awssecurityhub

type AssetSync struct {
	types.OperationSettings
}

type AssumeRoleCredentialSchema struct {
	// RoleARN is the cross-account IAM role ARN Openlane should assume in the tenant environment
	RoleARN string `` /* 166-byte string literal not displayed */
	// ExternalID is the external ID required in the tenant role trust policy
	ExternalID string `` /* 172-byte string literal not displayed */
	// HomeRegion is the AWS region where Security Hub cross-region aggregation is managed
	HomeRegion string `` /* 175-byte string literal not displayed */
	// AccountID is the AWS account ID, derived from RoleARN when not provided
	AccountID string `` /* 138-byte string literal not displayed */
	// AccountScope controls whether collection covers all delegated accounts or a subset
	AccountScope string `` /* 173-byte string literal not displayed */
	// AccountIDs lists the specific AWS account IDs used when account scope is specific
	AccountIDs []string `json:"accountIds,omitempty"      jsonschema:"title=Account IDs,description=Required when accountScope is specific."`
	// LinkedRegions limits findings collection to the listed source regions
	LinkedRegions []string `` /* 144-byte string literal not displayed */
	// SessionName is an optional STS session name override
	SessionName string `json:"sessionName,omitempty"     jsonschema:"title=Session Name,description=Optional STS session name override."`
	// SessionDuration is an optional STS session duration override
	SessionDuration string `json:"sessionDuration,omitempty" jsonschema:"title=Session Duration,description=Optional STS session duration (e.g. 1h)."`
}

type CheckSync struct {
	types.OperationSettings
}

type Client struct {
	// Config is the AWS SDK config the service clients are built from
	Config awssdk.Config
	// Scope is the non-secret collection scope of the connection
	Scope CollectionScope
}

type CollectionScope struct {
	// AccountID is the primary AWS account identifier
	AccountID string
	// AccountScope indicates whether collection targets all delegated accounts or a specific set
	AccountScope string
	// AccountIDs lists the explicitly selected AWS account identifiers when account scope is specific
	AccountIDs []string
	// LinkedRegions limits collection to the listed AWS source regions when configured
	LinkedRegions []string
}

type Config struct {
	// AccessKeyID is the AWS access key ID for Openlane's source identity used when assuming cross-account roles
	AccessKeyID string `json:"accessKeyId" koanf:"accesskeyid" sensitive:"true"`
	// SecretAccessKey is the AWS secret access key for Openlane's source identity
	SecretAccessKey string `json:"secretAccessKey" koanf:"secretaccesskey" sensitive:"true"`
	// ARN is the Openlane ARN that is used as the Principal that is allowed to use the assume role
	ARN string `json:"arn" koanf:"arn"`
}

type FindingSync struct {
	types.OperationSettings
}

type InstallationMetadata struct {
	// RoleARN is the cross-account IAM role ARN Openlane assumes for this installation
	RoleARN string `json:"roleArn,omitempty" jsonschema:"title=IAM Role ARN"`
	// HomeRegion is the AWS region used for Security Hub aggregation and API calls
	HomeRegion string `json:"homeRegion,omitempty" jsonschema:"title=Home Region"`
	// AccountID is the primary AWS account identifier when supplied during setup
	AccountID string `json:"accountId,omitempty" jsonschema:"title=Account ID"`
	// AccountScope indicates whether collection targets all delegated accounts or a specific set
	AccountScope string `json:"accountScope,omitempty" jsonschema:"title=Account Scope"`
	// AccountIDs lists the explicitly selected AWS account identifiers when account scope is specific
	AccountIDs []string `json:"accountIds,omitempty" jsonschema:"title=Account IDs"`
	// LinkedRegions limits collection to the listed AWS source regions when configured
	LinkedRegions []string `json:"linkedRegions,omitempty" jsonschema:"title=Linked Regions"`
}

type ServiceAccountCredentialSchema struct {
	// AccessKeyID is an service account credential when runtime IAM is unavailable
	AccessKeyID string `` /* 139-byte string literal not displayed */
	// SecretAccessKey is the AWS secret access key for static credentials
	SecretAccessKey string `json:"secretAccessKey" jsonschema:"required,title=Secret Access Key"`
	// SessionToken is the AWS session token for static credentials
	SessionToken string `json:"sessionToken,omitempty"    jsonschema:"title=Session Token"`
	// Region is the AWS region for API calls (e.g. us-east-1)
	Region string `` /* 139-byte string literal not displayed */
}