2026/09/23 - AWS Network Security Manager Customer API - 46 new api methods
Changes AWS Network Security Manager is a new service that helps you centrally configure, deploy, and continuously enforce security policies on network security services across the accounts and resources in your AWS Organization.
Retrieves the details of the specified template.
See also: AWS API Documentation
Request Syntax
client.get_template(
templateIdentifier='string'
)
string
[REQUIRED]
The identifier of the template. This is the template's Amazon Resource Name (ARN).
dict
Response Syntax
{
'templateId': 'string',
'templateArn': 'string',
'templateName': 'string',
'templateDescription': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'associatedRuleList': [
{
'ruleArn': 'string'
},
],
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'firewallType': 'WAF',
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
templateId (string) --
The service-generated id of the template.
templateArn (string) --
The Amazon Resource Name (ARN) of the template.
templateName (string) --
The name of the template.
templateDescription (string) --
A description of the template.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
associatedRuleList (list) --
The rules associated with the template.
(dict) --
An association between a template and a rule, as returned in outputs. The corresponding request structure is RuleReference.
ruleArn (string) --
The ARN of the associated rule.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
firewallType (string) --
The firewall type associated with the resource.
updatedAt (datetime) --
The time when the resource was last updated.
Retrieves the details of the specified AWS Network Security Manager administrator account.
See also: AWS API Documentation
Request Syntax
client.get_admin_account(
accountId='string'
)
string
[REQUIRED]
The AWS account ID of the administrator account to retrieve.
dict
Response Syntax
{
'adminAccountDetails': {
'adminAccount': 'string',
'priority': 123,
'adminScope': {
'scopeFilter': {
'includeAll': {},
'includeOnly': {
'accounts': [
{
'accountId': 'string',
'name': 'string',
'email': 'string'
},
],
'organizationalUnits': [
{
'ouId': 'string',
'name': 'string'
},
]
},
'excludeOnly': {
'accounts': [
{
'accountId': 'string',
'name': 'string',
'email': 'string'
},
],
'organizationalUnits': [
{
'ouId': 'string',
'name': 'string'
},
]
}
},
'firewallTypeScope': {
'allFirewallTypesEnabled': True|False,
'firewallTypes': [
'WAF'|'SHIELD_ADVANCED',
]
}
},
'status': 'ONBOARDED'|'OFFBOARDED'
}
}
Response Structure
(dict) --
adminAccountDetails (dict) --
The details of the administrator account.
adminAccount (string) --
The AWS account ID of the administrator account.
priority (integer) --
The priority assigned to the administrator account.
adminScope (dict) --
The administrative scope, which defines the accounts, organizational units, and firewall types that the administrator can manage.
scopeFilter (dict) --
The filter that determines which accounts and organizational units are in the administrator's scope.
includeAll (dict) --
All accounts and organizational units are in scope.
includeOnly (dict) --
Only the specified accounts and organizational units are in the administrator's scope.
accounts (list) --
The AWS accounts in the selection.
(dict) --
A reference to an AWS account, with optional display metadata.
accountId (string) --
The AWS account ID.
name (string) --
The display name of the account.
email (string) --
The email address associated with the account.
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(dict) --
A reference to an AWS Organizations organizational unit (OU), with optional display metadata.
ouId (string) --
The ID of the AWS Organizations organizational unit (OU).
name (string) --
The display name of the organizational unit.
excludeOnly (dict) --
The accounts and organizational units to exclude from the administrator's scope. All others are in scope.
accounts (list) --
The AWS accounts in the selection.
(dict) --
A reference to an AWS account, with optional display metadata.
accountId (string) --
The AWS account ID.
name (string) --
The display name of the account.
email (string) --
The email address associated with the account.
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(dict) --
A reference to an AWS Organizations organizational unit (OU), with optional display metadata.
ouId (string) --
The ID of the AWS Organizations organizational unit (OU).
name (string) --
The display name of the organizational unit.
firewallTypeScope (dict) --
The firewall types that the administrator can create and manage.
allFirewallTypesEnabled (boolean) --
Specifies whether the administrator can manage all firewall types, except for third-party firewall types.
firewallTypes (list) --
The list of firewall types that the administrator can manage.
(string) --
status (string) --
The status of the administrator account, either ONBOARDED or OFFBOARDED.
Lists the snapshots of the specified rule.
See also: AWS API Documentation
Request Syntax
client.list_rule_snapshots(
ruleIdentifier='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The identifier of the rule. This is the rule's Amazon Resource Name (ARN).
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
dict
Response Syntax
{
'nextToken': 'string',
'snapshots': [
{
'ruleId': 'string',
'ruleArn': 'string',
'ruleName': 'string',
'firewallType': 'WAF',
'ruleType': 'CONFIGURATION'|'INSPECTION',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
snapshots (list) --
The snapshots of the rule.
(dict) --
Summary information about a rule.
ruleId (string) --
The service-generated id of the rule.
ruleArn (string) --
The Amazon Resource Name (ARN) of the rule.
ruleName (string) --
The name of the rule.
firewallType (string) --
The firewall type associated with the resource.
ruleType (string) --
The type of the rule. CONFIGURATION rules contain firewall settings, and INSPECTION rules contain rule groups.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the resource was last updated. For a snapshot, this is the time when the snapshot was created.
Updates the specified template. To prevent conflicting concurrent updates, provide the current updateToken. Use isPublished to publish the update or keep the template as a draft.
See also: AWS API Documentation
Request Syntax
client.update_template(
templateIdentifier='string',
updateToken='string',
templateDescription='string',
associatedRuleList=[
{
'ruleIdentifier': 'string'
},
],
isPublished=True|False,
clientToken='string'
)
string
[REQUIRED]
The identifier of the template. This is the template's Amazon Resource Name (ARN).
string
[REQUIRED]
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
string
A description of the template.
list
The rules associated with the template.
(dict) --
A reference to a rule in a create or update request.
ruleIdentifier (string) -- [REQUIRED]
The identifier of the rule. This is the rule's Amazon Resource Name (ARN).
boolean
[REQUIRED]
Specifies whether to publish the resource. When true, the resource is saved in published ( ACTIVE) state. When false, it is saved as a draft ( DRAFT).
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
dict
Response Syntax
{
'templateId': 'string',
'templateArn': 'string',
'templateName': 'string',
'templateDescription': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'associatedRuleList': [
{
'ruleArn': 'string'
},
],
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'firewallType': 'WAF',
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
templateId (string) --
The service-generated id of the template.
templateArn (string) --
The Amazon Resource Name (ARN) of the template.
templateName (string) --
The name of the template.
templateDescription (string) --
A description of the template.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
associatedRuleList (list) --
The rules associated with the template.
(dict) --
An association between a template and a rule, as returned in outputs. The corresponding request structure is RuleReference.
ruleArn (string) --
The ARN of the associated rule.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
firewallType (string) --
The firewall type associated with the resource.
updatedAt (datetime) --
The time when the resource was last updated.
Updates the specified rule. To prevent conflicting concurrent updates, provide the current updateToken. Use isPublished to publish the update or keep the rule as a draft.
See also: AWS API Documentation
Request Syntax
client.update_rule(
ruleIdentifier='string',
updateToken='string',
ruleType='CONFIGURATION'|'INSPECTION',
ruleDescription='string',
configuration={...}|[...]|123|123.4|'string'|True|None,
isPublished=True|False,
clientToken='string'
)
string
[REQUIRED]
The identifier of the rule. This is the rule's Amazon Resource Name (ARN).
string
[REQUIRED]
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
string
The type of the rule. CONFIGURATION rules contain firewall settings, and INSPECTION rules contain rule groups.
string
A description of the rule.
:ref:`document<document>`
The firewall configuration for the rule, as a JSON document. The structure depends on the rule's firewall type and rule type. For an AWS WAF INSPECTION rule, provide an AWS WAF rule group. For an AWS WAF CONFIGURATION rule, provide a single web ACL setting, such as DefaultAction or VisibilityConfig; use wafConfigDataType to declare which setting the document contains. For the schema of each setting and complete examples, see Writing rule configurations in the AWS Network Security Manager Developer Guide.
boolean
[REQUIRED]
Specifies whether to publish the resource. When true, the resource is saved in published ( ACTIVE) state. When false, it is saved as a draft ( DRAFT).
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
dict
Response Syntax
{
'ruleId': 'string',
'ruleArn': 'string',
'ruleName': 'string',
'firewallType': 'WAF',
'ruleType': 'CONFIGURATION'|'INSPECTION',
'ruleDescription': 'string',
'configuration': {...}|[...]|123|123.4|'string'|True|None,
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
ruleId (string) --
The service-generated id of the rule.
ruleArn (string) --
The Amazon Resource Name (ARN) of the rule.
ruleName (string) --
The name of the rule.
firewallType (string) --
The firewall type associated with the resource.
ruleType (string) --
The type of the rule. CONFIGURATION rules contain firewall settings, and INSPECTION rules contain rule groups.
ruleDescription (string) --
A description of the rule.
configuration (:ref:`document<document>`) --
The firewall configuration for the rule, as a JSON document. The structure depends on the rule's firewall type and rule type.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the resource was last updated.
Creates a policy. A policy combines templates and rules with enforcement settings for a firewall type, such as AWS WAF or AWS Shield Advanced. Use isPublished to create the policy in published ( ACTIVE) or draft ( DRAFT) state.
See also: AWS API Documentation
Request Syntax
client.create_policy(
clientToken='string',
policyName='string',
policyDescription='string',
priority=123,
associatedTemplateAndRuleList=[
{
'templateIdentifier': 'string',
'ruleIdentifier': 'string'
},
],
firewallType='WAF'|'SHIELD_ADVANCED',
policyConfiguration={
'remediationEnabled': True|False,
'resourcesCleanUp': True|False,
'wafConfig': {
'existingCustomerWebACLResolution': 'RETROFIT'|'OVERRIDE_ASSOCIATION'|'NO_REMEDIATION',
'conflictResolution': 'MERGE_WHERE_APPLICABLE'
}
},
isPublished=True|False,
tags={
'string': 'string'
}
)
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
string
[REQUIRED]
The name of the policy.
string
A description of the policy.
integer
[REQUIRED]
The priority of the resource. A lower number indicates a higher priority.
list
The templates and rules to associate with the policy. For AWS WAF policies, specify 1 to 100 templates or rules, of which at most 2 can be templates. For AWS Shield Advanced policies, this list must be empty.
(dict) --
A reference to either a template or a rule in a create or update request. Set exactly one of templateIdentifier or ruleIdentifier.
templateIdentifier (string) --
The identifier of the template. This is the template's Amazon Resource Name (ARN).
ruleIdentifier (string) --
The identifier of the rule. This is the rule's Amazon Resource Name (ARN).
string
[REQUIRED]
The firewall type associated with the resource.
dict
[REQUIRED]
The configuration settings that control the policy's behavior, including remediation and firewall-type-specific settings.
remediationEnabled (boolean) -- [REQUIRED]
Specifies whether AWS Network Security Manager automatically remediates noncompliant resources. Default: false.
resourcesCleanUp (boolean) -- [REQUIRED]
Specifies whether AWS Network Security Manager automatically removes the resources it created when they are no longer needed. Default: false.
wafConfig (dict) --
AWS WAF-specific policy settings. This is populated only for AWS WAF policies.
existingCustomerWebACLResolution (string) -- [REQUIRED]
Determines how AWS Network Security Manager handles remediation when a resource already has a customer-created web ACL. Required for AWS WAF policies.
conflictResolution (string) -- [REQUIRED]
The conflict-resolution strategy for AWS WAF policies. Required for AWS WAF policies.
boolean
Specifies whether to publish the resource. When true, the resource is saved in published ( ACTIVE) state. When false, it is saved as a draft ( DRAFT). Default: true.
dict
The tags to add to the resource when it is created.
(string) --
(string) --
dict
Response Syntax
{
'policyId': 'string',
'policyArn': 'string',
'policyName': 'string',
'policyDescription': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'priority': 123,
'associatedTemplateAndRuleList': [
{
'templateArn': 'string',
'ruleArn': 'string'
},
],
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'firewallType': 'WAF'|'SHIELD_ADVANCED',
'policyConfiguration': {
'remediationEnabled': True|False,
'resourcesCleanUp': True|False,
'wafConfig': {
'existingCustomerWebACLResolution': 'RETROFIT'|'OVERRIDE_ASSOCIATION'|'NO_REMEDIATION',
'conflictResolution': 'MERGE_WHERE_APPLICABLE'
}
},
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
policyId (string) --
The service-generated id of the policy.
policyArn (string) --
The Amazon Resource Name (ARN) of the policy.
policyName (string) --
The name of the policy.
policyDescription (string) --
A description of the policy.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
priority (integer) --
The priority of the resource. A lower number indicates a higher priority.
associatedTemplateAndRuleList (list) --
The templates and rules associated with the policy. For AWS WAF policies, this list contains 1 to 100 templates or rules, of which at most 2 can be templates. For AWS Shield Advanced policies, this list is empty.
(dict) --
An association between a policy and either a template or a rule, as returned in outputs. Exactly one of templateArn or ruleArn is set. The corresponding request structure is TemplateOrRuleReference.
templateArn (string) --
The ARN of the associated template.
ruleArn (string) --
The ARN of the associated rule.
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
firewallType (string) --
The firewall type associated with the resource.
policyConfiguration (dict) --
The configuration settings that control the policy's behavior, including remediation and firewall-type-specific settings.
remediationEnabled (boolean) --
Specifies whether AWS Network Security Manager automatically remediates noncompliant resources. Default: false.
resourcesCleanUp (boolean) --
Specifies whether AWS Network Security Manager automatically removes the resources it created when they are no longer needed. Default: false.
wafConfig (dict) --
AWS WAF-specific policy settings. This is populated only for AWS WAF policies.
existingCustomerWebACLResolution (string) --
Determines how AWS Network Security Manager handles remediation when a resource already has a customer-created web ACL. Required for AWS WAF policies.
conflictResolution (string) --
The conflict-resolution strategy for AWS WAF policies. Required for AWS WAF policies.
updatedAt (datetime) --
The time when the resource was last updated.
Creates a snapshot of the current published version of the specified template.
See also: AWS API Documentation
Request Syntax
client.create_template_snapshot(
templateIdentifier='string',
clientToken='string',
tags={
'string': 'string'
}
)
string
[REQUIRED]
The identifier of the template. This is the template's Amazon Resource Name (ARN).
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
dict
The tags to add to the snapshot when it is created.
(string) --
(string) --
dict
Response Syntax
{
'templateId': 'string',
'templateArn': 'string',
'templateName': 'string',
'templateDescription': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'associatedRuleList': [
{
'ruleArn': 'string'
},
],
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'firewallType': 'WAF',
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
templateId (string) --
The service-generated id of the template.
templateArn (string) --
The Amazon Resource Name (ARN) of the template.
templateName (string) --
The name of the template.
templateDescription (string) --
A description of the template.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
associatedRuleList (list) --
The rules associated with the template.
(dict) --
An association between a template and a rule, as returned in outputs. The corresponding request structure is RuleReference.
ruleArn (string) --
The ARN of the associated rule.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
firewallType (string) --
The firewall type associated with the resource.
updatedAt (datetime) --
The time when the snapshot was created.
Retrieves the details of the specified scope.
See also: AWS API Documentation
Request Syntax
client.get_scope(
scopeIdentifier='string'
)
string
[REQUIRED]
The identifier of the scope. This is the scope's Amazon Resource Name (ARN).
dict
Response Syntax
{
'scopeId': 'string',
'scopeArn': 'string',
'scopeName': 'string',
'scopeDescription': 'string',
'scopeConfiguration': {
'accountFilter': {
'includeAll': {},
'include': {
'accountIds': [
'string',
],
'organizationalUnits': [
'string',
]
},
'exclude': {
'accountIds': [
'string',
],
'organizationalUnits': [
'string',
]
}
},
'resourceScopes': {
'string': {
'includeAll': True|False,
'include': {
'explicitArns': [
'string',
],
'expression': {
'criteria': {
'tags': {
'string': 'string'
},
'albConfig': {
'scheme': 'internet-facing'|'internal',
'ipAddressType': 'ipv4'|'dualstack'|'dualstack-without-public-ipv4'
}
},
'and': [
{'... recursive ...'},
],
'or': [
{'... recursive ...'},
],
'not': {'... recursive ...'}
}
},
'exclude': {
'explicitArns': [
'string',
],
'expression': {
'criteria': {
'tags': {
'string': 'string'
},
'albConfig': {
'scheme': 'internet-facing'|'internal',
'ipAddressType': 'ipv4'|'dualstack'|'dualstack-without-public-ipv4'
}
},
'and': [
{'... recursive ...'},
],
'or': [
{'... recursive ...'},
],
'not': {'... recursive ...'}
}
}
}
}
},
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
scopeId (string) --
The service-generated id of the scope.
scopeArn (string) --
The Amazon Resource Name (ARN) of the scope.
scopeName (string) --
The name of the scope.
scopeDescription (string) --
A description of the scope.
scopeConfiguration (dict) --
The configuration that defines which accounts and resources are in scope.
accountFilter (dict) --
The account filter that determines which accounts are in scope. When set, exactly one of includeAll, include, or exclude is set.
Organization administrators must include an account filter in every scope configuration. Single-account administrators must omit it: a scope without an account filter applies only to the administrator's own account. The presence of an account filter is fixed when the scope is created: an update can't add an account filter to a scope that was created without one, or remove the account filter from a scope that was created with one.
includeAll (dict) --
Includes all accounts. No account filtering is applied.
include (dict) --
Includes only the specified accounts and organizational units.
accountIds (list) --
The list of AWS account IDs.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
exclude (dict) --
Excludes the specified accounts and organizational units. All others are in scope.
accountIds (list) --
The list of AWS account IDs.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
resourceScopes (dict) --
The resource-level scoping configuration, keyed by resource type, that defines which resources within the selected accounts are in scope.
(string) --
(dict) --
Defines which resources of a given type are in scope. Exactly one of includeAll, include, or exclude is set.
includeAll (boolean) --
Includes all resources of the resource type.
include (dict) --
Includes the resources that match the specified criteria or explicit ARNs.
explicitArns (list) --
An explicit list of resource ARNs.
(string) --
expression (dict) --
A logical expression that selects resources by combining criteria with AND, OR, and NOT operators.
criteria (dict) --
A leaf condition that matches resources by tag or by resource-type-specific configuration.
tags (dict) --
Tag key-value pairs used to match resources.
(string) --
(string) --
albConfig (dict) --
Filter criteria specific to Application Load Balancers.
scheme (string) --
The scheme of the Application Load Balancer, either internet-facing or internal.
ipAddressType (string) --
The IP address type of the Application Load Balancer.
and (list) --
A list of subexpressions that must all match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
or (list) --
A list of subexpressions of which at least one must match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
not (dict) --
A subexpression that must not match.
exclude (dict) --
Excludes the resources that match the specified criteria or explicit ARNs.
explicitArns (list) --
An explicit list of resource ARNs.
(string) --
expression (dict) --
A logical expression that selects resources by combining criteria with AND, OR, and NOT operators.
criteria (dict) --
A leaf condition that matches resources by tag or by resource-type-specific configuration.
tags (dict) --
Tag key-value pairs used to match resources.
(string) --
(string) --
albConfig (dict) --
Filter criteria specific to Application Load Balancers.
scheme (string) --
The scheme of the Application Load Balancer, either internet-facing or internal.
ipAddressType (string) --
The IP address type of the Application Load Balancer.
and (list) --
A list of subexpressions that must all match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
or (list) --
A list of subexpressions of which at least one must match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
not (dict) --
A subexpression that must not match.
status (string) --
The current status of the resource: DRAFT (unpublished, editable), ACTIVE (published, in use), or DISABLED (deactivated; changes cannot be published until the resource is re-enabled).
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the resource was last updated.
Lists the AWS Network Security Manager administrator accounts in the organization.
See also: AWS API Documentation
Request Syntax
client.list_admin_accounts(
maxResults=123,
nextToken='string'
)
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
dict
Response Syntax
{
'nextToken': 'string',
'adminAccounts': [
{
'accountId': 'string',
'priority': 123,
'name': 'string',
'email': 'string'
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
adminAccounts (list) --
The list of administrator accounts.
(dict) --
Summary information about an AWS Network Security Manager administrator account.
accountId (string) --
The AWS account ID.
priority (integer) --
The priority assigned to the administrator account.
name (string) --
The name of the administrator account.
email (string) --
The email address associated with the account.
Lists the snapshots of the specified policy.
See also: AWS API Documentation
Request Syntax
client.list_policy_snapshots(
policyIdentifier='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The identifier of the policy. This is the policy's Amazon Resource Name (ARN).
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
dict
Response Syntax
{
'nextToken': 'string',
'snapshots': [
{
'policyId': 'string',
'policyArn': 'string',
'policyName': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'hasPublishedVersion': True|False,
'firewallType': 'WAF'|'SHIELD_ADVANCED',
'priority': 123,
'updatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
snapshots (list) --
The snapshots of the policy.
(dict) --
Summary information about a policy.
policyId (string) --
The service-generated id of the policy.
policyArn (string) --
The Amazon Resource Name (ARN) of the policy.
policyName (string) --
The name of the policy.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
firewallType (string) --
The firewall type associated with the resource.
priority (integer) --
The priority of the resource. A lower number indicates a higher priority.
updatedAt (datetime) --
The time when the resource was last updated. For a snapshot, this is the time when the snapshot was created.
Lists the policies in the account. You can filter the results by status and page through them using maxResults and nextToken.
See also: AWS API Documentation
Request Syntax
client.list_policies(
maxResults=123,
nextToken='string',
status='ACTIVE'|'DRAFT'|'DISABLED'
)
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
string
Filters the results by status, either ACTIVE or DRAFT.
dict
Response Syntax
{
'nextToken': 'string',
'policies': [
{
'policyId': 'string',
'policyArn': 'string',
'policyName': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'hasPublishedVersion': True|False,
'firewallType': 'WAF'|'SHIELD_ADVANCED',
'priority': 123,
'updatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
policies (list) --
The list of policies.
(dict) --
Summary information about a policy.
policyId (string) --
The service-generated id of the policy.
policyArn (string) --
The Amazon Resource Name (ARN) of the policy.
policyName (string) --
The name of the policy.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
firewallType (string) --
The firewall type associated with the resource.
priority (integer) --
The priority of the resource. A lower number indicates a higher priority.
updatedAt (datetime) --
The time when the resource was last updated. For a snapshot, this is the time when the snapshot was created.
Sets the AWS account that serves as an AWS Network Security Manager administrator account, and optionally configures the scope of resources that the administrator can manage.
You can't set an administrator account again immediately after you remove it, or while the service creates its service-linked role. Retry the request after a few minutes.
See also: AWS API Documentation
Request Syntax
client.put_admin_account(
accountId='string',
priority=123,
adminScope={
'scopeFilter': {
'includeAll': {}
,
'includeOnly': {
'accounts': [
'string',
],
'organizationalUnits': [
'string',
]
},
'excludeOnly': {
'accounts': [
'string',
],
'organizationalUnits': [
'string',
]
}
},
'firewallTypeScope': {
'allFirewallTypesEnabled': True|False,
'firewallTypes': [
'WAF'|'SHIELD_ADVANCED',
]
}
}
)
string
[REQUIRED]
The AWS account ID to set as the AWS Network Security Manager administrator account.
integer
[REQUIRED]
The priority to assign to the administrator account.
dict
The scope of accounts, organizational units, and firewall types that the administrator can manage.
scopeFilter (dict) --
The filter that determines which accounts and organizational units are in the administrator's scope.
includeAll (dict) --
All accounts and organizational units are in scope.
includeOnly (dict) --
Only the specified accounts and organizational units are in the administrator's scope.
accounts (list) --
The AWS accounts in the selection.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
excludeOnly (dict) --
The accounts and organizational units to exclude from the administrator's scope. All others are in scope.
accounts (list) --
The AWS accounts in the selection.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
firewallTypeScope (dict) --
The firewall types that the administrator can create and manage.
allFirewallTypesEnabled (boolean) --
Specifies whether the administrator can manage all firewall types, except for third-party firewall types.
firewallTypes (list) --
The list of firewall types that the administrator can manage.
(string) --
dict
Response Syntax
{
'adminAccountDetails': {
'adminAccount': 'string',
'priority': 123,
'adminScope': {
'scopeFilter': {
'includeAll': {},
'includeOnly': {
'accounts': [
{
'accountId': 'string',
'name': 'string',
'email': 'string'
},
],
'organizationalUnits': [
{
'ouId': 'string',
'name': 'string'
},
]
},
'excludeOnly': {
'accounts': [
{
'accountId': 'string',
'name': 'string',
'email': 'string'
},
],
'organizationalUnits': [
{
'ouId': 'string',
'name': 'string'
},
]
}
},
'firewallTypeScope': {
'allFirewallTypesEnabled': True|False,
'firewallTypes': [
'WAF'|'SHIELD_ADVANCED',
]
}
},
'status': 'ONBOARDED'|'OFFBOARDED'
}
}
Response Structure
(dict) --
adminAccountDetails (dict) --
The details of the administrator account that was set.
adminAccount (string) --
The AWS account ID of the administrator account.
priority (integer) --
The priority assigned to the administrator account.
adminScope (dict) --
The administrative scope, which defines the accounts, organizational units, and firewall types that the administrator can manage.
scopeFilter (dict) --
The filter that determines which accounts and organizational units are in the administrator's scope.
includeAll (dict) --
All accounts and organizational units are in scope.
includeOnly (dict) --
Only the specified accounts and organizational units are in the administrator's scope.
accounts (list) --
The AWS accounts in the selection.
(dict) --
A reference to an AWS account, with optional display metadata.
accountId (string) --
The AWS account ID.
name (string) --
The display name of the account.
email (string) --
The email address associated with the account.
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(dict) --
A reference to an AWS Organizations organizational unit (OU), with optional display metadata.
ouId (string) --
The ID of the AWS Organizations organizational unit (OU).
name (string) --
The display name of the organizational unit.
excludeOnly (dict) --
The accounts and organizational units to exclude from the administrator's scope. All others are in scope.
accounts (list) --
The AWS accounts in the selection.
(dict) --
A reference to an AWS account, with optional display metadata.
accountId (string) --
The AWS account ID.
name (string) --
The display name of the account.
email (string) --
The email address associated with the account.
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(dict) --
A reference to an AWS Organizations organizational unit (OU), with optional display metadata.
ouId (string) --
The ID of the AWS Organizations organizational unit (OU).
name (string) --
The display name of the organizational unit.
firewallTypeScope (dict) --
The firewall types that the administrator can create and manage.
allFirewallTypesEnabled (boolean) --
Specifies whether the administrator can manage all firewall types, except for third-party firewall types.
firewallTypes (list) --
The list of firewall types that the administrator can manage.
(string) --
status (string) --
The status of the administrator account, either ONBOARDED or OFFBOARDED.
Deletes the specified rule.
See also: AWS API Documentation
Request Syntax
client.delete_rule(
ruleIdentifier='string'
)
string
[REQUIRED]
The identifier of the rule. This is the rule's Amazon Resource Name (ARN).
None
Creates a scope. A scope selects the accounts and resources that a deployment applies to. Use isPublished to create the scope in published ( ACTIVE) or draft ( DRAFT) state.
See also: AWS API Documentation
Request Syntax
client.create_scope(
clientToken='string',
scopeName='string',
scopeDescription='string',
scopeConfiguration={
'accountFilter': {
'includeAll': {}
,
'include': {
'accountIds': [
'string',
],
'organizationalUnits': [
'string',
]
},
'exclude': {
'accountIds': [
'string',
],
'organizationalUnits': [
'string',
]
}
},
'resourceScopes': {
'string': {
'includeAll': True|False,
'include': {
'explicitArns': [
'string',
],
'expression': {
'criteria': {
'tags': {
'string': 'string'
},
'albConfig': {
'scheme': 'internet-facing'|'internal',
'ipAddressType': 'ipv4'|'dualstack'|'dualstack-without-public-ipv4'
}
},
'and': [
{'... recursive ...'},
],
'or': [
{'... recursive ...'},
],
'not': {'... recursive ...'}
}
},
'exclude': {
'explicitArns': [
'string',
],
'expression': {
'criteria': {
'tags': {
'string': 'string'
},
'albConfig': {
'scheme': 'internet-facing'|'internal',
'ipAddressType': 'ipv4'|'dualstack'|'dualstack-without-public-ipv4'
}
},
'and': [
{'... recursive ...'},
],
'or': [
{'... recursive ...'},
],
'not': {'... recursive ...'}
}
}
}
}
},
isPublished=True|False,
tags={
'string': 'string'
}
)
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
string
[REQUIRED]
The name of the scope.
string
A description of the scope.
dict
[REQUIRED]
The configuration that defines which accounts and resources are in scope.
accountFilter (dict) --
The account filter that determines which accounts are in scope. When set, exactly one of includeAll, include, or exclude is set.
Organization administrators must include an account filter in every scope configuration. Single-account administrators must omit it: a scope without an account filter applies only to the administrator's own account. The presence of an account filter is fixed when the scope is created: an update can't add an account filter to a scope that was created without one, or remove the account filter from a scope that was created with one.
includeAll (dict) --
Includes all accounts. No account filtering is applied.
include (dict) --
Includes only the specified accounts and organizational units.
accountIds (list) --
The list of AWS account IDs.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
exclude (dict) --
Excludes the specified accounts and organizational units. All others are in scope.
accountIds (list) --
The list of AWS account IDs.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
resourceScopes (dict) -- [REQUIRED]
The resource-level scoping configuration, keyed by resource type, that defines which resources within the selected accounts are in scope.
(string) --
(dict) --
Defines which resources of a given type are in scope. Exactly one of includeAll, include, or exclude is set.
includeAll (boolean) --
Includes all resources of the resource type.
include (dict) --
Includes the resources that match the specified criteria or explicit ARNs.
explicitArns (list) --
An explicit list of resource ARNs.
(string) --
expression (dict) --
A logical expression that selects resources by combining criteria with AND, OR, and NOT operators.
criteria (dict) --
A leaf condition that matches resources by tag or by resource-type-specific configuration.
tags (dict) --
Tag key-value pairs used to match resources.
(string) --
(string) --
albConfig (dict) --
Filter criteria specific to Application Load Balancers.
scheme (string) --
The scheme of the Application Load Balancer, either internet-facing or internal.
ipAddressType (string) --
The IP address type of the Application Load Balancer.
and (list) --
A list of subexpressions that must all match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
or (list) --
A list of subexpressions of which at least one must match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
not (dict) --
A subexpression that must not match.
exclude (dict) --
Excludes the resources that match the specified criteria or explicit ARNs.
explicitArns (list) --
An explicit list of resource ARNs.
(string) --
expression (dict) --
A logical expression that selects resources by combining criteria with AND, OR, and NOT operators.
criteria (dict) --
A leaf condition that matches resources by tag or by resource-type-specific configuration.
tags (dict) --
Tag key-value pairs used to match resources.
(string) --
(string) --
albConfig (dict) --
Filter criteria specific to Application Load Balancers.
scheme (string) --
The scheme of the Application Load Balancer, either internet-facing or internal.
ipAddressType (string) --
The IP address type of the Application Load Balancer.
and (list) --
A list of subexpressions that must all match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
or (list) --
A list of subexpressions of which at least one must match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
not (dict) --
A subexpression that must not match.
boolean
Specifies whether to publish the resource. When true, the resource is saved in published ( ACTIVE) state. When false, it is saved as a draft ( DRAFT). Default: true.
dict
The tags to add to the resource when it is created.
(string) --
(string) --
dict
Response Syntax
{
'scopeId': 'string',
'scopeArn': 'string',
'scopeName': 'string',
'scopeDescription': 'string',
'scopeConfiguration': {
'accountFilter': {
'includeAll': {},
'include': {
'accountIds': [
'string',
],
'organizationalUnits': [
'string',
]
},
'exclude': {
'accountIds': [
'string',
],
'organizationalUnits': [
'string',
]
}
},
'resourceScopes': {
'string': {
'includeAll': True|False,
'include': {
'explicitArns': [
'string',
],
'expression': {
'criteria': {
'tags': {
'string': 'string'
},
'albConfig': {
'scheme': 'internet-facing'|'internal',
'ipAddressType': 'ipv4'|'dualstack'|'dualstack-without-public-ipv4'
}
},
'and': [
{'... recursive ...'},
],
'or': [
{'... recursive ...'},
],
'not': {'... recursive ...'}
}
},
'exclude': {
'explicitArns': [
'string',
],
'expression': {
'criteria': {
'tags': {
'string': 'string'
},
'albConfig': {
'scheme': 'internet-facing'|'internal',
'ipAddressType': 'ipv4'|'dualstack'|'dualstack-without-public-ipv4'
}
},
'and': [
{'... recursive ...'},
],
'or': [
{'... recursive ...'},
],
'not': {'... recursive ...'}
}
}
}
}
},
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
scopeId (string) --
The service-generated id of the scope.
scopeArn (string) --
The Amazon Resource Name (ARN) of the scope.
scopeName (string) --
The name of the scope.
scopeDescription (string) --
A description of the scope.
scopeConfiguration (dict) --
The configuration that defines which accounts and resources are in scope.
accountFilter (dict) --
The account filter that determines which accounts are in scope. When set, exactly one of includeAll, include, or exclude is set.
Organization administrators must include an account filter in every scope configuration. Single-account administrators must omit it: a scope without an account filter applies only to the administrator's own account. The presence of an account filter is fixed when the scope is created: an update can't add an account filter to a scope that was created without one, or remove the account filter from a scope that was created with one.
includeAll (dict) --
Includes all accounts. No account filtering is applied.
include (dict) --
Includes only the specified accounts and organizational units.
accountIds (list) --
The list of AWS account IDs.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
exclude (dict) --
Excludes the specified accounts and organizational units. All others are in scope.
accountIds (list) --
The list of AWS account IDs.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
resourceScopes (dict) --
The resource-level scoping configuration, keyed by resource type, that defines which resources within the selected accounts are in scope.
(string) --
(dict) --
Defines which resources of a given type are in scope. Exactly one of includeAll, include, or exclude is set.
includeAll (boolean) --
Includes all resources of the resource type.
include (dict) --
Includes the resources that match the specified criteria or explicit ARNs.
explicitArns (list) --
An explicit list of resource ARNs.
(string) --
expression (dict) --
A logical expression that selects resources by combining criteria with AND, OR, and NOT operators.
criteria (dict) --
A leaf condition that matches resources by tag or by resource-type-specific configuration.
tags (dict) --
Tag key-value pairs used to match resources.
(string) --
(string) --
albConfig (dict) --
Filter criteria specific to Application Load Balancers.
scheme (string) --
The scheme of the Application Load Balancer, either internet-facing or internal.
ipAddressType (string) --
The IP address type of the Application Load Balancer.
and (list) --
A list of subexpressions that must all match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
or (list) --
A list of subexpressions of which at least one must match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
not (dict) --
A subexpression that must not match.
exclude (dict) --
Excludes the resources that match the specified criteria or explicit ARNs.
explicitArns (list) --
An explicit list of resource ARNs.
(string) --
expression (dict) --
A logical expression that selects resources by combining criteria with AND, OR, and NOT operators.
criteria (dict) --
A leaf condition that matches resources by tag or by resource-type-specific configuration.
tags (dict) --
Tag key-value pairs used to match resources.
(string) --
(string) --
albConfig (dict) --
Filter criteria specific to Application Load Balancers.
scheme (string) --
The scheme of the Application Load Balancer, either internet-facing or internal.
ipAddressType (string) --
The IP address type of the Application Load Balancer.
and (list) --
A list of subexpressions that must all match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
or (list) --
A list of subexpressions of which at least one must match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
not (dict) --
A subexpression that must not match.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the resource was last updated.
Lists the synchronization statuses of the resources covered by the specified deployment. You can filter the results by synchronization status and page through them.
See also: AWS API Documentation
Request Syntax
client.list_resource_synchronization_statuses(
deploymentIdentifier='string',
synchronizationStatus='IN_SYNC'|'OUT_OF_SYNC'|'NOT_APPLICABLE',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The identifier of the deployment to list synchronization statuses for. This is the deployment's Amazon Resource Name (ARN).
string
Filters the results by synchronization status, such as IN_SYNC or OUT_OF_SYNC.
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
dict
Response Syntax
{
'nextToken': 'string',
'resourceSynchronizationStatuses': [
{
'synchronizationStatus': 'IN_SYNC'|'OUT_OF_SYNC'|'NOT_APPLICABLE',
'accountId': 'string',
'resourceArn': 'string',
'deploymentArn': 'string',
'resourceType': 'AWS::ApiGateway::Stage'|'AWS::CloudFront::Distribution'|'AWS::EC2::EIP'|'AWS::ElasticLoadBalancingV2::LoadBalancer::application'|'AWS::ElasticLoadBalancing::LoadBalancer'|'AWS::WAFv2::WebACL'|'AWS::Shield::Protection'|'AWS::ShieldRegional::Protection',
'updatedAt': datetime(2015, 1, 1),
'outOfSyncReasons': {
'reasons': {
'string': {
'missingFirewall': 'string',
'invalidFirewall': {
'incorrectSingleValueConfigurations': [
{
'configurationName': 'string',
'expectedValue': 'string',
'actualValue': 'string'
},
],
'missingAppendableConfigurationValues': [
{
'configurationName': 'string',
'expectedValue': 'string',
'actualValue': 'string'
},
],
'unexpectedAppendableConfigurationValues': [
{
'configurationName': 'string',
'expectedValue': 'string',
'actualValue': 'string'
},
],
'incorrectAppendableConfigurationOrder': [
{
'configurationName': 'string',
'expectedValue': 'string',
'actualValue': 'string'
},
],
'missingMergeableConfigurationValues': [
{
'configurationName': 'string',
'expectedValue': 'string',
'actualValue': 'string'
},
],
'unexpectedMergeableConfigurationValues': [
{
'configurationName': 'string',
'expectedValue': 'string',
'actualValue': 'string'
},
]
}
}
},
'notVisible': {
'reason': 'string'
}
},
'remediationIssues': {
'issues': {
'string': {
'issueType': 'string',
'message': 'string',
'correctiveAction': 'string'
}
},
'notVisible': {
'reason': 'string'
}
},
'evaluatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
resourceSynchronizationStatuses (list) --
The list of resource synchronization statuses.
(dict) --
The synchronization status of a resource covered by a deployment.
synchronizationStatus (string) --
The synchronization status of the resource, such as IN_SYNC or OUT_OF_SYNC.
accountId (string) --
The AWS account ID that owns the resource.
resourceArn (string) --
The ARN of the resource whose synchronization status is reported.
deploymentArn (string) --
The ARN of the deployment that the synchronization status is associated with. This is absent for aggregate (cross-deployment) statuses.
resourceType (string) --
The type of the resource, in AWS CloudFormation format.
updatedAt (datetime) --
The time when the resource was last updated.
outOfSyncReasons (dict) --
The reasons the resource is out of sync, keyed by firewall type. This is null when the resource is in sync.
reasons (dict) --
The out-of-sync reasons, keyed by firewall type.
(string) --
(dict) --
Describes why a firewall is out of sync. Exactly one of missingFirewall or invalidFirewall is set.
missingFirewall (string) --
Indicates that an expected firewall is missing. The value describes the missing firewall.
invalidFirewall (dict) --
Details about a firewall whose configuration does not match the intended configuration.
incorrectSingleValueConfigurations (list) --
Single-value configuration settings whose values do not match the expected values.
(dict) --
Describes a single configuration value that does not match the intended configuration.
configurationName (string) --
The name of the configuration setting that is in conflict.
expectedValue (string) --
The configuration value that AWS Network Security Manager expected.
actualValue (string) --
The configuration value that was found on the resource.
missingAppendableConfigurationValues (list) --
Appendable configuration values that are expected but missing.
(dict) --
Describes a single configuration value that does not match the intended configuration.
configurationName (string) --
The name of the configuration setting that is in conflict.
expectedValue (string) --
The configuration value that AWS Network Security Manager expected.
actualValue (string) --
The configuration value that was found on the resource.
unexpectedAppendableConfigurationValues (list) --
Appendable configuration values that are present but not expected.
(dict) --
Describes a single configuration value that does not match the intended configuration.
configurationName (string) --
The name of the configuration setting that is in conflict.
expectedValue (string) --
The configuration value that AWS Network Security Manager expected.
actualValue (string) --
The configuration value that was found on the resource.
incorrectAppendableConfigurationOrder (list) --
Appendable configuration values that are present but in the wrong order.
(dict) --
Describes a single configuration value that does not match the intended configuration.
configurationName (string) --
The name of the configuration setting that is in conflict.
expectedValue (string) --
The configuration value that AWS Network Security Manager expected.
actualValue (string) --
The configuration value that was found on the resource.
missingMergeableConfigurationValues (list) --
Mergeable configuration values that are expected but missing.
(dict) --
Describes a single configuration value that does not match the intended configuration.
configurationName (string) --
The name of the configuration setting that is in conflict.
expectedValue (string) --
The configuration value that AWS Network Security Manager expected.
actualValue (string) --
The configuration value that was found on the resource.
unexpectedMergeableConfigurationValues (list) --
Mergeable configuration values that are present but not expected.
(dict) --
Describes a single configuration value that does not match the intended configuration.
configurationName (string) --
The name of the configuration setting that is in conflict.
expectedValue (string) --
The configuration value that AWS Network Security Manager expected.
actualValue (string) --
The configuration value that was found on the resource.
notVisible (dict) --
Indicates that the details are not visible because of cross-account restrictions.
reason (string) --
The reason the details are not visible.
remediationIssues (dict) --
Details about remediation issues, keyed by firewall type. This is null when there are no remediation issues.
issues (dict) --
The remediation issues, keyed by firewall type.
(string) --
(dict) --
Details about a remediation issue for a firewall type.
issueType (string) --
The type of remediation issue.
message (string) --
A human-readable description of the remediation issue.
correctiveAction (string) --
A recommended action for resolving the remediation issue.
notVisible (dict) --
Indicates that the details are not visible because of cross-account restrictions.
reason (string) --
The reason the details are not visible.
evaluatedAt (datetime) --
The time when the synchronization status was last evaluated.
Creates a template. A template groups one or more rules to simplify reuse across policies. You can also associate rules with a policy directly, without a template. Use isPublished to create the template in published ( ACTIVE) or draft ( DRAFT) state.
See also: AWS API Documentation
Request Syntax
client.create_template(
clientToken='string',
templateName='string',
templateDescription='string',
associatedRuleList=[
{
'ruleIdentifier': 'string'
},
],
firewallType='WAF',
isPublished=True|False,
tags={
'string': 'string'
}
)
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
string
[REQUIRED]
The name of the template.
string
A description of the template.
list
[REQUIRED]
The rules associated with the template.
(dict) --
A reference to a rule in a create or update request.
ruleIdentifier (string) -- [REQUIRED]
The identifier of the rule. This is the rule's Amazon Resource Name (ARN).
string
[REQUIRED]
The firewall type associated with the resource.
boolean
Specifies whether to publish the resource. When true, the resource is saved in published ( ACTIVE) state. When false, it is saved as a draft ( DRAFT). Default: true.
dict
The tags to add to the resource when it is created.
(string) --
(string) --
dict
Response Syntax
{
'templateId': 'string',
'templateArn': 'string',
'templateName': 'string',
'templateDescription': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'associatedRuleList': [
{
'ruleArn': 'string'
},
],
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'firewallType': 'WAF',
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
templateId (string) --
The service-generated id of the template.
templateArn (string) --
The Amazon Resource Name (ARN) of the template.
templateName (string) --
The name of the template.
templateDescription (string) --
A description of the template.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
associatedRuleList (list) --
The rules associated with the template.
(dict) --
An association between a template and a rule, as returned in outputs. The corresponding request structure is RuleReference.
ruleArn (string) --
The ARN of the associated rule.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
firewallType (string) --
The firewall type associated with the resource.
updatedAt (datetime) --
The time when the resource was last updated.
Updates the specified deployment. To prevent conflicting concurrent updates, provide the current updateToken. Use isPublished to publish the update or keep the deployment as a draft.
See also: AWS API Documentation
Request Syntax
client.update_deployment(
deploymentIdentifier='string',
updateToken='string',
deploymentDescription='string',
deploymentConfiguration={
'enableCrossAccountVisibility': True|False
},
associatedPolicyList=[
{
'policyIdentifier': 'string'
},
],
associatedScopeList=[
{
'scopeIdentifier': 'string'
},
],
isPublished=True|False,
clientToken='string'
)
string
[REQUIRED]
The identifier of the deployment. This is the deployment's Amazon Resource Name (ARN).
string
[REQUIRED]
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
string
A description of the deployment.
dict
The configuration settings for the deployment.
enableCrossAccountVisibility (boolean) -- [REQUIRED]
Specifies whether aggregate synchronization status details for the resources covered by this deployment are visible across accounts. Default: false.
list
The policies associated with the deployment.
(dict) --
A reference to a policy in a create or update request.
policyIdentifier (string) -- [REQUIRED]
The identifier of the policy. This is the policy's Amazon Resource Name (ARN), optionally version-qualified to pin a specific published version.
list
The scope associated with the deployment. A deployment has exactly one scope.
(dict) --
A reference to a scope in a create or update request.
scopeIdentifier (string) -- [REQUIRED]
The identifier of the scope. This is the scope's Amazon Resource Name (ARN).
boolean
[REQUIRED]
Specifies whether to publish the resource. When true, the resource is saved in published ( ACTIVE) state. When false, it is saved as a draft ( DRAFT).
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
dict
Response Syntax
{
'deploymentId': 'string',
'deploymentArn': 'string',
'deploymentName': 'string',
'deploymentDescription': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'deploymentConfiguration': {
'enableCrossAccountVisibility': True|False
},
'associatedPolicyList': [
{
'policyArn': 'string'
},
],
'associatedScopeList': [
{
'scopeArn': 'string'
},
],
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'deploymentCoverage': [
{
'firewallType': 'WAF'|'SHIELD_ADVANCED',
'policyArns': [
'string',
],
'inScopeResourceTypes': [
'AWS::ApiGateway::Stage'|'AWS::CloudFront::Distribution'|'AWS::EC2::EIP'|'AWS::ElasticLoadBalancingV2::LoadBalancer::application'|'AWS::ElasticLoadBalancing::LoadBalancer',
]
},
],
'warnings': [
{
'code': 'string',
'policyArn': 'string',
'message': 'string'
},
],
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
deploymentId (string) --
The service-generated id of the deployment.
deploymentArn (string) --
The Amazon Resource Name (ARN) of the deployment.
deploymentName (string) --
The name of the deployment.
deploymentDescription (string) --
A description of the deployment.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
deploymentConfiguration (dict) --
The configuration settings for the deployment.
enableCrossAccountVisibility (boolean) --
Specifies whether aggregate synchronization status details for the resources covered by this deployment are visible across accounts. Default: false.
associatedPolicyList (list) --
The policies associated with the deployment.
(dict) --
An association between a deployment and a policy, as returned in outputs. The corresponding request structure is PolicyReference.
policyArn (string) --
The ARN of the associated policy, including its version qualifier when a specific published version is pinned (for example, ...:policy:abc123:3).
associatedScopeList (list) --
The scope associated with the deployment. A deployment has exactly one scope.
(dict) --
An association between a deployment and a scope, as returned in outputs. The corresponding request structure is ScopeReference.
scopeArn (string) --
The ARN of the associated scope.
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
deploymentCoverage (list) --
The coverage information for the deployment. For each firewall type, it shows which policies have that firewall type and which in-scope resource types the firewall type protects.
(dict) --
Coverage information for one firewall type within a deployment. It lists the deployment's policies that have this firewall type. It also lists the resource types in the deployment's scope that the firewall type protects.
firewallType (string) --
The firewall type that the policies in this entry share.
policyArns (list) --
The Amazon Resource Names (ARNs) of the deployment's policies that have this firewall type.
(string) --
inScopeResourceTypes (list) --
The resource types in the deployment's scope that this firewall type protects. This list is empty if the scope does not select any resource types that the firewall type protects.
(string) --
warnings (list) --
Warnings about potential issues, such as a policy that has no applicable resources in the deployment's scope.
(dict) --
A warning about a potential issue with a deployment.
code (string) --
A code that identifies the type of warning.
policyArn (string) --
The ARN of the policy that the warning relates to.
message (string) --
A human-readable description of the warning.
updatedAt (datetime) --
The time when the resource was last updated.
Generates a rule configuration from a natural-language description. Provide a prompt along with the rule's firewall type and rule type. The service returns a configuration that you can use when you create or update a rule. If you also provide an existing configuration, the service edits that configuration instead of generating a new one.
See also: AWS API Documentation
Request Syntax
client.generate_rule_configuration(
prompt='string',
ruleFirewallType='WAF',
ruleType='CONFIGURATION'|'INSPECTION',
wafConfigDataType='DefaultAction'|'VisibilityConfig'|'CaptchaConfig'|'ChallengeConfig'|'CustomResponseBodies'|'LoggingConfiguration'|'DataProtectionConfig'|'AssociationConfig'|'OnSourceDDoSProtectionConfig'|'TokenDomains',
currentConfiguration='string',
clientToken='string'
)
string
[REQUIRED]
A natural-language description of the configuration that you want to generate.
string
[REQUIRED]
The firewall type of the rule.
string
[REQUIRED]
The type of the rule. CONFIGURATION rules contain firewall settings, and INSPECTION rules contain rule groups.
string
For AWS WAF configuration rules, the specific AWS WAF configuration variant to generate. This is optional; if you omit it, the service selects the variant.
string
An existing configuration to edit, as a JSON string. When you provide this value, the operation edits the configuration. When you omit it, the operation generates a new configuration.
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
dict
Response Syntax
{
'configuration': 'string',
'description': 'string'
}
Response Structure
(dict) --
configuration (string) --
The generated configuration, as a JSON string. You can use this value in the configuration field of a rule.
description (string) --
Reserved for a future human-readable description of the generated configuration. This field is currently not populated.
Removes the specified AWS Network Security Manager administrator account.
See also: AWS API Documentation
Request Syntax
client.delete_admin_account(
accountId='string'
)
string
[REQUIRED]
The AWS account ID of the administrator account to remove.
None
Creates a snapshot of the current published version of the specified scope.
See also: AWS API Documentation
Request Syntax
client.create_scope_snapshot(
scopeIdentifier='string',
clientToken='string',
tags={
'string': 'string'
}
)
string
[REQUIRED]
The identifier of the scope. This is the scope's Amazon Resource Name (ARN).
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
dict
The tags to add to the snapshot when it is created.
(string) --
(string) --
dict
Response Syntax
{
'scopeId': 'string',
'scopeArn': 'string',
'scopeName': 'string',
'scopeDescription': 'string',
'scopeConfiguration': {
'accountFilter': {
'includeAll': {},
'include': {
'accountIds': [
'string',
],
'organizationalUnits': [
'string',
]
},
'exclude': {
'accountIds': [
'string',
],
'organizationalUnits': [
'string',
]
}
},
'resourceScopes': {
'string': {
'includeAll': True|False,
'include': {
'explicitArns': [
'string',
],
'expression': {
'criteria': {
'tags': {
'string': 'string'
},
'albConfig': {
'scheme': 'internet-facing'|'internal',
'ipAddressType': 'ipv4'|'dualstack'|'dualstack-without-public-ipv4'
}
},
'and': [
{'... recursive ...'},
],
'or': [
{'... recursive ...'},
],
'not': {'... recursive ...'}
}
},
'exclude': {
'explicitArns': [
'string',
],
'expression': {
'criteria': {
'tags': {
'string': 'string'
},
'albConfig': {
'scheme': 'internet-facing'|'internal',
'ipAddressType': 'ipv4'|'dualstack'|'dualstack-without-public-ipv4'
}
},
'and': [
{'... recursive ...'},
],
'or': [
{'... recursive ...'},
],
'not': {'... recursive ...'}
}
}
}
}
},
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
scopeId (string) --
The service-generated id of the scope.
scopeArn (string) --
The Amazon Resource Name (ARN) of the scope.
scopeName (string) --
The name of the scope.
scopeDescription (string) --
A description of the scope.
scopeConfiguration (dict) --
The configuration that defines which accounts and resources are in scope.
accountFilter (dict) --
The account filter that determines which accounts are in scope. When set, exactly one of includeAll, include, or exclude is set.
Organization administrators must include an account filter in every scope configuration. Single-account administrators must omit it: a scope without an account filter applies only to the administrator's own account. The presence of an account filter is fixed when the scope is created: an update can't add an account filter to a scope that was created without one, or remove the account filter from a scope that was created with one.
includeAll (dict) --
Includes all accounts. No account filtering is applied.
include (dict) --
Includes only the specified accounts and organizational units.
accountIds (list) --
The list of AWS account IDs.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
exclude (dict) --
Excludes the specified accounts and organizational units. All others are in scope.
accountIds (list) --
The list of AWS account IDs.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
resourceScopes (dict) --
The resource-level scoping configuration, keyed by resource type, that defines which resources within the selected accounts are in scope.
(string) --
(dict) --
Defines which resources of a given type are in scope. Exactly one of includeAll, include, or exclude is set.
includeAll (boolean) --
Includes all resources of the resource type.
include (dict) --
Includes the resources that match the specified criteria or explicit ARNs.
explicitArns (list) --
An explicit list of resource ARNs.
(string) --
expression (dict) --
A logical expression that selects resources by combining criteria with AND, OR, and NOT operators.
criteria (dict) --
A leaf condition that matches resources by tag or by resource-type-specific configuration.
tags (dict) --
Tag key-value pairs used to match resources.
(string) --
(string) --
albConfig (dict) --
Filter criteria specific to Application Load Balancers.
scheme (string) --
The scheme of the Application Load Balancer, either internet-facing or internal.
ipAddressType (string) --
The IP address type of the Application Load Balancer.
and (list) --
A list of subexpressions that must all match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
or (list) --
A list of subexpressions of which at least one must match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
not (dict) --
A subexpression that must not match.
exclude (dict) --
Excludes the resources that match the specified criteria or explicit ARNs.
explicitArns (list) --
An explicit list of resource ARNs.
(string) --
expression (dict) --
A logical expression that selects resources by combining criteria with AND, OR, and NOT operators.
criteria (dict) --
A leaf condition that matches resources by tag or by resource-type-specific configuration.
tags (dict) --
Tag key-value pairs used to match resources.
(string) --
(string) --
albConfig (dict) --
Filter criteria specific to Application Load Balancers.
scheme (string) --
The scheme of the Application Load Balancer, either internet-facing or internal.
ipAddressType (string) --
The IP address type of the Application Load Balancer.
and (list) --
A list of subexpressions that must all match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
or (list) --
A list of subexpressions of which at least one must match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
not (dict) --
A subexpression that must not match.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the snapshot was created.
Deletes the specified deployment.
See also: AWS API Documentation
Request Syntax
client.delete_deployment(
deploymentIdentifier='string'
)
string
[REQUIRED]
The identifier of the deployment. This is the deployment's Amazon Resource Name (ARN).
None
Updates the specified scope. To prevent conflicting concurrent updates, provide the current updateToken. Use isPublished to publish the update or keep the scope as a draft.
See also: AWS API Documentation
Request Syntax
client.update_scope(
scopeIdentifier='string',
updateToken='string',
scopeDescription='string',
scopeConfiguration={
'accountFilter': {
'includeAll': {}
,
'include': {
'accountIds': [
'string',
],
'organizationalUnits': [
'string',
]
},
'exclude': {
'accountIds': [
'string',
],
'organizationalUnits': [
'string',
]
}
},
'resourceScopes': {
'string': {
'includeAll': True|False,
'include': {
'explicitArns': [
'string',
],
'expression': {
'criteria': {
'tags': {
'string': 'string'
},
'albConfig': {
'scheme': 'internet-facing'|'internal',
'ipAddressType': 'ipv4'|'dualstack'|'dualstack-without-public-ipv4'
}
},
'and': [
{'... recursive ...'},
],
'or': [
{'... recursive ...'},
],
'not': {'... recursive ...'}
}
},
'exclude': {
'explicitArns': [
'string',
],
'expression': {
'criteria': {
'tags': {
'string': 'string'
},
'albConfig': {
'scheme': 'internet-facing'|'internal',
'ipAddressType': 'ipv4'|'dualstack'|'dualstack-without-public-ipv4'
}
},
'and': [
{'... recursive ...'},
],
'or': [
{'... recursive ...'},
],
'not': {'... recursive ...'}
}
}
}
}
},
isPublished=True|False,
clientToken='string'
)
string
[REQUIRED]
The identifier of the scope. This is the scope's Amazon Resource Name (ARN).
string
[REQUIRED]
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
string
A description of the scope.
dict
The configuration that defines which accounts and resources are in scope. If you don't include this member, the scope keeps its existing configuration.
A new configuration can change which accounts and resources are selected, but it can't add or remove the account filter itself: a scope created for multi-account use stays multi-account, and a scope created for single-account use stays single-account.
accountFilter (dict) --
The account filter that determines which accounts are in scope. When set, exactly one of includeAll, include, or exclude is set.
Organization administrators must include an account filter in every scope configuration. Single-account administrators must omit it: a scope without an account filter applies only to the administrator's own account. The presence of an account filter is fixed when the scope is created: an update can't add an account filter to a scope that was created without one, or remove the account filter from a scope that was created with one.
includeAll (dict) --
Includes all accounts. No account filtering is applied.
include (dict) --
Includes only the specified accounts and organizational units.
accountIds (list) --
The list of AWS account IDs.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
exclude (dict) --
Excludes the specified accounts and organizational units. All others are in scope.
accountIds (list) --
The list of AWS account IDs.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
resourceScopes (dict) -- [REQUIRED]
The resource-level scoping configuration, keyed by resource type, that defines which resources within the selected accounts are in scope.
(string) --
(dict) --
Defines which resources of a given type are in scope. Exactly one of includeAll, include, or exclude is set.
includeAll (boolean) --
Includes all resources of the resource type.
include (dict) --
Includes the resources that match the specified criteria or explicit ARNs.
explicitArns (list) --
An explicit list of resource ARNs.
(string) --
expression (dict) --
A logical expression that selects resources by combining criteria with AND, OR, and NOT operators.
criteria (dict) --
A leaf condition that matches resources by tag or by resource-type-specific configuration.
tags (dict) --
Tag key-value pairs used to match resources.
(string) --
(string) --
albConfig (dict) --
Filter criteria specific to Application Load Balancers.
scheme (string) --
The scheme of the Application Load Balancer, either internet-facing or internal.
ipAddressType (string) --
The IP address type of the Application Load Balancer.
and (list) --
A list of subexpressions that must all match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
or (list) --
A list of subexpressions of which at least one must match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
not (dict) --
A subexpression that must not match.
exclude (dict) --
Excludes the resources that match the specified criteria or explicit ARNs.
explicitArns (list) --
An explicit list of resource ARNs.
(string) --
expression (dict) --
A logical expression that selects resources by combining criteria with AND, OR, and NOT operators.
criteria (dict) --
A leaf condition that matches resources by tag or by resource-type-specific configuration.
tags (dict) --
Tag key-value pairs used to match resources.
(string) --
(string) --
albConfig (dict) --
Filter criteria specific to Application Load Balancers.
scheme (string) --
The scheme of the Application Load Balancer, either internet-facing or internal.
ipAddressType (string) --
The IP address type of the Application Load Balancer.
and (list) --
A list of subexpressions that must all match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
or (list) --
A list of subexpressions of which at least one must match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
not (dict) --
A subexpression that must not match.
boolean
[REQUIRED]
Specifies whether to publish the resource. When true, the resource is saved in published ( ACTIVE) state. When false, it is saved as a draft ( DRAFT).
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
dict
Response Syntax
{
'scopeId': 'string',
'scopeArn': 'string',
'scopeName': 'string',
'scopeDescription': 'string',
'scopeConfiguration': {
'accountFilter': {
'includeAll': {},
'include': {
'accountIds': [
'string',
],
'organizationalUnits': [
'string',
]
},
'exclude': {
'accountIds': [
'string',
],
'organizationalUnits': [
'string',
]
}
},
'resourceScopes': {
'string': {
'includeAll': True|False,
'include': {
'explicitArns': [
'string',
],
'expression': {
'criteria': {
'tags': {
'string': 'string'
},
'albConfig': {
'scheme': 'internet-facing'|'internal',
'ipAddressType': 'ipv4'|'dualstack'|'dualstack-without-public-ipv4'
}
},
'and': [
{'... recursive ...'},
],
'or': [
{'... recursive ...'},
],
'not': {'... recursive ...'}
}
},
'exclude': {
'explicitArns': [
'string',
],
'expression': {
'criteria': {
'tags': {
'string': 'string'
},
'albConfig': {
'scheme': 'internet-facing'|'internal',
'ipAddressType': 'ipv4'|'dualstack'|'dualstack-without-public-ipv4'
}
},
'and': [
{'... recursive ...'},
],
'or': [
{'... recursive ...'},
],
'not': {'... recursive ...'}
}
}
}
}
},
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
scopeId (string) --
The service-generated id of the scope.
scopeArn (string) --
The Amazon Resource Name (ARN) of the scope.
scopeName (string) --
The name of the scope.
scopeDescription (string) --
A description of the scope.
scopeConfiguration (dict) --
The configuration that defines which accounts and resources are in scope.
accountFilter (dict) --
The account filter that determines which accounts are in scope. When set, exactly one of includeAll, include, or exclude is set.
Organization administrators must include an account filter in every scope configuration. Single-account administrators must omit it: a scope without an account filter applies only to the administrator's own account. The presence of an account filter is fixed when the scope is created: an update can't add an account filter to a scope that was created without one, or remove the account filter from a scope that was created with one.
includeAll (dict) --
Includes all accounts. No account filtering is applied.
include (dict) --
Includes only the specified accounts and organizational units.
accountIds (list) --
The list of AWS account IDs.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
exclude (dict) --
Excludes the specified accounts and organizational units. All others are in scope.
accountIds (list) --
The list of AWS account IDs.
(string) --
organizationalUnits (list) --
The AWS Organizations organizational units (OUs) in the selection.
(string) --
resourceScopes (dict) --
The resource-level scoping configuration, keyed by resource type, that defines which resources within the selected accounts are in scope.
(string) --
(dict) --
Defines which resources of a given type are in scope. Exactly one of includeAll, include, or exclude is set.
includeAll (boolean) --
Includes all resources of the resource type.
include (dict) --
Includes the resources that match the specified criteria or explicit ARNs.
explicitArns (list) --
An explicit list of resource ARNs.
(string) --
expression (dict) --
A logical expression that selects resources by combining criteria with AND, OR, and NOT operators.
criteria (dict) --
A leaf condition that matches resources by tag or by resource-type-specific configuration.
tags (dict) --
Tag key-value pairs used to match resources.
(string) --
(string) --
albConfig (dict) --
Filter criteria specific to Application Load Balancers.
scheme (string) --
The scheme of the Application Load Balancer, either internet-facing or internal.
ipAddressType (string) --
The IP address type of the Application Load Balancer.
and (list) --
A list of subexpressions that must all match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
or (list) --
A list of subexpressions of which at least one must match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
not (dict) --
A subexpression that must not match.
exclude (dict) --
Excludes the resources that match the specified criteria or explicit ARNs.
explicitArns (list) --
An explicit list of resource ARNs.
(string) --
expression (dict) --
A logical expression that selects resources by combining criteria with AND, OR, and NOT operators.
criteria (dict) --
A leaf condition that matches resources by tag or by resource-type-specific configuration.
tags (dict) --
Tag key-value pairs used to match resources.
(string) --
(string) --
albConfig (dict) --
Filter criteria specific to Application Load Balancers.
scheme (string) --
The scheme of the Application Load Balancer, either internet-facing or internal.
ipAddressType (string) --
The IP address type of the Application Load Balancer.
and (list) --
A list of subexpressions that must all match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
or (list) --
A list of subexpressions of which at least one must match.
(dict) --
A logical expression that selects resources. Exactly one of criteria, and, or, or not is set.
not (dict) --
A subexpression that must not match.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the resource was last updated.
Retrieves the details of the specified deployment, including coverage information and any warnings.
See also: AWS API Documentation
Request Syntax
client.get_deployment(
deploymentIdentifier='string'
)
string
[REQUIRED]
The identifier of the deployment. This is the deployment's Amazon Resource Name (ARN).
dict
Response Syntax
{
'deploymentId': 'string',
'deploymentArn': 'string',
'deploymentName': 'string',
'deploymentDescription': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'deploymentConfiguration': {
'enableCrossAccountVisibility': True|False
},
'associatedPolicyList': [
{
'policyArn': 'string'
},
],
'associatedScopeList': [
{
'scopeArn': 'string'
},
],
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1),
'deploymentCoverage': [
{
'firewallType': 'WAF'|'SHIELD_ADVANCED',
'policyArns': [
'string',
],
'inScopeResourceTypes': [
'AWS::ApiGateway::Stage'|'AWS::CloudFront::Distribution'|'AWS::EC2::EIP'|'AWS::ElasticLoadBalancingV2::LoadBalancer::application'|'AWS::ElasticLoadBalancing::LoadBalancer',
]
},
],
'warnings': [
{
'code': 'string',
'policyArn': 'string',
'message': 'string'
},
]
}
Response Structure
(dict) --
deploymentId (string) --
The service-generated id of the deployment.
deploymentArn (string) --
The Amazon Resource Name (ARN) of the deployment.
deploymentName (string) --
The name of the deployment.
deploymentDescription (string) --
A description of the deployment.
status (string) --
The current status of the resource: DRAFT (unpublished, editable), ACTIVE (published, in use), or DISABLED (deactivated; changes cannot be published until the resource is re-enabled).
deploymentConfiguration (dict) --
The configuration settings for the deployment.
enableCrossAccountVisibility (boolean) --
Specifies whether aggregate synchronization status details for the resources covered by this deployment are visible across accounts. Default: false.
associatedPolicyList (list) --
The policies associated with the deployment.
(dict) --
An association between a deployment and a policy, as returned in outputs. The corresponding request structure is PolicyReference.
policyArn (string) --
The ARN of the associated policy, including its version qualifier when a specific published version is pinned (for example, ...:policy:abc123:3).
associatedScopeList (list) --
The scope associated with the deployment. A deployment has exactly one scope.
(dict) --
An association between a deployment and a scope, as returned in outputs. The corresponding request structure is ScopeReference.
scopeArn (string) --
The ARN of the associated scope.
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the resource was last updated.
deploymentCoverage (list) --
The coverage information for the deployment. For each firewall type, it shows which policies have that firewall type and which in-scope resource types the firewall type protects.
(dict) --
Coverage information for one firewall type within a deployment. It lists the deployment's policies that have this firewall type. It also lists the resource types in the deployment's scope that the firewall type protects.
firewallType (string) --
The firewall type that the policies in this entry share.
policyArns (list) --
The Amazon Resource Names (ARNs) of the deployment's policies that have this firewall type.
(string) --
inScopeResourceTypes (list) --
The resource types in the deployment's scope that this firewall type protects. This list is empty if the scope does not select any resource types that the firewall type protects.
(string) --
warnings (list) --
Warnings about potential issues, such as a policy that has no applicable resources in the deployment's scope.
(dict) --
A warning about a potential issue with a deployment.
code (string) --
A code that identifies the type of warning.
policyArn (string) --
The ARN of the policy that the warning relates to.
message (string) --
A human-readable description of the warning.
Lists the aggregated synchronization statuses of resources across the deployments in your administrator account. You can filter the results by synchronization status and page through them.
See also: AWS API Documentation
Request Syntax
client.list_aggregate_resource_synchronization_statuses(
synchronizationStatus='IN_SYNC'|'OUT_OF_SYNC'|'NOT_APPLICABLE',
maxResults=123,
nextToken='string'
)
string
Filters the results by synchronization status, such as IN_SYNC or OUT_OF_SYNC.
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
dict
Response Syntax
{
'nextToken': 'string',
'resourceSynchronizationStatuses': [
{
'synchronizationStatus': 'IN_SYNC'|'OUT_OF_SYNC'|'NOT_APPLICABLE',
'accountId': 'string',
'resourceArn': 'string',
'deploymentArn': 'string',
'resourceType': 'AWS::ApiGateway::Stage'|'AWS::CloudFront::Distribution'|'AWS::EC2::EIP'|'AWS::ElasticLoadBalancingV2::LoadBalancer::application'|'AWS::ElasticLoadBalancing::LoadBalancer'|'AWS::WAFv2::WebACL'|'AWS::Shield::Protection'|'AWS::ShieldRegional::Protection',
'updatedAt': datetime(2015, 1, 1),
'outOfSyncReasons': {
'reasons': {
'string': {
'missingFirewall': 'string',
'invalidFirewall': {
'incorrectSingleValueConfigurations': [
{
'configurationName': 'string',
'expectedValue': 'string',
'actualValue': 'string'
},
],
'missingAppendableConfigurationValues': [
{
'configurationName': 'string',
'expectedValue': 'string',
'actualValue': 'string'
},
],
'unexpectedAppendableConfigurationValues': [
{
'configurationName': 'string',
'expectedValue': 'string',
'actualValue': 'string'
},
],
'incorrectAppendableConfigurationOrder': [
{
'configurationName': 'string',
'expectedValue': 'string',
'actualValue': 'string'
},
],
'missingMergeableConfigurationValues': [
{
'configurationName': 'string',
'expectedValue': 'string',
'actualValue': 'string'
},
],
'unexpectedMergeableConfigurationValues': [
{
'configurationName': 'string',
'expectedValue': 'string',
'actualValue': 'string'
},
]
}
}
},
'notVisible': {
'reason': 'string'
}
},
'remediationIssues': {
'issues': {
'string': {
'issueType': 'string',
'message': 'string',
'correctiveAction': 'string'
}
},
'notVisible': {
'reason': 'string'
}
},
'evaluatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
resourceSynchronizationStatuses (list) --
The list of resource synchronization statuses.
(dict) --
The synchronization status of a resource covered by a deployment.
synchronizationStatus (string) --
The synchronization status of the resource, such as IN_SYNC or OUT_OF_SYNC.
accountId (string) --
The AWS account ID that owns the resource.
resourceArn (string) --
The ARN of the resource whose synchronization status is reported.
deploymentArn (string) --
The ARN of the deployment that the synchronization status is associated with. This is absent for aggregate (cross-deployment) statuses.
resourceType (string) --
The type of the resource, in AWS CloudFormation format.
updatedAt (datetime) --
The time when the resource was last updated.
outOfSyncReasons (dict) --
The reasons the resource is out of sync, keyed by firewall type. This is null when the resource is in sync.
reasons (dict) --
The out-of-sync reasons, keyed by firewall type.
(string) --
(dict) --
Describes why a firewall is out of sync. Exactly one of missingFirewall or invalidFirewall is set.
missingFirewall (string) --
Indicates that an expected firewall is missing. The value describes the missing firewall.
invalidFirewall (dict) --
Details about a firewall whose configuration does not match the intended configuration.
incorrectSingleValueConfigurations (list) --
Single-value configuration settings whose values do not match the expected values.
(dict) --
Describes a single configuration value that does not match the intended configuration.
configurationName (string) --
The name of the configuration setting that is in conflict.
expectedValue (string) --
The configuration value that AWS Network Security Manager expected.
actualValue (string) --
The configuration value that was found on the resource.
missingAppendableConfigurationValues (list) --
Appendable configuration values that are expected but missing.
(dict) --
Describes a single configuration value that does not match the intended configuration.
configurationName (string) --
The name of the configuration setting that is in conflict.
expectedValue (string) --
The configuration value that AWS Network Security Manager expected.
actualValue (string) --
The configuration value that was found on the resource.
unexpectedAppendableConfigurationValues (list) --
Appendable configuration values that are present but not expected.
(dict) --
Describes a single configuration value that does not match the intended configuration.
configurationName (string) --
The name of the configuration setting that is in conflict.
expectedValue (string) --
The configuration value that AWS Network Security Manager expected.
actualValue (string) --
The configuration value that was found on the resource.
incorrectAppendableConfigurationOrder (list) --
Appendable configuration values that are present but in the wrong order.
(dict) --
Describes a single configuration value that does not match the intended configuration.
configurationName (string) --
The name of the configuration setting that is in conflict.
expectedValue (string) --
The configuration value that AWS Network Security Manager expected.
actualValue (string) --
The configuration value that was found on the resource.
missingMergeableConfigurationValues (list) --
Mergeable configuration values that are expected but missing.
(dict) --
Describes a single configuration value that does not match the intended configuration.
configurationName (string) --
The name of the configuration setting that is in conflict.
expectedValue (string) --
The configuration value that AWS Network Security Manager expected.
actualValue (string) --
The configuration value that was found on the resource.
unexpectedMergeableConfigurationValues (list) --
Mergeable configuration values that are present but not expected.
(dict) --
Describes a single configuration value that does not match the intended configuration.
configurationName (string) --
The name of the configuration setting that is in conflict.
expectedValue (string) --
The configuration value that AWS Network Security Manager expected.
actualValue (string) --
The configuration value that was found on the resource.
notVisible (dict) --
Indicates that the details are not visible because of cross-account restrictions.
reason (string) --
The reason the details are not visible.
remediationIssues (dict) --
Details about remediation issues, keyed by firewall type. This is null when there are no remediation issues.
issues (dict) --
The remediation issues, keyed by firewall type.
(string) --
(dict) --
Details about a remediation issue for a firewall type.
issueType (string) --
The type of remediation issue.
message (string) --
A human-readable description of the remediation issue.
correctiveAction (string) --
A recommended action for resolving the remediation issue.
notVisible (dict) --
Indicates that the details are not visible because of cross-account restrictions.
reason (string) --
The reason the details are not visible.
evaluatedAt (datetime) --
The time when the synchronization status was last evaluated.
Lists the snapshots of the specified scope.
See also: AWS API Documentation
Request Syntax
client.list_scope_snapshots(
scopeIdentifier='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The identifier of the scope. This is the scope's Amazon Resource Name (ARN).
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
dict
Response Syntax
{
'nextToken': 'string',
'snapshots': [
{
'scopeId': 'string',
'scopeArn': 'string',
'scopeName': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
snapshots (list) --
The snapshots of the scope.
(dict) --
Summary information about a scope.
scopeId (string) --
The service-generated id of the scope.
scopeArn (string) --
The Amazon Resource Name (ARN) of the scope.
scopeName (string) --
The name of the scope.
status (string) --
The current status of the resource: DRAFT (unpublished, editable), ACTIVE (published, in use), or DISABLED (deactivated; changes cannot be published until the resource is re-enabled).
version (string) --
The version of the resource.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the resource was last updated. For a snapshot, this is the time when the snapshot was created.
Creates a deployment. A deployment applies one or more policies to the accounts and resources selected by a scope. Use isPublished to create the deployment in published ( ACTIVE) or draft ( DRAFT) state. The response includes coverage information and any warnings about the deployment.
See also: AWS API Documentation
Request Syntax
client.create_deployment(
clientToken='string',
deploymentName='string',
deploymentDescription='string',
deploymentConfiguration={
'enableCrossAccountVisibility': True|False
},
associatedPolicyList=[
{
'policyIdentifier': 'string'
},
],
associatedScopeList=[
{
'scopeIdentifier': 'string'
},
],
isPublished=True|False,
tags={
'string': 'string'
}
)
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
string
[REQUIRED]
The name of the deployment.
string
A description of the deployment.
dict
[REQUIRED]
The configuration settings for the deployment.
enableCrossAccountVisibility (boolean) -- [REQUIRED]
Specifies whether aggregate synchronization status details for the resources covered by this deployment are visible across accounts. Default: false.
list
[REQUIRED]
The policies associated with the deployment.
(dict) --
A reference to a policy in a create or update request.
policyIdentifier (string) -- [REQUIRED]
The identifier of the policy. This is the policy's Amazon Resource Name (ARN), optionally version-qualified to pin a specific published version.
list
[REQUIRED]
The scope associated with the deployment. A deployment has exactly one scope.
(dict) --
A reference to a scope in a create or update request.
scopeIdentifier (string) -- [REQUIRED]
The identifier of the scope. This is the scope's Amazon Resource Name (ARN).
boolean
Specifies whether to publish the resource. When true, the resource is saved in published ( ACTIVE) state. When false, it is saved as a draft ( DRAFT). Default: true.
dict
The tags to add to the resource when it is created.
(string) --
(string) --
dict
Response Syntax
{
'deploymentId': 'string',
'deploymentArn': 'string',
'deploymentName': 'string',
'deploymentDescription': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'deploymentConfiguration': {
'enableCrossAccountVisibility': True|False
},
'associatedPolicyList': [
{
'policyArn': 'string'
},
],
'associatedScopeList': [
{
'scopeArn': 'string'
},
],
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'deploymentCoverage': [
{
'firewallType': 'WAF'|'SHIELD_ADVANCED',
'policyArns': [
'string',
],
'inScopeResourceTypes': [
'AWS::ApiGateway::Stage'|'AWS::CloudFront::Distribution'|'AWS::EC2::EIP'|'AWS::ElasticLoadBalancingV2::LoadBalancer::application'|'AWS::ElasticLoadBalancing::LoadBalancer',
]
},
],
'warnings': [
{
'code': 'string',
'policyArn': 'string',
'message': 'string'
},
],
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
deploymentId (string) --
The service-generated id of the deployment.
deploymentArn (string) --
The Amazon Resource Name (ARN) of the deployment.
deploymentName (string) --
The name of the deployment.
deploymentDescription (string) --
A description of the deployment.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
deploymentConfiguration (dict) --
The configuration settings for the deployment.
enableCrossAccountVisibility (boolean) --
Specifies whether aggregate synchronization status details for the resources covered by this deployment are visible across accounts. Default: false.
associatedPolicyList (list) --
The policies associated with the deployment.
(dict) --
An association between a deployment and a policy, as returned in outputs. The corresponding request structure is PolicyReference.
policyArn (string) --
The ARN of the associated policy, including its version qualifier when a specific published version is pinned (for example, ...:policy:abc123:3).
associatedScopeList (list) --
The scope associated with the deployment. A deployment has exactly one scope.
(dict) --
An association between a deployment and a scope, as returned in outputs. The corresponding request structure is ScopeReference.
scopeArn (string) --
The ARN of the associated scope.
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
deploymentCoverage (list) --
The coverage information for the deployment. For each firewall type, it shows which policies have that firewall type and which in-scope resource types the firewall type protects.
(dict) --
Coverage information for one firewall type within a deployment. It lists the deployment's policies that have this firewall type. It also lists the resource types in the deployment's scope that the firewall type protects.
firewallType (string) --
The firewall type that the policies in this entry share.
policyArns (list) --
The Amazon Resource Names (ARNs) of the deployment's policies that have this firewall type.
(string) --
inScopeResourceTypes (list) --
The resource types in the deployment's scope that this firewall type protects. This list is empty if the scope does not select any resource types that the firewall type protects.
(string) --
warnings (list) --
Warnings about potential issues, such as a policy that has no applicable resources in the deployment's scope.
(dict) --
A warning about a potential issue with a deployment.
code (string) --
A code that identifies the type of warning.
policyArn (string) --
The ARN of the policy that the warning relates to.
message (string) --
A human-readable description of the warning.
updatedAt (datetime) --
The time when the resource was last updated.
Lists the tags associated with the specified resource.
See also: AWS API Documentation
Request Syntax
client.list_tags_for_resource(
resourceArn='string'
)
string
[REQUIRED]
The ARN of the resource to list tags for. The ARN must not include a :DRAFT qualifier.
dict
Response Syntax
{
'tags': {
'string': 'string'
}
}
Response Structure
(dict) --
tags (dict) --
The tags associated with the resource. Each tag is a key-value pair.
(string) --
(string) --
Lists the templates in the account. You can filter the results by status and page through them using maxResults and nextToken.
See also: AWS API Documentation
Request Syntax
client.list_templates(
maxResults=123,
nextToken='string',
status='ACTIVE'|'DRAFT'|'DISABLED'
)
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
string
Filters the results by status, either ACTIVE or DRAFT.
dict
Response Syntax
{
'nextToken': 'string',
'templates': [
{
'templateId': 'string',
'templateArn': 'string',
'templateName': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'hasPublishedVersion': True|False,
'firewallType': 'WAF',
'updatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
templates (list) --
The list of templates.
(dict) --
Summary information about a template.
templateId (string) --
The service-generated id of the template.
templateArn (string) --
The Amazon Resource Name (ARN) of the template.
templateName (string) --
The name of the template.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
firewallType (string) --
The firewall type associated with the resource.
updatedAt (datetime) --
The time when the resource was last updated. For a snapshot, this is the time when the snapshot was created.
Lists the resources associated with the specified resource.
See also: AWS API Documentation
Request Syntax
client.list_resource_associations(
resourceIdentifier='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The identifier of the resource to list associations for. This is the resource's Amazon Resource Name (ARN).
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
dict
Response Syntax
{
'nextToken': 'string',
'resourceAssociations': [
{
'arn': 'string',
'resourceType': 'Rule'|'Template'|'Policy'|'Deployment'|'Scope'
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
resourceAssociations (list) --
The list of resource associations.
(dict) --
Describes an association between a resource and another entity.
arn (string) --
The ARN of the associated resource.
resourceType (string) --
The type of the associated resource, such as Policy, Template, or Deployment.
Lists the rules in the account. You can filter the results by status and page through them using maxResults and nextToken.
See also: AWS API Documentation
Request Syntax
client.list_rules(
maxResults=123,
nextToken='string',
status='ACTIVE'|'DRAFT'|'DISABLED'
)
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
string
Filters the results by status, either ACTIVE or DRAFT.
dict
Response Syntax
{
'nextToken': 'string',
'rules': [
{
'ruleId': 'string',
'ruleArn': 'string',
'ruleName': 'string',
'firewallType': 'WAF',
'ruleType': 'CONFIGURATION'|'INSPECTION',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
rules (list) --
The list of rules.
(dict) --
Summary information about a rule.
ruleId (string) --
The service-generated id of the rule.
ruleArn (string) --
The Amazon Resource Name (ARN) of the rule.
ruleName (string) --
The name of the rule.
firewallType (string) --
The firewall type associated with the resource.
ruleType (string) --
The type of the rule. CONFIGURATION rules contain firewall settings, and INSPECTION rules contain rule groups.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the resource was last updated. For a snapshot, this is the time when the snapshot was created.
Creates a snapshot of the current published version of the specified policy.
See also: AWS API Documentation
Request Syntax
client.create_policy_snapshot(
policyIdentifier='string',
clientToken='string',
tags={
'string': 'string'
}
)
string
[REQUIRED]
The identifier of the policy. This is the policy's Amazon Resource Name (ARN).
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
dict
The tags to add to the snapshot when it is created.
(string) --
(string) --
dict
Response Syntax
{
'policyId': 'string',
'policyArn': 'string',
'policyName': 'string',
'policyDescription': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'priority': 123,
'associatedTemplateAndRuleList': [
{
'templateArn': 'string',
'ruleArn': 'string'
},
],
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'firewallType': 'WAF'|'SHIELD_ADVANCED',
'policyConfiguration': {
'remediationEnabled': True|False,
'resourcesCleanUp': True|False,
'wafConfig': {
'existingCustomerWebACLResolution': 'RETROFIT'|'OVERRIDE_ASSOCIATION'|'NO_REMEDIATION',
'conflictResolution': 'MERGE_WHERE_APPLICABLE'
}
},
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
policyId (string) --
The service-generated id of the policy.
policyArn (string) --
The Amazon Resource Name (ARN) of the policy.
policyName (string) --
The name of the policy.
policyDescription (string) --
A description of the policy.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
priority (integer) --
The priority of the resource. A lower number indicates a higher priority.
associatedTemplateAndRuleList (list) --
The templates and rules associated with the policy. For AWS WAF policies, this list contains 1 to 100 templates or rules, of which at most 2 can be templates. For AWS Shield Advanced policies, this list is empty.
(dict) --
An association between a policy and either a template or a rule, as returned in outputs. Exactly one of templateArn or ruleArn is set. The corresponding request structure is TemplateOrRuleReference.
templateArn (string) --
The ARN of the associated template.
ruleArn (string) --
The ARN of the associated rule.
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
firewallType (string) --
The firewall type associated with the resource.
policyConfiguration (dict) --
The configuration settings that control the policy's behavior, including remediation and firewall-type-specific settings.
remediationEnabled (boolean) --
Specifies whether AWS Network Security Manager automatically remediates noncompliant resources. Default: false.
resourcesCleanUp (boolean) --
Specifies whether AWS Network Security Manager automatically removes the resources it created when they are no longer needed. Default: false.
wafConfig (dict) --
AWS WAF-specific policy settings. This is populated only for AWS WAF policies.
existingCustomerWebACLResolution (string) --
Determines how AWS Network Security Manager handles remediation when a resource already has a customer-created web ACL. Required for AWS WAF policies.
conflictResolution (string) --
The conflict-resolution strategy for AWS WAF policies. Required for AWS WAF policies.
updatedAt (datetime) --
The time when the snapshot was created.
Lists the snapshots of the specified deployment.
See also: AWS API Documentation
Request Syntax
client.list_deployment_snapshots(
deploymentIdentifier='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The identifier of the deployment. This is the deployment's Amazon Resource Name (ARN).
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
dict
Response Syntax
{
'nextToken': 'string',
'snapshots': [
{
'deploymentId': 'string',
'deploymentArn': 'string',
'deploymentName': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
snapshots (list) --
The snapshots of the deployment.
(dict) --
Summary information about a deployment.
deploymentId (string) --
The service-generated id of the deployment.
deploymentArn (string) --
The Amazon Resource Name (ARN) of the deployment.
deploymentName (string) --
The name of the deployment.
status (string) --
The current status of the resource: DRAFT (unpublished, editable), ACTIVE (published, in use), or DISABLED (deactivated; changes cannot be published until the resource is re-enabled).
version (string) --
The version of the resource.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the resource was last updated. For a snapshot, this is the time when the snapshot was created.
Creates a rule. A rule defines a network security configuration to enforce, such as an AWS WAF rule group or configuration data. Use isPublished to create the rule in published ( ACTIVE) or draft ( DRAFT) state.
See also: AWS API Documentation
Request Syntax
client.create_rule(
clientToken='string',
ruleName='string',
firewallType='WAF',
ruleType='CONFIGURATION'|'INSPECTION',
ruleDescription='string',
configuration={...}|[...]|123|123.4|'string'|True|None,
isPublished=True|False,
tags={
'string': 'string'
}
)
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
string
[REQUIRED]
The name of the rule.
string
[REQUIRED]
The firewall type associated with the resource.
string
[REQUIRED]
The type of the rule. CONFIGURATION rules contain firewall settings, and INSPECTION rules contain rule groups.
string
A description of the rule.
:ref:`document<document>`
[REQUIRED]
The firewall configuration for the rule, as a JSON document. The structure depends on the rule's firewall type and rule type. For an AWS WAF INSPECTION rule, provide an AWS WAF rule group. For an AWS WAF CONFIGURATION rule, provide a single web ACL setting, such as DefaultAction or VisibilityConfig; use wafConfigDataType to declare which setting the document contains. For the schema of each setting and complete examples, see Writing rule configurations in the AWS Network Security Manager Developer Guide.
boolean
Specifies whether to publish the resource. When true, the resource is saved in published ( ACTIVE) state. When false, it is saved as a draft ( DRAFT). Default: true.
dict
The tags to add to the resource when it is created.
(string) --
(string) --
dict
Response Syntax
{
'ruleId': 'string',
'ruleArn': 'string',
'ruleName': 'string',
'firewallType': 'WAF',
'ruleType': 'CONFIGURATION'|'INSPECTION',
'ruleDescription': 'string',
'configuration': {...}|[...]|123|123.4|'string'|True|None,
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
ruleId (string) --
The service-generated id of the rule.
ruleArn (string) --
The Amazon Resource Name (ARN) of the rule.
ruleName (string) --
The name of the rule.
firewallType (string) --
The firewall type associated with the resource.
ruleType (string) --
The type of the rule. CONFIGURATION rules contain firewall settings, and INSPECTION rules contain rule groups.
ruleDescription (string) --
A description of the rule.
configuration (:ref:`document<document>`) --
The firewall configuration for the rule, as a JSON document. The structure depends on the rule's firewall type and rule type.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the resource was last updated.
Retrieves the details of the specified rule.
See also: AWS API Documentation
Request Syntax
client.get_rule(
ruleIdentifier='string'
)
string
[REQUIRED]
The identifier of the rule. This is the rule's Amazon Resource Name (ARN).
dict
Response Syntax
{
'ruleId': 'string',
'ruleArn': 'string',
'ruleName': 'string',
'firewallType': 'WAF',
'ruleType': 'CONFIGURATION'|'INSPECTION',
'ruleDescription': 'string',
'configuration': {...}|[...]|123|123.4|'string'|True|None,
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
ruleId (string) --
The service-generated id of the rule.
ruleArn (string) --
The Amazon Resource Name (ARN) of the rule.
ruleName (string) --
The name of the rule.
firewallType (string) --
The firewall type associated with the resource.
ruleType (string) --
The type of the rule. CONFIGURATION rules contain firewall settings, and INSPECTION rules contain rule groups.
ruleDescription (string) --
A description of the rule.
configuration (:ref:`document<document>`) --
The firewall configuration for the rule, as a JSON document. The structure depends on the rule's firewall type and rule type.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the resource was last updated.
Lists the snapshots of the specified template.
See also: AWS API Documentation
Request Syntax
client.list_template_snapshots(
templateIdentifier='string',
maxResults=123,
nextToken='string'
)
string
[REQUIRED]
The identifier of the template. This is the template's Amazon Resource Name (ARN).
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
dict
Response Syntax
{
'nextToken': 'string',
'snapshots': [
{
'templateId': 'string',
'templateArn': 'string',
'templateName': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'hasPublishedVersion': True|False,
'firewallType': 'WAF',
'updatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
snapshots (list) --
The snapshots of the template.
(dict) --
Summary information about a template.
templateId (string) --
The service-generated id of the template.
templateArn (string) --
The Amazon Resource Name (ARN) of the template.
templateName (string) --
The name of the template.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
firewallType (string) --
The firewall type associated with the resource.
updatedAt (datetime) --
The time when the resource was last updated. For a snapshot, this is the time when the snapshot was created.
Deletes the specified template.
See also: AWS API Documentation
Request Syntax
client.delete_template(
templateIdentifier='string'
)
string
[REQUIRED]
The identifier of the template. This is the template's Amazon Resource Name (ARN).
None
Removes the specified tags from the given resource.
See also: AWS API Documentation
Request Syntax
client.untag_resource(
resourceArn='string',
tagKeys=[
'string',
]
)
string
[REQUIRED]
The ARN of the resource to remove tags from. The ARN must not include a :DRAFT qualifier.
list
[REQUIRED]
The keys of the tags to remove from the resource.
(string) --
dict
Response Syntax
{}
Response Structure
(dict) --
Retrieves the details of the specified policy.
See also: AWS API Documentation
Request Syntax
client.get_policy(
policyIdentifier='string'
)
string
[REQUIRED]
The identifier of the policy. This is the policy's Amazon Resource Name (ARN).
dict
Response Syntax
{
'policyId': 'string',
'policyArn': 'string',
'policyName': 'string',
'policyDescription': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'priority': 123,
'associatedTemplateAndRuleList': [
{
'templateArn': 'string',
'ruleArn': 'string'
},
],
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'firewallType': 'WAF'|'SHIELD_ADVANCED',
'policyConfiguration': {
'remediationEnabled': True|False,
'resourcesCleanUp': True|False,
'wafConfig': {
'existingCustomerWebACLResolution': 'RETROFIT'|'OVERRIDE_ASSOCIATION'|'NO_REMEDIATION',
'conflictResolution': 'MERGE_WHERE_APPLICABLE'
}
},
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
policyId (string) --
The service-generated id of the policy.
policyArn (string) --
The Amazon Resource Name (ARN) of the policy.
policyName (string) --
The name of the policy.
policyDescription (string) --
A description of the policy.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
priority (integer) --
The priority of the resource. A lower number indicates a higher priority.
associatedTemplateAndRuleList (list) --
The templates and rules associated with the policy. For AWS WAF policies, this list contains 1 to 100 templates or rules, of which at most 2 can be templates. For AWS Shield Advanced policies, this list is empty.
(dict) --
An association between a policy and either a template or a rule, as returned in outputs. Exactly one of templateArn or ruleArn is set. The corresponding request structure is TemplateOrRuleReference.
templateArn (string) --
The ARN of the associated template.
ruleArn (string) --
The ARN of the associated rule.
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
firewallType (string) --
The firewall type associated with the resource.
policyConfiguration (dict) --
The configuration settings that control the policy's behavior, including remediation and firewall-type-specific settings.
remediationEnabled (boolean) --
Specifies whether AWS Network Security Manager automatically remediates noncompliant resources. Default: false.
resourcesCleanUp (boolean) --
Specifies whether AWS Network Security Manager automatically removes the resources it created when they are no longer needed. Default: false.
wafConfig (dict) --
AWS WAF-specific policy settings. This is populated only for AWS WAF policies.
existingCustomerWebACLResolution (string) --
Determines how AWS Network Security Manager handles remediation when a resource already has a customer-created web ACL. Required for AWS WAF policies.
conflictResolution (string) --
The conflict-resolution strategy for AWS WAF policies. Required for AWS WAF policies.
updatedAt (datetime) --
The time when the resource was last updated.
Creates a snapshot of the current published version of the specified deployment.
See also: AWS API Documentation
Request Syntax
client.create_deployment_snapshot(
deploymentIdentifier='string',
clientToken='string',
tags={
'string': 'string'
}
)
string
[REQUIRED]
The identifier of the deployment. This is the deployment's Amazon Resource Name (ARN).
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
dict
The tags to add to the snapshot when it is created.
(string) --
(string) --
dict
Response Syntax
{
'deploymentId': 'string',
'deploymentArn': 'string',
'deploymentName': 'string',
'deploymentDescription': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'deploymentConfiguration': {
'enableCrossAccountVisibility': True|False
},
'associatedPolicyList': [
{
'policyArn': 'string'
},
],
'associatedScopeList': [
{
'scopeArn': 'string'
},
],
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
deploymentId (string) --
The service-generated id of the deployment.
deploymentArn (string) --
The Amazon Resource Name (ARN) of the deployment.
deploymentName (string) --
The name of the deployment.
deploymentDescription (string) --
A description of the deployment.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
deploymentConfiguration (dict) --
The configuration settings for the deployment.
enableCrossAccountVisibility (boolean) --
Specifies whether aggregate synchronization status details for the resources covered by this deployment are visible across accounts. Default: false.
associatedPolicyList (list) --
The policies associated with the deployment.
(dict) --
An association between a deployment and a policy, as returned in outputs. The corresponding request structure is PolicyReference.
policyArn (string) --
The ARN of the associated policy, including its version qualifier when a specific published version is pinned (for example, ...:policy:abc123:3).
associatedScopeList (list) --
The scope associated with the deployment. A deployment has exactly one scope.
(dict) --
An association between a deployment and a scope, as returned in outputs. The corresponding request structure is ScopeReference.
scopeArn (string) --
The ARN of the associated scope.
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the snapshot was created.
Lists the scopes in the account. You can filter the results by status and page through them using maxResults and nextToken.
See also: AWS API Documentation
Request Syntax
client.list_scopes(
maxResults=123,
nextToken='string',
status='ACTIVE'|'DRAFT'|'DISABLED'
)
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
string
Filters the results by status: ACTIVE, DRAFT, or DISABLED.
dict
Response Syntax
{
'nextToken': 'string',
'scopes': [
{
'scopeId': 'string',
'scopeArn': 'string',
'scopeName': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
scopes (list) --
The list of scopes.
(dict) --
Summary information about a scope.
scopeId (string) --
The service-generated id of the scope.
scopeArn (string) --
The Amazon Resource Name (ARN) of the scope.
scopeName (string) --
The name of the scope.
status (string) --
The current status of the resource: DRAFT (unpublished, editable), ACTIVE (published, in use), or DISABLED (deactivated; changes cannot be published until the resource is re-enabled).
version (string) --
The version of the resource.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the resource was last updated. For a snapshot, this is the time when the snapshot was created.
Creates a snapshot of the current published version of the specified rule. A snapshot is an immutable, versioned copy that other resources can reference.
See also: AWS API Documentation
Request Syntax
client.create_rule_snapshot(
ruleIdentifier='string',
clientToken='string',
tags={
'string': 'string'
}
)
string
[REQUIRED]
The identifier of the rule. This is the rule's Amazon Resource Name (ARN).
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
dict
The tags to add to the snapshot when it is created.
(string) --
(string) --
dict
Response Syntax
{
'ruleId': 'string',
'ruleArn': 'string',
'ruleName': 'string',
'firewallType': 'WAF',
'ruleType': 'CONFIGURATION'|'INSPECTION',
'ruleDescription': 'string',
'configuration': {...}|[...]|123|123.4|'string'|True|None,
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
ruleId (string) --
The service-generated id of the rule.
ruleArn (string) --
The Amazon Resource Name (ARN) of the rule.
ruleName (string) --
The name of the rule.
firewallType (string) --
The firewall type associated with the resource.
ruleType (string) --
The type of the rule. CONFIGURATION rules contain firewall settings, and INSPECTION rules contain rule groups.
ruleDescription (string) --
A description of the rule.
configuration (:ref:`document<document>`) --
The firewall configuration for the rule, as a JSON document. The structure depends on the rule's firewall type and rule type.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the snapshot was created.
Deletes the specified scope.
See also: AWS API Documentation
Request Syntax
client.delete_scope(
scopeIdentifier='string'
)
string
[REQUIRED]
The identifier of the scope. This is the scope's Amazon Resource Name (ARN).
None
Adds or overwrites the specified tags on the given resource.
See also: AWS API Documentation
Request Syntax
client.tag_resource(
resourceArn='string',
tags={
'string': 'string'
}
)
string
[REQUIRED]
The ARN of the resource to tag. The ARN must not include a :DRAFT qualifier.
dict
[REQUIRED]
The tags to add to the resource.
(string) --
(string) --
dict
Response Syntax
{}
Response Structure
(dict) --
Deletes the specified policy.
See also: AWS API Documentation
Request Syntax
client.delete_policy(
policyIdentifier='string'
)
string
[REQUIRED]
The identifier of the policy. This is the policy's Amazon Resource Name (ARN).
None
Lists the deployments in the account. You can filter the results by status and page through them using maxResults and nextToken.
See also: AWS API Documentation
Request Syntax
client.list_deployments(
maxResults=123,
nextToken='string',
status='ACTIVE'|'DRAFT'|'DISABLED'
)
integer
The maximum number of results to return in a single call. Valid range: 1-100. To retrieve the remaining results, use the returned nextToken value in a subsequent call.
string
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
string
Filters the results by status: ACTIVE, DRAFT, or DISABLED.
dict
Response Syntax
{
'nextToken': 'string',
'deployments': [
{
'deploymentId': 'string',
'deploymentArn': 'string',
'deploymentName': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'version': 'string',
'hasPublishedVersion': True|False,
'updatedAt': datetime(2015, 1, 1)
},
]
}
Response Structure
(dict) --
nextToken (string) --
The token for the next page of results. To retrieve the next page, call the operation again and provide this value. When there are no more results, this value is null.
deployments (list) --
The list of deployments.
(dict) --
Summary information about a deployment.
deploymentId (string) --
The service-generated id of the deployment.
deploymentArn (string) --
The Amazon Resource Name (ARN) of the deployment.
deploymentName (string) --
The name of the deployment.
status (string) --
The current status of the resource: DRAFT (unpublished, editable), ACTIVE (published, in use), or DISABLED (deactivated; changes cannot be published until the resource is re-enabled).
version (string) --
The version of the resource.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
updatedAt (datetime) --
The time when the resource was last updated. For a snapshot, this is the time when the snapshot was created.
Updates the specified policy. To prevent conflicting concurrent updates, provide the current updateToken. Use isPublished to publish the update or keep the policy as a draft.
See also: AWS API Documentation
Request Syntax
client.update_policy(
policyIdentifier='string',
updateToken='string',
policyDescription='string',
priority=123,
associatedTemplateAndRuleList=[
{
'templateIdentifier': 'string',
'ruleIdentifier': 'string'
},
],
policyConfiguration={
'remediationEnabled': True|False,
'resourcesCleanUp': True|False,
'wafConfig': {
'existingCustomerWebACLResolution': 'RETROFIT'|'OVERRIDE_ASSOCIATION'|'NO_REMEDIATION',
'conflictResolution': 'MERGE_WHERE_APPLICABLE'
}
},
isPublished=True|False,
clientToken='string'
)
string
[REQUIRED]
The identifier of the policy. This is the policy's Amazon Resource Name (ARN).
string
[REQUIRED]
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
string
A description of the policy.
integer
The priority of the resource. A lower number indicates a higher priority.
list
The templates and rules to associate with the policy. For AWS WAF policies, specify 1 to 100 templates or rules, of which at most 2 can be templates. For AWS Shield Advanced policies, this list must be empty.
(dict) --
A reference to either a template or a rule in a create or update request. Set exactly one of templateIdentifier or ruleIdentifier.
templateIdentifier (string) --
The identifier of the template. This is the template's Amazon Resource Name (ARN).
ruleIdentifier (string) --
The identifier of the rule. This is the rule's Amazon Resource Name (ARN).
dict
The configuration settings that control the policy's behavior, including remediation and firewall-type-specific settings.
remediationEnabled (boolean) -- [REQUIRED]
Specifies whether AWS Network Security Manager automatically remediates noncompliant resources. Default: false.
resourcesCleanUp (boolean) -- [REQUIRED]
Specifies whether AWS Network Security Manager automatically removes the resources it created when they are no longer needed. Default: false.
wafConfig (dict) --
AWS WAF-specific policy settings. This is populated only for AWS WAF policies.
existingCustomerWebACLResolution (string) -- [REQUIRED]
Determines how AWS Network Security Manager handles remediation when a resource already has a customer-created web ACL. Required for AWS WAF policies.
conflictResolution (string) -- [REQUIRED]
The conflict-resolution strategy for AWS WAF policies. Required for AWS WAF policies.
boolean
[REQUIRED]
Specifies whether to publish the resource. When true, the resource is saved in published ( ACTIVE) state. When false, it is saved as a draft ( DRAFT).
string
A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.
This field is autopopulated if not provided.
dict
Response Syntax
{
'policyId': 'string',
'policyArn': 'string',
'policyName': 'string',
'policyDescription': 'string',
'status': 'DRAFT'|'ACTIVE'|'DISABLED',
'priority': 123,
'associatedTemplateAndRuleList': [
{
'templateArn': 'string',
'ruleArn': 'string'
},
],
'version': 'string',
'updateToken': 'string',
'isSnapshot': True|False,
'hasPublishedVersion': True|False,
'firewallType': 'WAF'|'SHIELD_ADVANCED',
'policyConfiguration': {
'remediationEnabled': True|False,
'resourcesCleanUp': True|False,
'wafConfig': {
'existingCustomerWebACLResolution': 'RETROFIT'|'OVERRIDE_ASSOCIATION'|'NO_REMEDIATION',
'conflictResolution': 'MERGE_WHERE_APPLICABLE'
}
},
'updatedAt': datetime(2015, 1, 1)
}
Response Structure
(dict) --
policyId (string) --
The service-generated id of the policy.
policyArn (string) --
The Amazon Resource Name (ARN) of the policy.
policyName (string) --
The name of the policy.
policyDescription (string) --
A description of the policy.
status (string) --
The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).
priority (integer) --
The priority of the resource. A lower number indicates a higher priority.
associatedTemplateAndRuleList (list) --
The templates and rules associated with the policy. For AWS WAF policies, this list contains 1 to 100 templates or rules, of which at most 2 can be templates. For AWS Shield Advanced policies, this list is empty.
(dict) --
An association between a policy and either a template or a rule, as returned in outputs. Exactly one of templateArn or ruleArn is set. The corresponding request structure is TemplateOrRuleReference.
templateArn (string) --
The ARN of the associated template.
ruleArn (string) --
The ARN of the associated rule.
version (string) --
The version of the resource.
updateToken (string) --
A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.
isSnapshot (boolean) --
Specifies whether the resource is a snapshot of a published version.
hasPublishedVersion (boolean) --
Specifies whether a published version of the resource exists.
firewallType (string) --
The firewall type associated with the resource.
policyConfiguration (dict) --
The configuration settings that control the policy's behavior, including remediation and firewall-type-specific settings.
remediationEnabled (boolean) --
Specifies whether AWS Network Security Manager automatically remediates noncompliant resources. Default: false.
resourcesCleanUp (boolean) --
Specifies whether AWS Network Security Manager automatically removes the resources it created when they are no longer needed. Default: false.
wafConfig (dict) --
AWS WAF-specific policy settings. This is populated only for AWS WAF policies.
existingCustomerWebACLResolution (string) --
Determines how AWS Network Security Manager handles remediation when a resource already has a customer-created web ACL. Required for AWS WAF policies.
conflictResolution (string) --
The conflict-resolution strategy for AWS WAF policies. Required for AWS WAF policies.
updatedAt (datetime) --
The time when the resource was last updated.