2021/03/05 - AWS Shield - 3 new 7 updated api methods
Changes Add support for tagging of Shield protection and protection group resources.
Removes tags from a resource in AWS Shield.
See also: AWS API Documentation
Request Syntax
client.untag_resource(
ResourceARN='string',
TagKeys=[
'string',
]
)
string
[REQUIRED]
The Amazon Resource Name (ARN) of the resource that you want to remove tags from.
list
[REQUIRED]
The tag key for each tag that you want to remove from the resource.
(string) --
dict
Response Syntax
{}
Response Structure
(dict) --
Adds or updates tags for a resource in AWS Shield.
See also: AWS API Documentation
Request Syntax
client.tag_resource(
ResourceARN='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
string
[REQUIRED]
The Amazon Resource Name (ARN) of the resource that you want to add or update tags for.
list
[REQUIRED]
The tags that you want to modify or add to the resource.
(dict) --
A tag associated with an AWS resource. Tags are key:value pairs that you can use to categorize and manage your resources, for purposes like billing or other management. Typically, the tag key represents a category, such as "environment", and the tag value represents a specific value within that category, such as "test," "development," or "production". Or you might set the tag key to "customer" and the value to the customer name or ID. You can specify one or more tags to add to each AWS resource, up to 50 tags for a resource.
Key (string) --
Part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive.
Value (string) --
Part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.
dict
Response Syntax
{}
Response Structure
(dict) --
Gets information about AWS tags for a specified Amazon Resource Name (ARN) in AWS Shield.
See also: AWS API Documentation
Request Syntax
client.list_tags_for_resource(
ResourceARN='string'
)
string
[REQUIRED]
The Amazon Resource Name (ARN) of the resource to get tags for.
dict
Response Syntax
{
'Tags': [
{
'Key': 'string',
'Value': 'string'
},
]
}
Response Structure
(dict) --
Tags (list) --
A list of tag key and value pairs associated with the specified resource.
(dict) --
A tag associated with an AWS resource. Tags are key:value pairs that you can use to categorize and manage your resources, for purposes like billing or other management. Typically, the tag key represents a category, such as "environment", and the tag value represents a specific value within that category, such as "test," "development," or "production". Or you might set the tag key to "customer" and the value to the customer name or ID. You can specify one or more tags to add to each AWS resource, up to 50 tags for a resource.
Key (string) --
Part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive.
Value (string) --
Part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.
{'Tags': [{'Key': 'string', 'Value': 'string'}]}
Enables AWS Shield Advanced for a specific AWS resource. The resource can be an Amazon CloudFront distribution, Elastic Load Balancing load balancer, AWS Global Accelerator accelerator, Elastic IP Address, or an Amazon Route 53 hosted zone.
You can add protection to only a single resource with each CreateProtection request. If you want to add protection to multiple resources at once, use the AWS WAF console. For more information see Getting Started with AWS Shield Advanced and Add AWS Shield Advanced Protection to more AWS Resources.
See also: AWS API Documentation
Request Syntax
client.create_protection(
Name='string',
ResourceArn='string',
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
string
[REQUIRED]
Friendly name for the Protection you are creating.
string
[REQUIRED]
The ARN (Amazon Resource Name) of the resource to be protected.
The ARN should be in one of the following formats:
For an Application Load Balancer: arn:aws:elasticloadbalancing:region:account-id:loadbalancer/app/load-balancer-name/load-balancer-id
For an Elastic Load Balancer (Classic Load Balancer): arn:aws:elasticloadbalancing:region:account-id:loadbalancer/load-balancer-name
For an AWS CloudFront distribution: arn:aws:cloudfront::account-id:distribution/distribution-id
For an AWS Global Accelerator accelerator: arn:aws:globalaccelerator::account-id:accelerator/accelerator-id
For Amazon Route 53: arn:aws:route53:::hostedzone/hosted-zone-id
For an Elastic IP address: arn:aws:ec2:region:account-id:eip-allocation/allocation-id
list
One or more tag key-value pairs for the Protection object that is created.
(dict) --
A tag associated with an AWS resource. Tags are key:value pairs that you can use to categorize and manage your resources, for purposes like billing or other management. Typically, the tag key represents a category, such as "environment", and the tag value represents a specific value within that category, such as "test," "development," or "production". Or you might set the tag key to "customer" and the value to the customer name or ID. You can specify one or more tags to add to each AWS resource, up to 50 tags for a resource.
Key (string) --
Part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive.
Value (string) --
Part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.
dict
Response Syntax
{
'ProtectionId': 'string'
}
Response Structure
(dict) --
ProtectionId (string) --
The unique identifier (ID) for the Protection object that is created.
{'Tags': [{'Key': 'string', 'Value': 'string'}]}
Creates a grouping of protected resources so they can be handled as a collective. This resource grouping improves the accuracy of detection and reduces false positives.
See also: AWS API Documentation
Request Syntax
client.create_protection_group(
ProtectionGroupId='string',
Aggregation='SUM'|'MEAN'|'MAX',
Pattern='ALL'|'ARBITRARY'|'BY_RESOURCE_TYPE',
ResourceType='CLOUDFRONT_DISTRIBUTION'|'ROUTE_53_HOSTED_ZONE'|'ELASTIC_IP_ALLOCATION'|'CLASSIC_LOAD_BALANCER'|'APPLICATION_LOAD_BALANCER'|'GLOBAL_ACCELERATOR',
Members=[
'string',
],
Tags=[
{
'Key': 'string',
'Value': 'string'
},
]
)
string
[REQUIRED]
The name of the protection group. You use this to identify the protection group in lists and to manage the protection group, for example to update, delete, or describe it.
string
[REQUIRED]
Defines how AWS Shield combines resource data for the group in order to detect, mitigate, and report events.
Sum - Use the total traffic across the group. This is a good choice for most cases. Examples include Elastic IP addresses for EC2 instances that scale manually or automatically.
Mean - Use the average of the traffic across the group. This is a good choice for resources that share traffic uniformly. Examples include accelerators and load balancers.
Max - Use the highest traffic from each resource. This is useful for resources that don't share traffic and for resources that share that traffic in a non-uniform way. Examples include CloudFront distributions and origin resources for CloudFront distributions.
string
[REQUIRED]
The criteria to use to choose the protected resources for inclusion in the group. You can include all resources that have protections, provide a list of resource Amazon Resource Names (ARNs), or include all resources of a specified resource type.
string
The resource type to include in the protection group. All protected resources of this type are included in the protection group. Newly protected resources of this type are automatically added to the group. You must set this when you set Pattern to BY_RESOURCE_TYPE and you must not set it for any other Pattern setting.
list
The Amazon Resource Names (ARNs) of the resources to include in the protection group. You must set this when you set Pattern to ARBITRARY and you must not set it for any other Pattern setting.
(string) --
list
One or more tag key-value pairs for the protection group.
(dict) --
A tag associated with an AWS resource. Tags are key:value pairs that you can use to categorize and manage your resources, for purposes like billing or other management. Typically, the tag key represents a category, such as "environment", and the tag value represents a specific value within that category, such as "test," "development," or "production". Or you might set the tag key to "customer" and the value to the customer name or ID. You can specify one or more tags to add to each AWS resource, up to 50 tags for a resource.
Key (string) --
Part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive.
Value (string) --
Part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.
dict
Response Syntax
{}
Response Structure
(dict) --
{'Protection': {'ProtectionArn': 'string'}}
Lists the details of a Protection object.
See also: AWS API Documentation
Request Syntax
client.describe_protection(
ProtectionId='string',
ResourceArn='string'
)
string
The unique identifier (ID) for the Protection object that is described. When submitting the DescribeProtection request you must provide either the ResourceArn or the ProtectionID , but not both.
string
The ARN (Amazon Resource Name) of the AWS resource for the Protection object that is described. When submitting the DescribeProtection request you must provide either the ResourceArn or the ProtectionID , but not both.
dict
Response Syntax
{
'Protection': {
'Id': 'string',
'Name': 'string',
'ResourceArn': 'string',
'HealthCheckIds': [
'string',
],
'ProtectionArn': 'string'
}
}
Response Structure
(dict) --
Protection (dict) --
The Protection object that is described.
Id (string) --
The unique identifier (ID) of the protection.
Name (string) --
The name of the protection. For example, My CloudFront distributions .
ResourceArn (string) --
The ARN (Amazon Resource Name) of the AWS resource that is protected.
HealthCheckIds (list) --
The unique identifier (ID) for the Route 53 health check that's associated with the protection.
(string) --
ProtectionArn (string) --
The ARN (Amazon Resource Name) of the protection.
{'ProtectionGroup': {'ProtectionGroupArn': 'string'}}
Returns the specification for the specified protection group.
See also: AWS API Documentation
Request Syntax
client.describe_protection_group(
ProtectionGroupId='string'
)
string
[REQUIRED]
The name of the protection group. You use this to identify the protection group in lists and to manage the protection group, for example to update, delete, or describe it.
dict
Response Syntax
{
'ProtectionGroup': {
'ProtectionGroupId': 'string',
'Aggregation': 'SUM'|'MEAN'|'MAX',
'Pattern': 'ALL'|'ARBITRARY'|'BY_RESOURCE_TYPE',
'ResourceType': 'CLOUDFRONT_DISTRIBUTION'|'ROUTE_53_HOSTED_ZONE'|'ELASTIC_IP_ALLOCATION'|'CLASSIC_LOAD_BALANCER'|'APPLICATION_LOAD_BALANCER'|'GLOBAL_ACCELERATOR',
'Members': [
'string',
],
'ProtectionGroupArn': 'string'
}
}
Response Structure
(dict) --
ProtectionGroup (dict) --
A grouping of protected resources that you and AWS Shield Advanced can monitor as a collective. This resource grouping improves the accuracy of detection and reduces false positives.
ProtectionGroupId (string) --
The name of the protection group. You use this to identify the protection group in lists and to manage the protection group, for example to update, delete, or describe it.
Aggregation (string) --
Defines how AWS Shield combines resource data for the group in order to detect, mitigate, and report events.
Sum - Use the total traffic across the group. This is a good choice for most cases. Examples include Elastic IP addresses for EC2 instances that scale manually or automatically.
Mean - Use the average of the traffic across the group. This is a good choice for resources that share traffic uniformly. Examples include accelerators and load balancers.
Max - Use the highest traffic from each resource. This is useful for resources that don't share traffic and for resources that share that traffic in a non-uniform way. Examples include CloudFront distributions and origin resources for CloudFront distributions.
Pattern (string) --
The criteria to use to choose the protected resources for inclusion in the group. You can include all resources that have protections, provide a list of resource Amazon Resource Names (ARNs), or include all resources of a specified resource type.
ResourceType (string) --
The resource type to include in the protection group. All protected resources of this type are included in the protection group. You must set this when you set Pattern to BY_RESOURCE_TYPE and you must not set it for any other Pattern setting.
Members (list) --
The Amazon Resource Names (ARNs) of the resources to include in the protection group. You must set this when you set Pattern to ARBITRARY and you must not set it for any other Pattern setting.
(string) --
ProtectionGroupArn (string) --
The ARN (Amazon Resource Name) of the protection group.
{'Subscription': {'SubscriptionArn': 'string'}}
Provides details about the AWS Shield Advanced subscription for an account.
See also: AWS API Documentation
Request Syntax
client.describe_subscription()
dict
Response Syntax
{
'Subscription': {
'StartTime': datetime(2015, 1, 1),
'EndTime': datetime(2015, 1, 1),
'TimeCommitmentInSeconds': 123,
'AutoRenew': 'ENABLED'|'DISABLED',
'Limits': [
{
'Type': 'string',
'Max': 123
},
],
'ProactiveEngagementStatus': 'ENABLED'|'DISABLED'|'PENDING',
'SubscriptionLimits': {
'ProtectionLimits': {
'ProtectedResourceTypeLimits': [
{
'Type': 'string',
'Max': 123
},
]
},
'ProtectionGroupLimits': {
'MaxProtectionGroups': 123,
'PatternTypeLimits': {
'ArbitraryPatternLimits': {
'MaxMembers': 123
}
}
}
},
'SubscriptionArn': 'string'
}
}
Response Structure
(dict) --
Subscription (dict) --
The AWS Shield Advanced subscription details for an account.
StartTime (datetime) --
The start time of the subscription, in Unix time in seconds. For more information see timestamp.
EndTime (datetime) --
The date and time your subscription will end.
TimeCommitmentInSeconds (integer) --
The length, in seconds, of the AWS Shield Advanced subscription for the account.
AutoRenew (string) --
If ENABLED , the subscription will be automatically renewed at the end of the existing subscription period.
When you initally create a subscription, AutoRenew is set to ENABLED . You can change this by submitting an UpdateSubscription request. If the UpdateSubscription request does not included a value for AutoRenew , the existing value for AutoRenew remains unchanged.
Limits (list) --
Specifies how many protections of a given type you can create.
(dict) --
Specifies how many protections of a given type you can create.
Type (string) --
The type of protection.
Max (integer) --
The maximum number of protections that can be created for the specified Type .
ProactiveEngagementStatus (string) --
If ENABLED , the DDoS Response Team (DRT) will use email and phone to notify contacts about escalations to the DRT and to initiate proactive customer support.
If PENDING , you have requested proactive engagement and the request is pending. The status changes to ENABLED when your request is fully processed.
If DISABLED , the DRT will not proactively notify contacts about escalations or to initiate proactive customer support.
SubscriptionLimits (dict) --
Limits settings for your subscription.
ProtectionLimits (dict) --
Limits settings on protections for your subscription.
ProtectedResourceTypeLimits (list) --
The maximum number of resource types that you can specify in a protection.
(dict) --
Specifies how many protections of a given type you can create.
Type (string) --
The type of protection.
Max (integer) --
The maximum number of protections that can be created for the specified Type .
ProtectionGroupLimits (dict) --
Limits settings on protection groups for your subscription.
MaxProtectionGroups (integer) --
The maximum number of protection groups that you can have at one time.
PatternTypeLimits (dict) --
Limits settings by pattern type in the protection groups for your subscription.
ArbitraryPatternLimits (dict) --
Limits settings on protection groups with arbitrary pattern type.
MaxMembers (integer) --
The maximum number of resources you can specify for a single arbitrary pattern in a protection group.
SubscriptionArn (string) --
The ARN (Amazon Resource Name) of the subscription.
{'ProtectionGroups': {'ProtectionGroupArn': 'string'}}
Retrieves the ProtectionGroup objects for the account.
See also: AWS API Documentation
Request Syntax
client.list_protection_groups(
NextToken='string',
MaxResults=123
)
string
The next token value from a previous call to ListProtectionGroups . Pass null if this is the first call.
integer
The maximum number of ProtectionGroup objects to return. If you leave this blank, Shield Advanced returns the first 20 results.
This is a maximum value. Shield Advanced might return the results in smaller batches. That is, the number of objects returned could be less than MaxResults , even if there are still more objects yet to return. If there are more objects to return, Shield Advanced returns a value in NextToken that you can use in your next request, to get the next batch of objects.
dict
Response Syntax
{
'ProtectionGroups': [
{
'ProtectionGroupId': 'string',
'Aggregation': 'SUM'|'MEAN'|'MAX',
'Pattern': 'ALL'|'ARBITRARY'|'BY_RESOURCE_TYPE',
'ResourceType': 'CLOUDFRONT_DISTRIBUTION'|'ROUTE_53_HOSTED_ZONE'|'ELASTIC_IP_ALLOCATION'|'CLASSIC_LOAD_BALANCER'|'APPLICATION_LOAD_BALANCER'|'GLOBAL_ACCELERATOR',
'Members': [
'string',
],
'ProtectionGroupArn': 'string'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
ProtectionGroups (list) --
(dict) --
A grouping of protected resources that you and AWS Shield Advanced can monitor as a collective. This resource grouping improves the accuracy of detection and reduces false positives.
ProtectionGroupId (string) --
The name of the protection group. You use this to identify the protection group in lists and to manage the protection group, for example to update, delete, or describe it.
Aggregation (string) --
Defines how AWS Shield combines resource data for the group in order to detect, mitigate, and report events.
Sum - Use the total traffic across the group. This is a good choice for most cases. Examples include Elastic IP addresses for EC2 instances that scale manually or automatically.
Mean - Use the average of the traffic across the group. This is a good choice for resources that share traffic uniformly. Examples include accelerators and load balancers.
Max - Use the highest traffic from each resource. This is useful for resources that don't share traffic and for resources that share that traffic in a non-uniform way. Examples include CloudFront distributions and origin resources for CloudFront distributions.
Pattern (string) --
The criteria to use to choose the protected resources for inclusion in the group. You can include all resources that have protections, provide a list of resource Amazon Resource Names (ARNs), or include all resources of a specified resource type.
ResourceType (string) --
The resource type to include in the protection group. All protected resources of this type are included in the protection group. You must set this when you set Pattern to BY_RESOURCE_TYPE and you must not set it for any other Pattern setting.
Members (list) --
The Amazon Resource Names (ARNs) of the resources to include in the protection group. You must set this when you set Pattern to ARBITRARY and you must not set it for any other Pattern setting.
(string) --
ProtectionGroupArn (string) --
The ARN (Amazon Resource Name) of the protection group.
NextToken (string) --
If you specify a value for MaxResults and you have more protection groups than the value of MaxResults, AWS Shield Advanced returns this token that you can use in your next request, to get the next batch of objects.
{'Protections': {'ProtectionArn': 'string'}}
Lists all Protection objects for the account.
See also: AWS API Documentation
Request Syntax
client.list_protections(
NextToken='string',
MaxResults=123
)
string
The ListProtectionsRequest.NextToken value from a previous call to ListProtections . Pass null if this is the first call.
integer
The maximum number of Protection objects to return. If you leave this blank, Shield Advanced returns the first 20 results.
This is a maximum value. Shield Advanced might return the results in smaller batches. That is, the number of objects returned could be less than MaxResults , even if there are still more objects yet to return. If there are more objects to return, Shield Advanced returns a value in NextToken that you can use in your next request, to get the next batch of objects.
dict
Response Syntax
{
'Protections': [
{
'Id': 'string',
'Name': 'string',
'ResourceArn': 'string',
'HealthCheckIds': [
'string',
],
'ProtectionArn': 'string'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
Protections (list) --
The array of enabled Protection objects.
(dict) --
An object that represents a resource that is under DDoS protection.
Id (string) --
The unique identifier (ID) of the protection.
Name (string) --
The name of the protection. For example, My CloudFront distributions .
ResourceArn (string) --
The ARN (Amazon Resource Name) of the AWS resource that is protected.
HealthCheckIds (list) --
The unique identifier (ID) for the Route 53 health check that's associated with the protection.
(string) --
ProtectionArn (string) --
The ARN (Amazon Resource Name) of the protection.
NextToken (string) --
If you specify a value for MaxResults and you have more Protections than the value of MaxResults, AWS Shield Advanced returns a NextToken value in the response that allows you to list another group of Protections. For the second and subsequent ListProtections requests, specify the value of NextToken from the previous response to get information about another batch of Protections.
Shield Advanced might return the list of Protection objects in batches smaller than the number specified by MaxResults. If there are more Protection objects to return, Shield Advanced will always also return a NextToken .