---
title: "GET /finding/{id}#analyzerArn"
method: GET
path: "/finding/{id}#analyzerArn"
---

# GET /finding/{id}#analyzerArn

`GET /finding/{id}#analyzerArn`

Retrieves information about the specified finding.

## Path parameters

- `id` string, required

## Query parameters

- `analyzerArn` string, required

## Response `200`

Success

- GetFindingResponse — The response to the request.
  - `finding` object — A <code>finding</code> object that contains finding details.
    - `id` string, required — The ID of the finding.
    - `principal` object — The external principal that access to a resource within the zone of trust.
    - `action` String[] — The action in the analyzed policy statement that an external principal has permission to use.
    - `resource` string — The resource that an external principal has access to.
    - `isPublic` boolean — Indicates whether the policy that generated the finding allows public access to the resource.
    - `resourceType` 'AWS::S3::Bucket' | 'AWS::IAM::Role' | 'AWS::SQS::Queue' | 'AWS::Lambda::Function' | 'AWS::Lambda::LayerVersion' | 'AWS::KMS::Key' | 'AWS::SecretsManager::Secret' | 'AWS::EFS::FileSystem' | 'AWS::EC2::Snapshot' | 'AWS::ECR::Repository' | 'AWS::RDS::DBSnapshot' | 'AWS::RDS::DBClusterSnapshot' | 'AWS::SNS::Topic', required — The type of the resource identified in the finding.
    - `condition` object, required — The condition in the analyzed policy statement that resulted in a finding.
    - `createdAt` string, date-time, required — The time at which the finding was generated.
    - `analyzedAt` string, date-time, required — The time at which the resource was analyzed.
    - `updatedAt` string, date-time, required — The time at which the finding was updated.
    - `status` 'ACTIVE' | 'ARCHIVED' | 'RESOLVED', required — The current status of the finding.
    - `resourceOwnerAccount` string, required — The Amazon Web Services account ID that owns the resource.
    - `error` string — An error.
    - `sources` FindingSource[] — The sources of the finding. This indicates how the access that generated the finding is granted. It is populated for Amazon S3 bucket findings.
      - `type` 'POLICY' | 'BUCKET_ACL' | 'S3_ACCESS_POINT' | 'S3_ACCESS_POINT_ACCOUNT', required — Indicates the type of access that generated the finding.
      - `detail` object — Includes details about how the access that generated the finding is granted. This is populated for Amazon S3 bucket findings.
        - `accessPointArn` string — The ARN of the access point that generated the finding. The ARN format depends on whether the ARN represents an access point or a multi-region access point.
        - `accessPointAccount` string — The account of the cross-account access point that generated the finding.

## Other responses

- `480` — ResourceNotFoundException
- `481` — ValidationException
- `482` — InternalServerException
- `483` — ThrottlingException
- `484` — AccessDeniedException

---

[API](https://skmtc.net/aws/apis/accessanalyzer.md) · [All operations](https://skmtc.net/aws/apis/accessanalyzer/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/accessanalyzer/versions/d729b5bbb9cd/schema)