AWS Surgical GRC Controls Tables

Tables

AWSConfigRules

Stores AWS Config rule records including rule name, source owner, evaluation frequency, scope, and input parameters, used to assess compliance of AWS resources against defined configurations.

Name	Type	Description
ConfigRuleArn	string	AWS Config rule ARN. Composite PK with ConfigID.
ConfigID	integer	AWS integration configuration ID. Composite PK.
BatchDate	datetime	UTC timestamp of the ETL batch that wrote this row.
ConfigRuleName	string	Display name of the Config rule.
ConfigRuleId	string	AWS-assigned Config rule identifier.
Description	string	Rule description from AWS.
Region	string	AWS region the rule was collected from.
ConfigRuleState	string	Rule lifecycle state (for example `ACTIVE` or `DELETING`).
MaximumExecutionFrequency	string	How often AWS Config evaluates the rule.
CreatedBy	string	Principal that created the rule.
SourceOwner	string	Who owns the rule source (`AWS` or `CUSTOM_LAMBDA`).
SourceIdentifier	string	Identifier of the managed rule or custom Lambda.

AWSConfigRuleComplianceDetails

Contains per-resource compliance evaluation results for AWS Config rules, capturing whether each resource is compliant, non-compliant, or not applicable at the time of the most recent evaluation.

Name	Type	Description
ID	integer	Identity PK. Composite PK with ConfigID.
ConfigID	integer	AWS integration configuration ID. Composite PK.
BatchDate	datetime	UTC timestamp of the ETL batch that wrote this row.
AWSConfigRuleArn	string	Parent Config rule ARN. FK to `AWSConfigRules`.
ConfigRuleName	string	Name of the Config rule that produced this result.
ResourceID	string	Evaluated AWS resource ID.
ResourceType	string	Evaluated resource type (for example `AWS::S3::Bucket`).
Region	string	AWS region of the evaluation.
ComplianceType	string	Evaluation result (`COMPLIANT`, `NON_COMPLIANT`, `NOT_APPLICABLE`).
ResultRecordedTime	datetime	When AWS Config recorded this result.
ConfigRuleInvokedTime	datetime	When the Config rule last ran for this resource.
Annotation	string	Evaluator annotation explaining the result.
OrderingTimestamp	datetime	Timestamp used to order evaluation results.

AWSCloudTrailTrails

Stores AWS CloudTrail trail records including logging status, S3 delivery configuration, CloudWatch Logs integration, KMS encryption, and multi-region and organization trail settings.

Name	Type	Description
TrailARN	string	CloudTrail trail ARN. Composite PK with ConfigID.
ConfigID	integer	AWS integration configuration ID. Composite PK.
BatchDate	datetime	UTC timestamp of the ETL batch that wrote this row.
S3BucketName	string	S3 bucket that receives trail log files.
S3KeyPrefix	string	Optional S3 key prefix for log files.
SnsTopicName	string	Legacy SNS topic name for trail notifications.
SnsTopicARN	string	SNS topic ARN for trail notifications.
IncludeGlobalServiceEvents	boolean	Whether global service events (`IAM`, `STS`, `CloudFront`) are logged.
IsMultiRegionTrail	boolean	Whether the trail logs events from all regions.
HomeRegion	string	Region that owns the trail; status/selectors must be queried here.
LogFileValidationEnabled	boolean	Whether log-file integrity validation is enabled.
CloudWatchLogsLogGroupArn	string	CloudWatch Logs group ARN receiving trail events.

AWSCloudTrailEventSelectors

Contains classic event selector configurations for AWS CloudTrail trails, defining which management and data events are logged and which resource types are included.

Name	Type	Description
ID	integer	Identity PK. Composite PK with `ConfigID`.
ConfigID	integer	AWS integration configuration ID. Composite PK.
BatchDate	datetime	UTC timestamp of the ETL batch that wrote this row.
AWSCloudTrailTrailARN	string	Parent trail ARN. FK to `AWSCloudTrailTrails`.
ReadWriteType	string	Which API operations are logged (`ReadOnly`, `WriteOnly`, `All`).
IncludeManagementEvents	boolean	Whether management events are included.
DataResourcesSerialized	string	JSON of data-event resource selectors.
ExcludeManagementEventSourcesSerialized	string	JSON of management-event sources excluded from the trail.

AWSCloudTrailAdvancedEventSelectors

Stores advanced event selector configurations for AWS CloudTrail trails, enabling fine-grained field-based filtering of logged events using named selector conditions.

Name	Type	Description
ID	integer	Identity PK. Composite PK with `ConfigID`.
ConfigID	integer	AWS integration configuration ID. Composite PK.
BatchDate	datetime	UTC timestamp of the ETL batch that wrote this row.
AWSCloudTrailTrailARN	string	Parent trail ARN. FK to `AWSCloudTrailTrails`.
Name	string	Advanced event selector name.
FieldSelectorsSerialized	string	JSON of field-based selector conditions.

AWSBackupPlans

Contains AWS Backup plan records defining the backup schedules, retention policies, and advanced settings used to protect AWS resources across a region.

Name	Type	Description
BackupPlanArn	string	Backup plan ARN. Composite PK with `ConfigID`.
ConfigID	integer	AWS integration configuration ID. Composite PK.
BatchDate	datetime	UTC timestamp of the ETL batch that wrote this row.
BackupPlanID	string	AWS Backup plan ID.
BackupPlanName	string	Display name of the backup plan.
VersionID	string	Current backup-plan version ID.
CreationDate	datetime	When the backup plan was created.
CreatorRequestId	string	Idempotency token from plan creation.
LastExecutionDate	datetime	When the plan last ran a backup.
AdvancedBackupSettingsSerialized	string	JSON of advanced backup settings (for example `Windows VSS`).
Region	string	AWS region the plan was collected from.

AWSBackupPlanRules

Stores individual backup rules within an AWS Backup plan, including the schedule expression, target vault, retention lifecycle, continuous backup settings, and cross-region copy actions.

Name	Type	Description
ID	integer	Identity PK. Composite PK with `ConfigID`.
ConfigID	integer	AWS integration configuration ID. Composite PK.
BatchDate	datetime	UTC timestamp of the ETL batch that wrote this row.
RuleName	string	Name of the backup rule.
BackupPlanArn	string	Parent backup plan ARN. FK to `AWSBackupPlans`.
TargetBackupVaultName	string	Vault that stores recovery points created by this rule.
ScheduleExpression	string	Cron/rate expression for the backup schedule.
ScheduleExpressionTimezone	string	Time zone for the schedule expression.
StartWindowMinutes	biginteger	Minutes after the scheduled time in which a backup must start.
CompletionWindowMinutes	biginteger	Minutes allowed for the backup job to complete.
LifecycleDeleteAfterDays	biginteger	Days after creation before the recovery point is deleted.
LifecycleMoveToColdStorageAfterDays	biginteger	Days after creation before the recovery point moves to cold storage.

AWSBackupJobs

Records AWS Backup job executions including the resource being backed up, job state, backup size, bytes transferred, IAM role, and completion timestamps.

Name	Type	Description
BackupJobID	string	Backup job ID. Composite PK with `ConfigID`.
ConfigID	integer	AWS integration configuration ID. Composite PK.
BatchDate	datetime	UTC timestamp of the ETL batch that wrote this row.
AccountID	string	AWS account that owns the job.
BackupVaultName	string	Vault receiving the recovery point.
BackupVaultArn	string	Vault ARN receiving the recovery point.
RecoveryPointArn	string	Recovery point ARN created by this job.
ResourceArn	string	ARN of the resource being backed up.
ResourceName	string	Display name of the backed-up resource.
ResourceType	string	Resource type (for example `EBS`, `RDS`, `S3`).
CreationDate	datetime	When the backup job was created.
CompletionDate	datetime	When the backup job finished.

AWSBackupRecoveryPoints

Contains AWS Backup recovery point records representing completed backups, including storage class, encryption status, lifecycle settings, vault association, and the protected resource details.

Name	Type	Description
RecoveryPointArn	string	Recovery point ARN. Composite PK with `ConfigID`.
ConfigID	integer	AWS integration configuration ID. Composite PK.
BatchDate	datetime	UTC timestamp of the ETL batch that wrote this row.
BackupVaultName	string	Vault that stores this recovery point.
BackupVaultArn	string	Vault ARN that stores this recovery point.
SourceBackupVaultArn	string	Source vault ARN when this recovery point was copied.
ResourceArn	string	ARN of the protected resource.
ResourceName	string	Display name of the protected resource.
ResourceType	string	Resource type of the protected resource.
IamRoleArn	string	IAM role used to create the recovery point.
Status	string	Recovery point status (`COMPLETED`, `PARTIAL`, `EXPIRED`, and so on).
StatusMessage	string	Status or error message for the recovery point.

AWSIAMCredentialReportRows

Stores rows from the AWS IAM credential report, capturing per-user password status, MFA enablement, access key activity and rotation dates, and signing certificate status for compliance auditing.

Name	Type	Description
UserArn	string	IAM user ARN (or root). Composite PK with `ConfigID`.
ConfigID	integer	AWS integration configuration ID. Composite PK.
BatchDate	datetime	UTC timestamp of the ETL batch that wrote this row.
UserName	string	IAM user name, or `<root_account>` for the root user.
UserCreationTime	datetime	When the IAM user was created.
PasswordEnabled	string	Whether a password is enabled (`true`, `false`, or `not_supported` for root).
PasswordLastUsed	datetime	When the password was last used. Null when AWS reports N/A.
PasswordLastChanged	datetime	When the password was last changed.
PasswordNextRotation	datetime	When the password is next due to rotate.
MfaActive	boolean	Whether MFA is enabled for the user.
AccessKey1Active	boolean	Whether access key 1 is active.
AccessKey1LastRotated	datetime	When access key 1 was last rotated.

AWSAccessAnalyzerFindings

Contains AWS IAM Access Analyzer findings identifying resources that are accessible by external principals, including the resource, principal, allowed actions, conditions, and current finding status.

Name	Type	Description
FindingID	string	Access Analyzer finding ID. Composite PK with `ConfigID`.
ConfigID	integer	AWS integration configuration ID. Composite PK.
BatchDate	datetime	UTC timestamp of the ETL batch that wrote this row.
AnalyzerArn	string	ARN of the analyzer that produced the finding.
AnalyzerName	string	Name of the analyzer that produced the finding.
Resource	string	ARN of the resource the finding applies to.
ResourceType	string	Resource type (for example `AWS::S3::Bucket`).
ResourceOwnerAccount	string	AWS account that owns the resource.
IsPublic	boolean	Whether the resource is publicly accessible.
PrincipalSerialized	string	JSON of the external principal granted access.
ActionSerialized	string	JSON of IAM actions covered by the finding.
ConditionSerialized	string	JSON of policy conditions on the finding.

AWSOrganizationPolicies

Stores AWS Organizations Service Control Policy (SCP) records including policy name, description, AWS-managed status, and the full JSON policy document content.

Name	Type	Description
PolicyID	string	Organizations policy ID. Composite PK with `ConfigID`.
ConfigID	integer	AWS integration configuration ID. Composite PK.
BatchDate	datetime	UTC timestamp of the ETL batch that wrote this row.
Arn	string	Policy ARN.
Name	string	Policy display name.
Description	string	Policy description.
Type	string	Policy type. This collector stores `SERVICE_CONTROL_POLICY`.
AwsManaged	boolean	Whether the policy is an AWS-managed SCP.
Content	string	SCP JSON document content.

AWSOrganizationPolicyTargets

Records the organizational targets (roots, OUs, or accounts) to which each AWS Organizations SCP is attached, enabling visibility into the scope of policy enforcement.

Name	Type	Description
ID	integer	Identity PK. Composite PK with `ConfigID`.
ConfigID	integer	AWS integration configuration ID. Composite PK.
BatchDate	datetime	UTC timestamp of the ETL batch that wrote this row.
PolicyID	string	Parent policy ID. FK to `AWSOrganizationPolicies`.
TargetID	string	ID of the attached root, OU, or account.
Arn	string	ARN of the attached target.
Name	string	Display name of the attached target.
Type	string	Target type (`ROOT`, `ORGANIZATIONAL_UNIT`, or `ACCOUNT`).