider

Example Requests

Retrieving information about the specified finding

GET https://{hostname}/v5/analyzers/{analyzer_id}/findings/{finding_id}

Example Responses

Status code: 200

{
  "finding" : {
    "action" : [ "obs:bucket:listBucket" ],
    "analyzed_at" : "2023-09-07T08:04:41.698Z",
    "condition" : [ {
      "key" : "g:PrincipalOrgId",
      "value" : "org_id"
    } ],
    "created_at" : "2023-09-07T08:04:41.698Z",
    "id" : "{finding_id}",
    "is_public" : false,
    "principal" : {
      "identifier" : "{domain_id}",
      "type" : "account"
    },
    "resource" : "obs:{region_id}::bucket:{bucket_name}",
    "resource_owner_account" : "{domain_id}",
    "resource_type" : "obs:bucket",
    "sources" : [ "bucket_policy" ],
    "status" : "active",
    "updated_at" : "2023-09-07T08:04:41.698Z"
  }
}