String adminAccount
The AWS account ID to associate with AWS Firewall Manager as the AWS Firewall Manager administrator account. This can be an AWS Organizations master account or a member account. For more information about AWS Organizations and master accounts, see Managing the AWS Accounts in Your Organization.
String resourceId
The resource ID.
String violationReason
The reason that the resource is not protected by the policy.
String resourceType
The resource type. This is in the format shown in the AWS
Resource Types Reference. For example: AWS::ElasticLoadBalancingV2::LoadBalancer or
AWS::CloudFront::Distribution.
String policyId
The ID of the policy that you want to delete. PolicyId is returned by PutPolicy and by
ListPolicies.
Boolean deleteAllPolicyResources
If True, the request performs cleanup according to the policy type.
For AWS WAF and Shield Advanced policies, the cleanup does the following:
Deletes rule groups created by AWS Firewall Manager
Removes web ACLs from in-scope resources
Deletes web ACLs that contain no rules or rule groups
For security group policies, the cleanup does the following for each security group in the policy:
Disassociates the security group from in-scope resources
Deletes the security group if it was created through Firewall Manager and if it's no longer associated with any resources through another policy
After the cleanup, in-scope resources are no longer protected by web ACLs in this policy. Protection of out-of-scope resources remains unchanged. Scope is determined by tags that you create and accounts that you associate with the policy. When creating the policy, if you specify that only resources in specific accounts or with specific tags are in scope of the policy, those accounts and resources are handled by the policy. All others are out of scope. If you don't specify tags or accounts, all resources are in scope.
String complianceStatus
Describes an AWS account's compliance with the AWS Firewall Manager policy.
Long violatorCount
The number of resources that are noncompliant with the specified policy. For AWS WAF and Shield Advanced policies, a resource is considered noncompliant if it is not associated with the policy. For security group policies, a resource is considered noncompliant if it doesn't comply with the rules of the policy and remediation is disabled or not possible.
Boolean evaluationLimitExceeded
Indicates that over 100 resources are noncompliant with the AWS Firewall Manager policy.
PolicyComplianceDetail policyComplianceDetail
Information about the resources and the policy that you specified in the GetComplianceDetail
request.
String policyId
The ID of the AWS Firewall Manager policy that you want the details for.
String policyId
The ID of the policy for which you want to get the attack information.
String memberAccountId
The AWS account that is in scope of the policy that you want to get the details for.
Date startTime
The start of the time period to query for the attacks. This is a timestamp type. The request syntax
listing indicates a number type because the default used by AWS Firewall Manager is Unix time in
seconds. However, any valid timestamp format is allowed.
Date endTime
The end of the time period to query for the attacks. This is a timestamp type. The request syntax
listing indicates a number type because the default used by AWS Firewall Manager is Unix time in
seconds. However, any valid timestamp format is allowed.
String nextToken
If you specify a value for MaxResults and you have more objects than the number that you specify for
MaxResults, AWS Firewall Manager returns a NextToken value in the response, which you
can use to retrieve another group of objects. For the second and subsequent GetProtectionStatus
requests, specify the value of NextToken from the previous response to get information about another
batch of objects.
Integer maxResults
Specifies the number of objects that you want AWS Firewall Manager to return for this request. If you have more
objects than the number that you specify for MaxResults, the response includes a
NextToken value that you can use to get another batch of objects.
String adminAccountId
The ID of the AWS Firewall administrator account for this policy.
String serviceType
The service type that is protected by the policy. Currently, this is always SHIELD_ADVANCED.
String data
Details about the attack, including the following:
Attack type
Account ID
ARN of the resource attacked
Start time of the attack
End time of the attack (ongoing attacks will not have an end time)
The details are in JSON format.
String nextToken
If you have more objects than the number that you specified for MaxResults in the request, the
response includes a NextToken value. To list more objects, submit another
GetProtectionStatus request, and specify the NextToken value from the response in the
NextToken value in the next request.
AWS SDKs provide auto-pagination that identify NextToken in a response and make subsequent request
calls automatically on your behalf. However, this feature is not supported by GetProtectionStatus.
You must submit subsequent requests with NextToken using your own processes.
String policyId
The ID of the AWS Firewall Manager policy that you want the details for.
String nextToken
If you specify a value for MaxResults and you have more PolicyComplianceStatus objects
than the number that you specify for MaxResults, AWS Firewall Manager returns a
NextToken value in the response that allows you to list another group of
PolicyComplianceStatus objects. For the second and subsequent ListComplianceStatus
requests, specify the value of NextToken from the previous response to get information about another
batch of PolicyComplianceStatus objects.
Integer maxResults
Specifies the number of PolicyComplianceStatus objects that you want AWS Firewall Manager to return
for this request. If you have more PolicyComplianceStatus objects than the number that you specify
for MaxResults, the response includes a NextToken value that you can use to get another
batch of PolicyComplianceStatus objects.
List<E> policyComplianceStatusList
An array of PolicyComplianceStatus objects.
String nextToken
If you have more PolicyComplianceStatus objects than the number that you specified for
MaxResults in the request, the response includes a NextToken value. To list more
PolicyComplianceStatus objects, submit another ListComplianceStatus request, and
specify the NextToken value from the response in the NextToken value in the next
request.
String nextToken
If you specify a value for MaxResults and you have more account IDs than the number that you specify
for MaxResults, AWS Firewall Manager returns a NextToken value in the response that
allows you to list another group of IDs. For the second and subsequent ListMemberAccountsRequest
requests, specify the value of NextToken from the previous response to get information about another
batch of member account IDs.
Integer maxResults
Specifies the number of member account IDs that you want AWS Firewall Manager to return for this request. If you
have more IDs than the number that you specify for MaxResults, the response includes a
NextToken value that you can use to get another batch of member account IDs.
List<E> memberAccounts
An array of account IDs.
String nextToken
If you have more member account IDs than the number that you specified for MaxResults in the
request, the response includes a NextToken value. To list more IDs, submit another
ListMemberAccounts request, and specify the NextToken value from the response in the
NextToken value in the next request.
String nextToken
If you specify a value for MaxResults and you have more PolicySummary objects than the
number that you specify for MaxResults, AWS Firewall Manager returns a NextToken value
in the response that allows you to list another group of PolicySummary objects. For the second and
subsequent ListPolicies requests, specify the value of NextToken from the previous
response to get information about another batch of PolicySummary objects.
Integer maxResults
Specifies the number of PolicySummary objects that you want AWS Firewall Manager to return for this
request. If you have more PolicySummary objects than the number that you specify for
MaxResults, the response includes a NextToken value that you can use to get another
batch of PolicySummary objects.
List<E> policyList
An array of PolicySummary objects.
String nextToken
If you have more PolicySummary objects than the number that you specified for
MaxResults in the request, the response includes a NextToken value. To list more
PolicySummary objects, submit another ListPolicies request, and specify the
NextToken value from the response in the NextToken value in the next request.
String policyId
The ID of the AWS Firewall Manager policy.
String policyName
The friendly name of the AWS Firewall Manager policy.
String policyUpdateToken
A unique identifier for each update to the policy. When issuing a PutPolicy request, the
PolicyUpdateToken in the request must match the PolicyUpdateToken of the current policy
version. To get the PolicyUpdateToken of the current policy version, use a GetPolicy
request.
SecurityServicePolicyData securityServicePolicyData
Details about the security service that is being used to protect the resources.
String resourceType
The type of resource protected by or in scope of the policy. This is in the format shown in the AWS
Resource Types Reference. For AWS WAF and Shield Advanced, examples include
AWS::ElasticLoadBalancingV2::LoadBalancer and AWS::CloudFront::Distribution. For a
security group common policy, valid values are AWS::EC2::NetworkInterface and
AWS::EC2::Instance. For a security group content audit policy, valid values are
AWS::EC2::SecurityGroup, AWS::EC2::NetworkInterface, and
AWS::EC2::Instance. For a security group usage audit policy, the value is
AWS::EC2::SecurityGroup.
List<E> resourceTypeList
An array of ResourceType.
List<E> resourceTags
An array of ResourceTag objects.
Boolean excludeResourceTags
If set to True, resources with the tags that are specified in the ResourceTag array are
not in scope of the policy. If set to False, and the ResourceTag array is not null,
only resources with the specified tags are in scope of the policy.
Boolean remediationEnabled
Indicates if the policy should be automatically applied to new resources.
Map<K,V> includeMap
Specifies the AWS account IDs to include in the policy. If IncludeMap is null, all accounts in the
organization in AWS Organizations are included in the policy. If IncludeMap is not null, only values
listed in IncludeMap are included in the policy.
The key to the map is ACCOUNT. For example, a valid IncludeMap would be
{“ACCOUNT” : [“accountID1”, “accountID2”]}.
Map<K,V> excludeMap
Specifies the AWS account IDs to exclude from the policy. The IncludeMap values are evaluated first,
with all the appropriate account IDs added to the policy. Then the accounts listed in ExcludeMap are
removed, resulting in the final list of accounts to add to the policy.
The key to the map is ACCOUNT. For example, a valid ExcludeMap would be
{“ACCOUNT” : [“accountID1”, “accountID2”]}.
String policyOwner
The AWS account that created the AWS Firewall Manager policy.
String policyId
The ID of the AWS Firewall Manager policy.
String memberAccount
The AWS account ID.
List<E> violators
An array of resources that aren't protected by the AWS WAF or Shield Advanced policy or that aren't in compliance with the security group policy.
Boolean evaluationLimitExceeded
Indicates if over 100 resources are noncompliant with the AWS Firewall Manager policy.
Date expiredAt
A timestamp that indicates when the returned information should be considered out of date.
Map<K,V> issueInfoMap
Details about problems with dependent services, such as AWS WAF or AWS Config, that are causing a resource to be noncompliant. The details include the name of the dependent service and the error message received that indicates the problem with the service.
String policyOwner
The AWS account that created the AWS Firewall Manager policy.
String policyId
The ID of the AWS Firewall Manager policy.
String policyName
The friendly name of the AWS Firewall Manager policy.
String memberAccount
The member account ID.
List<E> evaluationResults
An array of EvaluationResult objects.
Date lastUpdated
Timestamp of the last update to the EvaluationResult objects.
Map<K,V> issueInfoMap
Details about problems with dependent services, such as AWS WAF or AWS Config, that are causing a resource to be noncompliant. The details include the name of the dependent service and the error message received that indicates the problem with the service.
String policyArn
The Amazon Resource Name (ARN) of the specified policy.
String policyId
The ID of the specified policy.
String policyName
The friendly name of the specified policy.
String resourceType
The type of resource protected by or in scope of the policy. This is in the format shown in the AWS
Resource Types Reference. For AWS WAF and Shield Advanced, examples include
AWS::ElasticLoadBalancingV2::LoadBalancer and AWS::CloudFront::Distribution. For a
security group common policy, valid values are AWS::EC2::NetworkInterface and
AWS::EC2::Instance. For a security group content audit policy, valid values are
AWS::EC2::SecurityGroup, AWS::EC2::NetworkInterface, and
AWS::EC2::Instance. For a security group usage audit policy, the value is
AWS::EC2::SecurityGroup.
String securityServiceType
The service that the policy is using to protect the resources. This specifies the type of policy that is created, either an AWS WAF policy, a Shield Advanced policy, or a security group policy.
Boolean remediationEnabled
Indicates if the policy should be automatically applied to new resources.
Policy policy
The details of the AWS Firewall Manager policy to be created.
String type
The service that the policy is using to protect the resources. This specifies the type of policy that is created, either an AWS WAF policy, a Shield Advanced policy, or a security group policy. For security group policies, Firewall Manager supports one security group for each common policy and for each content audit policy. This is an adjustable limit that you can increase by contacting AWS Support.
String managedServiceData
Details about the service that are specific to the service type, in JSON format. For service type
SHIELD_ADVANCED, this is an empty string.
Example: WAF
ManagedServiceData": "{\"type\": \"WAF\", \"ruleGroups\": [{\"id\": \"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}
Example: SECURITY_GROUPS_COMMON
"SecurityServicePolicyData":{"Type":"SECURITY_GROUPS_COMMON","ManagedServiceData":"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"},"RemediationEnabled":false,"ResourceType":"AWS::EC2::NetworkInterface"}
Example: SECURITY_GROUPS_CONTENT_AUDIT
"SecurityServicePolicyData":{"Type":"SECURITY_GROUPS_CONTENT_AUDIT","ManagedServiceData":"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd \"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"},"RemediationEnabled":false,"ResourceType":"AWS::EC2::NetworkInterface"}
The security group action for content audit can be ALLOW or DENY. For
ALLOW, all in-scope security group rules must be within the allowed range of the policy's security
group rules. For DENY, all in-scope security group rules must not contain a value or a range that
matches a rule value or range in the policy security group.
Example: SECURITY_GROUPS_USAGE_AUDIT
"SecurityServicePolicyData":{"Type":"SECURITY_GROUPS_USAGE_AUDIT","ManagedServiceData":"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"},"RemediationEnabled":false,"Resou rceType":"AWS::EC2::SecurityGroup"}
Copyright © 2019. All rights reserved.