AWSherlock · Security report

Scan overview

Account{{ report.metadata.account_id }}

Collected at{{ report.metadata.started_at }}

Configured region{% if report.metadata.regions is defined %}{{ report.metadata.regions | join(', ') }}{% else %}{{ report.metadata.region or 'Not configured / global services' }}{% endif %}

Scan ID{{ report.metadata.scan_id }}

{% if report.metadata.accounts is defined %}

Organization accounts

{% for account in report.metadata.accounts %}{% else %}{% endfor %}

Account	Name	State	Scan status
{{ account.account_id }}	{{ account.name }}	{{ account.state }}	{{ account.scan_status }}
No accounts discovered. Review discovery coverage.

{% endif %} {% if report.summary.incomplete %}{% endif %}

Resources{{ report.summary.resources }}

Checks evaluated{{ report.summary.checks_evaluated }}

Findings{{ report.summary.findings }}

Severity distribution

{% for severity, count in report.summary.severity.items() %}

{{ severity }}{{ count }}

{% endfor %}

Findings

{% if report.identities is defined %}

Identity governance

AI declarations, workload bindings, configured trust and observed callers are separate evidence. Unknown attribution does not establish approval or safety.

{% for identity in report.identities %}{% endfor %}

Account / identity	AI attribution	Approval	Observed connection	Evidence
{{ identity.account_id }} {{ identity.name }} {{ identity.type }} / {{ identity.evaluation_scope }}	{{ identity.ai_attribution }} {{ identity.classification_source }}{% if identity.shared_declared %} Shared identity declared; individual actor unresolved{% endif %}	{{ identity.approval_status }}	{{ identity.observed_mechanisms \| join(', ') or 'Unknown / not observed' }}	Review identity evidence {{ identity \| tojson(indent=2) }}

{% endif %}

{% for finding in report.findings %}

{{ finding.severity }}{{ finding.title }}{{ finding.id }} · {{ finding.service }} · {{ finding.resource_id }}

Account {{ finding.account_id }} · Region {{ finding.region or 'Global' }}
{{ finding.resource_arn or finding.resource_id }}

Evidence

{{ finding.evidence | tojson(indent=2) }}

Risk

Remediation

{% if finding.references %}

References

{{ reference }}

{% endif %}

{% endfor %}

{% if not report.findings %}

No findings were produced by the evaluated checks. Review scan coverage before drawing conclusions.

{% endif %}

Scan coverage · {{ report.coverage | length }} account / service entries

{% if report.metadata.regions is defined %}{% endif %}{% for entry in report.coverage %}{% if report.metadata.regions is defined %}{% endif %}{% endfor %}

Coverage of the selected checks at collection time. COMPLETE describes evaluation coverage, not a secure account.
Account / Service	Region / Scope	Status	Resources	Evaluated	Not scanned	Issues
{{ entry.account_id }} / {{ entry.service }}	{{ entry.region \| default(none) or entry.scope \| default('global') }}	{{ entry.status }}	{{ entry.resources }}	{{ entry.evaluated }}	{{ entry.not_scanned }}	{% if entry.issues %} {{ entry.issues \| length }} issue(s) {% for issue in entry.issues %} {{ issue.resource_id or 'Account' }} · {{ issue.operation }}: {{ issue.message }} {% endfor %} {% else %}No collection errors{% endif %}