String appName
The application's name.
String protocol
The IP protocol name or number. The name can be one of tcp, udp, or icmp.
For information on possible numbers, see Protocol Numbers.
Long port
The application's port number, for example 80.
String listId
The ID of the Firewall Manager applications list.
String listName
The name of the Firewall Manager applications list.
String listUpdateToken
A unique identifier for each update to the list. When you update the list, the update token must match the token of the current version of the application list. You can retrieve the update token by getting the list.
Date createTime
The time that the Firewall Manager applications list was created.
Date lastUpdateTime
The time that the Firewall Manager applications list was last updated.
List<E> appsList
An array of applications in the Firewall Manager applications list.
Map<K,V> previousAppsList
A map of previous version numbers to their corresponding App object arrays.
String adminAccount
The Amazon Web Services account ID to associate with Firewall Manager as the Firewall Manager administrator account. This must be an Organizations member account. For more information about Organizations, see Managing the Amazon Web Services Accounts in Your Organization.
String violationTarget
The security group rule that is being evaluated.
String violationTargetDescription
A description of the security group that violates the policy.
List<E> partialMatches
List of rules specified in the security group of the Firewall Manager policy that partially match the
ViolationTarget rule.
List<E> possibleSecurityGroupRemediationActions
Remediation options for the rule specified in the ViolationTarget.
String resourceId
The resource ID.
String violationReason
The reason that the resource is not protected by the policy.
String resourceType
The resource type. This is in the format shown in the Amazon
Web Services Resource Types Reference. For example: AWS::ElasticLoadBalancingV2::LoadBalancer,
AWS::CloudFront::Distribution, or AWS::NetworkFirewall::FirewallPolicy.
String listId
The ID of the applications list that you want to delete. You can retrieve this ID from PutAppsList,
ListAppsLists, and GetAppsList.
String policyId
The ID of the policy that you want to delete. You can retrieve this ID from PutPolicy and
ListPolicies.
Boolean deleteAllPolicyResources
If True, the request performs cleanup according to the policy type.
For WAF and Shield Advanced policies, the cleanup does the following:
Deletes rule groups created by Firewall Manager
Removes web ACLs from in-scope resources
Deletes web ACLs that contain no rules or rule groups
For security group policies, the cleanup does the following for each security group in the policy:
Disassociates the security group from in-scope resources
Deletes the security group if it was created through Firewall Manager and if it's no longer associated with any resources through another policy
After the cleanup, in-scope resources are no longer protected by web ACLs in this policy. Protection of out-of-scope resources remains unchanged. Scope is determined by tags that you create and accounts that you associate with the policy. When creating the policy, if you specify that only resources in specific accounts or with specific tags are in scope of the policy, those accounts and resources are handled by the policy. All others are out of scope. If you don't specify tags or accounts, all resources are in scope.
String listId
The ID of the protocols list that you want to delete. You can retrieve this ID from PutProtocolsList, ListProtocolsLists, and GetProtocolsLost.
String violationTarget
Information about the VPC ID.
String violationTargetDescription
A description of the violation that specifies the rule group and VPC.
Integer numberOfRuleGroupsAlreadyAssociated
The number of rule groups currently associated with the VPC.
String violationTarget
Information about the VPC ID.
String violationTargetDescription
A description of the violation that specifies the VPC and the rule group that's already associated with it.
Integer conflictingPriority
The priority setting of the two conflicting rule groups.
String conflictingPolicyId
The ID of the Firewall Manager DNS Firewall policy that was already applied to the VPC. This policy contains the rule group that's already associated with the VPC.
List<E> unavailablePriorities
The priorities of rule groups that are already associated with the VPC. To retry your operation, choose priority settings that aren't in this list for the rule groups in your new DNS Firewall policy.
String description
A description of the EC2 route table that is associated with the remediation action.
ActionTarget routeTableId
The ID of the EC2 route table that is associated with the remediation action.
ActionTarget subnetId
The ID of the subnet for the EC2 route table that is associated with the remediation action.
ActionTarget gatewayId
The ID of the gateway to be used with the EC2 route table that is associated with the remediation action.
String description
A description of the copied EC2 route table that is associated with the remediation action.
ActionTarget vpcId
The VPC ID of the copied EC2 route table that is associated with the remediation action.
ActionTarget routeTableId
The ID of the copied EC2 route table that is associated with the remediation action.
String description
A description of CreateRoute action in Amazon EC2.
String destinationCidrBlock
Information about the IPv4 CIDR address block used for the destination match.
String destinationPrefixListId
Information about the ID of a prefix list used for the destination match.
String destinationIpv6CidrBlock
Information about the IPv6 CIDR block destination.
ActionTarget vpcEndpointId
Information about the ID of a VPC endpoint. Supported for Gateway Load Balancer endpoints only.
ActionTarget gatewayId
Information about the ID of an internet gateway or virtual private gateway attached to your VPC.
ActionTarget routeTableId
Information about the ID of the route table for the route.
String description
A description of the CreateRouteTable action.
ActionTarget vpcId
Information about the ID of a VPC.
String description
A description of the DeleteRoute action.
String destinationCidrBlock
Information about the IPv4 CIDR range for the route. The value you specify must match the CIDR for the route exactly.
String destinationPrefixListId
Information about the ID of the prefix list for the route.
String destinationIpv6CidrBlock
Information about the IPv6 CIDR range for the route. The value you specify must match the CIDR for the route exactly.
ActionTarget routeTableId
Information about the ID of the route table.
String description
A description of the ReplaceRoute action in Amazon EC2.
String destinationCidrBlock
Information about the IPv4 CIDR address block used for the destination match. The value that you provide must match the CIDR of an existing route in the table.
String destinationPrefixListId
Information about the ID of the prefix list for the route.
String destinationIpv6CidrBlock
Information about the IPv6 CIDR address block used for the destination match. The value that you provide must match the CIDR of an existing route in the table.
ActionTarget gatewayId
Information about the ID of an internet gateway or virtual private gateway.
ActionTarget routeTableId
Information about the ID of the route table.
String description
A description of the ReplaceRouteTableAssociation action in Amazon EC2.
ActionTarget associationId
Information about the association ID.
ActionTarget routeTableId
Information about the ID of the new route table to associate with the subnet.
String complianceStatus
Describes an Amazon Web Services account's compliance with the Firewall Manager policy.
Long violatorCount
The number of resources that are noncompliant with the specified policy. For WAF and Shield Advanced policies, a resource is considered noncompliant if it is not associated with the policy. For security group policies, a resource is considered noncompliant if it doesn't comply with the rules of the policy and remediation is disabled or not possible.
Boolean evaluationLimitExceeded
Indicates that over 100 resources are noncompliant with the Firewall Manager policy.
String ipV4Cidr
Information about the IPv4 CIDR block.
String prefixListId
Information about the ID of the prefix list for the route.
String ipV6Cidr
Information about the IPv6 CIDR block.
List<E> contributingSubnets
Information about the contributing subnets.
List<E> allowedTargets
Information about the allowed targets.
String routeTableId
Information about the route table ID.
AppsListData appsList
Information about the specified Firewall Manager applications list.
String appsListArn
The Amazon Resource Name (ARN) of the applications list.
PolicyComplianceDetail policyComplianceDetail
Information about the resources and the policy that you specified in the GetComplianceDetail
request.
String policyId
The ID of the Firewall Manager policy that you want the details for.
String policyId
The ID of the policy for which you want to get the attack information.
String memberAccountId
The Amazon Web Services account that is in scope of the policy that you want to get the details for.
Date startTime
The start of the time period to query for the attacks. This is a timestamp type. The request syntax
listing indicates a number type because the default used by Firewall Manager is Unix time in
seconds. However, any valid timestamp format is allowed.
Date endTime
The end of the time period to query for the attacks. This is a timestamp type. The request syntax
listing indicates a number type because the default used by Firewall Manager is Unix time in
seconds. However, any valid timestamp format is allowed.
String nextToken
If you specify a value for MaxResults and you have more objects than the number that you specify for
MaxResults, Firewall Manager returns a NextToken value in the response, which you can
use to retrieve another group of objects. For the second and subsequent GetProtectionStatus
requests, specify the value of NextToken from the previous response to get information about another
batch of objects.
Integer maxResults
Specifies the number of objects that you want Firewall Manager to return for this request. If you have more
objects than the number that you specify for MaxResults, the response includes a
NextToken value that you can use to get another batch of objects.
String adminAccountId
The ID of the Firewall Manager administrator account for this policy.
String serviceType
The service type that is protected by the policy. Currently, this is always SHIELD_ADVANCED.
String data
Details about the attack, including the following:
Attack type
Account ID
ARN of the resource attacked
Start time of the attack
End time of the attack (ongoing attacks will not have an end time)
The details are in JSON format.
String nextToken
If you have more objects than the number that you specified for MaxResults in the request, the
response includes a NextToken value. To list more objects, submit another
GetProtectionStatus request, and specify the NextToken value from the response in the
NextToken value in the next request.
Amazon Web Services SDKs provide auto-pagination that identify NextToken in a response and make
subsequent request calls automatically on your behalf. However, this feature is not supported by
GetProtectionStatus. You must submit subsequent requests with NextToken using your own
processes.
ProtocolsListData protocolsList
Information about the specified Firewall Manager protocols list.
String protocolsListArn
The Amazon Resource Name (ARN) of the specified protocols list.
String policyId
The ID of the Firewall Manager policy that you want the details for. This currently only supports security group content audit policies.
String memberAccount
The Amazon Web Services account ID that you want the details for.
String resourceId
The ID of the resource that has violations.
String resourceType
The resource type. This is in the format shown in the Amazon
Web Services Resource Types Reference. Supported resource types are: AWS::EC2::Instance,
AWS::EC2::NetworkInterface, AWS::EC2::SecurityGroup,
AWS::NetworkFirewall::FirewallPolicy, and AWS::EC2::Subnet.
ViolationDetail violationDetail
Violation detail for a resource.
Boolean defaultLists
Specifies whether the lists to retrieve are default lists owned by Firewall Manager.
String nextToken
If you specify a value for MaxResults in your list request, and you have more objects than the
maximum, Firewall Manager returns this token in the response. For all but the first request, you provide the
token returned by the prior request in the request parameters, to retrieve the next batch of objects.
Integer maxResults
The maximum number of objects that you want Firewall Manager to return for this request. If more objects are
available, in the response, Firewall Manager provides a NextToken value that you can use in a
subsequent call to get the next batch of objects.
If you don't specify this, Firewall Manager returns all available objects.
List<E> appsLists
An array of AppsListDataSummary objects.
String nextToken
If you specify a value for MaxResults in your list request, and you have more objects than the
maximum, Firewall Manager returns this token in the response. You can use this token in subsequent requests to
retrieve the next batch of objects.
String policyId
The ID of the Firewall Manager policy that you want the details for.
String nextToken
If you specify a value for MaxResults and you have more PolicyComplianceStatus objects
than the number that you specify for MaxResults, Firewall Manager returns a NextToken
value in the response that allows you to list another group of PolicyComplianceStatus objects. For
the second and subsequent ListComplianceStatus requests, specify the value of NextToken
from the previous response to get information about another batch of PolicyComplianceStatus objects.
Integer maxResults
Specifies the number of PolicyComplianceStatus objects that you want Firewall Manager to return for
this request. If you have more PolicyComplianceStatus objects than the number that you specify for
MaxResults, the response includes a NextToken value that you can use to get another
batch of PolicyComplianceStatus objects.
List<E> policyComplianceStatusList
An array of PolicyComplianceStatus objects.
String nextToken
If you have more PolicyComplianceStatus objects than the number that you specified for
MaxResults in the request, the response includes a NextToken value. To list more
PolicyComplianceStatus objects, submit another ListComplianceStatus request, and
specify the NextToken value from the response in the NextToken value in the next
request.
String nextToken
If you specify a value for MaxResults and you have more account IDs than the number that you specify
for MaxResults, Firewall Manager returns a NextToken value in the response that allows
you to list another group of IDs. For the second and subsequent ListMemberAccountsRequest requests,
specify the value of NextToken from the previous response to get information about another batch of
member account IDs.
Integer maxResults
Specifies the number of member account IDs that you want Firewall Manager to return for this request. If you have
more IDs than the number that you specify for MaxResults, the response includes a
NextToken value that you can use to get another batch of member account IDs.
List<E> memberAccounts
An array of account IDs.
String nextToken
If you have more member account IDs than the number that you specified for MaxResults in the
request, the response includes a NextToken value. To list more IDs, submit another
ListMemberAccounts request, and specify the NextToken value from the response in the
NextToken value in the next request.
String nextToken
If you specify a value for MaxResults and you have more PolicySummary objects than the
number that you specify for MaxResults, Firewall Manager returns a NextToken value in
the response that allows you to list another group of PolicySummary objects. For the second and
subsequent ListPolicies requests, specify the value of NextToken from the previous
response to get information about another batch of PolicySummary objects.
Integer maxResults
Specifies the number of PolicySummary objects that you want Firewall Manager to return for this
request. If you have more PolicySummary objects than the number that you specify for
MaxResults, the response includes a NextToken value that you can use to get another
batch of PolicySummary objects.
List<E> policyList
An array of PolicySummary objects.
String nextToken
If you have more PolicySummary objects than the number that you specified for
MaxResults in the request, the response includes a NextToken value. To list more
PolicySummary objects, submit another ListPolicies request, and specify the
NextToken value from the response in the NextToken value in the next request.
Boolean defaultLists
Specifies whether the lists to retrieve are default lists owned by Firewall Manager.
String nextToken
If you specify a value for MaxResults in your list request, and you have more objects than the
maximum, Firewall Manager returns this token in the response. For all but the first request, you provide the
token returned by the prior request in the request parameters, to retrieve the next batch of objects.
Integer maxResults
The maximum number of objects that you want Firewall Manager to return for this request. If more objects are
available, in the response, Firewall Manager provides a NextToken value that you can use in a
subsequent call to get the next batch of objects.
If you don't specify this, Firewall Manager returns all available objects.
List<E> protocolsLists
An array of ProtocolsListDataSummary objects.
String nextToken
If you specify a value for MaxResults in your list request, and you have more objects than the
maximum, Firewall Manager returns this token in the response. You can use this token in subsequent requests to
retrieve the next batch of objects.
String resourceArn
The Amazon Resource Name (ARN) of the resource to return tags for. The Firewall Manager resources that support tagging are policies, applications lists, and protocols lists.
String subnetId
The subnet ID.
String subnetAvailabilityZone
The subnet Availability Zone.
String routeTableId
Information about the route table ID.
List<E> violatingRoutes
The route or routes that are in violation.
Boolean isRouteTableUsedInDifferentAZ
Information about whether the route table is used in another Availability Zone.
String currentFirewallSubnetRouteTable
Information about the subnet route table for the current firewall.
String expectedFirewallEndpoint
The expected endpoint for the current firewall.
String firewallSubnetId
The firewall subnet ID.
List<E> expectedFirewallSubnetRoutes
The firewall subnet routes that are expected.
List<E> actualFirewallSubnetRoutes
The actual firewall subnet routes.
String internetGatewayId
The internet gateway ID.
String currentInternetGatewayRouteTable
The current route table for the internet gateway.
List<E> expectedInternetGatewayRoutes
The internet gateway routes that are expected.
List<E> actualInternetGatewayRoutes
The actual internet gateway routes.
String vpcId
Information about the VPC ID.
List<E> affectedSubnets
The subnets that are affected.
String routeTableId
The route table ID.
Boolean isRouteTableUsedInDifferentAZ
Information about whether the route table is used in another Availability Zone.
Route violatingRoute
The route that's in violation.
String currentFirewallSubnetRouteTable
The subnet route table for the current firewall.
String expectedFirewallEndpoint
The firewall endpoint that's expected.
String actualFirewallEndpoint
The actual firewall endpoint.
String expectedFirewallSubnetId
The expected subnet ID for the firewall.
String actualFirewallSubnetId
The actual subnet ID for the firewall.
List<E> expectedFirewallSubnetRoutes
The firewall subnet routes that are expected.
List<E> actualFirewallSubnetRoutes
The actual firewall subnet routes that are expected.
String internetGatewayId
The internet gateway ID.
String currentInternetGatewayRouteTable
The route table for the current internet gateway.
List<E> expectedInternetGatewayRoutes
The expected routes for the internet gateway.
List<E> actualInternetGatewayRoutes
The actual internet gateway routes.
String vpcId
Information about the VPC ID.
String violationTarget
The ID of the Network Firewall or VPC resource that's in violation.
String vPC
The resource ID of the VPC associated with a violating subnet.
String availabilityZone
The Availability Zone of a violating subnet.
String currentRouteTable
The resource ID of the current route table that's associated with the subnet, if one is available.
String expectedRouteTable
The resource ID of the route table that should be associated with the subnet.
String violationTarget
The ID of the Network Firewall or VPC resource that's in violation.
String vPC
The resource ID of the VPC associated with a violating subnet.
String availabilityZone
The Availability Zone of a violating subnet.
String targetViolationReason
The reason the resource has this violation, if one is available.
String violationTarget
The ID of the Network Firewall or VPC resource that's in violation.
String vPC
The resource ID of the VPC associated with a violating subnet.
String availabilityZone
The Availability Zone of a violating subnet.
String targetViolationReason
The reason the resource has this violation, if one is available.
List<E> statelessRuleGroups
The stateless rule groups that are used in the Network Firewall firewall policy.
List<E> statelessDefaultActions
The actions to take on packets that don't match any of the stateless rule groups.
List<E> statelessFragmentDefaultActions
The actions to take on packet fragments that don't match any of the stateless rule groups.
List<E> statelessCustomActions
Names of custom actions that are available for use in the stateless default actions settings.
List<E> statefulRuleGroups
The stateful rule groups that are used in the Network Firewall firewall policy.
String violationTarget
The ID of the Network Firewall or VPC resource that's in violation.
NetworkFirewallPolicyDescription currentPolicyDescription
The policy that's currently in use in the individual account.
NetworkFirewallPolicyDescription expectedPolicyDescription
The policy that should be in use in the individual account in order to be compliant.
String firewallSubnetId
The subnet ID for the firewall.
List<E> violatingRoutes
The routes that are in violation.
String routeTableId
The ID of the route table.
String firewallEndpoint
The endpoint of the firewall.
String vpcId
Information about the VPC ID.
String policyId
The ID of the Firewall Manager policy.
String policyName
The name of the Firewall Manager policy.
String policyUpdateToken
A unique identifier for each update to the policy. When issuing a PutPolicy request, the
PolicyUpdateToken in the request must match the PolicyUpdateToken of the current policy
version. To get the PolicyUpdateToken of the current policy version, use a GetPolicy
request.
SecurityServicePolicyData securityServicePolicyData
Details about the security service that is being used to protect the resources.
String resourceType
The type of resource protected by or in scope of the policy. This is in the format shown in the Amazon
Web Services Resource Types Reference. To apply this policy to multiple resource types, specify a resource
type of ResourceTypeList and then specify the resource types in a ResourceTypeList.
For WAF and Shield Advanced, example resource types include
AWS::ElasticLoadBalancingV2::LoadBalancer and AWS::CloudFront::Distribution. For a
security group common policy, valid values are AWS::EC2::NetworkInterface and
AWS::EC2::Instance. For a security group content audit policy, valid values are
AWS::EC2::SecurityGroup, AWS::EC2::NetworkInterface, and
AWS::EC2::Instance. For a security group usage audit policy, the value is
AWS::EC2::SecurityGroup. For an Network Firewall policy or DNS Firewall policy, the value is
AWS::EC2::VPC.
List<E> resourceTypeList
An array of ResourceType objects. Use this only to specify multiple resource types. To specify a
single resource type, use ResourceType.
List<E> resourceTags
An array of ResourceTag objects.
Boolean excludeResourceTags
If set to True, resources with the tags that are specified in the ResourceTag array are
not in scope of the policy. If set to False, and the ResourceTag array is not null,
only resources with the specified tags are in scope of the policy.
Boolean remediationEnabled
Indicates if the policy should be automatically applied to new resources.
Boolean deleteUnusedFMManagedResources
Indicates whether Firewall Manager should delete Firewall Manager managed resources, such as web ACLs and security groups, when they are not in use by the Firewall Manager policy. By default, Firewall Manager doesn't delete unused Firewall Manager managed resources. This option is not available for Shield Advanced or WAF Classic policies.
Map<K,V> includeMap
Specifies the Amazon Web Services account IDs and Organizations organizational units (OUs) to include in the policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can specify inclusions or exclusions, but not both. If you specify an IncludeMap, Firewall
Manager applies the policy to all accounts specified by the IncludeMap, and does not evaluate any
ExcludeMap specifications. If you do not specify an IncludeMap, then Firewall Manager
applies the policy to all accounts except for those specified by the ExcludeMap.
You can specify account IDs, OUs, or a combination:
Specify account IDs by setting the key to ACCOUNT. For example, the following is a valid map:
{“ACCOUNT” : [“accountID1”, “accountID2”]}.
Specify OUs by setting the key to ORG_UNIT. For example, the following is a valid map:
{“ORG_UNIT” : [“ouid111”, “ouid112”]}.
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid
map: {“ACCOUNT” : [“accountID1”, “accountID2”], “ORG_UNIT” : [“ouid111”, “ouid112”]}.
Map<K,V> excludeMap
Specifies the Amazon Web Services account IDs and Organizations organizational units (OUs) to exclude from the policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can specify inclusions or exclusions, but not both. If you specify an IncludeMap, Firewall
Manager applies the policy to all accounts specified by the IncludeMap, and does not evaluate any
ExcludeMap specifications. If you do not specify an IncludeMap, then Firewall Manager
applies the policy to all accounts except for those specified by the ExcludeMap.
You can specify account IDs, OUs, or a combination:
Specify account IDs by setting the key to ACCOUNT. For example, the following is a valid map:
{“ACCOUNT” : [“accountID1”, “accountID2”]}.
Specify OUs by setting the key to ORG_UNIT. For example, the following is a valid map:
{“ORG_UNIT” : [“ouid111”, “ouid112”]}.
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid
map: {“ACCOUNT” : [“accountID1”, “accountID2”], “ORG_UNIT” : [“ouid111”, “ouid112”]}.
String policyOwner
The Amazon Web Services account that created the Firewall Manager policy.
String policyId
The ID of the Firewall Manager policy.
String memberAccount
The Amazon Web Services account ID.
List<E> violators
An array of resources that aren't protected by the WAF or Shield Advanced policy or that aren't in compliance with the security group policy.
Boolean evaluationLimitExceeded
Indicates if over 100 resources are noncompliant with the Firewall Manager policy.
Date expiredAt
A timestamp that indicates when the returned information should be considered out of date.
Map<K,V> issueInfoMap
Details about problems with dependent services, such as WAF or Config, and the error message received that indicates the problem with the service.
String policyOwner
The Amazon Web Services account that created the Firewall Manager policy.
String policyId
The ID of the Firewall Manager policy.
String policyName
The name of the Firewall Manager policy.
String memberAccount
The member account ID.
List<E> evaluationResults
An array of EvaluationResult objects.
Date lastUpdated
Timestamp of the last update to the EvaluationResult objects.
Map<K,V> issueInfoMap
Details about problems with dependent services, such as WAF or Config, and the error message received that indicates the problem with the service.
String policyArn
The Amazon Resource Name (ARN) of the specified policy.
String policyId
The ID of the specified policy.
String policyName
The name of the specified policy.
String resourceType
The type of resource protected by or in scope of the policy. This is in the format shown in the Amazon
Web Services Resource Types Reference. For WAF and Shield Advanced, examples include
AWS::ElasticLoadBalancingV2::LoadBalancer and AWS::CloudFront::Distribution. For a
security group common policy, valid values are AWS::EC2::NetworkInterface and
AWS::EC2::Instance. For a security group content audit policy, valid values are
AWS::EC2::SecurityGroup, AWS::EC2::NetworkInterface, and
AWS::EC2::Instance. For a security group usage audit policy, the value is
AWS::EC2::SecurityGroup. For an Network Firewall policy or DNS Firewall policy, the value is
AWS::EC2::VPC.
String securityServiceType
The service that the policy is using to protect the resources. This specifies the type of policy that is created, either an WAF policy, a Shield Advanced policy, or a security group policy.
Boolean remediationEnabled
Indicates if the policy should be automatically applied to new resources.
Boolean deleteUnusedFMManagedResources
Indicates whether Firewall Manager should delete Firewall Manager managed resources, such as web ACLs and security groups, when they are not in use by the Firewall Manager policy. By default, Firewall Manager doesn't delete unused Firewall Manager managed resources. This option is not available for Shield Advanced or WAF Classic policies.
String listId
The ID of the Firewall Manager protocols list.
String listName
The name of the Firewall Manager protocols list.
String listUpdateToken
A unique identifier for each update to the list. When you update the list, the update token must match the token of the current version of the application list. You can retrieve the update token by getting the list.
Date createTime
The time that the Firewall Manager protocols list was created.
Date lastUpdateTime
The time that the Firewall Manager protocols list was last updated.
List<E> protocolsList
An array of protocols in the Firewall Manager protocols list.
Map<K,V> previousProtocolsList
A map of previous version numbers to their corresponding protocol arrays.
String listArn
The Amazon Resource Name (ARN) of the specified protocols list.
String listId
The ID of the specified protocols list.
String listName
The name of the specified protocols list.
List<E> protocolsList
An array of protocols in the Firewall Manager protocols list.
AppsListData appsList
The details of the Firewall Manager applications list to be created.
List<E> tagList
The tags associated with the resource.
AppsListData appsList
The details of the Firewall Manager applications list.
String appsListArn
The Amazon Resource Name (ARN) of the applications list.
ProtocolsListData protocolsList
The details of the Firewall Manager protocols list to be created.
List<E> tagList
The tags associated with the resource.
ProtocolsListData protocolsList
The details of the Firewall Manager protocols list.
String protocolsListArn
The Amazon Resource Name (ARN) of the protocols list.
String description
A description of a remediation action.
EC2CreateRouteAction eC2CreateRouteAction
Information about the CreateRoute action in the Amazon EC2 API.
EC2ReplaceRouteAction eC2ReplaceRouteAction
Information about the ReplaceRoute action in the Amazon EC2 API.
EC2DeleteRouteAction eC2DeleteRouteAction
Information about the DeleteRoute action in the Amazon EC2 API.
EC2CopyRouteTableAction eC2CopyRouteTableAction
Information about the CopyRouteTable action in the Amazon EC2 API.
EC2ReplaceRouteTableAssociationAction eC2ReplaceRouteTableAssociationAction
Information about the ReplaceRouteTableAssociation action in the Amazon EC2 API.
EC2AssociateRouteTableAction eC2AssociateRouteTableAction
Information about the AssociateRouteTable action in the Amazon EC2 API.
EC2CreateRouteTableAction eC2CreateRouteTableAction
Information about the CreateRouteTable action in the Amazon EC2 API.
RemediationAction remediationAction
Information about an action you can take to remediate a violation.
Integer order
The order of the remediation actions in the list.
AwsVPCSecurityGroupViolation awsVPCSecurityGroupViolation
Violation detail for security groups.
AwsEc2NetworkInterfaceViolation awsEc2NetworkInterfaceViolation
Violation detail for a network interface.
AwsEc2InstanceViolation awsEc2InstanceViolation
Violation detail for an EC2 instance.
NetworkFirewallMissingFirewallViolation networkFirewallMissingFirewallViolation
Violation detail for an Network Firewall policy that indicates that a subnet has no Firewall Manager managed firewall in its VPC.
NetworkFirewallMissingSubnetViolation networkFirewallMissingSubnetViolation
Violation detail for an Network Firewall policy that indicates that an Availability Zone is missing the expected Firewall Manager managed subnet.
NetworkFirewallMissingExpectedRTViolation networkFirewallMissingExpectedRTViolation
Violation detail for an Network Firewall policy that indicates that a subnet is not associated with the expected Firewall Manager managed route table.
NetworkFirewallPolicyModifiedViolation networkFirewallPolicyModifiedViolation
Violation detail for an Network Firewall policy that indicates that a firewall policy in an individual account has been modified in a way that makes it noncompliant. For example, the individual account owner might have deleted a rule group, changed the priority of a stateless rule group, or changed a policy default action.
NetworkFirewallInternetTrafficNotInspectedViolation networkFirewallInternetTrafficNotInspectedViolation
Violation detail for the subnet for which internet traffic hasn't been inspected.
NetworkFirewallInvalidRouteConfigurationViolation networkFirewallInvalidRouteConfigurationViolation
The route configuration is invalid.
NetworkFirewallBlackHoleRouteDetectedViolation networkFirewallBlackHoleRouteDetectedViolation
NetworkFirewallUnexpectedFirewallRoutesViolation networkFirewallUnexpectedFirewallRoutesViolation
There's an unexpected firewall route.
NetworkFirewallUnexpectedGatewayRoutesViolation networkFirewallUnexpectedGatewayRoutesViolation
There's an unexpected gateway route.
NetworkFirewallMissingExpectedRoutesViolation networkFirewallMissingExpectedRoutesViolation
Expected routes are missing from Network Firewall.
DnsRuleGroupPriorityConflictViolation dnsRuleGroupPriorityConflictViolation
Violation detail for a DNS Firewall policy that indicates that a rule group that Firewall Manager tried to associate with a VPC has the same priority as a rule group that's already associated.
DnsDuplicateRuleGroupViolation dnsDuplicateRuleGroupViolation
Violation detail for a DNS Firewall policy that indicates that a rule group that Firewall Manager tried to associate with a VPC is already associated with the VPC and can't be associated again.
DnsRuleGroupLimitExceededViolation dnsRuleGroupLimitExceededViolation
Violation detail for a DNS Firewall policy that indicates that the VPC reached the limit for associated DNS Firewall rule groups. Firewall Manager tried to associate another rule group with the VPC and failed.
PossibleRemediationActions possibleRemediationActions
A list of possible remediation action lists. Each individual possible remediation action is a list of individual remediation actions.
String remediationActionType
The remediation action that will be performed.
String description
Brief description of the action that will be performed.
SecurityGroupRuleDescription remediationResult
The final state of the rule specified in the ViolationTarget after it is remediated.
Boolean isDefaultAction
Indicates if the current action is the default action.
String iPV4Range
The IPv4 ranges for the security group rule.
String iPV6Range
The IPv6 ranges for the security group rule.
String prefixListId
The ID of the prefix list for the security group rule.
String protocol
The IP protocol name (tcp, udp, icmp, icmpv6) or number.
Long fromPort
The start of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A value of
-1 indicates all ICMP/ICMPv6 types.
Long toPort
The end of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1
indicates all ICMP/ICMPv6 codes.
String type
The service that the policy is using to protect the resources. This specifies the type of policy that is created, either an WAF policy, a Shield Advanced policy, or a security group policy. For security group policies, Firewall Manager supports one security group for each common policy and for each content audit policy. This is an adjustable limit that you can increase by contacting Amazon Web Services Support.
String managedServiceData
Details about the service that are specific to the service type, in JSON format. For service type
SHIELD_ADVANCED, this is an empty string.
Example: DNS_FIREWALL
"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"
Valid values for preProcessRuleGroups are between 1 and 99. Valid values for
postProcessRuleGroups are between 9901 and 10000.
Example: NETWORK_FIREWALL
"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-1:1234567891011:stateless-rulegroup/rulegroup2\",\"priority\":10}],\"networkFirewallStatelessDefaultActions\":[\"aws:pass\",\"custom1\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"custom2\",\"aws:pass\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"custom1\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"dimension1\"}]}}},{\"actionName\":\"custom2\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"dimension2\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-1:1234567891011:stateful-rulegroup/rulegroup1\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":true,\"allowedIPV4CidrList\":[\"10.24.34.0/28\"]} }"
Example: WAFV2
"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesAmazonIpReputationList\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"
In the loggingConfiguration, you can specify one logDestinationConfigs, you can
optionally provide up to 20 redactedFields, and the RedactedFieldType must be one of
URI, QUERY_STRING, HEADER, or METHOD.
Example: WAF Classic
"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"
Example: SECURITY_GROUPS_COMMON
"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"
Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns
"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"
Example: SECURITY_GROUPS_CONTENT_AUDIT
"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"
The security group action for content audit can be ALLOW or DENY. For
ALLOW, all in-scope security group rules must be within the allowed range of the policy's security
group rules. For DENY, all in-scope security group rules must not contain a value or a range that
matches a rule value or range in the policy security group.
Example: SECURITY_GROUPS_USAGE_AUDIT
"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"
String ruleGroupName
The name of the rule group.
String resourceId
The resource ID of the rule group.
Integer priority
The priority of the rule group. Network Firewall evaluates the stateless rule groups in a firewall policy starting from the lowest priority setting.
String key
Part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive.
String value
Part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.
String policyId
The ID of the Firewall Manager policy that the violation details were requested for.
String memberAccount
The Amazon Web Services account that the violation details were requested for.
String resourceId
The resource ID that the violation details were requested for.
String resourceType
The resource type that the violation details were requested for.
List<E> resourceViolations
List of violations for the requested resource.
List<E> resourceTags
The ResourceTag objects associated with the resource.
String resourceDescription
Brief description for the requested resource.
Copyright © 2021. All rights reserved.