rage.fail

aws-detective-graph-investigation-data

Detective's behavior graph aggregates IAM principal, access-key ID, IP, Kubernetes, process, and service activity; it does not normally retain secret key values.

awshigh service: aws:detective emits CanReadData

Where it sits

location	`ListIndicators.Indicators[].IndicatorDetail`
location kind	`data_record`
data kinds	`access_key` `pii` `sensitive_data` `customer_data`
emits edge	`CanReadData`
service	Detective (aws:detective)

Collection recipe

access mode	`read_api`
operation	`ListIndicators`
response path	`Indicators[].IndicatorDetail`
encoding	`json`
params	`{"GraphArn": "\u003cgraph-arn\u003e", "InvestigationId": "\u003cinvestigation-id\u003e"}`

Required permissions

detective:ListIndicators

References

https://docs.aws.amazon.com/cli/latest/reference/detective/list-indicators.html
https://docs.aws.amazon.com/service-authorization/latest/reference/service-reference.html
https://servicereference.us-east-1.amazonaws.com/v1/detective/detective.json