AWS EC2

LAST UPDATED: 05/14/2024

Overview

Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides secure, resizable compute capacity in the cloud. Integration with AWS EC2 covers the major operations such as Get EC2 Instance Details, Get Network ACL Details, Take Snapshot, Add Tag, Create Auto Scaling Group, etc.

D3 SOAR is providing REST operations to function with AWS EC2.

For example, you can use AWS EC2 for data integration, data transformation, and data mining purposes, with the capability to scale up the capacity vertically according to your needs.

AWS EC2 is available for use in:

D3 SOAR	V12.7.241+
Category	Cloud Services
Deployment Options	Option II, Option IV

Known Limitations

When you created your AWS account, Amazon set default quotas (also referred to as limits) on resources based on your region. You can view your current limit information in the Amazon EC2 console for resources provided by Amazon EC2 and Amazon VPC, on a per-Region basis.

If you exceed an API throttling limit, you will receive the RequestLimitExceeded error code.

Please refer to Amazon EC2 Service Quotas and View Your Current Limits for more detailed information.

Connection

To connect to AWS EC2 from D3 SOAR, please follow this part to collect the required information below:

Parameter	Description	Example
Region Name	The AWS region name. The default value is US East (N.Virginia): us-east-1.	US East (N. Virginia)
Access Key	The access key for authentication. Please check the Policy Permission for this access key in the AWS Management Console, and ensure that this access key has granted permissions to run all commands in EC2 integration below: Add Tags To EC2 Instances(CreateTags), Block Ips By Vpc Acl(CreateNetworkAclEntry), Create Auto Scaling Group With EC2 Instance(CreateAutoScalingGroup), Get EC2 Instance Details(DescribeInstances), Get Network ACL Details(DescribeNetworkAcls), Get Security Group Details(DescribeSecurityGroups), Quarantine EC2 Instances(ModifyNetworkInterfaceAttribute), Take Snapshot On Volumes(CreateSnapshot), Test Connection(DescribeAccountAttributes), Update Auto Scaling Group(PutScheduledUpdateGroupAction).	AKIAxxxxxxxxxxxx4CYL
Secret Key	The secret key used for authentication.	Xdwchs**E8vjHyIx9x6iPuWdX**DXSdH

Permission Requirements

Each endpoint in the AWS EC2 API requires a certain permission scope. The following are required scopes for the commands in this integration:

Command	Policy
Command	Service	Access level (Actions)
Add Tags To EC2 Instances	EC2	CreateTags
Block Ips By Vpc Acl	EC2	CreateNetworkAclEntry
Create Auto Scaling Group With Ec2 Instance	EC2	CreateAutoScalingGroup
Get EC2 Instance Details	EC2	DescribeInstances
Get Network ACL Details	EC2	DescribeNetworkAcls
Get Security Group Details	EC2	DescribeSecurityGroups
Quarantine EC2 Instances	EC2	ModifyNetworkInterfaceAttribute
Take Snapshot On Volumes	EC2	CreateSnapshot
Update Auto Scaling Group	EC2 Auto Scaling	PutScheduledUpdateGroupAction
Test Connection	EC2	DescribeAccountAttributes

Configuring AWS EC2 to Work with D3 SOAR

If your login user is ready to use (no policy configuration needed), please follow the steps below to obtain your Access Key and Secret Key.

If you would like to configure an account with limited API access, after you login to the AWS console, please follow Create Policy > Create User > Access Key and Secret Key to retrieve the keys.

Sign in to the AWS console with your account credentials.
Click the account icon at the top right corner, then click Security Credentials.
On my security credentials page, under the AWS IAM credentials tab, click the button Create access key to create a new Access Key and Secret Key.

READER NOTE

If you do not have permission to read or create an access key, please ask your administrator for help.

Copy the Access key ID and the Secret access key to use to connect with D3 SOAR.

READER NOTE

The secret access key can only be viewed or downloaded at this time. It is recommended that you promptly download the .csv file and securely store it for future reference. If you lose or forget your secret key, you will not be able to recover it. If you have lost your secret key, you will need to create a new access key and deactivate the old key. You can have a maximum of two access keys (active or inactive) at a time.

Create Policy

Click on Services, which will expand the navigation menu. Then select IAM.
Select Access management, which will open a menu where you can select Policies. Then, click the Create Policy button.
In the Select a service section, click on Service to Choose a service. Please refer to Permission Requirements for the service you have selected. Then click Next.
Search and assign in the Actions allowed section. For example, search for DescribeInstances in the search box, and use the tick box to select this action. Please refer to Permission Requirements for the necessary Access level (Actions). You can specify multiple permissions under the same policy. Then click Next.
Type a name under Policy name. Click Create policy.

Create User

Find the Users tab.
Create user by typing the User name, then click Next.
Choose Attach policies directly. Search for and select the name of the policy you have just created. Then click Next.
Review the details you have entered, and click Create user.

Access Key and Secret Key

Find the user you have created, and click on your user to access the details.
Under the Security credentials tab, click on Create access key.
Create an access key and save the details. Click Done after saving these credentials.

READER NOTE

The secret access key can only be viewed or downloaded at this time. It is recommended that you promptly download the .csv file and securely store it for future reference. If you lose or forget your secret key, you will not be able to recover it. If you have lost your secret key, you will need to create a new access key and deactivate the old key. You can have a maximum of two access keys (active or inactive) at a time.

Configuring D3 SOAR to Work with AWS EC2

Log in to D3 SOAR.
Find the AWS EC2 integration.
1. Navigate to Configuration on the top header menu.
2. Click on the Integration icon on the left sidebar.
3. Type AWS EC2 in the search box to find the integration, then click it to select it.
4. Click + Connection, on the right side of the Connections section. A new connection window will appear.
Configure the following fields to create a connection to AWS EC2.
1. Connection Name: The desired name for the connection.
2. Site: Specifies the site to use the integration connection. Use the drop-down menu to select the site. The Share to Internal Sites option enables all sites defined as internal sites to use the connection. Selecting a specific site will only enable that site to use the connection.
3. Recipient site for events from connections Shared to Internal Sites: This field appears if you selected Share to Internal Sites for Site to let you select the internal site to deploy the integration connection.
4. Agent Name (Optional): Specifies the proxy agent required to build the connection. Use the dropdown menu to select the proxy agent from a list of previously configured proxy agents.
5. Description (Optional): Add your desired description for the connection.
6. Tenant (Optional): When configuring the connection from a master tenant site, you have the option to choose the specific tenant sites you want to share the connection with. Once you enable this setting, you can filter and select the desired tenant sites from the dropdowns to share the connection.
7. Configure User Permissions: Defines which users have access to the connection.
8. Active: Check the tick box to ensure the connection is available for use.
9. System: This section contains the parameters defined specifically for the integration. These parameters must be configured to create the integration connection.
  
  1. Select Region Name from the drop-down menu.
  2. Input the Access Key. Please refer to step 4 of Configuring AWS EC2 to Work with D3 SOAR.
  3. Input the Secret Key from the AWS EC2 platform. Please refer to step 4 of Configuring AWS EC2 to Work with D3 SOAR.
10. Enable Password Vault: An optional feature that allows users to take the stored credentials from their own password vault. Please refer to the password vault connection guide if needed.
11. Connection Health Check: Updates the connection status you have created. A connection health check is done by scheduling the Test Connection command of this integration. This can only be done when the connection is active.
  To set up a connection health check, check the Connection Health Check tickbox. You can customize the interval (minutes) for scheduling the health check. An email notification can be set up after a specified number of failed connection attempts.
Test the connection.
1. Click Test Connection to verify the account credentials and network connection. If the Test Connection Passed alert window appears, the test connection is successful. You will see Passed with a green checkmark appear beside the Test Connection button. If the test connection fails, please check your connection parameters and try again.
2. Click OK to close the alert window.
3. Click + Add to create and add the configured connection.

Commands

AWS EC2 includes the following executable commands for users to set up schedules or create playbook workflows. With the Test Command, you can execute these commands independently for playbook troubleshooting.

Integration API Note

For more information about the AWS EC2 API, please refer to the AWS EC2 API reference.

READER NOTE

Certain permissions are required for each command. Please refer to the Permission Requirements and Configuring AWS EC2 to Work with D3 SOAR for details.

Note for Time-related parameters

The input format of time-related parameters may vary based on your account settings. As a result, the sample data provided in our commands is different from what you see. To set your preferred time format, follow these steps:

Navigate to Configuration > Application Settings. Select Date/Time Format.
Choose your desired date and time format.

After that, you will be able to view your preferred time format when configuring the DateTime input parameters for commands.

Add Tags To EC2 Instances

Adds or overwrites only the specified tags for the specified AWS EC2 resource(s). When you specify an existing tag key, its value gets replaced with the new value. Each resource can have a maximum of 50 tags, with each tag comprising a unique key and an optional value.

READER NOTE

The parameter Instance IDs is required to run this command.

Run the Get EC2 Instance Details command to obtain Instance IDs. Instance IDs can be found in the raw data at the path $.Reservations[*].Instances[0].InstanceId.

Input

Input Parameter

Required/Optional

Description

Example

Instance IDs

Required

The Instance IDs parameter is used to add tags to instances. You can add tags to a maximum of 1000 instances at once. Instance IDs can be obtained using the Get EC2 Instance Details command.

[

"i-040********5c9"

]

Block IPs By Vpc Acl

Blocks the specified IP address(es) by VPC and ACL. You can use this command to block IP(s) in all Network ACLs of the specified VPC. If you want to block IP(s) in specific Network ACLs no matter which VPC, you can run the Block IPs By Acl command.

READER NOTE

Vpc ID is a required parameter to run this command.
- Run the Get Network ACL Details command to obtain Vpc ID. Vpc IDs can be found in the raw data at the path $.NetworkAcls[*].VpcId.
NetworkACL ID is an optional parameter to run this command.
- Run the Get Network ACL Details command to obtain NetworkACL ID. NetworkACL ID can be found in the raw data at the path $.NetworkAcls[*].NetworkAclId.
The input values of Vpc ID and NetworkACL ID must match, which means they must be a pair of values from the same JSON object in the raw data. Otherwise an error of "Cannot find specified Network Acl." will be returned.

Input

Input Parameter	Required/Optional	Description	Example
Vpc ID	Required	The ID of the VPC to which the Network ACL binds. The Vpc ID can be obtained using the Get Network ACL Details command.	vpc-063********ea9
NetworkACL ID	Optional	The IDs of the Network ACLs in which to block IPs. If not specified, then the block rule will be created in all Network ACLs of the specified VPC. NetworkACL IDs can be obtained using the Get Network ACL Details command.	acl-01f********89d
IP Addresses	Required	The IP addresses to be blocked. Use either IPV4 or IPV6 addresses.	["136.243.*.*"]
Priority	Required	The rule numbers for the blocked IPs. ACL entries are processed in ascending order by rule number. The available rule number is a positive integer from 1 to 32766. If there are multiple IP addresses to block, you need to assign a rule number for each IP address, and map IP address and corresponding rule number in the same position of the arrays.	15

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Succeed

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

[
    {
        "IP": "136.243.***.***",
        "outBound": "Succeed",
        "inBound": "Succeed"
    }
]

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

[
    {
        "IP": "136.243.***.***",
        "outBound": "Succeed",
        "inBound": "Succeed"
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "outBound": [
        "Succeed"
    ],
    "inBound": [
        "Succeed"
    ],
    "IPs": [
        "136.243.***.***"
    ]
}

Result

Provides a brief summary of outputs in an HTML formatted table.

SAMPLE DATA

CODE

No Sample Data

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Block Ips By Vpc Acl failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the AWS EC2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 404.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Cannot find specified Network Acl.

Error Sample Data

Block Ips By Vpc Acl failed.

Status Code: 404.

Message: Cannot find specified Network Acl.

Create Auto Scaling Group With EC2 Instance

Creates an Auto Scaling Group based on the specified EC2 Instance with the given Auto Scaling Group name and attributes.

READER NOTE

EC2 Instance ID is a required parameter to run this command.

Run the Get EC2 Instance Details command to obtain EC2 Instance ID. EC2 Instance IDs can be found in the raw data at the path $.Reservations[*].Instances[0].InstanceId.
Please note that the EC2 instance utilized as the basis for the launch configuration must be in 'running' state. The state of the instance can be found in the raw data at the path $.Reservations[*].Instances[0].State.Name.

Input

Input Parameter	Required/Optional	Description	Example
EC2 Instance ID	Required	The ID of the EC2 instance serves as the foundation for creating the launch configuration. Amazon EC2 Auto Scaling uses the configuration values from the specified instance to create a new launch configuration. EC2 Instance IDs can be obtained using the Get EC2 Instance Details command. Please note that the EC2 instance utilized as the basis for the launch configuration must be in 'running' state.	i-072********992d
AutoScalingGroupName	Required	The name of the Auto Scaling group.	API_Create_AutoScalingGroup01
MinSize	Required	The minimum size of the Auto Scaling group.	1
MaxSize	Required	The maximum size of the Auto Scaling group.	4
DesiredCapacity	Optional	The desired capacity represents the Auto Scaling group's initial capacity after the scheduled action is executed, indicating both its initial size and the level of capacity it attempts to maintain. This number must be greater than or equal to MinSize and less than or equal to MaxSize. If you do not specify a desired capacity, the default is MinSize.	2
Configs	Optional	The other configurations for creating Auto Scaling groups in JSON object format. Keys and values must follow the API document: AutoScaling - Boto3 1.34.104 documentation.	JSON { "LaunchConfigurationName": "string", "LaunchTemplate": { "LaunchTemplateId": "string", "LaunchTemplateName": "string", "Version": "string" }, "MixedInstancesPolicy": { "LaunchTemplate": { "LaunchTemplateSpecification": { "LaunchTemplateId": "string", "LaunchTemplateName": "string", "Version": "string" }, "Overrides": [ { "InstanceType": "string", "WeightedCapacity": "string" } ] }, "InstancesDistribution": { "OnDemandAllocationStrategy": "string", "OnDemandBaseCapacity": 123, "OnDemandPercentageAboveBaseCapacity": 123, "SpotAllocationStrategy": "string", "SpotInstancePools": 123, "SpotMaxPrice": "string" } }, "DefaultCooldown": 123, "AvailabilityZones": [ "string" ], "LoadBalancerNames": [ "string" ], "TargetGroupARNs": [ "string" ], "HealthCheckType": "string", "HealthCheckGracePeriod": 123, "PlacementGroup": "string", "VPCZoneIdentifier": "string", "TerminationPolicies": [ "string" ], "NewInstancesProtectedFromScaleIn": true, "LifecycleHookSpecificationList": [ { "LifecycleHookName": "string", "LifecycleTransition": "string", "NotificationMetadata": "string", "HeartbeatTimeout": 123, "DefaultResult": "string", "NotificationTargetARN": "string", "RoleARN": "string" } ], "Tags": [ { "ResourceId": "string", "ResourceType": "string", "Key": "string", "Value": "string", "PropagateAtLaunch": true } ], "ServiceLinkedRoleARN": "string", "MaxInstanceLifetime": 123}

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

{
    "ResponseMetadata": {
        "RequestId": "ea7************79c",
        "HTTPStatusCode": 200,
        "HTTPHeaders": {
            "x-amzn-requestid": "ea7************79c",
            "content-type": "text/xml",
            "content-length": "245",
            "date": "Fri, 19 Jun 2020 02:31:21 GMT"
        },
        "RetryAttempts": 0
    }
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

D3 customizes the context data by adding "EC2InstanceID" and "AutoScalingGroupName" fields.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

{
    "EC2InstanceID": [
        "i-072********992d"
    ],
    "AutoScalingGroupName": [
        "API_Create_AutoScalingGroup01"
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "EC2InstanceID": [
        "i-072********992d"
    ],
    "AutoScalingGroupName": [
        "API_Create_AutoScalingGroup01"
    ]
}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Create Auto Scaling Group With EC2 Instance failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the AWS EC2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Failed to create AutoScalingGroup "**" for the EC2 instance "**".

Error Sample Data

Create Auto Scaling Group With EC2 Instance failed.

Status Code: 400.

Message: Failed to create AutoScalingGroup "****" for the EC2 instance "****".

Get EC2 Instance Details

Describes the specified instances or all instances in the region.

Input

Input Parameter	Required/Optional	Description	Example
InstanceIDs	Optional	The IDs of the EC2 instances to retrieve details of the instance. If not specified, all EC2 instances in the region will be returned.	["i-040********5c9"]

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Succeed

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

{
    "Reservations": [
        {
            "Groups": [],
            "Instances": [
                {
                    "AmiLaunchIndex": 0,
                    "ImageId": "ami-0b8********ded",
                    "InstanceId": "i-040********5c9",
                    "InstanceType": "t2.large",
                    "KeyName": "aws_d3*****-01",
                    "LaunchTime": "2020-02-11 00:59:34+00:00",
                    "Monitoring": {
                        "State": "enabled"
                    },
                    "Placement": {
                        "AvailabilityZone": "us-east-2a",
                        "GroupName": "",
                        "Tenancy": "default"
                    },
                    "Platform": "windows",
                    "PrivateDnsName": "ip-10-10-*-***.us-east-2.compute.internal",
                    "PrivateIpAddress": "10.10.*.***",
                    "ProductCodes": [],
                    "PublicDnsName": "",
                    "PublicIpAddress": "18.223.***.***",
                    "State": {
                        "Code": 16,
                        "Name": "running"
                    },
                    "StateTransitionReason": "",
                    "SubnetId": "subnet-04d********787",
                    "VpcId": "vpc-063********ea9",
                    "Architecture": "x86_64",
                    "BlockDeviceMappings": [
                        {
                            "DeviceName": "/dev/sda1",
                            "Ebs": {
                                "AttachTime": "2019-11-06 00:19:38+00:00",
                                "DeleteOnTermination": true,
                                "Status": "attached",
                                "VolumeId": "vol-067********4f2"
                            }
                        }
                    ],
                    "ClientToken": "",
                    "EbsOptimized": false,
                    "EnaSupport": true,
                    "Hypervisor": "xen",
                    "IamInstanceProfile": {
                        "Arn": "arn:aws:iam::391******688:instance-profile/EnablesEC2ToAccessSystemsManagerRole",
                        "Id": "AIP********PIK"
                    },
                    "NetworkInterfaces": [
                        {
                            "Association": {
                                "IpOwnerId": "amazon",
                                "PublicDnsName": "",
                                "PublicIp": "18.223.***.***"
                            },
                            "Attachment": {
                                "AttachTime": "2019-11-06 00:19:37+00:00",
                                "AttachmentId": "eni-attach-095********942",
                                "DeleteOnTermination": true,
                                "DeviceIndex": 0,
                                "Status": "attached"
                            },
                            "Description": "Primary network interface",
                            "Groups": [
                                {
                                    "GroupName": "isolated*****",
                                    "GroupId": "sg-0c6********e0c"
                                }
                            ],
                            "Ipv6Addresses": [],
                            "MacAddress": "02:08:06:a5:36:c8",
                            "NetworkInterfaceId": "eni-0bd********555",
                            "OwnerId": "391******688",
                            "PrivateIpAddress": "10.10.*.***",
                            "PrivateIpAddresses": [
                                {
                                    "Association": {
                                        "IpOwnerId": "amazon",
                                        "PublicDnsName": "",
                                        "PublicIp": "18.223.***.***"
                                    },
                                    "Primary": true,
                                    "PrivateIpAddress": "10.10.*.***"
                                }
                            ],
                            "SourceDestCheck": true,
                            "Status": "in-use",
                            "SubnetId": "subnet-04d********787",
                            "VpcId": "vpc-063********ea9",
                            "InterfaceType": "interface"
                        }
                    ],
                    "RootDeviceName": "/dev/sda1",
                    "RootDeviceType": "ebs",
                    "SecurityGroups": [
                        {
                            "GroupName": "isolated*****",
                            "GroupId": "sg-0c6********e0c"
                        }
                    ],
                    "SourceDestCheck": true,
                    "Tags": [
                        {
                            "Key": "teste11",
                            "Value": "teste112"
                        },
                        {
                            "Key": "ThisIsTestTagKey",
                            "Value": "ThisIsTestTagValue"
                        },
                        {
                            "Key": "Name",
                            "Value": "AWS-BitCoin2"
                        },
                        {
                            "Key": "SystemType66",
                            "Value": "Server66"
                        },
                        {
                            "Key": "SystemType",
                            "Value": "Server"
                        },
                        {
                            "Key": "D3Cyber_W2016_Bitcoin2",
                            "Value": "D3Cyber_W2016_Bitcoin2"
                        },
                        {
                            "Key": "teste13",
                            "Value": "teste113"
                        }
                    ],
                    "VirtualizationType": "hvm",
                    "CpuOptions": {
                        "CoreCount": 2,
                        "ThreadsPerCore": 1
                    },
                    "CapacityReservationSpecification": {
                        "CapacityReservationPreference": "open"
                    },
                    "HibernationOptions": {
                        "Configured": false
                    },
                    "MetadataOptions": {
                        "State": "applied",
                        "HttpTokens": "optional",
                        "HttpPutResponseHopLimit": 1,
                        "HttpEndpoint": "enabled"
                    }
                }
            ],
            "OwnerId": "391******688",
            "ReservationId": "r-066********134"
        }
    ],
    "ResponseMetadata": {
        "RequestId": "1f6************43c",
        "HTTPStatusCode": 200,
        "HTTPHeaders": {
            "content-type": "text/xml;charset=UTF-8",
            "transfer-encoding": "chunked",
            "vary": "accept-encoding",
            "date": "Tue, 11 Feb 2020 22:56:26 GMT",
            "server": "AmazonEC2"
        },
        "RetryAttempts": 0
    }
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

D3 customizes the Context Data by extracting the data from path $.Reservations in API returned JSON.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

[
    {
        "Instance": "i-040********5c9",
        "NetworkInterfaceIds": [
            "eni-0bd********555"
        ],
        "MacAddresses": [
            "02:08:06:a5:36:c8"
        ],
        "SecurityGroupIDs": [
            {
                "GroupName": "isolated*****",
                "GroupId": "sg-0c6********e0c"
            }
        ],
        "VolumeIDs": [
            "vol-067********4f2"
        ],
        "ImageID": "ami-0b8********ded"
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "Instances": [
        "i-040********5c9"
    ],
    "NetworkInterfaceIds": [
        "eni-0bd********555"
    ],
    "MacAddresses": [
        "02:08:06:a5:36:c8"
    ],
    "SecurityGroupIDs": [{
        "GroupName": "isolated*****",
        "GroupId": "sg-0c6********e0c"
    }],
    "VolumeIDs": [
        "vol-067********4f2"
    ],
    "ImageIDs": [
        "ami-0b8********ded"
    ]
}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get EC2 Instance Details failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the AWS EC2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Failed to create AutoScalingGroup "**" for the EC2 instance "**".

Error Sample Data

Get EC2 Instance Details failed.

Status Code: 400.

Message: Failed to create AutoScalingGroup "****" for the EC2 instance "****".

Get Network ACL Details

Retrieves the region in which to access resources.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

{
    "NetworkAcls": [
        {
            "Associations": [
                {
                    "NetworkAclAssociationId": "aclassoc-043********32d",
                    "NetworkAclId": "acl-05b********dc3",
                    "SubnetId": "subnet-06f********45a"
                },
                {
                    "NetworkAclAssociationId": "aclassoc-95****dfa",
                    "NetworkAclId": "acl-05b********dc3",
                    "SubnetId": "subnet-055********810"
                },
                {
                    "NetworkAclAssociationId": "aclassoc-09c********b79",
                    "NetworkAclId": "acl-05b********dc3",
                    "SubnetId": "subnet-056*******72e"
                },
                {
                    "NetworkAclAssociationId": "aclassoc-0ad********ae7",
                    "NetworkAclId": "acl-05b********dc3",
                    "SubnetId": "subnet-09e********235"
                }
            ],
            "Entries": [
                {
                    "CidrBlock": "10.10.**.*/**",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 10
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                },
                {
                    "CidrBlock": "10.10.**.*/**",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 10
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                }
            ],
            "IsDefault": true,
            "NetworkAclId": "acl-05b********dc3",
            "Tags": [
                {
                    "Key": "Name",
                    "Value": "Test*****IPaddress"
                }
            ],
            "VpcId": "vpc-00a********cf7",
            "OwnerId": "391******688"
        },
        {
            "Associations": [
                {
                    "NetworkAclAssociationId": "aclassoc-34c***55",
                    "NetworkAclId": "acl-01f********89d",
                    "SubnetId": "subnet-0d3********eae"
                },
                {
                    "NetworkAclAssociationId": "aclassoc-d5****b5",
                    "NetworkAclId": "acl-01f********89d",
                    "SubnetId": "subnet-0b6********78c"
                },
                {
                    "NetworkAclAssociationId": "aclassoc-097********9b4",
                    "NetworkAclId": "acl-01f********89d",
                    "SubnetId": "subnet-0bb********b73"
                },
                {
                    "NetworkAclAssociationId": "aclassoc-0a3********996",
                    "NetworkAclId": "acl-01f********89d",
                    "SubnetId": "subnet-04d********787"
                }
            ],
            "Entries": [
                {
                    "CidrBlock": "49.12.**.**/**",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 1
                },
                {
                    "CidrBlock": "49.12.**.**/**",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 2
                },
                {
                    "CidrBlock": "49.12.**.**/**",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 3
                },
                {
                    "CidrBlock": "10.10.**.*/**",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 10
                },
                {
                    "CidrBlock": "136.243.***.***/32",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 15
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 32766
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                },
                {
                    "CidrBlock": "49.12.**.**/**",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 2
                },
                {
                    "CidrBlock": "49.12.**.**/**",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 3
                },
                {
                    "CidrBlock": "10.10.**.*/**",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 10
                },
                {
                    "CidrBlock": "136.243.***.***/32",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 15
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 32766
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                }
            ],
            "IsDefault": true,
            "NetworkAclId": "acl-01f********89d",
            "Tags": [],
            "VpcId": "vpc-063********ea9",
            "OwnerId": "391******688"
        },
        {
            "Associations": [],
            "Entries": [
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                }
            ],
            "IsDefault": true,
            "NetworkAclId": "acl-0a8********d9a",
            "Tags": [],
            "VpcId": "vpc-0ea********c8f",
            "OwnerId": "391******688"
        },
        {
            "Associations": [],
            "Entries": [
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                }
            ],
            "IsDefault": true,
            "NetworkAclId": "acl-001********90f",
            "Tags": [],
            "VpcId": "vpc-0e3********06c",
            "OwnerId": "391******688"
        },
        {
            "Associations": [
                {
                    "NetworkAclAssociationId": "aclassoc-0e7********1c5",
                    "NetworkAclId": "acl-071********d49",
                    "SubnetId": "subnet-030********a68"
                },
                {
                    "NetworkAclAssociationId": "aclassoc-012********ab1",
                    "NetworkAclId": "acl-071********d49",
                    "SubnetId": "subnet-016********547"
                },
                {
                    "NetworkAclAssociationId": "aclassoc-0ac********26e",
                    "NetworkAclId": "acl-071********d49",
                    "SubnetId": "subnet-079********8d1"
                }
            ],
            "Entries": [
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                }
            ],
            "IsDefault": true,
            "NetworkAclId": "acl-071********d49",
            "Tags": [],
            "VpcId": "vpc-06b********5c3",
            "OwnerId": "391******688"
        },
        {
            "Associations": [
                {
                    "NetworkAclAssociationId": "aclassoc-033********25f",
                    "NetworkAclId": "acl-0e6********f22",
                    "SubnetId": "subnet-002********43c"
                }
            ],
            "Entries": [
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                }
            ],
            "IsDefault": true,
            "NetworkAclId": "acl-0e6********f22",
            "Tags": [],
            "VpcId": "vpc-094*******f9d",
            "OwnerId": "391******688"
        },
        {
            "Associations": [
                {
                    "NetworkAclAssociationId": "aclassoc-06f********fc6",
                    "NetworkAclId": "acl-058*********ae2",
                    "SubnetId": "subnet-03b********fca"
                },
                {
                    "NetworkAclAssociationId": "aclassoc-05b*******377",
                    "NetworkAclId": "acl-058*********ae2",
                    "SubnetId": "subnet-01e********0ea"
                }
            ],
            "Entries": [
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                }
            ],
            "IsDefault": true,
            "NetworkAclId": "acl-058*********ae2",
            "Tags": [],
            "VpcId": "vpc-0fc********520",
            "OwnerId": "391******688"
        },
        {
            "Associations": [
                {
                    "NetworkAclAssociationId": "aclassoc-40d***27",
                    "NetworkAclId": "acl-0f3********e6a",
                    "SubnetId": "subnet-00b********243"
                }
            ],
            "Entries": [
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": true,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "allow",
                    "RuleNumber": 100
                },
                {
                    "CidrBlock": "0.0.0.0/0",
                    "Egress": false,
                    "Protocol": "-1",
                    "RuleAction": "deny",
                    "RuleNumber": 32767
                }
            ],
            "IsDefault": true,
            "NetworkAclId": "acl-0f3********e6a",
            "Tags": [],
            "VpcId": "vpc-08c********c8c",
            "OwnerId": "391******688"
        }
    ],
    "ResponseMetadata": {
        "RequestId": "a57*****************f27",
        "HTTPStatusCode": 200,
        "HTTPHeaders": {
            "x-amzn-requestid": "a57*****************f27",
            "cache-control": "no-cache, no-store",
            "strict-transport-security": "max-age=31536000; includeSubDomains",
            "vary": "accept-encoding",
            "content-type": "text/xml;charset=UTF-8",
            "transfer-encoding": "chunked",
            "date": "Tue, 29 Mar 2022 21:46:55 GMT",
            "server": "AmazonEC2"
        },
        "RetryAttempts": 0
    }
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

[
    {
        "Associations": [
            {
                "NetworkAclAssociationId": "aclassoc-043********32d",
                "NetworkAclId": "acl-05b********dc3",
                "SubnetId": "subnet-06f********45a"
            },
            {
                "NetworkAclAssociationId": "aclassoc-95****dfa",
                "NetworkAclId": "acl-05b********dc3",
                "SubnetId": "subnet-055********810"
            },
            {
                "NetworkAclAssociationId": "aclassoc-09c********b79",
                "NetworkAclId": "acl-05b********dc3",
                "SubnetId": "subnet-056*******72e"
            },
            {
                "NetworkAclAssociationId": "aclassoc-0ad********ae7",
                "NetworkAclId": "acl-05b********dc3",
                "SubnetId": "subnet-09e********235"
            }
        ],
        "Entries": [
            {
                "CidrBlock": "10.10.**.*/**",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 10
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            },
            {
                "CidrBlock": "10.10.**.*/**",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 10
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            }
        ],
        "IsDefault": true,
        "NetworkAclId": "acl-05b********dc3",
        "Tags": [
            {
                "Key": "Name",
                "Value": "Test*****IPaddress"
            }
        ],
        "VpcId": "vpc-00a********cf7",
        "OwnerId": "391******688"
    },
    {
        "Associations": [
            {
                "NetworkAclAssociationId": "aclassoc-34c***55",
                "NetworkAclId": "acl-01f********89d",
                "SubnetId": "subnet-0d3********eae"
            },
            {
                "NetworkAclAssociationId": "aclassoc-d5****b5",
                "NetworkAclId": "acl-01f********89d",
                "SubnetId": "subnet-0b6********78c"
            },
            {
                "NetworkAclAssociationId": "aclassoc-097********9b4",
                "NetworkAclId": "acl-01f********89d",
                "SubnetId": "subnet-0bb********b73"
            },
            {
                "NetworkAclAssociationId": "aclassoc-0a3********996",
                "NetworkAclId": "acl-01f********89d",
                "SubnetId": "subnet-04d********787"
            }
        ],
        "Entries": [
            {
                "CidrBlock": "49.12.**.**/**",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 1
            },
            {
                "CidrBlock": "49.12.**.**/**",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 2
            },
            {
                "CidrBlock": "49.12.**.**/**",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 3
            },
            {
                "CidrBlock": "10.10.**.*/**",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 10
            },
            {
                "CidrBlock": "136.243.***.***/32",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 15
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 32766
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            },
            {
                "CidrBlock": "49.12.**.**/**",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 2
            },
            {
                "CidrBlock": "49.12.**.**/**",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 3
            },
            {
                "CidrBlock": "10.10.**.*/**",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 10
            },
            {
                "CidrBlock": "136.243.***.***/32",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 15
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 32766
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            }
        ],
        "IsDefault": true,
        "NetworkAclId": "acl-01f********89d",
        "Tags": [],
        "VpcId": "vpc-063********ea9",
        "OwnerId": "391******688"
    },
    {
        "Associations": [],
        "Entries": [
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            }
        ],
        "IsDefault": true,
        "NetworkAclId": "acl-0a8********d9a",
        "Tags": [],
        "VpcId": "vpc-0ea********c8f",
        "OwnerId": "391******688"
    },
    {
        "Associations": [],
        "Entries": [
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            }
        ],
        "IsDefault": true,
        "NetworkAclId": "acl-001********90f",
        "Tags": [],
        "VpcId": "vpc-0e3********06c",
        "OwnerId": "391******688"
    },
    {
        "Associations": [
            {
                "NetworkAclAssociationId": "aclassoc-0e7********1c5",
                "NetworkAclId": "acl-071********d49",
                "SubnetId": "subnet-030********a68"
            },
            {
                "NetworkAclAssociationId": "aclassoc-012********ab1",
                "NetworkAclId": "acl-071********d49",
                "SubnetId": "subnet-016********547"
            },
            {
                "NetworkAclAssociationId": "aclassoc-0ac********26e",
                "NetworkAclId": "acl-071********d49",
                "SubnetId": "subnet-079********8d1"
            }
        ],
        "Entries": [
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            }
        ],
        "IsDefault": true,
        "NetworkAclId": "acl-071********d49",
        "Tags": [],
        "VpcId": "vpc-06b********5c3",
        "OwnerId": "391******688"
    },
    {
        "Associations": [
            {
                "NetworkAclAssociationId": "aclassoc-033********25f",
                "NetworkAclId": "acl-0e6********f22",
                "SubnetId": "subnet-002********43c"
            }
        ],
        "Entries": [
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            }
        ],
        "IsDefault": true,
        "NetworkAclId": "acl-0e6********f22",
        "Tags": [],
        "VpcId": "vpc-094*******f9d",
        "OwnerId": "391******688"
    },
    {
        "Associations": [
            {
                "NetworkAclAssociationId": "aclassoc-06f********fc6",
                "NetworkAclId": "acl-058*********ae2",
                "SubnetId": "subnet-03b********fca"
            },
            {
                "NetworkAclAssociationId": "aclassoc-05b*******377",
                "NetworkAclId": "acl-058*********ae2",
                "SubnetId": "subnet-01e********0ea"
            }
        ],
        "Entries": [
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            }
        ],
        "IsDefault": true,
        "NetworkAclId": "acl-058*********ae2",
        "Tags": [],
        "VpcId": "vpc-0fc********520",
        "OwnerId": "391******688"
    },
    {
        "Associations": [
            {
                "NetworkAclAssociationId": "aclassoc-40d***27",
                "NetworkAclId": "acl-0f3********e6a",
                "SubnetId": "subnet-00b********243"
            }
        ],
        "Entries": [
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": true,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "allow",
                "RuleNumber": 100
            },
            {
                "CidrBlock": "0.0.0.0/0",
                "Egress": false,
                "Protocol": "-1",
                "RuleAction": "deny",
                "RuleNumber": 32767
            }
        ],
        "IsDefault": true,
        "NetworkAclId": "acl-0f3********e6a",
        "Tags": [],
        "VpcId": "vpc-08c********c8c",
        "OwnerId": "391******688"
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "VPCIDs": [
        "vpc-00a********cf7"
    ]
}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Network ACL Details failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the AWS EC2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AWS was not able to validate the provided access credentials.

Error Sample Data

Get Network ACL Details failed.

Status Code: 403.

Message: AWS was not able to validate the provided access credentials.

Get Security Group Details

Describes the specified security groups or all of your security groups.

Input

Input Parameter	Required/Optional	Description	Example
SecurityGroupIDs	Optional	The IDs of the Security Groups to retrieve details. If not specified, all Security Groups will be returned.	["sg-04a********c92"]

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Succeed

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

{
    "SecurityGroups": [
        {
            "Description": "launch-wizard-1 created 2019-10-28T16:44:43.060-07:00",
            "GroupName": "launch-wizard-*****01",
            "IpPermissions": [
                {
                    "FromPort": 3389,
                    "IpProtocol": "tcp",
                    "IpRanges": [
                        {
                            "CidrIp": "216.251.***.***/**"
                        }
                    ],
                    "Ipv6Ranges": [],
                    "PrefixListIds": [],
                    "ToPort": 3389,
                    "UserIdGroupPairs": []
                }
            ],
            "OwnerId": "391******688",
            "GroupId": "sg-04a********c92",
            "IpPermissionsEgress": [
                {
                    "IpProtocol": "-1",
                    "IpRanges": [
                        {
                            "CidrIp": "0.0.0.0/0"
                        }
                    ],
                    "Ipv6Ranges": [],
                    "PrefixListIds": [],
                    "UserIdGroupPairs": []
                }
            ],
            "Tags": [
                {
                    "Key": "d3*****-01",
                    "Value": "1"
                }
            ],
            "VpcId": "vpc-063********ea9"
        }
    ],
    "ResponseMetadata": {
        "RequestId": "c4d************81f",
        "HTTPStatusCode": 200,
        "HTTPHeaders": {
            "content-type": "text/xml;charset=UTF-8",
            "content-length": "1750",
            "date": "Tue, 11 Feb 2020 23:09:37 GMT",
            "server": "AmazonEC2"
        },
        "RetryAttempts": 0
    }
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

D3 customizes the Context Data by extracting the data from path $.SecurityGroups in API returned JSON.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

[
	  {
		"VpcId": "vpc-063********ea9",
		"GroupName": "launch-wizard-*****01",
		"GroupId": "sg-04a********c92",
		"Description": "launch-wizard-1 created 2019-10-28T16:44:43.060-07:00"
	  }
	][
	  {
		"VolumeId": "vol-067********4f2",
		"SnapshotId": "snap-06f*******ba3"
	  }
	]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "VpcIds": [
        "vpc-063********ea9"
    ],
    "GroupNames": [
        "launch-wizard-*****01"
    ],
    "GroupIds": [
        "sg-04a********c92"
    ],
    "Description": [
        "launch-wizard-1 created 2019-10-28T16:44:43.060-07:00"
    ]
}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Get Security Group Details failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the AWS EC2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: You are not authorized to perform this operation.

Error Sample Data

Get Security Group Details failed.

Status Code: 401.

Message: You are not authorized to perform this operation.

Quarantine EC2 Instances

Designates Security Group ID(s) for quarantining specific EC2 instance(s), ensuring they belong to the same VPC as the instance(s) you intend to isolate. If uncertain about having the appropriate Security Group(s) for quarantining instance(s), it is advisable to leave the Security Group ID parameter empty; the system will then automatically generate quarantine Security Group(s) for you.

READER NOTE

Security Group IDs and Network Interface IDs are optional parameters to run this command.

Run the Get EC2 Instance Details command to obtain Security Group IDs. Security Group IDs can be found in the returned raw data at the path $.Reservations[*].Instances[0].SecurityGroups[0].
Run the Get EC2 Instance Details command to obtain NetworkInterfaceIDs. NetworkInterfaceIDs can be found in the returned raw data at the path $.Reservations[*].Instances[0].NetworkInterfaces[*].NetworkInterfaceId.

Input

Input Parameter	Required/Optional	Description	Example
Security Group IDs	Optional	The ID of the Security Group that corresponds with the instance(s) to be quarantined. Security Group IDs can be obtained using the Get EC2 Instance Details command. You can specify Security Group ID(s) for quarantining EC2 instance(s), but you must ensure the Security Group you specify is in the same VPC as the instance you are quarantining. If you are not sure whether you have the Security Group(s) ready for quarantining instance(s), it is recommended that you leave the Security Group ID empty, and the system will create quarantine Security Group(s) for you automatically. Please note, if you have multiple EC2 Instances to quarantine, and you want to specify Security Group for each instance, you must ensure that Instance ID and Security Group ID mappings are correctly positioned. For example, Security Group ID for the first instance ID in the instance list must be in the first position of the Security Group IDs list; and Security Group ID for the second Instance ID in the instance list must be in the second position of the Security Group IDs list, etc.	["sg-0c6********e0c"]
Network Interface IDs	Optional	The Network Interface IDs is used to specify the network interfaces that are associated with the instance you want to quarantine. Network Interface IDs can be obtained using the Get EC2 Instance Details command.	["eni-0bd********555"]

Output

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Succeed

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

[
    {
        "NetworkInterfaceId": "eni-0bd********555",
        "response": {
            "ResponseMetadata": {
                "RequestId": "b08************ead",
                "HTTPStatusCode": 200,
                "HTTPHeaders": {
                    "content-type": "text/xml;charset=UTF-8",
                    "content-length": "263",
                    "date": "Wed, 12 Feb 2020 00:00:02 GMT",
                    "server": "AmazonEC2"
                },
                "RetryAttempts": 0
            }
        }
    }
]

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

D3 customizes the Context Data by adding "NetworkInterfaceId" and "status" fields.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

[
    {
        "NetworkInterfaceId": "eni-0bd********555",
        "status": "Succeed"
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "NetworkInterfaceIds": [
        "eni-0bd********555"
    ],
    "status": [
        "Succeed"
    ]
}

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Quarantine EC2 Instances failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the AWS EC2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 401.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: You are not authorized to perform this operation..

Error Sample Data

Quarantine EC2 Instances failed.

Status Code: 401.

Message: You are not authorized to perform this operation..

Take Snapshot On Volumes

Captures snapshots of designated EBS volumes, storing them within the same region as the volumes in Amazon S3.

READER NOTE

The parameter Volume IDs is required to run this command.

Run the Get EC2 Instance Details command to obtain Volume IDs. Volume IDs can be found in the returned raw data at the path $.Reservations[*].Instances[0].BlockDeviceMappings[*].Ebs.VolumeId.

Input

Input Parameter	Required/Optional	Description	Example
Volume IDs	Required	The IDs of the Volumes used to create snapshots. Volume IDs can be obtained using the Get EC2 Instance Details command.	["vol-067********4f2"]

Output

Return Data

Indicates one of the possible command execution states: Successful, Partially Successful, or Failed.

The Partially Successful state only occurs when a command’s input accepts an array of items (e.g. an array of IP addresses) and one or more items within the array return an error from the API request.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Succeed

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

[
    {
        "VolumeId": "vol-067********4f2",
        "SnapshotId": "snap-03d********34b"
    }
]

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

[
    {
        "VolumeId": "vol-067********4f2",
        "SnapshotId": "snap-03d********34b"
    }
]

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "VolumeIds": [
        "vol-067********4f2
    ],
    "SnapshotIds": [
        "snap-03d********34b"
    ]
}

Error Handling

If the Return Data is Partially Successful or Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Take Snapshot On Volumes failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the AWS EC2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 400.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Value **** for parameter volumeId is invalid.

Error Sample Data

Take Snapshot On Volumes failed.

Status Code: 400.

Message: Value **** for parameter volumeId is invalid..

Update Auto Scaling Group

Updates a scheduled scaling action for an Auto Scaling group; if the action does not exist, it will be created automatically.

READER NOTE

Auto Scaling Group Name is a required parameter to run this command.

Run the Get Auto Scaling Group Details command to obtain Auto Scaling Group Name. Auto Scaling Group Name can be found in the raw data at the path $.AutoScalingGroupName.

Input

Input Parameter	Required/Optional	Description	Example
Auto Scaling Group Name	Required	The name of the Auto Scaling group to be updated. Auto Scaling Group Name can be obtained using the Get Auto Scaling Group Details command.	eks-40b************823
ScheduledActionName	Required	The name of this scaling action.	Action01-5*******
Start Time	Optional	The date and time for this action to start in UTC time.	2020-06-17 06:00:00
End Time	Optional	The date and time for this action to end in UTC time.	2020-06-18 06:00:00
Recurrence	Optional	The recurring schedule for this action, in Unix cron syntax format.(for example, "30 0 1 1,6,12 *" )	30 0 1 1,6,12 *
MinSize	Optional	The minimum size of the Auto Scaling group.	2
MaxSize	Optional	The maximum size of the Auto Scaling group.	6
DesireCapacity	Optional	The desired capacity is the initial capacity of the Auto Scaling group at the time of its creation and the capacity it attempts to maintain. This number must be greater than or equal to MinSize and less than or equal to MaxSize.	3

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

Return Data can be passed down directly to a subsequent command or used to create conditional tasks in playbooks.

SAMPLE DATA

CODE

Successful

Raw Data

The primary response data from the API request.

SAMPLE DATA

CODE

{
    "ResponseMetadata": {
        "RequestId": "ea7************79c",
        "HTTPStatusCode": 200,
        "HTTPHeaders": {
            "x-amzn-requestid": "ea7************79c",
            "content-type": "text/xml",
            "content-length": "245",
            "date": "Fri, 19 Jun 2020 02:31:21 GMT"
        },
        "RetryAttempts": 0
    }
}

Context Data

The data extracted from Raw Data converted into JSON format. Context Data may be identical to Raw Data in some cases.

D3 customizes the context data by adding "AutoScalingGroupName" and "ScheduledActionName" fields.

It is recommended to refer to the Raw Data instead of Context Data, since it contains the complete API response data. D3 will deprecate Context Data in the future, and playbook tasks using Context Data will be replaced with Raw Data.

SAMPLE DATA

CODE

{
    "AutoScalingGroupName": [
        "eks-40b************823"
    ],
    "ScheduledActionName": [
        "Action01-5*******"
    ]
}

Key Fields

Common cyber security indicators such as unique IDs, file hash values, CVE numbers, IP addresses, etc., will be extracted from Raw Data as Key Fields.

The system stores these key fields in the path $.[playbookTask].outputData. You can use these key-value pairs as data points for playbook task inputs.

SAMPLE DATA

CODE

{
    "AutoScalingGroupName": [
        "eks-40b************823"
    ],
    "ScheduledActionName": [
        "Action01-5*******"
    ]
}

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Update Auto Scaling Group failed.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the AWS EC2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 500.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: Failed to apply Action "*" to the AutoScalingGroup "**".

Error Sample Data

Update Auto Scaling Group failed.

Status Code: 500.

Message: Failed to apply Action "***" to the AutoScalingGroup "****".

Test Connection

Allows you to perform a health check on an integration connection. You can schedule a periodic health check by selecting Connection Health Check when editing an integration connection.

Input

N/A

Output

Return Data

Indicates one of the possible command execution states: Successful or Failed.

The Failed state can be triggered by any of the following errors:

A connection issue with the integration
The API returned an error message
No response from the API

You can view more details about an error in the Error tab.

SAMPLE DATA

CODE

Successful

Error Handling

If the Return Data is Failed, an Error tab will appear in the Test Result window.

The error tab contains the details responded from D3 SOAR or third-party API calls, including Failure Indicator, Status Code, and Message. This can help you locate the root cause of a command failure.

Parts in Error	Description	Example
Failure Indicator	Indicates the command failure that happened at a specific input and/or API call.	Test Connection failed. Failed to check the connector.
Status Code	The response code issued by the third-party API server or the D3 SOAR system that can be used to locate the corresponding error category. For example, if the returned status code is 401, the selected connection is unauthorized to run the command. The user or system support would need to check the permission setting in the AWS EC2 portal. Refer to the HTTP Status Code Registry for details.	Status Code: 403.
Message	The raw data or captured key error message from the integration API server about the API request failure.	Message: AWS was not able to validate the provided access credentials.

Error Sample Data

Test Connection failed. Failed to check the connector.

Status Code: 403.

Message: AWS was not able to validate the provided access credentials.