AWS.Detective reference

AcceptInvitation

Source: src/AWS/Detective/AcceptInvitation.ts

Runtime binding for detective:AcceptInvitation.

Accepts an invitation into an administrator account’s behavior graph — the graph belongs to the admin account, so its ARN arrives at runtime (typically from ListInvitations) rather than from a bound resource. Provide the implementation with Effect.provide(AWS.Detective.AcceptInvitationHttp).

AcceptInvitation: Responding to Invitations

// init — account-level binding, no resource argument
const acceptInvitation = yield* AWS.Detective.AcceptInvitation();

// runtime
yield* acceptInvitation({ GraphArn: invitation.GraphArn! });

BatchGetGraphMemberDatasources

Source: src/AWS/Detective/BatchGetGraphMemberDatasources.ts

Runtime binding for detective:BatchGetGraphMemberDatasources.

Reads per-member data source ingest history for the behavior graph — which packages each member account is contributing and when their ingest state last changed. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.BatchGetGraphMemberDatasourcesHttp).

BatchGetGraphMemberDatasources: Managing Data Source Packages

// init
const batchGetGraphMemberDatasources =
  yield* AWS.Detective.BatchGetGraphMemberDatasources(graph);

// runtime
const { MemberDatasources } = yield* batchGetGraphMemberDatasources({
  AccountIds: ["111122223333"],
});

BatchGetMembershipDatasources

Source: src/AWS/Detective/BatchGetMembershipDatasources.ts

Runtime binding for detective:BatchGetMembershipDatasources.

Reads this account’s data source ingest history across the behavior graphs it is a member of — the member-side view of what each admin’s graph is ingesting from this account. Provide the implementation with Effect.provide(AWS.Detective.BatchGetMembershipDatasourcesHttp).

BatchGetMembershipDatasources: Responding to Invitations

// init — account-level binding, no resource argument
const batchGetMembershipDatasources =
  yield* AWS.Detective.BatchGetMembershipDatasources();

// runtime
const { MembershipDatasources } = yield* batchGetMembershipDatasources({
  GraphArns: [adminGraphArn],
});

CreateMembers

Source: src/AWS/Detective/CreateMembers.ts

Runtime binding for detective:CreateMembers.

Invites accounts into the behavior graph (or auto-enables organization accounts) — the automation hook for onboarding new accounts to Detective as they join the fleet. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.CreateMembersHttp).

CreateMembers: Administering Member Accounts

// init
const createMembers = yield* AWS.Detective.CreateMembers(graph);

// runtime
yield* createMembers({
  Accounts: [{ AccountId: "111122223333", EmailAddress: email }],
  DisableEmailNotification: true,
});

DeleteMembers

Source: src/AWS/Detective/DeleteMembers.ts

Runtime binding for detective:DeleteMembers.

Removes member accounts from the behavior graph — the off-boarding counterpart to CreateMembers when an account leaves the fleet. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.DeleteMembersHttp).

DeleteMembers: Administering Member Accounts

// init
const deleteMembers = yield* AWS.Detective.DeleteMembers(graph);

// runtime
yield* deleteMembers({ AccountIds: ["111122223333"] });

DescribeOrganizationConfiguration

Source: src/AWS/Detective/DescribeOrganizationConfiguration.ts

Runtime binding for detective:DescribeOrganizationConfiguration.

Reads whether new organization accounts are auto-enabled as members of the behavior graph. Callable only by the organization’s delegated Detective administrator account. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.DescribeOrganizationConfigurationHttp).

DescribeOrganizationConfiguration: Organization Administration

// init
const describeOrganizationConfiguration =
  yield* AWS.Detective.DescribeOrganizationConfiguration(graph);

// runtime
const { AutoEnable } = yield* describeOrganizationConfiguration();

DisableOrganizationAdminAccount

Source: src/AWS/Detective/DisableOrganizationAdminAccount.ts

Runtime binding for detective:DisableOrganizationAdminAccount.

Revokes the organization’s delegated Detective administrator. Callable only from the organization management account. Provide the implementation with Effect.provide(AWS.Detective.DisableOrganizationAdminAccountHttp).

DisableOrganizationAdminAccount: Organization Administration

// init — account-level binding, no resource argument
const disableOrganizationAdminAccount =
  yield* AWS.Detective.DisableOrganizationAdminAccount();

// runtime
yield* disableOrganizationAdminAccount();

DisassociateMembership

Source: src/AWS/Detective/DisassociateMembership.ts

Runtime binding for detective:DisassociateMembership.

Removes this account from a behavior graph it previously accepted an invitation to — the member-side exit, mirroring the admin’s DeleteMembers. Provide the implementation with Effect.provide(AWS.Detective.DisassociateMembershipHttp).

DisassociateMembership: Responding to Invitations

// init — account-level binding, no resource argument
const disassociateMembership = yield* AWS.Detective.DisassociateMembership();

// runtime
yield* disassociateMembership({ GraphArn: adminGraphArn });

EnableOrganizationAdminAccount

Source: src/AWS/Detective/EnableOrganizationAdminAccount.ts

Runtime binding for detective:EnableOrganizationAdminAccount.

Designates an organization account as the delegated Detective administrator. Callable only from the organization management account — the org-governance automation hook. Provide the implementation with Effect.provide(AWS.Detective.EnableOrganizationAdminAccountHttp).

EnableOrganizationAdminAccount: Organization Administration

// init — account-level binding, no resource argument
const enableOrganizationAdminAccount =
  yield* AWS.Detective.EnableOrganizationAdminAccount();

// runtime
yield* enableOrganizationAdminAccount({ AccountId: securityAccountId });

GetInvestigation

Source: src/AWS/Detective/GetInvestigation.ts

Runtime binding for detective:GetInvestigation.

Reads a single investigation’s detail — entity, scope window, status, severity, and state — so a triage function can poll a running investigation to completion. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.GetInvestigationHttp).

GetInvestigation: Running Investigations

// init
const getInvestigation = yield* AWS.Detective.GetInvestigation(graph);

// runtime
const detail = yield* getInvestigation({ InvestigationId: id });
if (detail.Status === "SUCCESSFUL") {
  yield* Effect.log(`severity: ${detail.Severity}`);
}

GetMembers

Source: src/AWS/Detective/GetMembers.ts

Runtime binding for detective:GetMembers.

Reads the membership details of specific accounts in the behavior graph — status, volume usage, and per-package ingest states. Unknown accounts come back in UnprocessedAccounts. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.GetMembersHttp).

GetMembers: Administering Member Accounts

// init
const getMembers = yield* AWS.Detective.GetMembers(graph);

// runtime
const { MemberDetails } = yield* getMembers({
  AccountIds: ["111122223333"],
});

Graph

Source: src/AWS/Detective/Graph.ts

A Detective behavior graph — the account/region singleton that enables Amazon Detective. An account can have at most one behavior graph per region, so this resource is a capture-and-restore singleton: adopting a pre-existing graph that Alchemy did not create requires --adopt.

Graph: Enabling Detective

Enable a behavior graph

const graph = yield* Detective.Graph("Graph", {});

Enable with tags

const graph = yield* Detective.Graph("Graph", {
  tags: { team: "security" },
});

ListDatasourcePackages

Source: src/AWS/Detective/ListDatasourcePackages.ts

Runtime binding for detective:ListDatasourcePackages.

Lists the behavior graph’s data source packages (core CloudTrail/VPC Flow, EKS audit, ASFF findings) and their ingest state — audit what Detective is actually ingesting. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.ListDatasourcePackagesHttp).

ListDatasourcePackages: Managing Data Source Packages

// init
const listDatasourcePackages =
  yield* AWS.Detective.ListDatasourcePackages(graph);

// runtime
const { DatasourcePackages } = yield* listDatasourcePackages();

ListIndicators

Source: src/AWS/Detective/ListIndicators.ts

Runtime binding for detective:ListIndicators.

Lists the indicators of compromise a finished investigation surfaced — TTPs, impossible travel, new geolocations, related findings — the raw material for an automated triage report. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.ListIndicatorsHttp).

ListIndicators: Running Investigations

// init
const listIndicators = yield* AWS.Detective.ListIndicators(graph);

// runtime
const { Indicators } = yield* listIndicators({ InvestigationId: id });

ListInvestigations

Source: src/AWS/Detective/ListInvestigations.ts

Runtime binding for detective:ListInvestigations.

Enumerates the behavior graph’s investigations with optional filter and sort criteria — list everything triaged in the last week, or every investigation still ACTIVE. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.ListInvestigationsHttp).

ListInvestigations: Running Investigations

// init
const listInvestigations = yield* AWS.Detective.ListInvestigations(graph);

// runtime
const { InvestigationDetails } = yield* listInvestigations();

ListInvitations

Source: src/AWS/Detective/ListInvitations.ts

Runtime binding for detective:ListInvitations.

Lists open behavior-graph invitations received by this account — the member-account side of the Detective handshake, ready for an automation that auto-accepts invitations from the security account. Provide the implementation with Effect.provide(AWS.Detective.ListInvitationsHttp).

ListInvitations: Responding to Invitations

// init — account-level binding, no resource argument
const listInvitations = yield* AWS.Detective.ListInvitations();

// runtime
const { Invitations } = yield* listInvitations();

ListMembers

Source: src/AWS/Detective/ListMembers.ts

Runtime binding for detective:ListMembers.

Lists the behavior graph’s member accounts — invited and enabled alike — so an admin-account function can audit coverage of the security fleet. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.ListMembersHttp).

ListMembers: Administering Member Accounts

// init
const listMembers = yield* AWS.Detective.ListMembers(graph);

// runtime
const { MemberDetails } = yield* listMembers();

ListOrganizationAdminAccounts

Source: src/AWS/Detective/ListOrganizationAdminAccounts.ts

Runtime binding for detective:ListOrganizationAdminAccounts.

Lists the organization’s delegated Detective administrator account. Callable only from the organization management account. Provide the implementation with Effect.provide(AWS.Detective.ListOrganizationAdminAccountsHttp).

ListOrganizationAdminAccounts: Organization Administration

// init — account-level binding, no resource argument
const listOrganizationAdminAccounts =
  yield* AWS.Detective.ListOrganizationAdminAccounts();

// runtime
const { Administrators } = yield* listOrganizationAdminAccounts();

RejectInvitation

Source: src/AWS/Detective/RejectInvitation.ts

Runtime binding for detective:RejectInvitation.

Rejects an open invitation into an administrator account’s behavior graph — the decline path of the member-account invitation flow. Provide the implementation with Effect.provide(AWS.Detective.RejectInvitationHttp).

RejectInvitation: Responding to Invitations

// init — account-level binding, no resource argument
const rejectInvitation = yield* AWS.Detective.RejectInvitation();

// runtime
yield* rejectInvitation({ GraphArn: invitation.GraphArn! });

StartInvestigation

Source: src/AWS/Detective/StartInvestigation.ts

Runtime binding for detective:StartInvestigation.

Kicks off a Detective investigation into an IAM user or role over a time window — the programmatic version of the console’s “Run investigation” button. A security-automation function can trigger triage the moment a GuardDuty finding lands. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.StartInvestigationHttp).

StartInvestigation: Running Investigations

// init — bind the operation to the behavior graph
const startInvestigation = yield* AWS.Detective.StartInvestigation(graph);

// runtime
const { InvestigationId } = yield* startInvestigation({
  EntityArn: suspiciousRoleArn,
  ScopeStartTime: new Date(Date.now() - 24 * 60 * 60 * 1000),
  ScopeEndTime: new Date(),
});

StartMonitoringMember

Source: src/AWS/Detective/StartMonitoringMember.ts

Runtime binding for detective:StartMonitoringMember.

Re-enables data ingest for a member account that was accepted but is ACCEPTED_BUT_DISABLED (e.g. it previously blew the graph’s volume limit). The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.StartMonitoringMemberHttp).

StartMonitoringMember: Administering Member Accounts

// init
const startMonitoringMember =
  yield* AWS.Detective.StartMonitoringMember(graph);

// runtime
yield* startMonitoringMember({ AccountId: "111122223333" });

UpdateDatasourcePackages

Source: src/AWS/Detective/UpdateDatasourcePackages.ts

Runtime binding for detective:UpdateDatasourcePackages.

Starts ingest for additional data source packages (e.g. EKS_AUDIT, ASFF_SECURITYHUB_FINDING) on the behavior graph. Enabling a package is irreversible through this API and affects Detective billing. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.UpdateDatasourcePackagesHttp).

UpdateDatasourcePackages: Managing Data Source Packages

// init
const updateDatasourcePackages =
  yield* AWS.Detective.UpdateDatasourcePackages(graph);

// runtime
yield* updateDatasourcePackages({ DatasourcePackages: ["EKS_AUDIT"] });

UpdateInvestigationState

Source: src/AWS/Detective/UpdateInvestigationState.ts

Runtime binding for detective:UpdateInvestigationState.

Moves an investigation between ACTIVE and ARCHIVED — close out a triaged investigation from the same function that opened it. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.UpdateInvestigationStateHttp).

UpdateInvestigationState: Running Investigations

// init
const updateInvestigationState =
  yield* AWS.Detective.UpdateInvestigationState(graph);

// runtime
yield* updateInvestigationState({ InvestigationId: id, State: "ARCHIVED" });

UpdateOrganizationConfiguration

Source: src/AWS/Detective/UpdateOrganizationConfiguration.ts

Runtime binding for detective:UpdateOrganizationConfiguration.

Toggles auto-enable for new organization accounts on the behavior graph. Callable only by the organization’s delegated Detective administrator account. The graph ARN is injected from the bound Graph. Provide the implementation with Effect.provide(AWS.Detective.UpdateOrganizationConfigurationHttp).

UpdateOrganizationConfiguration: Organization Administration

// init
const updateOrganizationConfiguration =
  yield* AWS.Detective.UpdateOrganizationConfiguration(graph);

// runtime
yield* updateOrganizationConfiguration({ AutoEnable: true });