AWSherlock
SECURITY ASSESSMENT / {{ report.metadata.version }}

AWS security report

Investigation Leads, observed evidence, relationships, findings, and collection limits.

SCAN COVERAGE{% if report.summary.incomplete %}INCOMPLETE{% else %}COMPLETE{% endif %}COMPLETE means evaluated, not secure

Scan overview

Account
Collected at{{ report.metadata.started_at }}
Configured region{% if report.metadata.regions is defined %}{{ report.metadata.regions | join(', ') }}{% else %}{{ report.metadata.region or 'Not configured / global services' }}{% endif %}
Scan ID{{ report.metadata.scan_id }}
{% if report.summary.incomplete %}{% endif %}
Resources{{ report.summary.resources }}
Checks evaluated{{ report.summary.checks_evaluated }}
Findings{{ report.summary.findings }}
Investigation Leads{{ investigation.leads | length }}

Finding severity

{% for severity, count in report.summary.severity.items() %}
{{ severity }}{{ count }}
{% endfor %}

Investigation priority

{% for priority, count in investigation.priority.items() %}
{{ priority }}{{ count }}
{% endfor %}

Coverage status

{% for status, count in investigation.coverage_status.items() %}
{{ status }}{{ count }}
{% endfor %}

COMPLETE means selected evaluation had sufficient evidence. It is not a security PASS.

Relationship capability

{{ investigation.relationship_capability | upper }}

{% if investigation.relationship_capability == 'supported' %}All rendered scopes support stored relationships.{% elif investigation.relationship_capability == 'unsupported' %}Snapshot relationships are unsupported by the rendered scope schema.{% elif investigation.relationship_capability == 'mixed' %}Some rendered scopes support relationships and some do not.{% else %}Investigation context unavailable; the report cannot determine whether relationships or Leads exist.{% endif %}

{% if report.metadata.accounts is defined %}

Organization accounts

{% for account in report.metadata.accounts %}{% else %}{% endfor %}
AccountNameStateScan status
{{ account.account_id }}{{ account.name }}{{ account.state }}{{ account.scan_status }}
No accounts discovered. Review discovery coverage.
{% endif %}

Investigation Leads

{% if not investigation.available %}
Investigation context unavailable. Findings and coverage remain reportable, but missing presentation context is not evidence that no resources, relationships, or Leads exist.
{% elif investigation.leads %}{% for lead in investigation.leads %}
{{ lead.priority }}{{ lead.title }}{{ lead.pattern_id }} · Investigation priority

Subject

    {% for subject in lead.subjects %}
  • {% if subject.href %}{% endif %}{{ subject.service }}/{{ subject.resource_type }} · {{ subject.resource_id }}{% if subject.href %}{% endif %}{% if subject.reference_kind == 'relationship-only' %} relationship-only reference{% elif subject.reference_kind == 'unresolved' %} unresolved reference{% endif %}{% if subject.runtime_id is defined %}
    Runtime ID {{ subject.runtime_id }} · Version {{ subject.runtime_version }}{% endif %}
    {{ subject.account_id }} · {{ subject.region or 'Global' }}{% if subject.resource_arn %} · {{ subject.resource_arn }}{% endif %}
    • {% endfor %}
{% if lead.related_resources %}

Related resources

{% endif %}

Supporting Findings

Supporting Relationships

Observed

    {% for statement in lead.observed %}
  • {{ statement.code }}
    {{ statement.text }}
    • {% endfor %}

Unknown / not evaluated

    {% for statement in lead.unknown %}
  • {{ statement.code }}
    {{ statement.text }}
    • {% endfor %}

Not proven

    {% for statement in lead.not_proven %}
  • {{ statement.code }}
    {{ statement.text }}
    • {% endfor %}

Why it matters

{{ lead.why_it_matters }}

Next investigative action

{{ lead.next_step }}

{% endfor %} {% else %}
No positive investigation correlations were produced from the available evidence. This does not establish the absence of risk or relationships; review coverage.
{% endif %}

Relationships

{% if not investigation.available %}

Investigation context unavailable; relationship capability cannot be determined.

{% elif investigation.relationship_capability == 'unsupported' %}

Relationships are unsupported by this snapshot version. No absence conclusion can be drawn.

{% elif not investigation.relationships %}

No positive relationships recorded. This is not proof that no relationships exist.

{% else %}
{% for relationship in investigation.relationships %}{% endfor %}
Positive normalized relationships stored in snapshot v2. Missing edges are not negative evidence.
SourceTypeTargetEvidence
{% if relationship.source.href %}{% endif %}{{ relationship.source.service }}/{{ relationship.source.resource_type }}
{{ relationship.source.resource_id }}{% if relationship.source.href %}{% endif %}{% if relationship.source.runtime_id is defined %}
Runtime ID {{ relationship.source.runtime_id }} · Version {{ relationship.source.runtime_version }}{% endif %}
{{ relationship.source.account_id }} · {{ relationship.source.region or 'Global' }}{% if relationship.source.resource_arn %}
{{ relationship.source.resource_arn }}{% endif %}{% if relationship.source.reference_kind == 'relationship-only' %}
relationship-only reference{% endif %}		{{ relationship.type }}{% if relationship.target.href %}{% endif %}{{ relationship.target.service }}/{{ relationship.target.resource_type }}
{{ relationship.target.resource_id }}{% if relationship.target.href %}{% endif %}
{{ relationship.target.account_id }} · {{ relationship.target.region or 'Global' }}{% if relationship.target.resource_arn %}
{{ relationship.target.resource_arn }}{% endif %}
    {% for evidence in relationship.evidence %}
  • {{ evidence.service }} / {{ evidence.fact }} / {{ evidence.operation or 'operation provenance not retained' }}
    • {% endfor %}
{% endif %}

Resources

{% if investigation.available %}
{{ investigation.resources | length }} collected or relationship-referenced identities
{% for resource in investigation.resources %}{% endfor %}
Identity context only. Resource existence does not imply its checks passed.
IdentityKindAccount / RegionRelated evidence
{{ resource.service }}/{{ resource.resource_type }}
{{ resource.resource_id }}{% if resource.runtime_id is defined %}
Runtime ID {{ resource.runtime_id }} · Version {{ resource.runtime_version }}{% endif %}{% if resource.resource_arn %}
{{ resource.resource_arn }}{% endif %}		{{ resource.reference_kind }}{{ resource.account_id }}
{{ resource.region or 'Global' }}		{% for href in resource.finding_hrefs %}Finding {% endfor %}{% for href in resource.relationship_hrefs %}Relationship {% endfor %}{% if not resource.finding_hrefs and not resource.relationship_hrefs %}No linked rendered evidence{% endif %}
{% else %}

Resource presentation context unavailable. No resource absence conclusion can be drawn.

{% endif %}
{% if report.suppressions is defined %}

Suppression audit

{{ report.summary.suppressed }} finding(s) annotated; {{ report.summary.expired_suppressions }} expired record(s). Findings remain visible.

{% for entry in report.suppressions %}{% endfor %}
StatusCheck / resourceOwnerReasonExpires (UTC)
{{ entry.status }}{{ entry.check_id }} / {{ entry.account_id }} / {{ entry.resource_id }}{{ entry.owner }}{{ entry.reason }}{{ entry.expires_on }}
{% endif %}

Findings

{% if report.identities is defined %}

Identity governance

AI declarations, workload bindings, configured trust and observed callers are separate evidence. Unknown attribution does not establish approval or safety.

{% for identity in report.identities %}{% endfor %}
Account / identityAI attributionApprovalObserved connectionEvidence
{{ identity.account_id }}
{{ identity.name }}
{{ identity.type }} / {{ identity.evaluation_scope }}		{{ identity.ai_attribution }}
{{ identity.classification_source }}		{{ identity.approval_status }}{{ identity.observed_mechanisms | join(', ') or 'Unknown / not observed' }}
Review identity evidence
{{ identity | tojson(indent=2) }}
{% endif %}
{{ report.findings | length }} findings
{% for finding in report.findings %}
{{ finding.severity }}{{ finding.title }}{{ finding.id }} · {{ finding.service }} · {{ finding.resource_id }}

{{ finding.description }}

{% if finding.suppression is defined %}

Suppressed until {{ finding.suppression.expires_on }} (UTC) by {{ finding.suppression.owner }}: {{ finding.suppression.reason }}

{% endif %}

Account {{ finding.account_id }} · Region {{ finding.region or 'Global' }}
{% if finding.resource.href %}{% endif %}{{ finding.resource_arn or finding.resource_id }}{% if finding.resource.href %}{% elif finding.resource.ambiguous %} ambiguous resource; not linked{% endif %}

Evidence

{{ finding.evidence | tojson(indent=2) }}

Risk

{{ finding.risk }}

Remediation

{{ finding.remediation }}

{% if finding.references %}

References

    {% for reference in finding.references %}
  • {% if reference.href %}{{ reference.text }}{% else %}{{ reference.text }}{% endif %}
    • {% endfor %}
{% endif %}
{% endfor %}
{% if not report.findings %}
No findings were produced by the evaluated checks. Review scan coverage before drawing conclusions.
{% endif %}
Scan coverage · {{ report.coverage | length }} account / service entries
{% for entry in report.coverage %}{% endfor %}
Coverage of selected checks. COMPLETE describes evaluation coverage, not a secure account or per-check PASS.
Account / ServiceRegion / ScopeStatusResourcesEvaluatedNot scannedIssues
{{ entry.account_id }} / {{ entry.service }}{{ entry.region | default(none) or entry.scope | default('global') }}{{ entry.status }}{{ entry.resources }}{{ entry.evaluated }}{{ entry.not_scanned }}{% if entry.issues %}
{{ entry.issues | length }} issue(s)
    {% for issue in entry.issues %}
  • {{ issue.resource_id or 'Account' }} · {{ issue.operation }}: {{ issue.message }}
    • {% endfor %}
{% else %}No collection errors{% endif %}