AWS Firewall Manager - Firewall ManagementJan 01, 2018 · AWS Firewall Manager will set the appropriate permissions for the given member account. The account that you associate with

AWS Firewall ManagerFirewall Management

API Version 2018-01-01

AWS Firewall Manager Firewall Management

AWS Firewall Manager: Firewall ManagementCopyright © 2021 Amazon Web Services, Inc. and/or its affiliates. All rights reserved.

Amazon's trademarks and trade dress may not be used in connection with any product or service that is notAmazon's, in any manner that is likely to cause confusion among customers, or in any manner that disparages ordiscredits Amazon. All other trademarks not owned by Amazon are the property of their respective owners, who mayor may not be affiliated with, connected to, or sponsored by Amazon.


Table of ContentsWelcome .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Actions .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

AssociateAdminAccount .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

DeleteAppsList ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

DeleteNotificationChannel ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

DeletePolicy .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

DeleteProtocolsList ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12

DisassociateAdminAccount .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

GetAdminAccount .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

GetAppsList ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

GetComplianceDetail .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

GetNotificationChannel ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

API Version 2018-01-01iii


Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

GetPolicy .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

GetProtectionStatus .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29Examples .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

GetProtocolsList ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33

GetViolationDetails ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

ListAppsLists ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

ListComplianceStatus .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

ListMemberAccounts .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

ListPolicies ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48

API Version 2018-01-01iv


Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

ListProtocolsLists ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

ListTagsForResource .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

PutAppsList ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58

PutNotificationChannel ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60

PutPolicy .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 63See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64

PutProtocolsList ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65Response Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67

TagResource .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

UntagResource .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70Request Syntax .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70Request Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70Response Elements .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

API Version 2018-01-01v


Data Types .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72App .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

AppsListData .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75

AppsListDataSummary .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76

AwsEc2InstanceViolation .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

AwsEc2NetworkInterfaceViolation .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

AwsVPCSecurityGroupViolation .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80

ComplianceViolator ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81

EvaluationResult ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82

NetworkFirewallMissingExpectedRTViolation .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84

NetworkFirewallMissingFirewallViolation .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85

NetworkFirewallMissingSubnetViolation .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87

NetworkFirewallPolicyDescription .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89

NetworkFirewallPolicyModifiedViolation .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91

PartialMatch .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

Policy .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 95

PolicyComplianceDetail .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97

PolicyComplianceStatus .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99

PolicySummary .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101

ProtocolsListData .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102

API Version 2018-01-01vi


See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103ProtocolsListDataSummary .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104

ResourceTag .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106

ResourceViolation .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108

SecurityGroupRemediationAction .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109

SecurityGroupRuleDescription .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111

SecurityServicePolicyData .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

StatefulRuleGroup .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114

StatelessRuleGroup .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115

Tag .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116

ViolationDetail .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117Contents .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117See Also .... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118

Common Parameters ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119Common Errors ... . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121

API Version 2018-01-01vii


WelcomeThis is the AWS Firewall Manager API Reference. This guide is for developers who need detailedinformation about the AWS Firewall Manager API actions, data types, and errors. For detailedinformation about AWS Firewall Manager features, see the AWS Firewall Manager Developer Guide.

Some API actions require explicit resource permissions. For information, see the developer guide topicFirewall Manager required permissions for API actions.

This document was last published on January 27, 2021.


https://docs.aws.amazon.com/waf/latest/developerguide/fms-chapter.html

https://docs.aws.amazon.com/waf/latest/developerguide/fms-api-permissions-ref.html


ActionsThe following actions are supported:

• AssociateAdminAccount (p. 3)• DeleteAppsList (p. 5)• DeleteNotificationChannel (p. 7)• DeletePolicy (p. 8)• DeleteProtocolsList (p. 11)• DisassociateAdminAccount (p. 13)• GetAdminAccount (p. 14)• GetAppsList (p. 16)• GetComplianceDetail (p. 19)• GetNotificationChannel (p. 22)• GetPolicy (p. 24)• GetProtectionStatus (p. 27)• GetProtocolsList (p. 32)• GetViolationDetails (p. 35)• ListAppsLists (p. 39)• ListComplianceStatus (p. 42)• ListMemberAccounts (p. 45)• ListPolicies (p. 48)• ListProtocolsLists (p. 51)• ListTagsForResource (p. 54)• PutAppsList (p. 56)• PutNotificationChannel (p. 59)• PutPolicy (p. 61)• PutProtocolsList (p. 65)• TagResource (p. 68)• UntagResource (p. 70)


AWS Firewall Manager Firewall ManagementAssociateAdminAccount

AssociateAdminAccountSets the AWS Firewall Manager administrator account. AWS Firewall Manager must be associatedwith the master account of your AWS organization or associated with a member account that has theappropriate permissions. If the account ID that you submit is not an AWS Organizations master account,AWS Firewall Manager will set the appropriate permissions for the given member account.

The account that you associate with AWS Firewall Manager is called the AWS Firewall Manageradministrator account.

Request Syntax{ "AdminAccount": "string"}

Request ParametersFor information about the parameters that are common to all actions, see CommonParameters (p. 119).

The request accepts the following data in JSON format.

AdminAccount (p. 3)

The AWS account ID to associate with AWS Firewall Manager as the AWS Firewall Manageradministrator account. This can be an AWS Organizations master account or a member account. Formore information about AWS Organizations and master accounts, see Managing the AWS Accountsin Your Organization.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 1024.

Pattern: ^[0-9]+$

Required: Yes

Response ElementsIf the action is successful, the service sends back an HTTP 200 response with an empty HTTP body.

ErrorsFor information about the errors that are common to all actions, see Common Errors (p. 121).

InternalErrorException

The operation failed because of a system problem, even though the request was valid. Retry yourrequest.

HTTP Status Code: 400InvalidInputException

The parameters of the request were invalid.


https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts.html

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts.html

AWS Firewall Manager Firewall ManagementSee Also

HTTP Status Code: 400InvalidOperationException

The operation failed because there was nothing to do or the operation wasn't possible. For example,you might have submitted an AssociateAdminAccount request for an account ID that was alreadyset as the AWS Firewall Manager administrator. Or you might have tried to access a Region that'sdisabled by default, and that you need to enable for the Firewall Manager administrator account andfor AWS Organizations before you can access it.

HTTP Status Code: 400ResourceNotFoundException

The specified resource was not found.

HTTP Status Code: 400

See AlsoFor more information about using this API in one of the language-specific AWS SDKs, see the following:

• AWS Command Line Interface• AWS SDK for .NET• AWS SDK for C++• AWS SDK for Go• AWS SDK for Java V2• AWS SDK for JavaScript• AWS SDK for PHP V3• AWS SDK for Python• AWS SDK for Ruby V3


https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/AssociateAdminAccount

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/AssociateAdminAccount

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/AssociateAdminAccount

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/AssociateAdminAccount

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/AssociateAdminAccount

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/AssociateAdminAccount

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/AssociateAdminAccount

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/AssociateAdminAccount

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/AssociateAdminAccount

AWS Firewall Manager Firewall ManagementDeleteAppsList

DeleteAppsListPermanently deletes an AWS Firewall Manager applications list.

Request Syntax{ "ListId": "string"}



ListId (p. 5)

The ID of the applications list that you want to delete. You can retrieve this ID from PutAppsList,ListAppsLists, and GetAppsList.

Type: String

Length Constraints: Fixed length of 36.

Pattern: ^[a-z0-9A-Z-]{36}$

Required: Yes










ResourceNotFoundException






https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/DeleteAppsList

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/DeleteAppsList

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/DeleteAppsList

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/DeleteAppsList

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/DeleteAppsList

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/DeleteAppsList

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/DeleteAppsList

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/DeleteAppsList

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/DeleteAppsList

AWS Firewall Manager Firewall ManagementDeleteNotificationChannel

DeleteNotificationChannelDeletes an AWS Firewall Manager association with the IAM role and the Amazon Simple NotificationService (SNS) topic that is used to record AWS Firewall Manager SNS logs.













https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/DeleteNotificationChannel

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/DeleteNotificationChannel

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/DeleteNotificationChannel

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/DeleteNotificationChannel

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/DeleteNotificationChannel

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/DeleteNotificationChannel

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/DeleteNotificationChannel

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/DeleteNotificationChannel

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/DeleteNotificationChannel

AWS Firewall Manager Firewall ManagementDeletePolicy

DeletePolicyPermanently deletes an AWS Firewall Manager policy.

Request Syntax{ "DeleteAllPolicyResources": boolean, "PolicyId": "string"}



DeleteAllPolicyResources (p. 8)

If True, the request performs cleanup according to the policy type.

For AWS WAF and Shield Advanced policies, the cleanup does the following:• Deletes rule groups created by AWS Firewall Manager• Removes web ACLs from in-scope resources• Deletes web ACLs that contain no rules or rule groups

For security group policies, the cleanup does the following for each security group in the policy:• Disassociates the security group from in-scope resources• Deletes the security group if it was created through Firewall Manager and if it's no longer

associated with any resources through another policy

After the cleanup, in-scope resources are no longer protected by web ACLs in this policy. Protectionof out-of-scope resources remains unchanged. Scope is determined by tags that you create andaccounts that you associate with the policy. When creating the policy, if you specify that onlyresources in specific accounts or with specific tags are in scope of the policy, those accounts andresources are handled by the policy. All others are out of scope. If you don't specify tags or accounts,all resources are in scope.

Type: Boolean

Required: NoPolicyId (p. 8)

The ID of the policy that you want to delete. You can retrieve this ID from PutPolicy andListPolicies.

Type: String



Required: Yes


AWS Firewall Manager Firewall ManagementResponse Elements









HTTP Status Code: 400LimitExceededException

The operation exceeds a resource limit, for example, the maximum number of policy objects thatyou can create for an AWS account. For more information, see Firewall Manager Limits in the AWSWAF Developer Guide.





• AWS Command Line Interface• AWS SDK for .NET• AWS SDK for C++• AWS SDK for Go• AWS SDK for Java V2• AWS SDK for JavaScript• AWS SDK for PHP V3• AWS SDK for Python


https://docs.aws.amazon.com/waf/latest/developerguide/fms-limits.html

https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/DeletePolicy

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/DeletePolicy

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/DeletePolicy

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/DeletePolicy

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/DeletePolicy

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/DeletePolicy

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/DeletePolicy

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/DeletePolicy


• AWS SDK for Ruby V3


https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/DeletePolicy

AWS Firewall Manager Firewall ManagementDeleteProtocolsList

DeleteProtocolsListPermanently deletes an AWS Firewall Manager protocols list.

Request Syntax{ "ListId": "string"}



ListId (p. 11)

The ID of the protocols list that you want to delete. You can retrieve this ID fromPutProtocolsList, ListProtocolsLists, and GetProtocolsLost.

Type: String



Required: Yes
















https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/DeleteProtocolsList

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/DeleteProtocolsList

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/DeleteProtocolsList

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/DeleteProtocolsList

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/DeleteProtocolsList

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/DeleteProtocolsList

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/DeleteProtocolsList

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/DeleteProtocolsList

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/DeleteProtocolsList

AWS Firewall Manager Firewall ManagementDisassociateAdminAccount

DisassociateAdminAccountDisassociates the account that has been set as the AWS Firewall Manager administrator account. To set adifferent account as the administrator account, you must submit an AssociateAdminAccount request.













https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/DisassociateAdminAccount

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/DisassociateAdminAccount

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/DisassociateAdminAccount

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/DisassociateAdminAccount

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/DisassociateAdminAccount

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/DisassociateAdminAccount

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/DisassociateAdminAccount

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/DisassociateAdminAccount

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/DisassociateAdminAccount

AWS Firewall Manager Firewall ManagementGetAdminAccount

GetAdminAccountReturns the AWS Organizations master account that is associated with AWS Firewall Manager as the AWSFirewall Manager administrator.

Response Syntax{ "AdminAccount": "string", "RoleStatus": "string"}

Response ElementsIf the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

AdminAccount (p. 14)

The AWS account that is set as the AWS Firewall Manager administrator.

Type: String


Pattern: ^[0-9]+$RoleStatus (p. 14)

The status of the AWS account that you set as the AWS Firewall Manager administrator.

Type: String

Valid Values: READY | CREATING | PENDING_DELETION | DELETING | DELETED















https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/GetAdminAccount

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/GetAdminAccount

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/GetAdminAccount

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/GetAdminAccount

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/GetAdminAccount

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/GetAdminAccount

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/GetAdminAccount

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/GetAdminAccount

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/GetAdminAccount

AWS Firewall Manager Firewall ManagementGetAppsList

GetAppsListReturns information about the specified AWS Firewall Manager applications list.

Request Syntax{ "DefaultList": boolean, "ListId": "string"}



DefaultList (p. 16)

Specifies whether the list to retrieve is a default list owned by AWS Firewall Manager.

Type: Boolean

Required: No

ListId (p. 16)

The ID of the AWS Firewall Manager applications list that you want the details for.

Type: String



Required: Yes

Response Syntax{ "AppsList": { "AppsList": [ { "AppName": "string", "Port": number, "Protocol": "string" } ], "CreateTime": number, "LastUpdateTime": number, "ListId": "string", "ListName": "string", "ListUpdateToken": "string", "PreviousAppsList": { "string" : [



{ "AppName": "string", "Port": number, "Protocol": "string" } ] } }, "AppsListArn": "string"}



AppsList (p. 16)

Information about the specified AWS Firewall Manager applications list.

Type: AppsListData (p. 74) object

AppsListArn (p. 16)

The Amazon Resource Name (ARN) of the applications list.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$





InvalidOperationException











https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/GetAppsList

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/GetAppsList

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/GetAppsList

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/GetAppsList

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/GetAppsList

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/GetAppsList

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/GetAppsList

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/GetAppsList

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/GetAppsList

AWS Firewall Manager Firewall ManagementGetComplianceDetail

GetComplianceDetailReturns detailed compliance information about the specified member account. Details include resourcesthat are in and out of compliance with the specified policy. Resources are considered noncompliant forAWS WAF and Shield Advanced policies if the specified policy has not been applied to them. Resourcesare considered noncompliant for security group policies if they are in scope of the policy, they violateone or more of the policy rules, and remediation is disabled or not possible. Resources are considerednoncompliant for Network Firewall policies if a firewall is missing in the VPC, if the firewall endpointisn't set up in an expected Availability Zone and subnet, if a subnet created by the Firewall Managerdoesn't have the expected route table, and for modifications to a firewall policy that violate the FirewallManager policy's rules.

Request Syntax{ "MemberAccount": "string", "PolicyId": "string"}



MemberAccount (p. 19)

The AWS account that owns the resources that you want to get the details for.

Type: String


Pattern: ^[0-9]+$

Required: YesPolicyId (p. 19)

The ID of the policy that you want to get the details for. PolicyId is returned by PutPolicy andby ListPolicies.

Type: String



Required: Yes

Response Syntax{ "PolicyComplianceDetail": {



"EvaluationLimitExceeded": boolean, "ExpiredAt": number, "IssueInfoMap": { "string" : "string" }, "MemberAccount": "string", "PolicyId": "string", "PolicyOwner": "string", "Violators": [ { "ResourceId": "string", "ResourceType": "string", "ViolationReason": "string" } ] }}



PolicyComplianceDetail (p. 19)

Information about the resources and the policy that you specified in the GetComplianceDetailrequest.

Type: PolicyComplianceDetail (p. 96) object
















https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/GetComplianceDetail

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/GetComplianceDetail

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/GetComplianceDetail

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/GetComplianceDetail

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/GetComplianceDetail

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/GetComplianceDetail

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/GetComplianceDetail

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/GetComplianceDetail

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/GetComplianceDetail

AWS Firewall Manager Firewall ManagementGetNotificationChannel

GetNotificationChannelInformation about the Amazon Simple Notification Service (SNS) topic that is used to record AWSFirewall Manager SNS logs.

Response Syntax{ "SnsRoleName": "string", "SnsTopicArn": "string"}



SnsRoleName (p. 22)

The IAM role that is used by AWS Firewall Manager to record activity to SNS.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$SnsTopicArn (p. 22)

The SNS topic that records AWS Firewall Manager activity.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$














https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/GetNotificationChannel

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/GetNotificationChannel

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/GetNotificationChannel

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/GetNotificationChannel

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/GetNotificationChannel

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/GetNotificationChannel

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/GetNotificationChannel

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/GetNotificationChannel

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/GetNotificationChannel

AWS Firewall Manager Firewall ManagementGetPolicy

GetPolicyReturns information about the specified AWS Firewall Manager policy.

Request Syntax{ "PolicyId": "string"}



PolicyId (p. 24)

The ID of the AWS Firewall Manager policy that you want the details for.

Type: String



Required: Yes

Response Syntax{ "Policy": { "ExcludeMap": { "string" : [ "string" ] }, "ExcludeResourceTags": boolean, "IncludeMap": { "string" : [ "string" ] }, "PolicyId": "string", "PolicyName": "string", "PolicyUpdateToken": "string", "RemediationEnabled": boolean, "ResourceTags": [ { "Key": "string", "Value": "string" } ], "ResourceType": "string", "ResourceTypeList": [ "string" ], "SecurityServicePolicyData": { "ManagedServiceData": "string", "Type": "string" } }, "PolicyArn": "string"



}



Policy (p. 24)

Information about the specified AWS Firewall Manager policy.

Type: Policy (p. 93) objectPolicyArn (p. 24)

The Amazon Resource Name (ARN) of the specified policy.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$






HTTP Status Code: 400InvalidTypeException

The value of the Type parameter is invalid.









https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/GetPolicy

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/GetPolicy

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/GetPolicy

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/GetPolicy

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/GetPolicy

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/GetPolicy

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/GetPolicy

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/GetPolicy

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/GetPolicy

AWS Firewall Manager Firewall ManagementGetProtectionStatus

GetProtectionStatusIf you created a Shield Advanced policy, returns policy-level attack summary information in the event ofa potential DDoS attack. Other policy types are currently unsupported.

Request Syntax{ "EndTime": number, "MaxResults": number, "MemberAccountId": "string", "NextToken": "string", "PolicyId": "string", "StartTime": number}



EndTime (p. 27)

The end of the time period to query for the attacks. This is a timestamp type. The request syntaxlisting indicates a number type because the default used by AWS Firewall Manager is Unix time inseconds. However, any valid timestamp format is allowed.

Type: Timestamp

Required: NoMaxResults (p. 27)

Specifies the number of objects that you want AWS Firewall Manager to return for this request. Ifyou have more objects than the number that you specify for MaxResults, the response includes aNextToken value that you can use to get another batch of objects.

Type: Integer

Valid Range: Minimum value of 1. Maximum value of 100.

Required: NoMemberAccountId (p. 27)

The AWS account that is in scope of the policy that you want to get the details for.

Type: String


Pattern: ^[0-9]+$

Required: NoNextToken (p. 27)

If you specify a value for MaxResults and you have more objects than the number that you specifyfor MaxResults, AWS Firewall Manager returns a NextToken value in the response, which you can


AWS Firewall Manager Firewall ManagementResponse Syntax

use to retrieve another group of objects. For the second and subsequent GetProtectionStatusrequests, specify the value of NextToken from the previous response to get information aboutanother batch of objects.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoPolicyId (p. 27)

The ID of the policy for which you want to get the attack information.

Type: String



Required: YesStartTime (p. 27)

The start of the time period to query for the attacks. This is a timestamp type. The request syntaxlisting indicates a number type because the default used by AWS Firewall Manager is Unix time inseconds. However, any valid timestamp format is allowed.

Type: Timestamp

Required: No

Response Syntax{ "AdminAccountId": "string", "Data": "string", "NextToken": "string", "ServiceType": "string"}



AdminAccountId (p. 28)

The ID of the AWS Firewall administrator account for this policy.

Type: String


Pattern: ^[0-9]+$Data (p. 28)

Details about the attack, including the following:


AWS Firewall Manager Firewall ManagementErrors

• Attack type• Account ID• ARN of the resource attacked• Start time of the attack• End time of the attack (ongoing attacks will not have an end time)

The details are in JSON format.

Type: StringNextToken (p. 28)

If you have more objects than the number that you specified for MaxResults in the request, theresponse includes a NextToken value. To list more objects, submit another GetProtectionStatusrequest, and specify the NextToken value from the response in the NextToken value in the nextrequest.

AWS SDKs provide auto-pagination that identify NextToken in a response and makesubsequent request calls automatically on your behalf. However, this feature is not supported byGetProtectionStatus. You must submit subsequent requests with NextToken using your ownprocesses.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$ServiceType (p. 28)

The service type that is protected by the policy. Currently, this is always SHIELD_ADVANCED.

Type: String

Valid Values: WAF | WAFV2 | SHIELD_ADVANCED | SECURITY_GROUPS_COMMON| SECURITY_GROUPS_CONTENT_AUDIT | SECURITY_GROUPS_USAGE_AUDIT |NETWORK_FIREWALL










AWS Firewall Manager Firewall ManagementExamples

ExamplesExample responseThis example illustrates one usage of GetProtectionStatus.

[ { accountId: account1 attackSummaries:[ { attackId: attackId1 resourceARN: resource1 attackVector: [SYC_FLOOD, UDP_REFLECTION] startTime: 1234567890123 endTime: 1234567890123 }, { attackId: attackId2 resourceARN: resource2 attackVector: [SYC_FLOOD] startTime: 1234567890123 endTime: 1234567890123 } ] }, { accountId: account2 attackSummaries:[ { attackId: attackId3 resourceARN: resource3 attackVector: [SYC_FLOOD, UDP_REFLECTION] startTime: 1234567890123 endTime: 1234567890123 }, { attackId: attackId4 resourceARN: resource4 attackVector: [SYC_FLOOD] startTime: 1234567890123 endTime: 1234567890123 } ] },]


• AWS Command Line Interface• AWS SDK for .NET• AWS SDK for C++• AWS SDK for Go• AWS SDK for Java V2• AWS SDK for JavaScript• AWS SDK for PHP V3


https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/GetProtectionStatus

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/GetProtectionStatus

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/GetProtectionStatus

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/GetProtectionStatus

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/GetProtectionStatus

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/GetProtectionStatus

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/GetProtectionStatus


• AWS SDK for Python• AWS SDK for Ruby V3


https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/GetProtectionStatus

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/GetProtectionStatus

AWS Firewall Manager Firewall ManagementGetProtocolsList

GetProtocolsListReturns information about the specified AWS Firewall Manager protocols list.

Request Syntax

{ "DefaultList": boolean, "ListId": "string"}



DefaultList (p. 32)

Specifies whether the list to retrieve is a default list owned by AWS Firewall Manager.

Type: Boolean

Required: No

ListId (p. 32)

The ID of the AWS Firewall Manager protocols list that you want the details for.

Type: String



Required: Yes

Response Syntax

{ "ProtocolsList": { "CreateTime": number, "LastUpdateTime": number, "ListId": "string", "ListName": "string", "ListUpdateToken": "string", "PreviousProtocolsList": { "string" : [ "string" ] }, "ProtocolsList": [ "string" ] }, "ProtocolsListArn": "string"}





ProtocolsList (p. 32)

Information about the specified AWS Firewall Manager protocols list.

Type: ProtocolsListData (p. 102) objectProtocolsListArn (p. 32)

The Amazon Resource Name (ARN) of the specified protocols list.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$










• AWS Command Line Interface• AWS SDK for .NET• AWS SDK for C++• AWS SDK for Go• AWS SDK for Java V2


https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/GetProtocolsList

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/GetProtocolsList

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/GetProtocolsList

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/GetProtocolsList

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/GetProtocolsList


• AWS SDK for JavaScript• AWS SDK for PHP V3• AWS SDK for Python• AWS SDK for Ruby V3


https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/GetProtocolsList

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/GetProtocolsList

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/GetProtocolsList

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/GetProtocolsList

AWS Firewall Manager Firewall ManagementGetViolationDetails

GetViolationDetailsRetrieves violations for a resource based on the specified AWS Firewall Manager policy and AWS account.

Request Syntax

{ "MemberAccount": "string", "PolicyId": "string", "ResourceId": "string", "ResourceType": "string"}



MemberAccount (p. 35)

The AWS account ID that you want the details for.

Type: String


Pattern: ^[0-9]+$

Required: Yes

PolicyId (p. 35)

The ID of the AWS Firewall Manager policy that you want the details for. This currently only supportssecurity group content audit policies.

Type: String



Required: Yes

ResourceId (p. 35)

The ID of the resource that has violations.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: Yes



ResourceType (p. 35)

The resource type. This is in the format shown in the AWS Resource Types Reference.Supported resource types are: AWS::EC2::Instance, AWS::EC2::NetworkInterface,AWS::EC2::SecurityGroup, AWS::NetworkFirewall::FirewallPolicy, andAWS::EC2::Subnet.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: Yes

Response Syntax{ "ViolationDetail": { "MemberAccount": "string", "PolicyId": "string", "ResourceDescription": "string", "ResourceId": "string", "ResourceTags": [ { "Key": "string", "Value": "string" } ], "ResourceType": "string", "ResourceViolations": [ { "AwsEc2InstanceViolation": { "AwsEc2NetworkInterfaceViolations": [ { "ViolatingSecurityGroups": [ "string" ], "ViolationTarget": "string" } ], "ViolationTarget": "string" }, "AwsEc2NetworkInterfaceViolation": { "ViolatingSecurityGroups": [ "string" ], "ViolationTarget": "string" }, "AwsVPCSecurityGroupViolation": { "PartialMatches": [ { "Reference": "string", "TargetViolationReasons": [ "string" ] } ], "PossibleSecurityGroupRemediationActions": [ { "Description": "string", "IsDefaultAction": boolean, "RemediationActionType": "string", "RemediationResult": { "FromPort": number, "IPV4Range": "string", "IPV6Range": "string", "PrefixListId": "string",


https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html


"Protocol": "string", "ToPort": number } } ], "ViolationTarget": "string", "ViolationTargetDescription": "string" }, "NetworkFirewallMissingExpectedRTViolation": { "AvailabilityZone": "string", "CurrentRouteTable": "string", "ExpectedRouteTable": "string", "ViolationTarget": "string", "VPC": "string" }, "NetworkFirewallMissingFirewallViolation": { "AvailabilityZone": "string", "TargetViolationReason": "string", "ViolationTarget": "string", "VPC": "string" }, "NetworkFirewallMissingSubnetViolation": { "AvailabilityZone": "string", "TargetViolationReason": "string", "ViolationTarget": "string", "VPC": "string" }, "NetworkFirewallPolicyModifiedViolation": { "CurrentPolicyDescription": { "StatefulRuleGroups": [ { "ResourceId": "string", "RuleGroupName": "string" } ], "StatelessCustomActions": [ "string" ], "StatelessDefaultActions": [ "string" ], "StatelessFragmentDefaultActions": [ "string" ], "StatelessRuleGroups": [ { "Priority": number, "ResourceId": "string", "RuleGroupName": "string" } ] }, "ExpectedPolicyDescription": { "StatefulRuleGroups": [ { "ResourceId": "string", "RuleGroupName": "string" } ], "StatelessCustomActions": [ "string" ], "StatelessDefaultActions": [ "string" ], "StatelessFragmentDefaultActions": [ "string" ], "StatelessRuleGroups": [ { "Priority": number, "ResourceId": "string", "RuleGroupName": "string" } ] }, "ViolationTarget": "string" }



} ] }}



ViolationDetail (p. 36)

Violation detail for a resource.

Type: ViolationDetail (p. 117) object












https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/GetViolationDetails

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/GetViolationDetails

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/GetViolationDetails

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/GetViolationDetails

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/GetViolationDetails

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/GetViolationDetails

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/GetViolationDetails

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/GetViolationDetails

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/GetViolationDetails

AWS Firewall Manager Firewall ManagementListAppsLists

ListAppsListsReturns an array of AppsListDataSummary objects.

Request Syntax{ "DefaultLists": boolean, "MaxResults": number, "NextToken": "string"}



DefaultLists (p. 39)

Specifies whether the lists to retrieve are default lists owned by AWS Firewall Manager.

Type: Boolean


The maximum number of objects that you want AWS Firewall Manager to return for this request. Ifmore objects are available, in the response, AWS Firewall Manager provides a NextToken value thatyou can use in a subsequent call to get the next batch of objects.

If you don't specify this, AWS Firewall Manager returns all available objects.

Type: Integer


Required: YesNextToken (p. 39)

If you specify a value for MaxResults in your list request, and you have more objects than themaximum, AWS Firewall Manager returns this token in the response. For all but the first request, youprovide the token returned by the prior request in the request parameters, to retrieve the next batchof objects.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: No

Response Syntax{



"AppsLists": [ { "AppsList": [ { "AppName": "string", "Port": number, "Protocol": "string" } ], "ListArn": "string", "ListId": "string", "ListName": "string" } ], "NextToken": "string"}



AppsLists (p. 39)

An array of AppsListDataSummary objects.

Type: Array of AppsListDataSummary (p. 76) objectsNextToken (p. 39)

If you specify a value for MaxResults in your list request, and you have more objects than themaximum, AWS Firewall Manager returns this token in the response. You can use this token insubsequent requests to retrieve the next batch of objects.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$









LimitExceededException









https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/ListAppsLists

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/ListAppsLists

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/ListAppsLists

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/ListAppsLists

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/ListAppsLists

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/ListAppsLists

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/ListAppsLists

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/ListAppsLists

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/ListAppsLists

AWS Firewall Manager Firewall ManagementListComplianceStatus

ListComplianceStatusReturns an array of PolicyComplianceStatus objects. Use PolicyComplianceStatus to get asummary of which member accounts are protected by the specified policy.

Request Syntax{ "MaxResults": number, "NextToken": "string", "PolicyId": "string"}



MaxResults (p. 42)

Specifies the number of PolicyComplianceStatus objects that you want AWS Firewall Managerto return for this request. If you have more PolicyComplianceStatus objects than the numberthat you specify for MaxResults, the response includes a NextToken value that you can use to getanother batch of PolicyComplianceStatus objects.

Type: Integer


Required: No

NextToken (p. 42)

If you specify a value for MaxResults and you have more PolicyComplianceStatus objects thanthe number that you specify for MaxResults, AWS Firewall Manager returns a NextToken valuein the response that allows you to list another group of PolicyComplianceStatus objects. Forthe second and subsequent ListComplianceStatus requests, specify the value of NextTokenfrom the previous response to get information about another batch of PolicyComplianceStatusobjects.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: No

PolicyId (p. 42)

The ID of the AWS Firewall Manager policy that you want the details for.

Type: String





Required: Yes

Response Syntax{ "NextToken": "string", "PolicyComplianceStatusList": [ { "EvaluationResults": [ { "ComplianceStatus": "string", "EvaluationLimitExceeded": boolean, "ViolatorCount": number } ], "IssueInfoMap": { "string" : "string" }, "LastUpdated": number, "MemberAccount": "string", "PolicyId": "string", "PolicyName": "string", "PolicyOwner": "string" } ]}



NextToken (p. 43)

If you have more PolicyComplianceStatus objects than the number that you specifiedfor MaxResults in the request, the response includes a NextToken value. To list morePolicyComplianceStatus objects, submit another ListComplianceStatus request, andspecify the NextToken value from the response in the NextToken value in the next request.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

PolicyComplianceStatusList (p. 43)

An array of PolicyComplianceStatus objects.

Type: Array of PolicyComplianceStatus (p. 98) objects












https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/ListComplianceStatus

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/ListComplianceStatus

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/ListComplianceStatus

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/ListComplianceStatus

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/ListComplianceStatus

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/ListComplianceStatus

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/ListComplianceStatus

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/ListComplianceStatus

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/ListComplianceStatus

AWS Firewall Manager Firewall ManagementListMemberAccounts

ListMemberAccountsReturns a MemberAccounts object that lists the member accounts in the administrator's AWSorganization.

The ListMemberAccounts must be submitted by the account that is set as the AWS Firewall Manageradministrator.

Request Syntax{ "MaxResults": number, "NextToken": "string"}



MaxResults (p. 45)

Specifies the number of member account IDs that you want AWS Firewall Manager to return forthis request. If you have more IDs than the number that you specify for MaxResults, the responseincludes a NextToken value that you can use to get another batch of member account IDs.

Type: Integer



If you specify a value for MaxResults and you have more account IDs than the numberthat you specify for MaxResults, AWS Firewall Manager returns a NextToken value inthe response that allows you to list another group of IDs. For the second and subsequentListMemberAccountsRequest requests, specify the value of NextToken from the previousresponse to get information about another batch of member account IDs.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: No

Response Syntax{ "MemberAccounts": [ "string" ], "NextToken": "string"



}



MemberAccounts (p. 45)

An array of account IDs.

Type: Array of strings


Pattern: ^[0-9]+$NextToken (p. 45)

If you have more member account IDs than the number that you specified for MaxResultsin the request, the response includes a NextToken value. To list more IDs, submit anotherListMemberAccounts request, and specify the NextToken value from the response in theNextToken value in the next request.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$








• AWS Command Line Interface• AWS SDK for .NET• AWS SDK for C++• AWS SDK for Go• AWS SDK for Java V2


https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/ListMemberAccounts

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/ListMemberAccounts

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/ListMemberAccounts

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/ListMemberAccounts

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/ListMemberAccounts


• AWS SDK for JavaScript• AWS SDK for PHP V3• AWS SDK for Python• AWS SDK for Ruby V3


https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/ListMemberAccounts

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/ListMemberAccounts

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/ListMemberAccounts

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/ListMemberAccounts

AWS Firewall Manager Firewall ManagementListPolicies

ListPoliciesReturns an array of PolicySummary objects.

Request Syntax{ "MaxResults": number, "NextToken": "string"}



MaxResults (p. 48)

Specifies the number of PolicySummary objects that you want AWS Firewall Manager to returnfor this request. If you have more PolicySummary objects than the number that you specify forMaxResults, the response includes a NextToken value that you can use to get another batch ofPolicySummary objects.

Type: Integer



If you specify a value for MaxResults and you have more PolicySummary objects than thenumber that you specify for MaxResults, AWS Firewall Manager returns a NextToken value inthe response that allows you to list another group of PolicySummary objects. For the second andsubsequent ListPolicies requests, specify the value of NextToken from the previous response toget information about another batch of PolicySummary objects.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: No

Response Syntax{ "NextToken": "string", "PolicyList": [ { "PolicyArn": "string", "PolicyId": "string", "PolicyName": "string",



"RemediationEnabled": boolean, "ResourceType": "string", "SecurityServiceType": "string" } ]}



NextToken (p. 48)

If you have more PolicySummary objects than the number that you specified for MaxResultsin the request, the response includes a NextToken value. To list more PolicySummary objects,submit another ListPolicies request, and specify the NextToken value from the response in theNextToken value in the next request.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$PolicyList (p. 48)

An array of PolicySummary objects.

Type: Array of PolicySummary (p. 100) objects


















https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/ListPolicies

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/ListPolicies

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/ListPolicies

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/ListPolicies

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/ListPolicies

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/ListPolicies

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/ListPolicies

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/ListPolicies

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/ListPolicies

AWS Firewall Manager Firewall ManagementListProtocolsLists

ListProtocolsListsReturns an array of ProtocolsListDataSummary objects.

Request Syntax{ "DefaultLists": boolean, "MaxResults": number, "NextToken": "string"}



DefaultLists (p. 51)

Specifies whether the lists to retrieve are default lists owned by AWS Firewall Manager.

Type: Boolean


The maximum number of objects that you want AWS Firewall Manager to return for this request. Ifmore objects are available, in the response, AWS Firewall Manager provides a NextToken value thatyou can use in a subsequent call to get the next batch of objects.

If you don't specify this, AWS Firewall Manager returns all available objects.

Type: Integer


Required: YesNextToken (p. 51)

If you specify a value for MaxResults in your list request, and you have more objects than themaximum, AWS Firewall Manager returns this token in the response. For all but the first request, youprovide the token returned by the prior request in the request parameters, to retrieve the next batchof objects.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: No

Response Syntax{



"NextToken": "string", "ProtocolsLists": [ { "ListArn": "string", "ListId": "string", "ListName": "string", "ProtocolsList": [ "string" ] } ]}



NextToken (p. 51)

If you specify a value for MaxResults in your list request, and you have more objects than themaximum, AWS Firewall Manager returns this token in the response. You can use this token insubsequent requests to retrieve the next batch of objects.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$ProtocolsLists (p. 51)

An array of ProtocolsListDataSummary objects.

Type: Array of ProtocolsListDataSummary (p. 104) objects














https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/ListProtocolsLists

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/ListProtocolsLists

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/ListProtocolsLists

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/ListProtocolsLists

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/ListProtocolsLists

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/ListProtocolsLists

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/ListProtocolsLists

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/ListProtocolsLists

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/ListProtocolsLists

AWS Firewall Manager Firewall ManagementListTagsForResource

ListTagsForResourceRetrieves the list of tags for the specified AWS resource.

Request Syntax{ "ResourceArn": "string"}



ResourceArn (p. 54)

The Amazon Resource Name (ARN) of the resource to return tags for. The AWS Firewall Managerresources that support tagging are policies, applications lists, and protocols lists.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: Yes

Response Syntax{ "TagList": [ { "Key": "string", "Value": "string" } ]}



TagList (p. 54)

The tags associated with the resource.

Type: Array of Tag (p. 116) objects

Array Members: Minimum number of 0 items. Maximum number of 200 items.
















https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/ListTagsForResource

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/ListTagsForResource

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/ListTagsForResource

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/ListTagsForResource

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/ListTagsForResource

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/ListTagsForResource

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/ListTagsForResource

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/ListTagsForResource

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/ListTagsForResource

AWS Firewall Manager Firewall ManagementPutAppsList

PutAppsListCreates an AWS Firewall Manager applications list.

Request Syntax{ "AppsList": { "AppsList": [ { "AppName": "string", "Port": number, "Protocol": "string" } ], "CreateTime": number, "LastUpdateTime": number, "ListId": "string", "ListName": "string", "ListUpdateToken": "string", "PreviousAppsList": { "string" : [ { "AppName": "string", "Port": number, "Protocol": "string" } ] } }, "TagList": [ { "Key": "string", "Value": "string" } ]}



AppsList (p. 56)

The details of the AWS Firewall Manager applications list to be created.

Type: AppsListData (p. 74) object

Required: YesTagList (p. 56)




Required: No



Response Syntax{ "AppsList": { "AppsList": [ { "AppName": "string", "Port": number, "Protocol": "string" } ], "CreateTime": number, "LastUpdateTime": number, "ListId": "string", "ListName": "string", "ListUpdateToken": "string", "PreviousAppsList": { "string" : [ { "AppName": "string", "Port": number, "Protocol": "string" } ] } }, "AppsListArn": "string"}



AppsList (p. 57)

The details of the AWS Firewall Manager applications list.

Type: AppsListData (p. 74) objectAppsListArn (p. 57)


Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$



















https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/PutAppsList

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/PutAppsList

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/PutAppsList

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/PutAppsList

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/PutAppsList

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/PutAppsList

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/PutAppsList

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/PutAppsList

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/PutAppsList

AWS Firewall Manager Firewall ManagementPutNotificationChannel

PutNotificationChannelDesignates the IAM role and Amazon Simple Notification Service (SNS) topic that AWS Firewall Manageruses to record SNS logs.

To perform this action outside of the console, you must configure the SNS topic to allow the FirewallManager role AWSServiceRoleForFMS to publish SNS logs. For more information, see Firewall Managerrequired permissions for API actions in the AWS Firewall Manager Developer Guide.

Request Syntax{ "SnsRoleName": "string", "SnsTopicArn": "string"}



SnsRoleName (p. 59)

The Amazon Resource Name (ARN) of the IAM role that allows Amazon SNS to record AWS FirewallManager activity.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: YesSnsTopicArn (p. 59)

The Amazon Resource Name (ARN) of the SNS topic that collects notifications from AWS FirewallManager.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: Yes

















https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/PutNotificationChannel

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/PutNotificationChannel

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/PutNotificationChannel

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/PutNotificationChannel

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/PutNotificationChannel

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/PutNotificationChannel

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/PutNotificationChannel

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/PutNotificationChannel

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/PutNotificationChannel

AWS Firewall Manager Firewall ManagementPutPolicy

PutPolicyCreates an AWS Firewall Manager policy.

Firewall Manager provides the following types of policies:

• An AWS WAF policy (type WAFV2), which defines rule groups to run first in the corresponding AWSWAF web ACL and rule groups to run last in the web ACL.

• An AWS WAF Classic policy (type WAF), which defines a rule group.

• A Shield Advanced policy, which applies Shield Advanced protection to specified accounts andresources.

• A security group policy, which manages VPC security groups across your AWS organization.

• An AWS Network Firewall policy, which provides firewall rules to filter network traffic in specifiedAmazon VPCs.

Each policy is specific to one of the types. If you want to enforce more than one policy type acrossaccounts, create multiple policies. You can create multiple policies for each type.

You must be subscribed to Shield Advanced to create a Shield Advanced policy. For more informationabout subscribing to Shield Advanced, see CreateSubscription.

Request Syntax

{ "Policy": { "ExcludeMap": { "string" : [ "string" ] }, "ExcludeResourceTags": boolean, "IncludeMap": { "string" : [ "string" ] }, "PolicyId": "string", "PolicyName": "string", "PolicyUpdateToken": "string", "RemediationEnabled": boolean, "ResourceTags": [ { "Key": "string", "Value": "string" } ], "ResourceType": "string", "ResourceTypeList": [ "string" ], "SecurityServicePolicyData": { "ManagedServiceData": "string", "Type": "string" } }, "TagList": [ { "Key": "string", "Value": "string" } ]}


https://docs.aws.amazon.com/waf/latest/DDOSAPIReference/API_CreateSubscription.html

AWS Firewall Manager Firewall ManagementRequest Parameters



Policy (p. 61)

The details of the AWS Firewall Manager policy to be created.

Type: Policy (p. 93) object


The tags to add to the AWS resource.



Required: No

Response Syntax{ "Policy": { "ExcludeMap": { "string" : [ "string" ] }, "ExcludeResourceTags": boolean, "IncludeMap": { "string" : [ "string" ] }, "PolicyId": "string", "PolicyName": "string", "PolicyUpdateToken": "string", "RemediationEnabled": boolean, "ResourceTags": [ { "Key": "string", "Value": "string" } ], "ResourceType": "string", "ResourceTypeList": [ "string" ], "SecurityServicePolicyData": { "ManagedServiceData": "string", "Type": "string" } }, "PolicyArn": "string"}





Policy (p. 62)

The details of the AWS Firewall Manager policy.

Type: Policy (p. 93) objectPolicyArn (p. 62)

The Amazon Resource Name (ARN) of the policy.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$








HTTP Status Code: 400InvalidTypeException

The value of the Type parameter is invalid.












https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/PutPolicy

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/PutPolicy

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/PutPolicy

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/PutPolicy

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/PutPolicy

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/PutPolicy

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/PutPolicy

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/PutPolicy

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/PutPolicy

AWS Firewall Manager Firewall ManagementPutProtocolsList

PutProtocolsListCreates an AWS Firewall Manager protocols list.

Request Syntax{ "ProtocolsList": { "CreateTime": number, "LastUpdateTime": number, "ListId": "string", "ListName": "string", "ListUpdateToken": "string", "PreviousProtocolsList": { "string" : [ "string" ] }, "ProtocolsList": [ "string" ] }, "TagList": [ { "Key": "string", "Value": "string" } ]}




The details of the AWS Firewall Manager protocols list to be created.

Type: ProtocolsListData (p. 102) object

Required: Yes

TagList (p. 65)




Required: No

Response Syntax{ "ProtocolsList": { "CreateTime": number,



"LastUpdateTime": number, "ListId": "string", "ListName": "string", "ListUpdateToken": "string", "PreviousProtocolsList": { "string" : [ "string" ] }, "ProtocolsList": [ "string" ] }, "ProtocolsListArn": "string"}




The details of the AWS Firewall Manager protocols list.

Type: ProtocolsListData (p. 102) objectProtocolsListArn (p. 65)

The Amazon Resource Name (ARN) of the protocols list.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$











LimitExceededException









https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/PutProtocolsList

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/PutProtocolsList

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/PutProtocolsList

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/PutProtocolsList

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/PutProtocolsList

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/PutProtocolsList

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/PutProtocolsList

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/PutProtocolsList

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/PutProtocolsList

AWS Firewall Manager Firewall ManagementTagResource

TagResourceAdds one or more tags to an AWS resource.

Request Syntax{ "ResourceArn": "string", "TagList": [ { "Key": "string", "Value": "string" } ]}



ResourceArn (p. 68)


Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$


The tags to add to the resource.



Required: Yes




















https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/TagResource

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/TagResource

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/TagResource

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/TagResource

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/TagResource

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/TagResource

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/TagResource

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/TagResource

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/TagResource

AWS Firewall Manager Firewall ManagementUntagResource

UntagResourceRemoves one or more tags from an AWS resource.

Request Syntax{ "ResourceArn": "string", "TagKeys": [ "string" ]}



ResourceArn (p. 70)


Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: YesTagKeys (p. 70)

The keys of the tags to remove from the resource.




Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: Yes

















https://docs.aws.amazon.com/goto/aws-cli/fms-2018-01-01/UntagResource

https://docs.aws.amazon.com/goto/DotNetSDKV3/fms-2018-01-01/UntagResource

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/UntagResource

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/UntagResource

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/UntagResource

https://docs.aws.amazon.com/goto/AWSJavaScriptSDK/fms-2018-01-01/UntagResource

https://docs.aws.amazon.com/goto/SdkForPHPV3/fms-2018-01-01/UntagResource

https://docs.aws.amazon.com/goto/boto3/fms-2018-01-01/UntagResource

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/UntagResource


Data TypesThe Firewall Management Service API contains several data types that various actions use. This sectiondescribes each data type in detail.

NoteThe order of each element in a data type structure is not guaranteed. Applications should notassume a particular order.

The following data types are supported:

• App (p. 73)• AppsListData (p. 74)• AppsListDataSummary (p. 76)• AwsEc2InstanceViolation (p. 78)• AwsEc2NetworkInterfaceViolation (p. 79)• AwsVPCSecurityGroupViolation (p. 80)• ComplianceViolator (p. 81)• EvaluationResult (p. 82)• NetworkFirewallMissingExpectedRTViolation (p. 83)• NetworkFirewallMissingFirewallViolation (p. 85)• NetworkFirewallMissingSubnetViolation (p. 87)• NetworkFirewallPolicyDescription (p. 89)• NetworkFirewallPolicyModifiedViolation (p. 91)• PartialMatch (p. 92)• Policy (p. 93)• PolicyComplianceDetail (p. 96)• PolicyComplianceStatus (p. 98)• PolicySummary (p. 100)• ProtocolsListData (p. 102)• ProtocolsListDataSummary (p. 104)• ResourceTag (p. 106)• ResourceViolation (p. 107)• SecurityGroupRemediationAction (p. 109)• SecurityGroupRuleDescription (p. 110)• SecurityServicePolicyData (p. 112)• StatefulRuleGroup (p. 114)• StatelessRuleGroup (p. 115)• Tag (p. 116)• ViolationDetail (p. 117)


AWS Firewall Manager Firewall ManagementApp

AppAn individual AWS Firewall Manager application.

ContentsAppName

The application's name.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: YesPort

The application's port number, for example 80.

Type: Long


Required: YesProtocol

The IP protocol name or number. The name can be one of tcp, udp, or icmp. For information onpossible numbers, see Protocol Numbers.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: Yes


• AWS SDK for C++• AWS SDK for Go• AWS SDK for Java V2• AWS SDK for Ruby V3


https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/App

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/App

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/App

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/App

AWS Firewall Manager Firewall ManagementAppsListData

AppsListDataAn AWS Firewall Manager applications list.

ContentsAppsList

An array of applications in the AWS Firewall Manager applications list.

Type: Array of App (p. 73) objects

Required: YesCreateTime

The time that the AWS Firewall Manager applications list was created.

Type: Timestamp

Required: NoLastUpdateTime

The time that the AWS Firewall Manager applications list was last updated.

Type: Timestamp

Required: NoListId

The ID of the AWS Firewall Manager applications list.

Type: String



Required: NoListName

The name of the AWS Firewall Manager applications list.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: YesListUpdateToken

A unique identifier for each update to the list. When you update the list, the update token mustmatch the token of the current version of the application list. You can retrieve the update token bygetting the list.

Type: String




Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoPreviousAppsList

A map of previous version numbers to their corresponding App object arrays.

Type: String to array of App (p. 73) objects map

Key Length Constraints: Minimum length of 1. Maximum length of 2.

Key Pattern: ^\d{1,2}$

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/AppsListData

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/AppsListData

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/AppsListData

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/AppsListData

AWS Firewall Manager Firewall ManagementAppsListDataSummary

AppsListDataSummaryDetails of the AWS Firewall Manager applications list.

ContentsAppsList

An array of App objects in the AWS Firewall Manager applications list.

Type: Array of App (p. 73) objects

Required: NoListArn


Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoListId

The ID of the applications list.

Type: String




The name of the applications list.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/AppsListDataSummary

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/AppsListDataSummary

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/AppsListDataSummary

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/AppsListDataSummary



AWS Firewall Manager Firewall ManagementAwsEc2InstanceViolation

AwsEc2InstanceViolationViolations for an EC2 instance resource.

ContentsAwsEc2NetworkInterfaceViolations

Violations for network interfaces associated with the EC2 instance.

Type: Array of AwsEc2NetworkInterfaceViolation (p. 79) objects

Required: NoViolationTarget

The resource ID of the EC2 instance.

Type: String


Pattern: .*

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/AwsEc2InstanceViolation

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/AwsEc2InstanceViolation

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/AwsEc2InstanceViolation

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/AwsEc2InstanceViolation

AWS Firewall Manager Firewall ManagementAwsEc2NetworkInterfaceViolation

AwsEc2NetworkInterfaceViolationViolations for network interfaces associated with an EC2 instance.

ContentsViolatingSecurityGroups

List of security groups that violate the rules specified in the master security group of the AWSFirewall Manager policy.



Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$


The resource ID of the network interface.

Type: String


Pattern: .*

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/AwsEc2NetworkInterfaceViolation

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/AwsEc2NetworkInterfaceViolation

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/AwsEc2NetworkInterfaceViolation

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/AwsEc2NetworkInterfaceViolation

AWS Firewall Manager Firewall ManagementAwsVPCSecurityGroupViolation

AwsVPCSecurityGroupViolationDetails of the rule violation in a security group when compared to the master security group of the AWSFirewall Manager policy.

ContentsPartialMatches

List of rules specified in the security group of the AWS Firewall Manager policy that partially matchthe ViolationTarget rule.

Type: Array of PartialMatch (p. 92) objects

Required: NoPossibleSecurityGroupRemediationActions

Remediation options for the rule specified in the ViolationTarget.

Type: Array of SecurityGroupRemediationAction (p. 109) objects


The security group rule that is being evaluated.

Type: String


Pattern: .*

Required: NoViolationTargetDescription

A description of the security group that violates the policy.

Type: String


Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/AwsVPCSecurityGroupViolation

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/AwsVPCSecurityGroupViolation

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/AwsVPCSecurityGroupViolation

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/AwsVPCSecurityGroupViolation

AWS Firewall Manager Firewall ManagementComplianceViolator

ComplianceViolatorDetails of the resource that is not protected by the policy.

ContentsResourceId

The resource ID.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoResourceType

The resource type. This is in the format shown in the AWS Resource Types Reference. For example:AWS::ElasticLoadBalancingV2::LoadBalancer, AWS::CloudFront::Distribution, orAWS::NetworkFirewall::FirewallPolicy.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoViolationReason

The reason that the resource is not protected by the policy.

Type: String

Valid Values: WEB_ACL_MISSING_RULE_GROUP | RESOURCE_MISSING_WEB_ACL| RESOURCE_INCORRECT_WEB_ACL | RESOURCE_MISSING_SHIELD_PROTECTION| RESOURCE_MISSING_WEB_ACL_OR_SHIELD_PROTECTION |RESOURCE_MISSING_SECURITY_GROUP | RESOURCE_VIOLATES_AUDIT_SECURITY_GROUP| SECURITY_GROUP_UNUSED | SECURITY_GROUP_REDUNDANT | MISSING_FIREWALL| MISSING_FIREWALL_SUBNET_IN_AZ | MISSING_EXPECTED_ROUTE_TABLE |NETWORK_FIREWALL_POLICY_MODIFIED

Required: No





https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/ComplianceViolator

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/ComplianceViolator

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/ComplianceViolator

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/ComplianceViolator

AWS Firewall Manager Firewall ManagementEvaluationResult

EvaluationResultDescribes the compliance status for the account. An account is considered noncompliant if it includesresources that are not protected by the specified policy or that don't comply with the policy.

ContentsComplianceStatus

Describes an AWS account's compliance with the AWS Firewall Manager policy.

Type: String

Valid Values: COMPLIANT | NON_COMPLIANT

Required: NoEvaluationLimitExceeded

Indicates that over 100 resources are noncompliant with the AWS Firewall Manager policy.

Type: Boolean

Required: NoViolatorCount

The number of resources that are noncompliant with the specified policy. For AWS WAF and ShieldAdvanced policies, a resource is considered noncompliant if it is not associated with the policy. Forsecurity group policies, a resource is considered noncompliant if it doesn't comply with the rules ofthe policy and remediation is disabled or not possible.

Type: Long

Valid Range: Minimum value of 0.

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/EvaluationResult

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/EvaluationResult

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/EvaluationResult

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/EvaluationResult

AWS Firewall Manager Firewall ManagementNetworkFirewallMissingExpectedRTViolation

NetworkFirewallMissingExpectedRTViolationViolation details for AWS Network Firewall for a subnet that's not associated to the expected FirewallManager managed route table.

ContentsAvailabilityZone

The Availability Zone of a violating subnet.

Type: String


Required: NoCurrentRouteTable

The resource ID of the current route table that's associated with the subnet, if one is available.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoExpectedRouteTable

The resource ID of the route table that should be associated with the subnet.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$


The ID of the AWS Network Firewall or VPC resource that's in violation.

Type: String


Pattern: .*

Required: NoVPC

The resource ID of the VPC associated with a violating subnet.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$



Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/NetworkFirewallMissingExpectedRTViolation

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/NetworkFirewallMissingExpectedRTViolation

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/NetworkFirewallMissingExpectedRTViolation

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/NetworkFirewallMissingExpectedRTViolation

AWS Firewall Manager Firewall ManagementNetworkFirewallMissingFirewallViolation

NetworkFirewallMissingFirewallViolationViolation details for AWS Network Firewall for a subnet that doesn't have a Firewall Manager managedfirewall in its VPC.



Type: String


Required: NoTargetViolationReason

The reason the resource has this violation, if one is available.

Type: String


Pattern: \w+



Type: String


Pattern: .*

Required: NoVPC


Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: No


• AWS SDK for C++• AWS SDK for Go


https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/NetworkFirewallMissingFirewallViolation

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/NetworkFirewallMissingFirewallViolation


• AWS SDK for Java V2• AWS SDK for Ruby V3


https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/NetworkFirewallMissingFirewallViolation

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/NetworkFirewallMissingFirewallViolation

AWS Firewall Manager Firewall ManagementNetworkFirewallMissingSubnetViolation

NetworkFirewallMissingSubnetViolationViolation details for AWS Network Firewall for an Availability Zone that's missing the expected FirewallManager managed subnet.



Type: String


Required: NoTargetViolationReason

The reason the resource has this violation, if one is available.

Type: String


Pattern: \w+



Type: String


Pattern: .*

Required: NoVPC


Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/NetworkFirewallMissingSubnetViolation

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/NetworkFirewallMissingSubnetViolation




https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/NetworkFirewallMissingSubnetViolation

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/NetworkFirewallMissingSubnetViolation

AWS Firewall Manager Firewall ManagementNetworkFirewallPolicyDescription

NetworkFirewallPolicyDescriptionThe definition of the AWS Network Firewall firewall policy.

ContentsStatefulRuleGroups

The stateful rule groups that are used in the Network Firewall firewall policy.

Type: Array of StatefulRuleGroup (p. 114) objects

Required: NoStatelessCustomActions

Names of custom actions that are available for use in the stateless default actions settings.



Pattern: ^[a-zA-Z0-9]+$

Required: NoStatelessDefaultActions

The actions to take on packets that don't match any of the stateless rule groups.




Required: NoStatelessFragmentDefaultActions

The actions to take on packet fragments that don't match any of the stateless rule groups.




Required: NoStatelessRuleGroups

The stateless rule groups that are used in the Network Firewall firewall policy.

Type: Array of StatelessRuleGroup (p. 115) objects

Required: No






https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/NetworkFirewallPolicyDescription

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/NetworkFirewallPolicyDescription

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/NetworkFirewallPolicyDescription

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/NetworkFirewallPolicyDescription

AWS Firewall Manager Firewall ManagementNetworkFirewallPolicyModifiedViolation

NetworkFirewallPolicyModifiedViolationViolation details for AWS Network Firewall for a firewall policy that has a differentNetworkFirewallPolicyDescription (p. 89) than is required by the Firewall Manager policy.

ContentsCurrentPolicyDescription

The policy that's currently in use in the individual account.

Type: NetworkFirewallPolicyDescription (p. 89) object

Required: NoExpectedPolicyDescription

The policy that should be in use in the individual account in order to be compliant.

Type: NetworkFirewallPolicyDescription (p. 89) object



Type: String


Pattern: .*

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/NetworkFirewallPolicyModifiedViolation

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/NetworkFirewallPolicyModifiedViolation

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/NetworkFirewallPolicyModifiedViolation

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/NetworkFirewallPolicyModifiedViolation

AWS Firewall Manager Firewall ManagementPartialMatch

PartialMatchThe reference rule that partially matches the ViolationTarget rule and violation reason.

ContentsReference

The reference rule from the master security group of the AWS Firewall Manager policy.

Type: String

Required: NoTargetViolationReasons

The violation reason.



Pattern: \w+

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/PartialMatch

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/PartialMatch

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/PartialMatch

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/PartialMatch

AWS Firewall Manager Firewall ManagementPolicy

PolicyAn AWS Firewall Manager policy.

ContentsExcludeMap

Specifies the AWS account IDs and AWS Organizations organizational units (OUs) to exclude fromthe policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of itschild OUs, including any child OUs and accounts that are added at a later time.

You can specify inclusions or exclusions, but not both. If you specify an IncludeMap, AWS FirewallManager applies the policy to all accounts specified by the IncludeMap, and does not evaluate anyExcludeMap specifications. If you do not specify an IncludeMap, then Firewall Manager applies thepolicy to all accounts except for those specified by the ExcludeMap.

You can specify account IDs, OUs, or a combination:• Specify account IDs by setting the key to ACCOUNT. For example, the following is a valid map:{“ACCOUNT” : [“accountID1”, “accountID2”]}.

• Specify OUs by setting the key to ORG_UNIT. For example, the following is a valid map:{“ORG_UNIT” : [“ouid111”, “ouid112”]}.

• Specify accounts and OUs together in a single map, separated with a comma. For example, thefollowing is a valid map: {“ACCOUNT” : [“accountID1”, “accountID2”], “ORG_UNIT” :[“ouid111”, “ouid112”]}.

Type: String to array of strings map

Valid Keys: ACCOUNT | ORG_UNIT


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoExcludeResourceTags

If set to True, resources with the tags that are specified in the ResourceTag array are not inscope of the policy. If set to False, and the ResourceTag array is not null, only resources with thespecified tags are in scope of the policy.

Type: Boolean

Required: YesIncludeMap

Specifies the AWS account IDs and AWS Organizations organizational units (OUs) to include in thepolicy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its childOUs, including any child OUs and accounts that are added at a later time.

You can specify inclusions or exclusions, but not both. If you specify an IncludeMap, AWS FirewallManager applies the policy to all accounts specified by the IncludeMap, and does not evaluate anyExcludeMap specifications. If you do not specify an IncludeMap, then Firewall Manager applies thepolicy to all accounts except for those specified by the ExcludeMap.

You can specify account IDs, OUs, or a combination:


AWS Firewall Manager Firewall ManagementContents

• Specify account IDs by setting the key to ACCOUNT. For example, the following is a valid map:{“ACCOUNT” : [“accountID1”, “accountID2”]}.

• Specify OUs by setting the key to ORG_UNIT. For example, the following is a valid map:{“ORG_UNIT” : [“ouid111”, “ouid112”]}.

• Specify accounts and OUs together in a single map, separated with a comma. For example, thefollowing is a valid map: {“ACCOUNT” : [“accountID1”, “accountID2”], “ORG_UNIT” :[“ouid111”, “ouid112”]}.


Valid Keys: ACCOUNT | ORG_UNIT


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoPolicyId

The ID of the AWS Firewall Manager policy.

Type: String



Required: NoPolicyName

The name of the AWS Firewall Manager policy.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: YesPolicyUpdateToken

A unique identifier for each update to the policy. When issuing a PutPolicy request, thePolicyUpdateToken in the request must match the PolicyUpdateToken of the current policyversion. To get the PolicyUpdateToken of the current policy version, use a GetPolicy request.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoRemediationEnabled

Indicates if the policy should be automatically applied to new resources.

Type: Boolean

Required: Yes



ResourceTags

An array of ResourceTag objects.

Type: Array of ResourceTag (p. 106) objects



The type of resource protected by or in scope of the policy. This is in the format shown inthe AWS Resource Types Reference. For AWS WAF and Shield Advanced, examples includeAWS::ElasticLoadBalancingV2::LoadBalancer and AWS::CloudFront::Distribution.For a security group common policy, valid values are AWS::EC2::NetworkInterfaceand AWS::EC2::Instance. For a security group content audit policy, valid values areAWS::EC2::SecurityGroup, AWS::EC2::NetworkInterface, and AWS::EC2::Instance. Fora security group usage audit policy, the value is AWS::EC2::SecurityGroup. For an AWS NetworkFirewall policy, the value is AWS::EC2::VPC.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: YesResourceTypeList

An array of ResourceType.



Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoSecurityServicePolicyData

Details about the security service that is being used to protect the resources.

Type: SecurityServicePolicyData (p. 112) object

Required: Yes





https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/Policy

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/Policy

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/Policy

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/Policy

AWS Firewall Manager Firewall ManagementPolicyComplianceDetail

PolicyComplianceDetailDescribes the noncompliant resources in a member account for a specific AWS Firewall Managerpolicy. A maximum of 100 entries are displayed. If more than 100 resources are noncompliant,EvaluationLimitExceeded is set to True.

ContentsEvaluationLimitExceeded

Indicates if over 100 resources are noncompliant with the AWS Firewall Manager policy.

Type: Boolean

Required: NoExpiredAt

A timestamp that indicates when the returned information should be considered out of date.

Type: Timestamp

Required: NoIssueInfoMap

Details about problems with dependent services, such as AWS WAF or AWS Config, that are causinga resource to be noncompliant. The details include the name of the dependent service and the errormessage received that indicates the problem with the service.

Type: String to string map

Valid Keys: AWSCONFIG | AWSWAF | AWSSHIELD_ADVANCED | AWSVPC

Value Length Constraints: Minimum length of 1. Maximum length of 1024.

Value Pattern: ^([\p{L}\p{Z}\p{N}_.:/=,+\-@]*)$

Required: NoMemberAccount

The AWS account ID.

Type: String


Pattern: ^[0-9]+$



Type: String



Required: No



PolicyOwner

The AWS account that created the AWS Firewall Manager policy.

Type: String


Pattern: ^[0-9]+$

Required: NoViolators

An array of resources that aren't protected by the AWS WAF or Shield Advanced policy or that aren'tin compliance with the security group policy.

Type: Array of ComplianceViolator (p. 81) objects

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/PolicyComplianceDetail

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/PolicyComplianceDetail

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/PolicyComplianceDetail

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/PolicyComplianceDetail

AWS Firewall Manager Firewall ManagementPolicyComplianceStatus

PolicyComplianceStatusIndicates whether the account is compliant with the specified policy. An account is considerednoncompliant if it includes resources that are not protected by the policy, for AWS WAF and ShieldAdvanced policies, or that are noncompliant with the policy, for security group policies.

ContentsEvaluationResults

An array of EvaluationResult objects.

Type: Array of EvaluationResult (p. 82) objects

Required: NoIssueInfoMap

Details about problems with dependent services, such as AWS WAF or AWS Config, that are causinga resource to be noncompliant. The details include the name of the dependent service and the errormessage received that indicates the problem with the service.

Type: String to string map

Valid Keys: AWSCONFIG | AWSWAF | AWSSHIELD_ADVANCED | AWSVPC

Value Length Constraints: Minimum length of 1. Maximum length of 1024.

Value Pattern: ^([\p{L}\p{Z}\p{N}_.:/=,+\-@]*)$

Required: NoLastUpdated

Timestamp of the last update to the EvaluationResult objects.

Type: Timestamp

Required: NoMemberAccount

The member account ID.

Type: String


Pattern: ^[0-9]+$



Type: String



Required: No



PolicyName

The name of the AWS Firewall Manager policy.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoPolicyOwner

The AWS account that created the AWS Firewall Manager policy.

Type: String


Pattern: ^[0-9]+$

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/PolicyComplianceStatus

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/PolicyComplianceStatus

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/PolicyComplianceStatus

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/PolicyComplianceStatus

AWS Firewall Manager Firewall ManagementPolicySummary

PolicySummaryDetails of the AWS Firewall Manager policy.

ContentsPolicyArn

The Amazon Resource Name (ARN) of the specified policy.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$


The ID of the specified policy.

Type: String



Required: NoPolicyName

The name of the specified policy.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoRemediationEnabled

Indicates if the policy should be automatically applied to new resources.

Type: Boolean


The type of resource protected by or in scope of the policy. This is in the format shown inthe AWS Resource Types Reference. For AWS WAF and Shield Advanced, examples includeAWS::ElasticLoadBalancingV2::LoadBalancer and AWS::CloudFront::Distribution.For a security group common policy, valid values are AWS::EC2::NetworkInterfaceand AWS::EC2::Instance. For a security group content audit policy, valid values areAWS::EC2::SecurityGroup, AWS::EC2::NetworkInterface, and AWS::EC2::Instance. Fora security group usage audit policy, the value is AWS::EC2::SecurityGroup. For an AWS NetworkFirewall policy, the value is AWS::EC2::VPC.

Type: String





Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoSecurityServiceType

The service that the policy is using to protect the resources. This specifies the type of policy that iscreated, either an AWS WAF policy, a Shield Advanced policy, or a security group policy.

Type: String


Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/PolicySummary

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/PolicySummary

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/PolicySummary

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/PolicySummary

AWS Firewall Manager Firewall ManagementProtocolsListData

ProtocolsListDataAn AWS Firewall Manager protocols list.

ContentsCreateTime

The time that the AWS Firewall Manager protocols list was created.

Type: Timestamp

Required: NoLastUpdateTime

The time that the AWS Firewall Manager protocols list was last updated.

Type: Timestamp

Required: NoListId

The ID of the AWS Firewall Manager protocols list.

Type: String




The name of the AWS Firewall Manager protocols list.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: YesListUpdateToken

A unique identifier for each update to the list. When you update the list, the update token mustmatch the token of the current version of the application list. You can retrieve the update token bygetting the list.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoPreviousProtocolsList

A map of previous version numbers to their corresponding protocol arrays.




Key Length Constraints: Minimum length of 1. Maximum length of 2.

Key Pattern: ^\d{1,2}$


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoProtocolsList

An array of protocols in the AWS Firewall Manager protocols list.



Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: Yes




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/ProtocolsListData

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/ProtocolsListData

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/ProtocolsListData

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/ProtocolsListData

AWS Firewall Manager Firewall ManagementProtocolsListDataSummary

ProtocolsListDataSummaryDetails of the AWS Firewall Manager protocols list.

ContentsListArn

The Amazon Resource Name (ARN) of the specified protocols list.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoListId

The ID of the specified protocols list.

Type: String




The name of the specified protocols list.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoProtocolsList

An array of protocols in the AWS Firewall Manager protocols list.



Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/ProtocolsListDataSummary

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/ProtocolsListDataSummary




https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/ProtocolsListDataSummary

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/ProtocolsListDataSummary

AWS Firewall Manager Firewall ManagementResourceTag

ResourceTagThe resource tags that AWS Firewall Manager uses to determine if a particular resource should beincluded or excluded from the AWS Firewall Manager policy. Tags enable you to categorize your AWSresources in different ways, for example, by purpose, owner, or environment. Each tag consists of a keyand an optional value. Firewall Manager combines the tags with "AND" so that, if you add more than onetag to a policy scope, a resource must have all the specified tags to be included or excluded. For moreinformation, see Working with Tag Editor.

ContentsKey

The resource tag key.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: YesValue

The resource tag value.

Type: String

Length Constraints: Maximum length of 256.

Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: No




https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/tag-editor.html

https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/ResourceTag

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/ResourceTag

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/ResourceTag

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/ResourceTag

AWS Firewall Manager Firewall ManagementResourceViolation

ResourceViolationViolation detail based on resource type.

ContentsAwsEc2InstanceViolation

Violation details for an EC2 instance.

Type: AwsEc2InstanceViolation (p. 78) object

Required: NoAwsEc2NetworkInterfaceViolation

Violation details for network interface.

Type: AwsEc2NetworkInterfaceViolation (p. 79) object

Required: NoAwsVPCSecurityGroupViolation

Violation details for security groups.

Type: AwsVPCSecurityGroupViolation (p. 80) object

Required: NoNetworkFirewallMissingExpectedRTViolation

Violation detail for an Network Firewall policy that indicates that a subnet is not associated with theexpected Firewall Manager managed route table.

Type: NetworkFirewallMissingExpectedRTViolation (p. 83) object

Required: NoNetworkFirewallMissingFirewallViolation

Violation detail for an Network Firewall policy that indicates that a subnet has no Firewall Managermanaged firewall in its VPC.

Type: NetworkFirewallMissingFirewallViolation (p. 85) object

Required: NoNetworkFirewallMissingSubnetViolation

Violation detail for an Network Firewall policy that indicates that an Availability Zone is missing theexpected Firewall Manager managed subnet.

Type: NetworkFirewallMissingSubnetViolation (p. 87) object

Required: NoNetworkFirewallPolicyModifiedViolation

Violation detail for an Network Firewall policy that indicates that a firewall policy in an individualaccount has been modified in a way that makes it noncompliant. For example, the individual accountowner might have deleted a rule group, changed the priority of a stateless rule group, or changed apolicy default action.



Type: NetworkFirewallPolicyModifiedViolation (p. 91) object

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/ResourceViolation

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/ResourceViolation

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/ResourceViolation

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/ResourceViolation

AWS Firewall Manager Firewall ManagementSecurityGroupRemediationAction

SecurityGroupRemediationActionRemediation option for the rule specified in the ViolationTarget.

ContentsDescription

Brief description of the action that will be performed.

Type: String


Pattern: .*

Required: NoIsDefaultAction

Indicates if the current action is the default action.

Type: Boolean

Required: NoRemediationActionType

The remediation action that will be performed.

Type: String

Valid Values: REMOVE | MODIFY

Required: NoRemediationResult

The final state of the rule specified in the ViolationTarget after it is remediated.

Type: SecurityGroupRuleDescription (p. 110) object

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/SecurityGroupRemediationAction

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/SecurityGroupRemediationAction

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/SecurityGroupRemediationAction

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/SecurityGroupRemediationAction

AWS Firewall Manager Firewall ManagementSecurityGroupRuleDescription

SecurityGroupRuleDescriptionDescribes a set of permissions for a security group rule.

ContentsFromPort

The start of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 type number. A valueof -1 indicates all ICMP/ICMPv6 types.

Type: Long


Required: NoIPV4Range

The IPv4 ranges for the security group rule.

Type: String


Pattern: [a-f0-9:./]+

Required: NoIPV6Range

The IPv6 ranges for the security group rule.

Type: String


Pattern: [a-f0-9:./]+

Required: NoPrefixListId

The ID of the prefix list for the security group rule.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoProtocol

The IP protocol name (tcp, udp, icmp, icmpv6) or number.

Type: String


Required: No



ToPort

The end of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code. A value of -1indicates all ICMP/ICMPv6 codes.

Type: Long


Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/SecurityGroupRuleDescription

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/SecurityGroupRuleDescription

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/SecurityGroupRuleDescription

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/SecurityGroupRuleDescription

AWS Firewall Manager Firewall ManagementSecurityServicePolicyData

SecurityServicePolicyDataDetails about the security service that is being used to protect the resources.

ContentsManagedServiceData

Details about the service that are specific to the service type, in JSON format. For service typeSHIELD_ADVANCED, this is an empty string.• Example: NETWORK_FIREWALL

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-1:1234567891011:stateless-rulegroup/rulegroup2\",\"priority\":10}],\"networkFirewallStatelessDefaultActions\":[\"aws:pass\",\"custom1\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"custom2\",\"aws:pass\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"custom1\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"dimension1\"}]}}},{\"actionName\":\"custom2\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"dimension2\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-1:1234567891011:stateful-rulegroup/rulegroup1\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":true,\"allowedIPV4CidrList\":[\"10.24.34.0/28\"]} }"

• Example: WAFV2

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesAmazonIpReputationList\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

In the loggingConfiguration, you can specify one logDestinationConfigs, you canoptionally provide up to 20 redactedFields, and the RedactedFieldType must be one ofURI, QUERY_STRING, HEADER, or METHOD.

• Example: WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}],\"defaultAction\": {\"type\": \"BLOCK\"}}"

• Example: SECURITY_GROUPS_COMMON

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false,\"applyToAllEC2InstanceENIs\":false,\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}]}"



• Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

The security group action for content audit can be ALLOW or DENY. For ALLOW, all in-scope securitygroup rules must be within the allowed range of the policy's security group rules. For DENY, all in-scope security group rules must not contain a value or a range that matches a rule value or rangein the policy security group.

• Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

Type: String


Pattern: .*

Required: NoType

The service that the policy is using to protect the resources. This specifies the type of policy that iscreated, either an AWS WAF policy, a Shield Advanced policy, or a security group policy. For securitygroup policies, Firewall Manager supports one security group for each common policy and for eachcontent audit policy. This is an adjustable limit that you can increase by contacting AWS Support.

Type: String


Required: Yes




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/SecurityServicePolicyData

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/SecurityServicePolicyData

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/SecurityServicePolicyData

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/SecurityServicePolicyData

AWS Firewall Manager Firewall ManagementStatefulRuleGroup

StatefulRuleGroupAWS Network Firewall stateful rule group, used in a NetworkFirewallPolicyDescription (p. 89).

ContentsResourceId

The resource ID of the rule group.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoRuleGroupName

The name of the rule group.

Type: String


Pattern: ^[a-zA-Z0-9-]+$

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/StatefulRuleGroup

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/StatefulRuleGroup

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/StatefulRuleGroup

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/StatefulRuleGroup

AWS Firewall Manager Firewall ManagementStatelessRuleGroup

StatelessRuleGroupAWS Network Firewall stateless rule group, used in a NetworkFirewallPolicyDescription (p. 89).

ContentsPriority

The priority of the rule group. AWS Network Firewall evaluates the stateless rule groups in a firewallpolicy starting from the lowest priority setting.

Type: Integer


Required: NoResourceId

The resource ID of the rule group.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: NoRuleGroupName

The name of the rule group.

Type: String


Pattern: ^[a-zA-Z0-9-]+$

Required: No




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/StatelessRuleGroup

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/StatelessRuleGroup

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/StatelessRuleGroup

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/StatelessRuleGroup

AWS Firewall Manager Firewall ManagementTag

TagA collection of key:value pairs associated with an AWS resource. The key:value pair can be anything youdefine. Typically, the tag key represents a category (such as "environment") and the tag value representsa specific value within that category (such as "test," "development," or "production"). You can add up to50 tags to each AWS resource.

ContentsKey

Part of the key:value pair that defines a tag. You can use a tag key to describe a category ofinformation, such as "customer." Tag keys are case-sensitive.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: YesValue

Part of the key:value pair that defines a tag. You can use a tag value to describe a specific valuewithin a category, such as "companyA" or "companyB." Tag values are case-sensitive.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: Yes




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/Tag

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/Tag

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/Tag

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/Tag

AWS Firewall Manager Firewall ManagementViolationDetail

ViolationDetailViolations for a resource based on the specified AWS Firewall Manager policy and AWS account.

ContentsMemberAccount

The AWS account that the violation details were requested for.

Type: String


Pattern: ^[0-9]+$

Required: YesPolicyId

The ID of the AWS Firewall Manager policy that the violation details were requested for.

Type: String



Required: YesResourceDescription

Brief description for the requested resource.

Type: String


Required: NoResourceId

The resource ID that the violation details were requested for.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: YesResourceTags

The ResourceTag objects associated with the resource.



Required: No



ResourceType

The resource type that the violation details were requested for.

Type: String


Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: YesResourceViolations

List of violations for the requested resource.

Type: Array of ResourceViolation (p. 107) objects

Required: Yes




https://docs.aws.amazon.com/goto/SdkForCpp/fms-2018-01-01/ViolationDetail

https://docs.aws.amazon.com/goto/SdkForGoV1/fms-2018-01-01/ViolationDetail

https://docs.aws.amazon.com/goto/SdkForJavaV2/fms-2018-01-01/ViolationDetail

https://docs.aws.amazon.com/goto/SdkForRubyV3/fms-2018-01-01/ViolationDetail


Common ParametersThe following list contains the parameters that all actions use for signing Signature Version 4 requestswith a query string. Any action-specific parameters are listed in the topic for that action. For moreinformation about Signature Version 4, see Signature Version 4 Signing Process in the Amazon WebServices General Reference.

Action

The action to be performed.

Type: string

Required: YesVersion

The API version that the request is written for, expressed in the format YYYY-MM-DD.

Type: string

Required: YesX-Amz-Algorithm

The hash algorithm that you used to create the request signature.

Condition: Specify this parameter when you include authentication information in a query stringinstead of in the HTTP authorization header.

Type: string

Valid Values: AWS4-HMAC-SHA256

Required: ConditionalX-Amz-Credential

The credential scope value, which is a string that includes your access key, the date, the region youare targeting, the service you are requesting, and a termination string ("aws4_request"). The value isexpressed in the following format: access_key/YYYYMMDD/region/service/aws4_request.

For more information, see Task 2: Create a String to Sign for Signature Version 4 in the Amazon WebServices General Reference.


Type: string

Required: ConditionalX-Amz-Date

The date that is used to create the signature. The format must be ISO 8601 basic format(YYYYMMDD'T'HHMMSS'Z'). For example, the following date time is a valid X-Amz-Date value:20120325T120000Z.

Condition: X-Amz-Date is optional for all requests; it can be used to override the date used forsigning requests. If the Date header is specified in the ISO 8601 basic format, X-Amz-Date is


http://docs.aws.amazon.com/general/latest/gr/signature-version-4.html

http://docs.aws.amazon.com/general/latest/gr/sigv4-create-string-to-sign.html


not required. When X-Amz-Date is used, it always overrides the value of the Date header. Formore information, see Handling Dates in Signature Version 4 in the Amazon Web Services GeneralReference.

Type: string

Required: ConditionalX-Amz-Security-Token

The temporary security token that was obtained through a call to AWS Security Token Service (AWSSTS). For a list of services that support temporary security credentials from AWS Security TokenService, go to AWS Services That Work with IAM in the IAM User Guide.

Condition: If you're using temporary security credentials from the AWS Security Token Service, youmust include the security token.

Type: string

Required: ConditionalX-Amz-Signature

Specifies the hex-encoded signature that was calculated from the string to sign and the derivedsigning key.


Type: string

Required: ConditionalX-Amz-SignedHeaders

Specifies all the HTTP headers that were included as part of the canonical request. For moreinformation about specifying signed headers, see Task 1: Create a Canonical Request For SignatureVersion 4 in the Amazon Web Services General Reference.


Type: string

Required: Conditional


http://docs.aws.amazon.com/general/latest/gr/sigv4-date-handling.html

http://docs.aws.amazon.com/IAM/latest/UserGuide/reference_aws-services-that-work-with-iam.html

http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html

http://docs.aws.amazon.com/general/latest/gr/sigv4-create-canonical-request.html


Common ErrorsThis section lists the errors common to the API actions of all AWS services. For errors specific to an APIaction for this service, see the topic for that API action.

AccessDeniedException

You do not have sufficient access to perform this action.

HTTP Status Code: 400IncompleteSignature

The request signature does not conform to AWS standards.

HTTP Status Code: 400InternalFailure

The request processing has failed because of an unknown error, exception or failure.

HTTP Status Code: 500InvalidAction

The action or operation requested is invalid. Verify that the action is typed correctly.

HTTP Status Code: 400InvalidClientTokenId

The X.509 certificate or AWS access key ID provided does not exist in our records.

HTTP Status Code: 403InvalidParameterCombination

Parameters that must not be used together were used together.

HTTP Status Code: 400InvalidParameterValue

An invalid or out-of-range value was supplied for the input parameter.

HTTP Status Code: 400InvalidQueryParameter

The AWS query string is malformed or does not adhere to AWS standards.

HTTP Status Code: 400MalformedQueryString

The query string contains a syntax error.

HTTP Status Code: 404MissingAction

The request is missing an action or a required parameter.




MissingAuthenticationToken

The request must contain either a valid (registered) AWS access key ID or X.509 certificate.

HTTP Status Code: 403MissingParameter

A required parameter for the specified action is not supplied.

HTTP Status Code: 400NotAuthorized

You do not have permission to perform this action.

HTTP Status Code: 400OptInRequired

The AWS access key ID needs a subscription for the service.

HTTP Status Code: 403RequestExpired

The request reached the service more than 15 minutes after the date stamp on the request or morethan 15 minutes after the request expiration date (such as for pre-signed URLs), or the date stampon the request is more than 15 minutes in the future.

HTTP Status Code: 400ServiceUnavailable

The request has failed due to a temporary failure of the server.

HTTP Status Code: 503ThrottlingException

The request was denied due to request throttling.

HTTP Status Code: 400ValidationError

The input fails to satisfy the constraints specified by an AWS service.



AWS Firewall Manager - Firewall ManagementJan 01, 2018 · AWS Firewall Manager will set the appropriate permissions for the given member account. The account that you associate with

Documents