type AccessControlList struct {
	// A value that indicates whether public read access for the bucket is enabled
	// through an Access Control List (ACL).
	AllowsPublicReadAccess *bool
	// A value that indicates whether public write access for the bucket is enabled
	// through an Access Control List (ACL).
	AllowsPublicWriteAccess *bool
}

type AccessKeyDetails struct {
	// The name of the user.
	UserName *string
	// The type of the user.
	UserType *string
	// The principal ID of the user.
	PrincipalId *string
	// The access key ID of the user.
	AccessKeyId *string
}

type AccountDetail struct {
	// The email address of the member account.
	Email *string
	// The member account ID.
	AccountId *string
}

type AccountLevelPermissions struct {
	// Describes the S3 Block Public Access settings of the bucket's parent account.
	BlockPublicAccess *BlockPublicAccess
}

type Action struct {
	// Information about the AWS_API_CALL action described in this finding.
	AwsApiCallAction *AwsApiCallAction
	// Information about the NETWORK_CONNECTION action described in this finding.
	NetworkConnectionAction *NetworkConnectionAction
	// Information about the PORT_PROBE action described in this finding.
	PortProbeAction *PortProbeAction
	// The GuardDuty finding activity type.
	ActionType *string
	// Information about the DNS_REQUEST action described in this finding.
	DnsRequestAction *DnsRequestAction
}

type AdminAccount struct {
	// Indicates whether the account is enabled as the delegated administrator.
	AdminStatus AdminStatus
	// The AWS account ID for the account.
	AdminAccountId *string
}

type AdminStatus string

const (
	AdminStatusEnabled             AdminStatus = "ENABLED"
	AdminStatusDisable_in_progress AdminStatus = "DISABLE_IN_PROGRESS"
)

type AwsApiCallAction struct {
	// The remote IP information of the connection.
	RemoteIpDetails *RemoteIpDetails
	// The AWS service name whose API was invoked.
	ServiceName *string
	// The AWS API caller type.
	CallerType *string
	// The AWS API name.
	Api *string
	// The domain information for the AWS API call.
	DomainDetails *DomainDetails
}

type BadRequestException struct {
	Message *string

	Type *string
}

type BlockPublicAccess struct {
	// Indicates if S3 Block Public Access is set to BlockPublicPolicy.
	BlockPublicPolicy *bool
	// Indicates if S3 Block Public Access is set to RestrictPublicBuckets.
	RestrictPublicBuckets *bool
	// Indicates if S3 Block Public Access is set to BlockPublicAcls.
	BlockPublicAcls *bool
	// Indicates if S3 Block Public Access is set to IgnorePublicAcls.
	IgnorePublicAcls *bool
}

type BucketLevelPermissions struct {
	// Contains information on how Access Control Policies are applied to the bucket.
	AccessControlList *AccessControlList
	// Contains information on the bucket policies for the S3 bucket.
	BucketPolicy *BucketPolicy
	// Contains information on which account level S3 Block Public Access settings are
	// applied to the S3 bucket.
	BlockPublicAccess *BlockPublicAccess
}

type BucketPolicy struct {
	// A value that indicates whether public read access for the bucket is enabled
	// through a bucket policy.
	AllowsPublicReadAccess *bool
	// A value that indicates whether public write access for the bucket is enabled
	// through a bucket policy.
	AllowsPublicWriteAccess *bool
}

type City struct {
	// The city name of the remote IP address.
	CityName *string
}

type CloudTrailConfigurationResult struct {
	// Describes whether CloudTrail is enabled as a data source for the detector.
	Status DataSourceStatus
}

type Condition struct {
	// Represents a greater than or equal condition to be applied to a single field
	// when querying for findings.
	Gte *int32
	// Represents a less than condition to be applied to a single field when querying
	// for findings.
	Lt *int32
	// Represents a greater than or equal condition to be applied to a single field
	// when querying for findings.
	GreaterThanOrEqual *int64
	// Represents the not equal condition to be applied to a single field when querying
	// for findings.
	Neq []*string
	// Represents a less than or equal condition to be applied to a single field when
	// querying for findings.
	LessThanOrEqual *int64
	// Represents the equal condition to be applied to a single field when querying for
	// findings.
	Eq []*string
	// Represents an equal condition to be applied to a single field when querying for
	// findings.
	Equals []*string
	// Represents a greater than condition to be applied to a single field when
	// querying for findings.
	Gt *int32
	// Represents a not equal condition to be applied to a single field when querying
	// for findings.
	NotEquals []*string
	// Represents a less than or equal condition to be applied to a single field when
	// querying for findings.
	Lte *int32
	// Represents a greater than condition to be applied to a single field when
	// querying for findings.
	GreaterThan *int64
	// Represents a less than condition to be applied to a single field when querying
	// for findings.
	LessThan *int64
}

type Country struct {
	// The country name of the remote IP address.
	CountryName *string
	// The country code of the remote IP address.
	CountryCode *string
}

type DNSLogsConfigurationResult struct {
	// Denotes whether DNS logs is enabled as a data source.
	Status DataSourceStatus
}

type DataSource string

const (
	DataSourceFlow_logs   DataSource = "FLOW_LOGS"
	DataSourceCloud_trail DataSource = "CLOUD_TRAIL"
	DataSourceDns_logs    DataSource = "DNS_LOGS"
	DataSourceS3_logs     DataSource = "S3_LOGS"
)

type DataSourceConfigurations struct {
	// Describes whether S3 data event logs are enabled as a data source.
	S3Logs *S3LogsConfiguration
}

type DataSourceConfigurationsResult struct {
	// An object that contains information on the status of CloudTrail as a data
	// source.
	CloudTrail *CloudTrailConfigurationResult
	// An object that contains information on the status of DNS logs as a data source.
	DNSLogs *DNSLogsConfigurationResult
	// An object that contains information on the status of VPC flow logs as a data
	// source.
	FlowLogs *FlowLogsConfigurationResult
	// An object that contains information on the status of S3 Data event logs as a
	// data source.
	S3Logs *S3LogsConfigurationResult
}

type DataSourceStatus string

const (
	DataSourceStatusEnabled  DataSourceStatus = "ENABLED"
	DataSourceStatusDisabled DataSourceStatus = "DISABLED"
)

type DefaultServerSideEncryption struct {
	// The Amazon Resource Name (ARN) of the KMS encryption key. Only available if the
	// bucket EncryptionType is aws:kms.
	KmsMasterKeyArn *string
	// The type of encryption used for objects within the S3 bucket.
	EncryptionType *string
}

type Destination struct {
	// The status of the publishing destination.
	Status PublishingStatus
	// The type of resource used for the publishing destination. Currently, only Amazon
	// S3 buckets are supported.
	DestinationType DestinationType
	// The unique ID of the publishing destination.
	DestinationId *string
}

type DestinationProperties struct {
	// The ARN of the resource to publish to.
	DestinationArn *string
	// The ARN of the KMS key to use for encryption.
	KmsKeyArn *string
}

type DestinationType string

const (
	DestinationTypeS3 DestinationType = "S3"
)

type DetectorStatus string

const (
	DetectorStatusEnabled  DetectorStatus = "ENABLED"
	DetectorStatusDisabled DetectorStatus = "DISABLED"
)

type DnsRequestAction struct {
	// The domain information for the API request.
	Domain *string
}

type DomainDetails struct {
	// The domain information for the AWS API call.
	Domain *string
}

type Evidence struct {
	// A list of threat intelligence details related to the evidence.
	ThreatIntelligenceDetails []*ThreatIntelligenceDetail
}

type Feedback string

const (
	FeedbackUseful     Feedback = "USEFUL"
	FeedbackNot_useful Feedback = "NOT_USEFUL"
)

type FilterAction string

const (
	FilterActionNoop    FilterAction = "NOOP"
	FilterActionArchive FilterAction = "ARCHIVE"
)

type Finding struct {
	// The type of finding.
	Type *string
	// Contains additional information about the generated finding.
	Service *Service
	// The ID of the account in which the finding was generated.
	AccountId *string
	// The confidence score for the finding.
	Confidence *float64
	// The version of the schema used for the finding.
	SchemaVersion *string
	// The severity of the finding.
	Severity *float64
	// The title of the finding.
	Title *string
	// The Region where the finding was generated.
	Region *string
	// The time and date when the finding was last updated.
	UpdatedAt *string
	// Contains information about the AWS resource associated with the activity that
	// prompted GuardDuty to generate a finding.
	Resource *Resource
	// The partition associated with the finding.
	Partition *string
	// The ARN of the finding.
	Arn *string
	// The time and date when the finding was created.
	CreatedAt *string
	// The description of the finding.
	Description *string
	// The ID of the finding.
	Id *string
}

type FindingCriteria struct {
	// Represents a map of finding properties that match specified conditions and
	// values when querying findings.
	Criterion map[string]*Condition
}

type FindingPublishingFrequency string

const (
	FindingPublishingFrequencyFifteen_minutes FindingPublishingFrequency = "FIFTEEN_MINUTES"
	FindingPublishingFrequencyOne_hour        FindingPublishingFrequency = "ONE_HOUR"
	FindingPublishingFrequencySix_hours       FindingPublishingFrequency = "SIX_HOURS"
)

type FindingStatisticType string

const (
	FindingStatisticTypeCount_by_severity FindingStatisticType = "COUNT_BY_SEVERITY"
)

type FindingStatistics struct {
	// Represents a map of severity to count statistics for a set of findings.
	CountBySeverity map[string]*int32
}

type FlowLogsConfigurationResult struct {
	// Denotes whether VPC flow logs is enabled as a data source.
	Status DataSourceStatus
}

type GeoLocation struct {
	// The longitude information of the remote IP address.
	Lon *float64
	// The latitude information of the remote IP address.
	Lat *float64
}

type IamInstanceProfile struct {
	// The profile ID of the EC2 instance.
	Id *string
	// The profile ARN of the EC2 instance.
	Arn *string
}

type InstanceDetails struct {
	// The product code of the EC2 instance.
	ProductCodes []*ProductCode
	// The image description of the EC2 instance.
	ImageDescription *string
	// The profile information of the EC2 instance.
	IamInstanceProfile *IamInstanceProfile
	// The Amazon Resource Name (ARN) of the AWS Outpost. Only applicable to AWS
	// Outposts instances.
	OutpostArn *string
	// The Availability Zone of the EC2 instance.
	AvailabilityZone *string
	// The tags of the EC2 instance.
	Tags []*Tag
	// The type of the EC2 instance.
	InstanceType *string
	// The platform of the EC2 instance.
	Platform *string
	// The launch time of the EC2 instance.
	LaunchTime *string
	// The state of the EC2 instance.
	InstanceState *string
	// The image ID of the EC2 instance.
	ImageId *string
	// The elastic network interface information of the EC2 instance.
	NetworkInterfaces []*NetworkInterface
	// The ID of the EC2 instance.
	InstanceId *string
}

type InternalServerErrorException struct {
	Message *string

	Type *string
}

type Invitation struct {
	// The timestamp when the invitation was sent.
	InvitedAt *string
	// The ID of the account that the invitation was sent from.
	AccountId *string
	// The ID of the invitation. This value is used to validate the inviter account to
	// the member account.
	InvitationId *string
	// The status of the relationship between the inviter and invitee accounts.
	RelationshipStatus *string
}

type IpSetFormat string

const (
	IpSetFormatTxt         IpSetFormat = "TXT"
	IpSetFormatStix        IpSetFormat = "STIX"
	IpSetFormatOtx_csv     IpSetFormat = "OTX_CSV"
	IpSetFormatAlien_vault IpSetFormat = "ALIEN_VAULT"
	IpSetFormatProof_point IpSetFormat = "PROOF_POINT"
	IpSetFormatFire_eye    IpSetFormat = "FIRE_EYE"
)

type IpSetStatus string

const (
	IpSetStatusInactive       IpSetStatus = "INACTIVE"
	IpSetStatusActivating     IpSetStatus = "ACTIVATING"
	IpSetStatusActive         IpSetStatus = "ACTIVE"
	IpSetStatusDeactivating   IpSetStatus = "DEACTIVATING"
	IpSetStatusError          IpSetStatus = "ERROR"
	IpSetStatusDelete_pending IpSetStatus = "DELETE_PENDING"
	IpSetStatusDeleted        IpSetStatus = "DELETED"
)

type LocalIpDetails struct {
	// The IPv4 local address of the connection.
	IpAddressV4 *string
}

type LocalPortDetails struct {
	// The port number of the local connection.
	Port *int32
	// The port name of the local connection.
	PortName *string
}

type Master struct {
	// The ID of the account used as the master account.
	AccountId *string
	// The timestamp when the invitation was sent.
	InvitedAt *string
	// The status of the relationship between the master and member accounts.
	RelationshipStatus *string
	// The value used to validate the master account to the member account.
	InvitationId *string
}

type Member struct {
	// The status of the relationship between the member and the master.
	RelationshipStatus *string
	// The master account ID.
	MasterId *string
	// The ID of the member account.
	AccountId *string
	// The last-updated timestamp of the member.
	UpdatedAt *string
	// The detector ID of the member account.
	DetectorId *string
	// The timestamp when the invitation was sent.
	InvitedAt *string
	// The email address of the member account.
	Email *string
}

type MemberDataSourceConfiguration struct {
	// Contains information on the status of data sources for the account.
	DataSources *DataSourceConfigurationsResult
	// The account ID for the member account.
	AccountId *string
}

type NetworkConnectionAction struct {
	// Indicates whether EC2 blocked the network connection to your instance.
	Blocked *bool
	// The local IP information of the connection.
	LocalIpDetails *LocalIpDetails
	// The network connection protocol.
	Protocol *string
	// The network connection direction.
	ConnectionDirection *string
	// The local port information of the connection.
	LocalPortDetails *LocalPortDetails
	// The remote port information of the connection.
	RemotePortDetails *RemotePortDetails
	// The remote IP information of the connection.
	RemoteIpDetails *RemoteIpDetails
}

type NetworkInterface struct {
	// The subnet ID of the EC2 instance.
	SubnetId *string
	// The public DNS name of the EC2 instance.
	PublicDnsName *string
	// The VPC ID of the EC2 instance.
	VpcId *string
	// The private IP address of the EC2 instance.
	PrivateIpAddress *string
	// The ID of the network interface.
	NetworkInterfaceId *string
	// A list of IPv6 addresses for the EC2 instance.
	Ipv6Addresses []*string
	// The private DNS name of the EC2 instance.
	PrivateDnsName *string
	// The public IP address of the EC2 instance.
	PublicIp *string
	// Other private IP address information of the EC2 instance.
	PrivateIpAddresses []*PrivateIpAddressDetails
	// The security groups associated with the EC2 instance.
	SecurityGroups []*SecurityGroup
}

type OrderBy string

const (
	OrderByAsc  OrderBy = "ASC"
	OrderByDesc OrderBy = "DESC"
)

type Organization struct {
	// The name of the internet provider.
	Org *string
	// The ISP information for the internet provider.
	Isp *string
	// The organization that registered this ASN.
	AsnOrg *string
	// The Autonomous System Number (ASN) of the internet provider of the remote IP
	// address.
	Asn *string
}

type OrganizationDataSourceConfigurations struct {
	// Describes whether S3 data event logs are enabled for new members of the
	// organization.
	S3Logs *OrganizationS3LogsConfiguration
}

type OrganizationDataSourceConfigurationsResult struct {
	// Describes whether S3 data event logs are enabled as a data source.
	S3Logs *OrganizationS3LogsConfigurationResult
}

type OrganizationS3LogsConfiguration struct {
	// A value that contains information on whether S3 data event logs will be enabled
	// automatically as a data source for the organization.
	AutoEnable *bool
}

type OrganizationS3LogsConfigurationResult struct {
	// A value that describes whether S3 data event logs are automatically enabled for
	// new members of the organization.
	AutoEnable *bool
}

type Owner struct {
	// The canonical user ID of the bucket owner. For information about locating your
	// canonical user ID see Finding Your Account Canonical User ID.
	// (https://docs.aws.amazon.com/general/latest/gr/acct-identifiers.html#FindingCanonicalId)
	Id *string
}

type PermissionConfiguration struct {
	// Contains information about the account level permissions on the S3 bucket.
	AccountLevelPermissions *AccountLevelPermissions
	// Contains information about the bucket level permissions for the S3 bucket.
	BucketLevelPermissions *BucketLevelPermissions
}

type PortProbeAction struct {
	// A list of objects related to port probe details.
	PortProbeDetails []*PortProbeDetail
	// Indicates whether EC2 blocked the port probe to the instance, such as with an
	// ACL.
	Blocked *bool
}

type PortProbeDetail struct {
	// The local port information of the connection.
	LocalPortDetails *LocalPortDetails
	// The local IP information of the connection.
	LocalIpDetails *LocalIpDetails
	// The remote IP information of the connection.
	RemoteIpDetails *RemoteIpDetails
}

type PrivateIpAddressDetails struct {
	// The private DNS name of the EC2 instance.
	PrivateDnsName *string
	// The private IP address of the EC2 instance.
	PrivateIpAddress *string
}

type ProductCode struct {
	// The product code information.
	Code *string
	// The product code type.
	ProductType *string
}

type PublicAccess struct {
	// Contains information about how permissions are configured for the S3 bucket.
	PermissionConfiguration *PermissionConfiguration
	// Describes the effective permission on this bucket after factoring all attached
	// policies.
	EffectivePermission *string
}

type PublishingStatus string

const (
	PublishingStatusPending_verification                       PublishingStatus = "PENDING_VERIFICATION"
	PublishingStatusPublishing                                 PublishingStatus = "PUBLISHING"
	PublishingStatusUnable_to_publish_fix_destination_property PublishingStatus = "UNABLE_TO_PUBLISH_FIX_DESTINATION_PROPERTY"
	PublishingStatusStopped                                    PublishingStatus = "STOPPED"
)

type RemoteIpDetails struct {
	// The location information of the remote IP address.
	GeoLocation *GeoLocation
	// The IPv4 remote address of the connection.
	IpAddressV4 *string
	// The ISP organization information of the remote IP address.
	Organization *Organization
	// The country code of the remote IP address.
	Country *Country
	// The city information of the remote IP address.
	City *City
}

type RemotePortDetails struct {
	// The port name of the remote connection.
	PortName *string
	// The port number of the remote connection.
	Port *int32
}

type Resource struct {
	// The type of AWS resource.
	ResourceType *string
	// Contains information on the S3 bucket.
	S3BucketDetails []*S3BucketDetail
	// The IAM access key details (IAM user information) of a user that engaged in the
	// activity that prompted GuardDuty to generate a finding.
	AccessKeyDetails *AccessKeyDetails
	// The information about the EC2 instance associated with the activity that
	// prompted GuardDuty to generate a finding.
	InstanceDetails *InstanceDetails
}

type S3BucketDetail struct {
	// The Amazon Resource Name (ARN) of the S3 bucket.
	Arn *string
	// The date and time the bucket was created at.
	CreatedAt *time.Time
	// Describes the public access policies that apply to the S3 bucket.
	PublicAccess *PublicAccess
	// The owner of the S3 bucket.
	Owner *Owner
	// Describes the server side encryption method used in the S3 bucket.
	DefaultServerSideEncryption *DefaultServerSideEncryption
	// The name of the S3 bucket.
	Name *string
	// Describes whether the bucket is a source or destination bucket.
	Type *string
	// All tags attached to the S3 bucket
	Tags []*Tag
}

type S3LogsConfiguration struct {
	// The status of S3 data event logs as a data source.
	Enable *bool
}

type S3LogsConfigurationResult struct {
	// A value that describes whether S3 data event logs are automatically enabled for
	// new members of the organization.
	Status DataSourceStatus
}

type SecurityGroup struct {
	// The security group name of the EC2 instance.
	GroupName *string
	// The security group ID of the EC2 instance.
	GroupId *string
}

type Service struct {
	// The detector ID for the GuardDuty service.
	DetectorId *string
	// The name of the AWS service (GuardDuty) that generated a finding.
	ServiceName *string
	// The total count of the occurrences of this finding type.
	Count *int32
	// An evidence object associated with the service.
	Evidence *Evidence
	// The last-seen timestamp of the activity that prompted GuardDuty to generate this
	// finding.
	EventLastSeen *string
	// The resource role information for this finding.
	ResourceRole *string
	// Feedback that was submitted about the finding.
	UserFeedback *string
	// Information about the activity that is described in a finding.
	Action *Action
	// Indicates whether this finding is archived.
	Archived *bool
	// The first-seen timestamp of the activity that prompted GuardDuty to generate
	// this finding.
	EventFirstSeen *string
}

type SortCriteria struct {
	// Represents the finding attribute (for example, accountId) to sort findings by.
	AttributeName *string
	// The order by which the sorted findings are to be displayed.
	OrderBy OrderBy
}

type Tag struct {
	// The EC2 instance tag value.
	Value *string
	// The EC2 instance tag key.
	Key *string
}

type ThreatIntelSetFormat string

const (
	ThreatIntelSetFormatTxt         ThreatIntelSetFormat = "TXT"
	ThreatIntelSetFormatStix        ThreatIntelSetFormat = "STIX"
	ThreatIntelSetFormatOtx_csv     ThreatIntelSetFormat = "OTX_CSV"
	ThreatIntelSetFormatAlien_vault ThreatIntelSetFormat = "ALIEN_VAULT"
	ThreatIntelSetFormatProof_point ThreatIntelSetFormat = "PROOF_POINT"
	ThreatIntelSetFormatFire_eye    ThreatIntelSetFormat = "FIRE_EYE"
)

type ThreatIntelSetStatus string

const (
	ThreatIntelSetStatusInactive       ThreatIntelSetStatus = "INACTIVE"
	ThreatIntelSetStatusActivating     ThreatIntelSetStatus = "ACTIVATING"
	ThreatIntelSetStatusActive         ThreatIntelSetStatus = "ACTIVE"
	ThreatIntelSetStatusDeactivating   ThreatIntelSetStatus = "DEACTIVATING"
	ThreatIntelSetStatusError          ThreatIntelSetStatus = "ERROR"
	ThreatIntelSetStatusDelete_pending ThreatIntelSetStatus = "DELETE_PENDING"
	ThreatIntelSetStatusDeleted        ThreatIntelSetStatus = "DELETED"
)

type ThreatIntelligenceDetail struct {
	// A list of names of the threats in the threat intelligence list that triggered
	// the finding.
	ThreatNames []*string
	// The name of the threat intelligence list that triggered the finding.
	ThreatListName *string
}

type Total struct {
	// The currency unit that the amount is given in.
	Unit *string
	// The total usage.
	Amount *string
}

type UnprocessedAccount struct {
	// A reason why the account hasn't been processed.
	Result *string
	// The AWS account ID.
	AccountId *string
}

type UsageAccountResult struct {
	// The Account ID that generated usage.
	AccountId *string
	// Represents the total of usage for the Account ID.
	Total *Total
}

type UsageCriteria struct {
	// The data sources to aggregate usage statistics from.
	DataSources []DataSource
	// The account IDs to aggregate usage statistics from.
	AccountIds []*string
	// The resources to aggregate usage statistics from. Only accepts exact resource
	// names.
	Resources []*string
}

type UsageDataSourceResult struct {
	// Represents the total of usage for the specified data source.
	Total *Total
	// The data source type that generated usage.
	DataSource DataSource
}

type UsageResourceResult struct {
	// Represents the sum total of usage for the specified resource type.
	Total *Total
	// The AWS resource that generated usage.
	Resource *string
}

type UsageStatisticType string

const (
	UsageStatisticTypeSum_by_account     UsageStatisticType = "SUM_BY_ACCOUNT"
	UsageStatisticTypeSum_by_data_source UsageStatisticType = "SUM_BY_DATA_SOURCE"
	UsageStatisticTypeSum_by_resource    UsageStatisticType = "SUM_BY_RESOURCE"
	UsageStatisticTypeTop_resources      UsageStatisticType = "TOP_RESOURCES"
)

type UsageStatistics struct {
	// Lists the top 50 resources that have generated the most GuardDuty usage, in
	// order from most to least expensive.
	TopResources []*UsageResourceResult
	// The usage statistic sum organized by on data source.
	SumByDataSource []*UsageDataSourceResult
	// The usage statistic sum organized by resource.
	SumByResource []*UsageResourceResult
	// The usage statistic sum organized by account ID.
	SumByAccount []*UsageAccountResult
}