Macie2 / Client / get_sensitive_data_occurrences_availability

get_sensitive_data_occurrences_availability#

Macie2.Client.get_sensitive_data_occurrences_availability(**kwargs)#

Checks whether occurrences of sensitive data can be retrieved for a finding.

Request Syntax

response = client.get_sensitive_data_occurrences_availability(
    findingId='string'
)

Parameters:

findingId (string) –

[REQUIRED]

The unique identifier for the finding.

Return type:

dict

Returns:

Response Syntax

{
    'code': 'AVAILABLE'|'UNAVAILABLE',
    'reasons': [
        'OBJECT_EXCEEDS_SIZE_QUOTA'|'UNSUPPORTED_OBJECT_TYPE'|'UNSUPPORTED_FINDING_TYPE'|'INVALID_CLASSIFICATION_RESULT'|'OBJECT_UNAVAILABLE'|'ACCOUNT_NOT_IN_ORGANIZATION'|'MISSING_GET_MEMBER_PERMISSION'|'ROLE_TOO_PERMISSIVE'|'MEMBER_ROLE_TOO_PERMISSIVE'|'INVALID_RESULT_SIGNATURE'|'RESULT_NOT_SIGNED',
    ]
}

Response Structure

(dict) –

The request succeeded.
- code (string) –
  
  Specifies whether occurrences of sensitive data can be retrieved for the finding. Possible values are: AVAILABLE, the sensitive data can be retrieved; and, UNAVAILABLE, the sensitive data can’t be retrieved. If this value is UNAVAILABLE, the reasons array indicates why the data can’t be retrieved.
- reasons (list) –
  
  Specifies why occurrences of sensitive data can’t be retrieved for the finding. Possible values are:
  - ACCOUNT_NOT_IN_ORGANIZATION - The affected account isn’t currently part of your organization. Or the account is part of your organization but Macie isn’t currently enabled for the account. You’re not allowed to access the affected S3 object by using Macie.
  - INVALID_CLASSIFICATION_RESULT - There isn’t a corresponding sensitive data discovery result for the finding. Or the corresponding sensitive data discovery result isn’t available in the current Amazon Web Services Region, is malformed or corrupted, or uses an unsupported storage format. Macie can’t verify the location of the sensitive data to retrieve.
  - INVALID_RESULT_SIGNATURE - The corresponding sensitive data discovery result is stored in an S3 object that wasn’t signed by Macie. Macie can’t verify the integrity and authenticity of the sensitive data discovery result. Therefore, Macie can’t verify the location of the sensitive data to retrieve.
  - MEMBER_ROLE_TOO_PERMISSIVE - The trust or permissions policy for the IAM role in the affected member account doesn’t meet Macie requirements for restricting access to the role. Or the role’s trust policy doesn’t specify the correct external ID for your organization. Macie can’t assume the role to retrieve the sensitive data.
  - MISSING_GET_MEMBER_PERMISSION - You’re not allowed to retrieve information about the association between your account and the affected account. Macie can’t determine whether you’re allowed to access the affected S3 object as the delegated Macie administrator for the affected account.
  - OBJECT_EXCEEDS_SIZE_QUOTA - The storage size of the affected S3 object exceeds the size quota for retrieving occurrences of sensitive data from this type of file.
  - OBJECT_UNAVAILABLE - The affected S3 object isn’t available. The object was renamed, moved, deleted, or changed after Macie created the finding. Or the object is encrypted with an KMS key that isn’t available. For example, the key is disabled, is scheduled for deletion, or was deleted.
  - RESULT_NOT_SIGNED - The corresponding sensitive data discovery result is stored in an S3 object that hasn’t been signed. Macie can’t verify the integrity and authenticity of the sensitive data discovery result. Therefore, Macie can’t verify the location of the sensitive data to retrieve.
  - ROLE_TOO_PERMISSIVE - Your account is configured to retrieve occurrences of sensitive data by using an IAM role whose trust or permissions policy doesn’t meet Macie requirements for restricting access to the role. Macie can’t assume the role to retrieve the sensitive data.
  - UNSUPPORTED_FINDING_TYPE - The specified finding isn’t a sensitive data finding.
  - UNSUPPORTED_OBJECT_TYPE - The affected S3 object uses a file or storage format that Macie doesn’t support for retrieving occurrences of sensitive data.
  This value is null if sensitive data can be retrieved for the finding.
  - (string) –
    
    Specifies why occurrences of sensitive data can’t be retrieved for a finding. Possible values are:

Exceptions

Macie2.Client.exceptions.ResourceNotFoundException
Macie2.Client.exceptions.ThrottlingException
Macie2.Client.exceptions.InternalServerException
Macie2.Client.exceptions.AccessDeniedException