String appName
The application's name.
String protocol
The IP protocol name or number. The name can be one of tcp, udp, or icmp.
For information on possible numbers, see Protocol Numbers.
Long port
The application's port number, for example 80.
String listId
The ID of the AWS Firewall Manager applications list.
String listName
The name of the AWS Firewall Manager applications list.
String listUpdateToken
A unique identifier for each update to the list. When you update the list, the update token must match the token of the current version of the application list. You can retrieve the update token by getting the list.
Date createTime
The time that the AWS Firewall Manager applications list was created.
Date lastUpdateTime
The time that the AWS Firewall Manager applications list was last updated.
List<E> appsList
An array of applications in the AWS Firewall Manager applications list.
Map<K,V> previousAppsList
A map of previous version numbers to their corresponding App object arrays.
String adminAccount
The AWS account ID to associate with AWS Firewall Manager as the AWS Firewall Manager administrator account. This can be an AWS Organizations master account or a member account. For more information about AWS Organizations and master accounts, see Managing the AWS Accounts in Your Organization.
String violationTarget
The security group rule that is being evaluated.
String violationTargetDescription
A description of the security group that violates the policy.
List<E> partialMatches
List of rules specified in the security group of the AWS Firewall Manager policy that partially match the
ViolationTarget rule.
List<E> possibleSecurityGroupRemediationActions
Remediation options for the rule specified in the ViolationTarget.
String resourceId
The resource ID.
String violationReason
The reason that the resource is not protected by the policy.
String resourceType
The resource type. This is in the format shown in the AWS
Resource Types Reference. For example: AWS::ElasticLoadBalancingV2::LoadBalancer,
AWS::CloudFront::Distribution, or AWS::NetworkFirewall::FirewallPolicy.
String listId
The ID of the applications list that you want to delete. You can retrieve this ID from PutAppsList,
ListAppsLists, and GetAppsList.
String policyId
The ID of the policy that you want to delete. You can retrieve this ID from PutPolicy and
ListPolicies.
Boolean deleteAllPolicyResources
If True, the request performs cleanup according to the policy type.
For AWS WAF and Shield Advanced policies, the cleanup does the following:
Deletes rule groups created by AWS Firewall Manager
Removes web ACLs from in-scope resources
Deletes web ACLs that contain no rules or rule groups
For security group policies, the cleanup does the following for each security group in the policy:
Disassociates the security group from in-scope resources
Deletes the security group if it was created through Firewall Manager and if it's no longer associated with any resources through another policy
After the cleanup, in-scope resources are no longer protected by web ACLs in this policy. Protection of out-of-scope resources remains unchanged. Scope is determined by tags that you create and accounts that you associate with the policy. When creating the policy, if you specify that only resources in specific accounts or with specific tags are in scope of the policy, those accounts and resources are handled by the policy. All others are out of scope. If you don't specify tags or accounts, all resources are in scope.
String listId
The ID of the protocols list that you want to delete. You can retrieve this ID from PutProtocolsList, ListProtocolsLists, and GetProtocolsLost.
String complianceStatus
Describes an AWS account's compliance with the AWS Firewall Manager policy.
Long violatorCount
The number of resources that are noncompliant with the specified policy. For AWS WAF and Shield Advanced policies, a resource is considered noncompliant if it is not associated with the policy. For security group policies, a resource is considered noncompliant if it doesn't comply with the rules of the policy and remediation is disabled or not possible.
Boolean evaluationLimitExceeded
Indicates that over 100 resources are noncompliant with the AWS Firewall Manager policy.
AppsListData appsList
Information about the specified AWS Firewall Manager applications list.
String appsListArn
The Amazon Resource Name (ARN) of the applications list.
PolicyComplianceDetail policyComplianceDetail
Information about the resources and the policy that you specified in the GetComplianceDetail
request.
String policyId
The ID of the AWS Firewall Manager policy that you want the details for.
String policyId
The ID of the policy for which you want to get the attack information.
String memberAccountId
The AWS account that is in scope of the policy that you want to get the details for.
Date startTime
The start of the time period to query for the attacks. This is a timestamp type. The request syntax
listing indicates a number type because the default used by AWS Firewall Manager is Unix time in
seconds. However, any valid timestamp format is allowed.
Date endTime
The end of the time period to query for the attacks. This is a timestamp type. The request syntax
listing indicates a number type because the default used by AWS Firewall Manager is Unix time in
seconds. However, any valid timestamp format is allowed.
String nextToken
If you specify a value for MaxResults and you have more objects than the number that you specify for
MaxResults, AWS Firewall Manager returns a NextToken value in the response, which you
can use to retrieve another group of objects. For the second and subsequent GetProtectionStatus
requests, specify the value of NextToken from the previous response to get information about another
batch of objects.
Integer maxResults
Specifies the number of objects that you want AWS Firewall Manager to return for this request. If you have more
objects than the number that you specify for MaxResults, the response includes a
NextToken value that you can use to get another batch of objects.
String adminAccountId
The ID of the AWS Firewall administrator account for this policy.
String serviceType
The service type that is protected by the policy. Currently, this is always SHIELD_ADVANCED.
String data
Details about the attack, including the following:
Attack type
Account ID
ARN of the resource attacked
Start time of the attack
End time of the attack (ongoing attacks will not have an end time)
The details are in JSON format.
String nextToken
If you have more objects than the number that you specified for MaxResults in the request, the
response includes a NextToken value. To list more objects, submit another
GetProtectionStatus request, and specify the NextToken value from the response in the
NextToken value in the next request.
AWS SDKs provide auto-pagination that identify NextToken in a response and make subsequent request
calls automatically on your behalf. However, this feature is not supported by GetProtectionStatus.
You must submit subsequent requests with NextToken using your own processes.
ProtocolsListData protocolsList
Information about the specified AWS Firewall Manager protocols list.
String protocolsListArn
The Amazon Resource Name (ARN) of the specified protocols list.
String policyId
The ID of the AWS Firewall Manager policy that you want the details for. This currently only supports security group content audit policies.
String memberAccount
The AWS account ID that you want the details for.
String resourceId
The ID of the resource that has violations.
String resourceType
The resource type. This is in the format shown in the AWS
Resource Types Reference. Supported resource types are: AWS::EC2::Instance,
AWS::EC2::NetworkInterface, AWS::EC2::SecurityGroup,
AWS::NetworkFirewall::FirewallPolicy, and AWS::EC2::Subnet.
ViolationDetail violationDetail
Violation detail for a resource.
Boolean defaultLists
Specifies whether the lists to retrieve are default lists owned by AWS Firewall Manager.
String nextToken
If you specify a value for MaxResults in your list request, and you have more objects than the
maximum, AWS Firewall Manager returns this token in the response. For all but the first request, you provide the
token returned by the prior request in the request parameters, to retrieve the next batch of objects.
Integer maxResults
The maximum number of objects that you want AWS Firewall Manager to return for this request. If more objects are
available, in the response, AWS Firewall Manager provides a NextToken value that you can use in a
subsequent call to get the next batch of objects.
If you don't specify this, AWS Firewall Manager returns all available objects.
List<E> appsLists
An array of AppsListDataSummary objects.
String nextToken
If you specify a value for MaxResults in your list request, and you have more objects than the
maximum, AWS Firewall Manager returns this token in the response. You can use this token in subsequent requests
to retrieve the next batch of objects.
String policyId
The ID of the AWS Firewall Manager policy that you want the details for.
String nextToken
If you specify a value for MaxResults and you have more PolicyComplianceStatus objects
than the number that you specify for MaxResults, AWS Firewall Manager returns a
NextToken value in the response that allows you to list another group of
PolicyComplianceStatus objects. For the second and subsequent ListComplianceStatus
requests, specify the value of NextToken from the previous response to get information about another
batch of PolicyComplianceStatus objects.
Integer maxResults
Specifies the number of PolicyComplianceStatus objects that you want AWS Firewall Manager to return
for this request. If you have more PolicyComplianceStatus objects than the number that you specify
for MaxResults, the response includes a NextToken value that you can use to get another
batch of PolicyComplianceStatus objects.
List<E> policyComplianceStatusList
An array of PolicyComplianceStatus objects.
String nextToken
If you have more PolicyComplianceStatus objects than the number that you specified for
MaxResults in the request, the response includes a NextToken value. To list more
PolicyComplianceStatus objects, submit another ListComplianceStatus request, and
specify the NextToken value from the response in the NextToken value in the next
request.
String nextToken
If you specify a value for MaxResults and you have more account IDs than the number that you specify
for MaxResults, AWS Firewall Manager returns a NextToken value in the response that
allows you to list another group of IDs. For the second and subsequent ListMemberAccountsRequest
requests, specify the value of NextToken from the previous response to get information about another
batch of member account IDs.
Integer maxResults
Specifies the number of member account IDs that you want AWS Firewall Manager to return for this request. If you
have more IDs than the number that you specify for MaxResults, the response includes a
NextToken value that you can use to get another batch of member account IDs.
List<E> memberAccounts
An array of account IDs.
String nextToken
If you have more member account IDs than the number that you specified for MaxResults in the
request, the response includes a NextToken value. To list more IDs, submit another
ListMemberAccounts request, and specify the NextToken value from the response in the
NextToken value in the next request.
String nextToken
If you specify a value for MaxResults and you have more PolicySummary objects than the
number that you specify for MaxResults, AWS Firewall Manager returns a NextToken value
in the response that allows you to list another group of PolicySummary objects. For the second and
subsequent ListPolicies requests, specify the value of NextToken from the previous
response to get information about another batch of PolicySummary objects.
Integer maxResults
Specifies the number of PolicySummary objects that you want AWS Firewall Manager to return for this
request. If you have more PolicySummary objects than the number that you specify for
MaxResults, the response includes a NextToken value that you can use to get another
batch of PolicySummary objects.
List<E> policyList
An array of PolicySummary objects.
String nextToken
If you have more PolicySummary objects than the number that you specified for
MaxResults in the request, the response includes a NextToken value. To list more
PolicySummary objects, submit another ListPolicies request, and specify the
NextToken value from the response in the NextToken value in the next request.
Boolean defaultLists
Specifies whether the lists to retrieve are default lists owned by AWS Firewall Manager.
String nextToken
If you specify a value for MaxResults in your list request, and you have more objects than the
maximum, AWS Firewall Manager returns this token in the response. For all but the first request, you provide the
token returned by the prior request in the request parameters, to retrieve the next batch of objects.
Integer maxResults
The maximum number of objects that you want AWS Firewall Manager to return for this request. If more objects are
available, in the response, AWS Firewall Manager provides a NextToken value that you can use in a
subsequent call to get the next batch of objects.
If you don't specify this, AWS Firewall Manager returns all available objects.
List<E> protocolsLists
An array of ProtocolsListDataSummary objects.
String nextToken
If you specify a value for MaxResults in your list request, and you have more objects than the
maximum, AWS Firewall Manager returns this token in the response. You can use this token in subsequent requests
to retrieve the next batch of objects.
String resourceArn
The Amazon Resource Name (ARN) of the resource to return tags for. The AWS Firewall Manager resources that support tagging are policies, applications lists, and protocols lists.
String violationTarget
The ID of the AWS Network Firewall or VPC resource that's in violation.
String vPC
The resource ID of the VPC associated with a violating subnet.
String availabilityZone
The Availability Zone of a violating subnet.
String currentRouteTable
The resource ID of the current route table that's associated with the subnet, if one is available.
String expectedRouteTable
The resource ID of the route table that should be associated with the subnet.
String violationTarget
The ID of the AWS Network Firewall or VPC resource that's in violation.
String vPC
The resource ID of the VPC associated with a violating subnet.
String availabilityZone
The Availability Zone of a violating subnet.
String targetViolationReason
The reason the resource has this violation, if one is available.
String violationTarget
The ID of the AWS Network Firewall or VPC resource that's in violation.
String vPC
The resource ID of the VPC associated with a violating subnet.
String availabilityZone
The Availability Zone of a violating subnet.
String targetViolationReason
The reason the resource has this violation, if one is available.
List<E> statelessRuleGroups
The stateless rule groups that are used in the Network Firewall firewall policy.
List<E> statelessDefaultActions
The actions to take on packets that don't match any of the stateless rule groups.
List<E> statelessFragmentDefaultActions
The actions to take on packet fragments that don't match any of the stateless rule groups.
List<E> statelessCustomActions
Names of custom actions that are available for use in the stateless default actions settings.
List<E> statefulRuleGroups
The stateful rule groups that are used in the Network Firewall firewall policy.
String violationTarget
The ID of the AWS Network Firewall or VPC resource that's in violation.
NetworkFirewallPolicyDescription currentPolicyDescription
The policy that's currently in use in the individual account.
NetworkFirewallPolicyDescription expectedPolicyDescription
The policy that should be in use in the individual account in order to be compliant.
String policyId
The ID of the AWS Firewall Manager policy.
String policyName
The name of the AWS Firewall Manager policy.
String policyUpdateToken
A unique identifier for each update to the policy. When issuing a PutPolicy request, the
PolicyUpdateToken in the request must match the PolicyUpdateToken of the current policy
version. To get the PolicyUpdateToken of the current policy version, use a GetPolicy
request.
SecurityServicePolicyData securityServicePolicyData
Details about the security service that is being used to protect the resources.
String resourceType
The type of resource protected by or in scope of the policy. This is in the format shown in the AWS
Resource Types Reference. For AWS WAF and Shield Advanced, examples include
AWS::ElasticLoadBalancingV2::LoadBalancer and AWS::CloudFront::Distribution. For a
security group common policy, valid values are AWS::EC2::NetworkInterface and
AWS::EC2::Instance. For a security group content audit policy, valid values are
AWS::EC2::SecurityGroup, AWS::EC2::NetworkInterface, and
AWS::EC2::Instance. For a security group usage audit policy, the value is
AWS::EC2::SecurityGroup. For an AWS Network Firewall policy, the value is AWS::EC2::VPC
.
List<E> resourceTypeList
An array of ResourceType.
List<E> resourceTags
An array of ResourceTag objects.
Boolean excludeResourceTags
If set to True, resources with the tags that are specified in the ResourceTag array are
not in scope of the policy. If set to False, and the ResourceTag array is not null,
only resources with the specified tags are in scope of the policy.
Boolean remediationEnabled
Indicates if the policy should be automatically applied to new resources.
Map<K,V> includeMap
Specifies the AWS account IDs and AWS Organizations organizational units (OUs) to include in the policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can specify inclusions or exclusions, but not both. If you specify an IncludeMap, AWS Firewall
Manager applies the policy to all accounts specified by the IncludeMap, and does not evaluate any
ExcludeMap specifications. If you do not specify an IncludeMap, then Firewall Manager
applies the policy to all accounts except for those specified by the ExcludeMap.
You can specify account IDs, OUs, or a combination:
Specify account IDs by setting the key to ACCOUNT. For example, the following is a valid map:
{“ACCOUNT” : [“accountID1”, “accountID2”]}.
Specify OUs by setting the key to ORG_UNIT. For example, the following is a valid map:
{“ORG_UNIT” : [“ouid111”, “ouid112”]}.
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid
map: {“ACCOUNT” : [“accountID1”, “accountID2”], “ORG_UNIT” : [“ouid111”, “ouid112”]}.
Map<K,V> excludeMap
Specifies the AWS account IDs and AWS Organizations organizational units (OUs) to exclude from the policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can specify inclusions or exclusions, but not both. If you specify an IncludeMap, AWS Firewall
Manager applies the policy to all accounts specified by the IncludeMap, and does not evaluate any
ExcludeMap specifications. If you do not specify an IncludeMap, then Firewall Manager
applies the policy to all accounts except for those specified by the ExcludeMap.
You can specify account IDs, OUs, or a combination:
Specify account IDs by setting the key to ACCOUNT. For example, the following is a valid map:
{“ACCOUNT” : [“accountID1”, “accountID2”]}.
Specify OUs by setting the key to ORG_UNIT. For example, the following is a valid map:
{“ORG_UNIT” : [“ouid111”, “ouid112”]}.
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid
map: {“ACCOUNT” : [“accountID1”, “accountID2”], “ORG_UNIT” : [“ouid111”, “ouid112”]}.
String policyOwner
The AWS account that created the AWS Firewall Manager policy.
String policyId
The ID of the AWS Firewall Manager policy.
String memberAccount
The AWS account ID.
List<E> violators
An array of resources that aren't protected by the AWS WAF or Shield Advanced policy or that aren't in compliance with the security group policy.
Boolean evaluationLimitExceeded
Indicates if over 100 resources are noncompliant with the AWS Firewall Manager policy.
Date expiredAt
A timestamp that indicates when the returned information should be considered out of date.
Map<K,V> issueInfoMap
Details about problems with dependent services, such as AWS WAF or AWS Config, that are causing a resource to be noncompliant. The details include the name of the dependent service and the error message received that indicates the problem with the service.
String policyOwner
The AWS account that created the AWS Firewall Manager policy.
String policyId
The ID of the AWS Firewall Manager policy.
String policyName
The name of the AWS Firewall Manager policy.
String memberAccount
The member account ID.
List<E> evaluationResults
An array of EvaluationResult objects.
Date lastUpdated
Timestamp of the last update to the EvaluationResult objects.
Map<K,V> issueInfoMap
Details about problems with dependent services, such as AWS WAF or AWS Config, that are causing a resource to be noncompliant. The details include the name of the dependent service and the error message received that indicates the problem with the service.
String policyArn
The Amazon Resource Name (ARN) of the specified policy.
String policyId
The ID of the specified policy.
String policyName
The name of the specified policy.
String resourceType
The type of resource protected by or in scope of the policy. This is in the format shown in the AWS
Resource Types Reference. For AWS WAF and Shield Advanced, examples include
AWS::ElasticLoadBalancingV2::LoadBalancer and AWS::CloudFront::Distribution. For a
security group common policy, valid values are AWS::EC2::NetworkInterface and
AWS::EC2::Instance. For a security group content audit policy, valid values are
AWS::EC2::SecurityGroup, AWS::EC2::NetworkInterface, and
AWS::EC2::Instance. For a security group usage audit policy, the value is
AWS::EC2::SecurityGroup. For an AWS Network Firewall policy, the value is AWS::EC2::VPC
.
String securityServiceType
The service that the policy is using to protect the resources. This specifies the type of policy that is created, either an AWS WAF policy, a Shield Advanced policy, or a security group policy.
Boolean remediationEnabled
Indicates if the policy should be automatically applied to new resources.
String listId
The ID of the AWS Firewall Manager protocols list.
String listName
The name of the AWS Firewall Manager protocols list.
String listUpdateToken
A unique identifier for each update to the list. When you update the list, the update token must match the token of the current version of the application list. You can retrieve the update token by getting the list.
Date createTime
The time that the AWS Firewall Manager protocols list was created.
Date lastUpdateTime
The time that the AWS Firewall Manager protocols list was last updated.
List<E> protocolsList
An array of protocols in the AWS Firewall Manager protocols list.
Map<K,V> previousProtocolsList
A map of previous version numbers to their corresponding protocol arrays.
String listArn
The Amazon Resource Name (ARN) of the specified protocols list.
String listId
The ID of the specified protocols list.
String listName
The name of the specified protocols list.
List<E> protocolsList
An array of protocols in the AWS Firewall Manager protocols list.
AppsListData appsList
The details of the AWS Firewall Manager applications list to be created.
List<E> tagList
The tags associated with the resource.
AppsListData appsList
The details of the AWS Firewall Manager applications list.
String appsListArn
The Amazon Resource Name (ARN) of the applications list.
ProtocolsListData protocolsList
The details of the AWS Firewall Manager protocols list to be created.
List<E> tagList
The tags associated with the resource.
ProtocolsListData protocolsList
The details of the AWS Firewall Manager protocols list.
String protocolsListArn
The Amazon Resource Name (ARN) of the protocols list.
AwsVPCSecurityGroupViolation awsVPCSecurityGroupViolation
Violation details for security groups.
AwsEc2NetworkInterfaceViolation awsEc2NetworkInterfaceViolation
Violation details for network interface.
AwsEc2InstanceViolation awsEc2InstanceViolation
Violation details for an EC2 instance.
NetworkFirewallMissingFirewallViolation networkFirewallMissingFirewallViolation
Violation detail for an Network Firewall policy that indicates that a subnet has no Firewall Manager managed firewall in its VPC.
NetworkFirewallMissingSubnetViolation networkFirewallMissingSubnetViolation
Violation detail for an Network Firewall policy that indicates that an Availability Zone is missing the expected Firewall Manager managed subnet.
NetworkFirewallMissingExpectedRTViolation networkFirewallMissingExpectedRTViolation
Violation detail for an Network Firewall policy that indicates that a subnet is not associated with the expected Firewall Manager managed route table.
NetworkFirewallPolicyModifiedViolation networkFirewallPolicyModifiedViolation
Violation detail for an Network Firewall policy that indicates that a firewall policy in an individual account has been modified in a way that makes it noncompliant. For example, the individual account owner might have deleted a rule group, changed the priority of a stateless rule group, or changed a policy default action.
String remediationActionType
The remediation action that will be performed.
String description
Brief description of the action that will be performed.
SecurityGroupRuleDescription remediationResult
The final state of the rule specified in the ViolationTarget after it is remediated.
Boolean isDefaultAction
Indicates if the current action is the default action.
String iPV4Range
The IPv4 ranges for the security group rule.
String iPV6Range
The IPv6 ranges for the security group rule.
String prefixListId
The ID of the prefix list for the security group rule.
String protocol
The IP protocol name (tcp, udp, icmp, icmpv6) or number.
Long fromPort
The start of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of
-1 indicates all ICMP/ICMPv6 types.
Long toPort
The end of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1
indicates all ICMP/ICMPv6 codes.
String type
The service that the policy is using to protect the resources. This specifies the type of policy that is created, either an AWS WAF policy, a Shield Advanced policy, or a security group policy. For security group policies, Firewall Manager supports one security group for each common policy and for each content audit policy. This is an adjustable limit that you can increase by contacting AWS Support.
String managedServiceData
Details about the service that are specific to the service type, in JSON format. For service type
SHIELD_ADVANCED, this is an empty string.
Example: NETWORK_FIREWALL
"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-1:1234567891011:stateless-rulegroup/rulegroup2\",\"priority\":10}],\"networkFirewallStatelessDefaultActions\":[\"aws:pass\",\"custom1\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"custom2\",\"aws:pass\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"custom1\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"dimension1\"}]}}},{\"actionName\":\"custom2\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"dimension2\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-1:1234567891011:stateful-rulegroup/rulegroup1\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":true,\"allowedIPV4CidrList\":[\"10.24.34.0/28\"]} }"
Example: WAFV2
"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesAmazonIpReputationList\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"
In the loggingConfiguration, you can specify one logDestinationConfigs, you can
optionally provide up to 20 redactedFields, and the RedactedFieldType must be one of
URI, QUERY_STRING, HEADER, or METHOD.
Example: WAF Classic
"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"
Example: SECURITY_GROUPS_COMMON
"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"
Example: SECURITY_GROUPS_CONTENT_AUDIT
"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"
The security group action for content audit can be ALLOW or DENY. For
ALLOW, all in-scope security group rules must be within the allowed range of the policy's security
group rules. For DENY, all in-scope security group rules must not contain a value or a range that
matches a rule value or range in the policy security group.
Example: SECURITY_GROUPS_USAGE_AUDIT
"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"
String ruleGroupName
The name of the rule group.
String resourceId
The resource ID of the rule group.
Integer priority
The priority of the rule group. AWS Network Firewall evaluates the stateless rule groups in a firewall policy starting from the lowest priority setting.
String key
Part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive.
String value
Part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.
String policyId
The ID of the AWS Firewall Manager policy that the violation details were requested for.
String memberAccount
The AWS account that the violation details were requested for.
String resourceId
The resource ID that the violation details were requested for.
String resourceType
The resource type that the violation details were requested for.
List<E> resourceViolations
List of violations for the requested resource.
List<E> resourceTags
The ResourceTag objects associated with the resource.
String resourceDescription
Brief description for the requested resource.
Copyright © 2021. All rights reserved.