emfirge_in_use_evidence
Check whether resources a branch deletes are still in use, using CloudTrail and CloudWatch, only after you approve the shown cost.
Parameters
branch_id: string · required; sources: cloudtrail_events | cloudwatch_metrics[] · optional; accept_estimate_id: string · optional; role_arn: string · optional
{ "branch_id": "branch_456" }
Returns
The response is JSON shaped for the operation. The fields and semantics are described below.
{
"estimate_id": "a17f…3c90", "branch_revision": "3f9a…c21e", "window_days": 90,
"sources": ["cloudtrail_events", "cloudwatch_metrics"],
"resources": ["NAME_201"], "calls": [ /* … API calls that would be made … */ ]
}
Validation, behavior, and limits
Call it first without accept_estimate_id. It returns an estimate: which resources, which API calls, the look-back window, and the cost. Nothing is read yet.
Only after the user agrees, call it again with accept_estimate_id and the same role_arn used for emfirge_scan. CloudTrail event history is free; CloudWatch metric reads are billed beyond the AWS free tier.
Evidence can only make a verdict stricter, never looser. A missing permission is reported as denied and leaves the verdict unchanged. CloudTrail user names, IP addresses, access keys, and raw events are never stored.