types

package
v1.3.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 8, 2021 License: Apache-2.0 Imports: 3 Imported by: 1

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type AccountRoleStatus 

type AccountRoleStatus string
const (
	AccountRoleStatusReady           AccountRoleStatus = "READY"
	AccountRoleStatusCreating        AccountRoleStatus = "CREATING"
	AccountRoleStatusPendingDeletion AccountRoleStatus = "PENDING_DELETION"
	AccountRoleStatusDeleting        AccountRoleStatus = "DELETING"
	AccountRoleStatusDeleted         AccountRoleStatus = "DELETED"
)

Enum values for AccountRoleStatus

func (AccountRoleStatus) Values added in v0.29.0 

func (AccountRoleStatus) Values() []AccountRoleStatus

Values returns all known values for AccountRoleStatus. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type App 

type App struct {

	// The application's name.
	//
	// This member is required.
	AppName *string

	// The application's port number, for example 80.
	//
	// This member is required.
	Port *int64

	// The IP protocol name or number. The name can be one of tcp, udp, or icmp. For
	// information on possible numbers, see Protocol Numbers
	// (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml).
	//
	// This member is required.
	Protocol *string
}

An individual AWS Firewall Manager application.

type AppsListData 

type AppsListData struct {

	// An array of applications in the AWS Firewall Manager applications list.
	//
	// This member is required.
	AppsList []App

	// The name of the AWS Firewall Manager applications list.
	//
	// This member is required.
	ListName *string

	// The time that the AWS Firewall Manager applications list was created.
	CreateTime *time.Time

	// The time that the AWS Firewall Manager applications list was last updated.
	LastUpdateTime *time.Time

	// The ID of the AWS Firewall Manager applications list.
	ListId *string

	// A unique identifier for each update to the list. When you update the list, the
	// update token must match the token of the current version of the application
	// list. You can retrieve the update token by getting the list.
	ListUpdateToken *string

	// A map of previous version numbers to their corresponding App object arrays.
	PreviousAppsList map[string][]App
}

An AWS Firewall Manager applications list.

type AppsListDataSummary 

type AppsListDataSummary struct {

	// An array of App objects in the AWS Firewall Manager applications list.
	AppsList []App

	// The Amazon Resource Name (ARN) of the applications list.
	ListArn *string

	// The ID of the applications list.
	ListId *string

	// The name of the applications list.
	ListName *string
}

Details of the AWS Firewall Manager applications list.

type AwsEc2InstanceViolation 

type AwsEc2InstanceViolation struct {

	// Violations for network interfaces associated with the EC2 instance.
	AwsEc2NetworkInterfaceViolations []AwsEc2NetworkInterfaceViolation

	// The resource ID of the EC2 instance.
	ViolationTarget *string
}

Violations for an EC2 instance resource.

type AwsEc2NetworkInterfaceViolation 

type AwsEc2NetworkInterfaceViolation struct {

	// List of security groups that violate the rules specified in the master security
	// group of the AWS Firewall Manager policy.
	ViolatingSecurityGroups []string

	// The resource ID of the network interface.
	ViolationTarget *string
}

Violations for network interfaces associated with an EC2 instance.

type AwsVPCSecurityGroupViolation 

type AwsVPCSecurityGroupViolation struct {

	// List of rules specified in the security group of the AWS Firewall Manager policy
	// that partially match the ViolationTarget rule.
	PartialMatches []PartialMatch

	// Remediation options for the rule specified in the ViolationTarget.
	PossibleSecurityGroupRemediationActions []SecurityGroupRemediationAction

	// The security group rule that is being evaluated.
	ViolationTarget *string

	// A description of the security group that violates the policy.
	ViolationTargetDescription *string
}

Details of the rule violation in a security group when compared to the master security group of the AWS Firewall Manager policy.

type ComplianceViolator 

type ComplianceViolator struct {

	// The resource ID.
	ResourceId *string

	// The resource type. This is in the format shown in the AWS Resource Types
	// Reference
	// (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html).
	// For example: AWS::ElasticLoadBalancingV2::LoadBalancer,
	// AWS::CloudFront::Distribution, or AWS::NetworkFirewall::FirewallPolicy.
	ResourceType *string

	// The reason that the resource is not protected by the policy.
	ViolationReason ViolationReason
}

Details of the resource that is not protected by the policy.

type CustomerPolicyScopeIdType 

type CustomerPolicyScopeIdType string
const (
	CustomerPolicyScopeIdTypeAccount CustomerPolicyScopeIdType = "ACCOUNT"
	CustomerPolicyScopeIdTypeOrgUnit CustomerPolicyScopeIdType = "ORG_UNIT"
)

Enum values for CustomerPolicyScopeIdType

func (CustomerPolicyScopeIdType) Values added in v0.29.0 

func (CustomerPolicyScopeIdType) Values() []CustomerPolicyScopeIdType

Values returns all known values for CustomerPolicyScopeIdType. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type DependentServiceName 

type DependentServiceName string
const (
	DependentServiceNameAWSConfig              DependentServiceName = "AWSCONFIG"
	DependentServiceNameAwswaf                 DependentServiceName = "AWSWAF"
	DependentServiceNameAWSShieldAdvanced      DependentServiceName = "AWSSHIELD_ADVANCED"
	DependentServiceNameAWSVirtualPrivateCloud DependentServiceName = "AWSVPC"
)

Enum values for DependentServiceName

func (DependentServiceName) Values added in v0.29.0 

func (DependentServiceName) Values() []DependentServiceName

Values returns all known values for DependentServiceName. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type DnsDuplicateRuleGroupViolation added in v1.3.0 

type DnsDuplicateRuleGroupViolation struct {

	// The ID of the VPC.
	ViolationTarget *string

	// A description of the violation that specifies the rule group and VPC.
	ViolationTargetDescription *string
}

A DNS Firewall rule group that Firewall Manager tried to associate with a VPC is already associated with the VPC and can't be associated again.

type DnsRuleGroupLimitExceededViolation added in v1.3.0 

type DnsRuleGroupLimitExceededViolation struct {

	// The number of rule groups currently associated with the VPC.
	NumberOfRuleGroupsAlreadyAssociated int32

	// The ID of the VPC.
	ViolationTarget *string

	// A description of the violation that specifies the rule group and VPC.
	ViolationTargetDescription *string
}

The VPC that Firewall Manager was applying a DNS Fireall policy to reached the limit for associated DNS Firewall rule groups. Firewall Manager tried to associate another rule group with the VPC and failed due to the limit.

type DnsRuleGroupPriorityConflictViolation added in v1.3.0 

type DnsRuleGroupPriorityConflictViolation struct {

	// The ID of the Firewall Manager DNS Firewall policy that was already applied to
	// the VPC. This policy contains the rule group that's already associated with the
	// VPC.
	ConflictingPolicyId *string

	// The priority setting of the two conflicting rule groups.
	ConflictingPriority int32

	// The priorities of rule groups that are already associated with the VPC. To retry
	// your operation, choose priority settings that aren't in this list for the rule
	// groups in your new DNS Firewall policy.
	UnavailablePriorities []int32

	// The ID of the VPC.
	ViolationTarget *string

	// A description of the violation that specifies the VPC and the rule group that's
	// already associated with it.
	ViolationTargetDescription *string
}

A rule group that Firewall Manager tried to associate with a VPC has the same priority as a rule group that's already associated.

type EvaluationResult 

type EvaluationResult struct {

	// Describes an AWS account's compliance with the AWS Firewall Manager policy.
	ComplianceStatus PolicyComplianceStatusType

	// Indicates that over 100 resources are noncompliant with the AWS Firewall Manager
	// policy.
	EvaluationLimitExceeded bool

	// The number of resources that are noncompliant with the specified policy. For AWS
	// WAF and Shield Advanced policies, a resource is considered noncompliant if it is
	// not associated with the policy. For security group policies, a resource is
	// considered noncompliant if it doesn't comply with the rules of the policy and
	// remediation is disabled or not possible.
	ViolatorCount int64
}

Describes the compliance status for the account. An account is considered noncompliant if it includes resources that are not protected by the specified policy or that don't comply with the policy.

type InternalErrorException 

type InternalErrorException struct {
	Message *string
}

The operation failed because of a system problem, even though the request was valid. Retry your request.

func (*InternalErrorException) Error 

func (e *InternalErrorException) Error() string

func (*InternalErrorException) ErrorCode 

func (e *InternalErrorException) ErrorCode() string

func (*InternalErrorException) ErrorFault 

func (e *InternalErrorException) ErrorFault() smithy.ErrorFault

func (*InternalErrorException) ErrorMessage 

func (e *InternalErrorException) ErrorMessage() string

type InvalidInputException 

type InvalidInputException struct {
	Message *string
}

The parameters of the request were invalid.

func (*InvalidInputException) Error 

func (e *InvalidInputException) Error() string

func (*InvalidInputException) ErrorCode 

func (e *InvalidInputException) ErrorCode() string

func (*InvalidInputException) ErrorFault 

func (e *InvalidInputException) ErrorFault() smithy.ErrorFault

func (*InvalidInputException) ErrorMessage 

func (e *InvalidInputException) ErrorMessage() string

type InvalidOperationException 

type InvalidOperationException struct {
	Message *string
}

The operation failed because there was nothing to do or the operation wasn't possible. For example, you might have submitted an AssociateAdminAccount request for an account ID that was already set as the AWS Firewall Manager administrator. Or you might have tried to access a Region that's disabled by default, and that you need to enable for the Firewall Manager administrator account and for AWS Organizations before you can access it.

func (*InvalidOperationException) Error 

func (e *InvalidOperationException) Error() string

func (*InvalidOperationException) ErrorCode 

func (e *InvalidOperationException) ErrorCode() string

func (*InvalidOperationException) ErrorFault 

func (e *InvalidOperationException) ErrorFault() smithy.ErrorFault

func (*InvalidOperationException) ErrorMessage 

func (e *InvalidOperationException) ErrorMessage() string

type InvalidTypeException 

type InvalidTypeException struct {
	Message *string
}

The value of the Type parameter is invalid.

func (*InvalidTypeException) Error 

func (e *InvalidTypeException) Error() string

func (*InvalidTypeException) ErrorCode 

func (e *InvalidTypeException) ErrorCode() string

func (*InvalidTypeException) ErrorFault 

func (e *InvalidTypeException) ErrorFault() smithy.ErrorFault

func (*InvalidTypeException) ErrorMessage 

func (e *InvalidTypeException) ErrorMessage() string

type LimitExceededException 

type LimitExceededException struct {
	Message *string
}

The operation exceeds a resource limit, for example, the maximum number of policy objects that you can create for an AWS account. For more information, see Firewall Manager Limits (https://docs.aws.amazon.com/waf/latest/developerguide/fms-limits.html) in the AWS WAF Developer Guide.

func (*LimitExceededException) Error 

func (e *LimitExceededException) Error() string

func (*LimitExceededException) ErrorCode 

func (e *LimitExceededException) ErrorCode() string

func (*LimitExceededException) ErrorFault 

func (e *LimitExceededException) ErrorFault() smithy.ErrorFault

func (*LimitExceededException) ErrorMessage 

func (e *LimitExceededException) ErrorMessage() string

type NetworkFirewallMissingExpectedRTViolation added in v0.30.0 

type NetworkFirewallMissingExpectedRTViolation struct {

	// The Availability Zone of a violating subnet.
	AvailabilityZone *string

	// The resource ID of the current route table that's associated with the subnet, if
	// one is available.
	CurrentRouteTable *string

	// The resource ID of the route table that should be associated with the subnet.
	ExpectedRouteTable *string

	// The resource ID of the VPC associated with a violating subnet.
	VPC *string

	// The ID of the AWS Network Firewall or VPC resource that's in violation.
	ViolationTarget *string
}

Violation details for AWS Network Firewall for a subnet that's not associated to the expected Firewall Manager managed route table.

type NetworkFirewallMissingFirewallViolation added in v0.30.0 

type NetworkFirewallMissingFirewallViolation struct {

	// The Availability Zone of a violating subnet.
	AvailabilityZone *string

	// The reason the resource has this violation, if one is available.
	TargetViolationReason *string

	// The resource ID of the VPC associated with a violating subnet.
	VPC *string

	// The ID of the AWS Network Firewall or VPC resource that's in violation.
	ViolationTarget *string
}

Violation details for AWS Network Firewall for a subnet that doesn't have a Firewall Manager managed firewall in its VPC.

type NetworkFirewallMissingSubnetViolation added in v0.30.0 

type NetworkFirewallMissingSubnetViolation struct {

	// The Availability Zone of a violating subnet.
	AvailabilityZone *string

	// The reason the resource has this violation, if one is available.
	TargetViolationReason *string

	// The resource ID of the VPC associated with a violating subnet.
	VPC *string

	// The ID of the AWS Network Firewall or VPC resource that's in violation.
	ViolationTarget *string
}

Violation details for AWS Network Firewall for an Availability Zone that's missing the expected Firewall Manager managed subnet.

type NetworkFirewallPolicyDescription added in v0.30.0 

type NetworkFirewallPolicyDescription struct {

	// The stateful rule groups that are used in the Network Firewall firewall policy.
	StatefulRuleGroups []StatefulRuleGroup

	// Names of custom actions that are available for use in the stateless default
	// actions settings.
	StatelessCustomActions []string

	// The actions to take on packets that don't match any of the stateless rule
	// groups.
	StatelessDefaultActions []string

	// The actions to take on packet fragments that don't match any of the stateless
	// rule groups.
	StatelessFragmentDefaultActions []string

	// The stateless rule groups that are used in the Network Firewall firewall policy.
	StatelessRuleGroups []StatelessRuleGroup
}

The definition of the AWS Network Firewall firewall policy.

type NetworkFirewallPolicyModifiedViolation added in v0.30.0 

type NetworkFirewallPolicyModifiedViolation struct {

	// The policy that's currently in use in the individual account.
	CurrentPolicyDescription *NetworkFirewallPolicyDescription

	// The policy that should be in use in the individual account in order to be
	// compliant.
	ExpectedPolicyDescription *NetworkFirewallPolicyDescription

	// The ID of the AWS Network Firewall or VPC resource that's in violation.
	ViolationTarget *string
}

Violation details for AWS Network Firewall for a firewall policy that has a different NetworkFirewallPolicyDescription than is required by the Firewall Manager policy.

type PartialMatch 

type PartialMatch struct {

	// The reference rule from the master security group of the AWS Firewall Manager
	// policy.
	Reference *string

	// The violation reason.
	TargetViolationReasons []string
}

The reference rule that partially matches the ViolationTarget rule and violation reason.

type Policy 

type Policy struct {

	// If set to True, resources with the tags that are specified in the ResourceTag
	// array are not in scope of the policy. If set to False, and the ResourceTag array
	// is not null, only resources with the specified tags are in scope of the policy.
	//
	// This member is required.
	ExcludeResourceTags bool

	// The name of the AWS Firewall Manager policy.
	//
	// This member is required.
	PolicyName *string

	// Indicates if the policy should be automatically applied to new resources.
	//
	// This member is required.
	RemediationEnabled bool

	// The type of resource protected by or in scope of the policy. This is in the
	// format shown in the AWS Resource Types Reference
	// (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html).
	// For AWS WAF and Shield Advanced, examples include
	// AWS::ElasticLoadBalancingV2::LoadBalancer and AWS::CloudFront::Distribution. For
	// a security group common policy, valid values are AWS::EC2::NetworkInterface and
	// AWS::EC2::Instance. For a security group content audit policy, valid values are
	// AWS::EC2::SecurityGroup, AWS::EC2::NetworkInterface, and AWS::EC2::Instance. For
	// a security group usage audit policy, the value is AWS::EC2::SecurityGroup. For
	// an AWS Network Firewall policy, the value is AWS::EC2::VPC.
	//
	// This member is required.
	ResourceType *string

	// Details about the security service that is being used to protect the resources.
	//
	// This member is required.
	SecurityServicePolicyData *SecurityServicePolicyData

	// Specifies the AWS account IDs and AWS Organizations organizational units (OUs)
	// to exclude from the policy. Specifying an OU is the equivalent of specifying all
	// accounts in the OU and in any of its child OUs, including any child OUs and
	// accounts that are added at a later time. You can specify inclusions or
	// exclusions, but not both. If you specify an IncludeMap, AWS Firewall Manager
	// applies the policy to all accounts specified by the IncludeMap, and does not
	// evaluate any ExcludeMap specifications. If you do not specify an IncludeMap,
	// then Firewall Manager applies the policy to all accounts except for those
	// specified by the ExcludeMap. You can specify account IDs, OUs, or a
	// combination:
	//
	// * Specify account IDs by setting the key to ACCOUNT. For example,
	// the following is a valid map: {“ACCOUNT” : [“accountID1”, “accountID2”]}.
	//
	// *
	// Specify OUs by setting the key to ORG_UNIT. For example, the following is a
	// valid map: {“ORG_UNIT” : [“ouid111”, “ouid112”]}.
	//
	// * Specify accounts and OUs
	// together in a single map, separated with a comma. For example, the following is
	// a valid map: {“ACCOUNT” : [“accountID1”, “accountID2”], “ORG_UNIT” : [“ouid111”,
	// “ouid112”]}.
	ExcludeMap map[string][]string

	// Specifies the AWS account IDs and AWS Organizations organizational units (OUs)
	// to include in the policy. Specifying an OU is the equivalent of specifying all
	// accounts in the OU and in any of its child OUs, including any child OUs and
	// accounts that are added at a later time. You can specify inclusions or
	// exclusions, but not both. If you specify an IncludeMap, AWS Firewall Manager
	// applies the policy to all accounts specified by the IncludeMap, and does not
	// evaluate any ExcludeMap specifications. If you do not specify an IncludeMap,
	// then Firewall Manager applies the policy to all accounts except for those
	// specified by the ExcludeMap. You can specify account IDs, OUs, or a
	// combination:
	//
	// * Specify account IDs by setting the key to ACCOUNT. For example,
	// the following is a valid map: {“ACCOUNT” : [“accountID1”, “accountID2”]}.
	//
	// *
	// Specify OUs by setting the key to ORG_UNIT. For example, the following is a
	// valid map: {“ORG_UNIT” : [“ouid111”, “ouid112”]}.
	//
	// * Specify accounts and OUs
	// together in a single map, separated with a comma. For example, the following is
	// a valid map: {“ACCOUNT” : [“accountID1”, “accountID2”], “ORG_UNIT” : [“ouid111”,
	// “ouid112”]}.
	IncludeMap map[string][]string

	// The ID of the AWS Firewall Manager policy.
	PolicyId *string

	// A unique identifier for each update to the policy. When issuing a PutPolicy
	// request, the PolicyUpdateToken in the request must match the PolicyUpdateToken
	// of the current policy version. To get the PolicyUpdateToken of the current
	// policy version, use a GetPolicy request.
	PolicyUpdateToken *string

	// An array of ResourceTag objects.
	ResourceTags []ResourceTag

	// An array of ResourceType.
	ResourceTypeList []string
}

An AWS Firewall Manager policy.

type PolicyComplianceDetail 

type PolicyComplianceDetail struct {

	// Indicates if over 100 resources are noncompliant with the AWS Firewall Manager
	// policy.
	EvaluationLimitExceeded bool

	// A timestamp that indicates when the returned information should be considered
	// out of date.
	ExpiredAt *time.Time

	// Details about problems with dependent services, such as AWS WAF or AWS Config,
	// that are causing a resource to be noncompliant. The details include the name of
	// the dependent service and the error message received that indicates the problem
	// with the service.
	IssueInfoMap map[string]string

	// The AWS account ID.
	MemberAccount *string

	// The ID of the AWS Firewall Manager policy.
	PolicyId *string

	// The AWS account that created the AWS Firewall Manager policy.
	PolicyOwner *string

	// An array of resources that aren't protected by the AWS WAF or Shield Advanced
	// policy or that aren't in compliance with the security group policy.
	Violators []ComplianceViolator
}

Describes the noncompliant resources in a member account for a specific AWS Firewall Manager policy. A maximum of 100 entries are displayed. If more than 100 resources are noncompliant, EvaluationLimitExceeded is set to True.

type PolicyComplianceStatus 

type PolicyComplianceStatus struct {

	// An array of EvaluationResult objects.
	EvaluationResults []EvaluationResult

	// Details about problems with dependent services, such as AWS WAF or AWS Config,
	// that are causing a resource to be noncompliant. The details include the name of
	// the dependent service and the error message received that indicates the problem
	// with the service.
	IssueInfoMap map[string]string

	// Timestamp of the last update to the EvaluationResult objects.
	LastUpdated *time.Time

	// The member account ID.
	MemberAccount *string

	// The ID of the AWS Firewall Manager policy.
	PolicyId *string

	// The name of the AWS Firewall Manager policy.
	PolicyName *string

	// The AWS account that created the AWS Firewall Manager policy.
	PolicyOwner *string
}

Indicates whether the account is compliant with the specified policy. An account is considered noncompliant if it includes resources that are not protected by the policy, for AWS WAF and Shield Advanced policies, or that are noncompliant with the policy, for security group policies.

type PolicyComplianceStatusType 

type PolicyComplianceStatusType string
const (
	PolicyComplianceStatusTypeCompliant    PolicyComplianceStatusType = "COMPLIANT"
	PolicyComplianceStatusTypeNonCompliant PolicyComplianceStatusType = "NON_COMPLIANT"
)

Enum values for PolicyComplianceStatusType

func (PolicyComplianceStatusType) Values added in v0.29.0 

func (PolicyComplianceStatusType) Values() []PolicyComplianceStatusType

Values returns all known values for PolicyComplianceStatusType. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type PolicySummary 

type PolicySummary struct {

	// The Amazon Resource Name (ARN) of the specified policy.
	PolicyArn *string

	// The ID of the specified policy.
	PolicyId *string

	// The name of the specified policy.
	PolicyName *string

	// Indicates if the policy should be automatically applied to new resources.
	RemediationEnabled bool

	// The type of resource protected by or in scope of the policy. This is in the
	// format shown in the AWS Resource Types Reference
	// (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html).
	// For AWS WAF and Shield Advanced, examples include
	// AWS::ElasticLoadBalancingV2::LoadBalancer and AWS::CloudFront::Distribution. For
	// a security group common policy, valid values are AWS::EC2::NetworkInterface and
	// AWS::EC2::Instance. For a security group content audit policy, valid values are
	// AWS::EC2::SecurityGroup, AWS::EC2::NetworkInterface, and AWS::EC2::Instance. For
	// a security group usage audit policy, the value is AWS::EC2::SecurityGroup. For
	// an AWS Network Firewall policy, the value is AWS::EC2::VPC.
	ResourceType *string

	// The service that the policy is using to protect the resources. This specifies
	// the type of policy that is created, either an AWS WAF policy, a Shield Advanced
	// policy, or a security group policy.
	SecurityServiceType SecurityServiceType
}

Details of the AWS Firewall Manager policy.

type ProtocolsListData 

type ProtocolsListData struct {

	// The name of the AWS Firewall Manager protocols list.
	//
	// This member is required.
	ListName *string

	// An array of protocols in the AWS Firewall Manager protocols list.
	//
	// This member is required.
	ProtocolsList []string

	// The time that the AWS Firewall Manager protocols list was created.
	CreateTime *time.Time

	// The time that the AWS Firewall Manager protocols list was last updated.
	LastUpdateTime *time.Time

	// The ID of the AWS Firewall Manager protocols list.
	ListId *string

	// A unique identifier for each update to the list. When you update the list, the
	// update token must match the token of the current version of the application
	// list. You can retrieve the update token by getting the list.
	ListUpdateToken *string

	// A map of previous version numbers to their corresponding protocol arrays.
	PreviousProtocolsList map[string][]string
}

An AWS Firewall Manager protocols list.

type ProtocolsListDataSummary 

type ProtocolsListDataSummary struct {

	// The Amazon Resource Name (ARN) of the specified protocols list.
	ListArn *string

	// The ID of the specified protocols list.
	ListId *string

	// The name of the specified protocols list.
	ListName *string

	// An array of protocols in the AWS Firewall Manager protocols list.
	ProtocolsList []string
}

Details of the AWS Firewall Manager protocols list.

type RemediationActionType 

type RemediationActionType string
const (
	RemediationActionTypeRemove RemediationActionType = "REMOVE"
	RemediationActionTypeModify RemediationActionType = "MODIFY"
)

Enum values for RemediationActionType

func (RemediationActionType) Values added in v0.29.0 

func (RemediationActionType) Values() []RemediationActionType

Values returns all known values for RemediationActionType. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type ResourceNotFoundException 

type ResourceNotFoundException struct {
	Message *string
}

The specified resource was not found.

func (*ResourceNotFoundException) Error 

func (e *ResourceNotFoundException) Error() string

func (*ResourceNotFoundException) ErrorCode 

func (e *ResourceNotFoundException) ErrorCode() string

func (*ResourceNotFoundException) ErrorFault 

func (e *ResourceNotFoundException) ErrorFault() smithy.ErrorFault

func (*ResourceNotFoundException) ErrorMessage 

func (e *ResourceNotFoundException) ErrorMessage() string

type ResourceTag 

type ResourceTag struct {

	// The resource tag key.
	//
	// This member is required.
	Key *string

	// The resource tag value.
	Value *string
}

The resource tags that AWS Firewall Manager uses to determine if a particular resource should be included or excluded from the AWS Firewall Manager policy. Tags enable you to categorize your AWS resources in different ways, for example, by purpose, owner, or environment. Each tag consists of a key and an optional value. Firewall Manager combines the tags with "AND" so that, if you add more than one tag to a policy scope, a resource must have all the specified tags to be included or excluded. For more information, see Working with Tag Editor (https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/tag-editor.html).

type ResourceViolation 

type ResourceViolation struct {

	// Violation details for an EC2 instance.
	AwsEc2InstanceViolation *AwsEc2InstanceViolation

	// Violation details for network interface.
	AwsEc2NetworkInterfaceViolation *AwsEc2NetworkInterfaceViolation

	// Violation details for security groups.
	AwsVPCSecurityGroupViolation *AwsVPCSecurityGroupViolation

	// Violation detail for a DNS Firewall policy that indicates that a rule group that
	// Firewall Manager tried to associate with a VPC is already associated with the
	// VPC and can't be associated again.
	DnsDuplicateRuleGroupViolation *DnsDuplicateRuleGroupViolation

	// Violation details for a DNS Firewall policy that indicates that the VPC reached
	// the limit for associated DNS Firewall rule groups. Firewall Manager tried to
	// associate another rule group with the VPC and failed.
	DnsRuleGroupLimitExceededViolation *DnsRuleGroupLimitExceededViolation

	// Violation detail for a DNS Firewall policy that indicates that a rule group that
	// Firewall Manager tried to associate with a VPC has the same priority as a rule
	// group that's already associated.
	DnsRuleGroupPriorityConflictViolation *DnsRuleGroupPriorityConflictViolation

	// Violation detail for an Network Firewall policy that indicates that a subnet is
	// not associated with the expected Firewall Manager managed route table.
	NetworkFirewallMissingExpectedRTViolation *NetworkFirewallMissingExpectedRTViolation

	// Violation detail for an Network Firewall policy that indicates that a subnet has
	// no Firewall Manager managed firewall in its VPC.
	NetworkFirewallMissingFirewallViolation *NetworkFirewallMissingFirewallViolation

	// Violation detail for an Network Firewall policy that indicates that an
	// Availability Zone is missing the expected Firewall Manager managed subnet.
	NetworkFirewallMissingSubnetViolation *NetworkFirewallMissingSubnetViolation

	// Violation detail for an Network Firewall policy that indicates that a firewall
	// policy in an individual account has been modified in a way that makes it
	// noncompliant. For example, the individual account owner might have deleted a
	// rule group, changed the priority of a stateless rule group, or changed a policy
	// default action.
	NetworkFirewallPolicyModifiedViolation *NetworkFirewallPolicyModifiedViolation
}

Violation detail based on resource type.

type SecurityGroupRemediationAction 

type SecurityGroupRemediationAction struct {

	// Brief description of the action that will be performed.
	Description *string

	// Indicates if the current action is the default action.
	IsDefaultAction bool

	// The remediation action that will be performed.
	RemediationActionType RemediationActionType

	// The final state of the rule specified in the ViolationTarget after it is
	// remediated.
	RemediationResult *SecurityGroupRuleDescription
}

Remediation option for the rule specified in the ViolationTarget.

type SecurityGroupRuleDescription 

type SecurityGroupRuleDescription struct {

	// The start of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6
	// type number. A value of -1 indicates all ICMP/ICMPv6 types.
	FromPort *int64

	// The IPv4 ranges for the security group rule.
	IPV4Range *string

	// The IPv6 ranges for the security group rule.
	IPV6Range *string

	// The ID of the prefix list for the security group rule.
	PrefixListId *string

	// The IP protocol name (tcp, udp, icmp, icmpv6) or number.
	Protocol *string

	// The end of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.
	// A value of -1 indicates all ICMP/ICMPv6 codes.
	ToPort *int64
}

Describes a set of permissions for a security group rule.

type SecurityServicePolicyData 

type SecurityServicePolicyData struct {

	// The service that the policy is using to protect the resources. This specifies
	// the type of policy that is created, either an AWS WAF policy, a Shield Advanced
	// policy, or a security group policy. For security group policies, Firewall
	// Manager supports one security group for each common policy and for each content
	// audit policy. This is an adjustable limit that you can increase by contacting
	// AWS Support.
	//
	// This member is required.
	Type SecurityServiceType

	// Details about the service that are specific to the service type, in JSON format.
	// For service type SHIELD_ADVANCED, this is an empty string.
	//
	// * Example:
	// NETWORK_FIREWALL"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-1:1234567891011:stateless-rulegroup/rulegroup2\",\"priority\":10}],\"networkFirewallStatelessDefaultActions\":[\"aws:pass\",\"custom1\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"custom2\",\"aws:pass\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"custom1\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"dimension1\"}]}}},{\"actionName\":\"custom2\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"dimension2\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-1:1234567891011:stateful-rulegroup/rulegroup1\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":true,\"allowedIPV4CidrList\":[\"10.24.34.0/28\"]}
	// }"
	//
	// * Example:
	// WAFV2"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesAmazonIpReputationList\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"
	// In the loggingConfiguration, you can specify one logDestinationConfigs, you can
	// optionally provide up to 20 redactedFields, and the RedactedFieldType must be
	// one of URI, QUERY_STRING, HEADER, or METHOD.
	//
	// * Example: WAF Classic"{\"type\":
	// \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\",
	// \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\":
	// \"BLOCK\"}}"
	//
	// * Example:
	// SECURITY_GROUPS_COMMON"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false,
	// \"applyToAllEC2InstanceENIs\":false,\"securityGroups\":[{\"id\":\"
	// sg-000e55995d61a06bd\"}]}"
	//
	// * Example:
	// SECURITY_GROUPS_CONTENT_AUDIT"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"
	// The security group action for content audit can be ALLOW or DENY. For ALLOW, all
	// in-scope security group rules must be within the allowed range of the policy's
	// security group rules. For DENY, all in-scope security group rules must not
	// contain a value or a range that matches a rule value or range in the policy
	// security group.
	//
	// * Example:
	// SECURITY_GROUPS_USAGE_AUDIT"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"
	ManagedServiceData *string
}

Details about the security service that is being used to protect the resources.

type SecurityServiceType 

type SecurityServiceType string
const (
	SecurityServiceTypeWaf                        SecurityServiceType = "WAF"
	SecurityServiceTypeWafv2                      SecurityServiceType = "WAFV2"
	SecurityServiceTypeShieldAdvanced             SecurityServiceType = "SHIELD_ADVANCED"
	SecurityServiceTypeSecurityGroupsCommon       SecurityServiceType = "SECURITY_GROUPS_COMMON"
	SecurityServiceTypeSecurityGroupsContentAudit SecurityServiceType = "SECURITY_GROUPS_CONTENT_AUDIT"
	SecurityServiceTypeSecurityGroupsUsageAudit   SecurityServiceType = "SECURITY_GROUPS_USAGE_AUDIT"
	SecurityServiceTypeNetworkFirewall            SecurityServiceType = "NETWORK_FIREWALL"
	SecurityServiceTypeDnsFirewall                SecurityServiceType = "DNS_FIREWALL"
)

Enum values for SecurityServiceType

func (SecurityServiceType) Values added in v0.29.0 

func (SecurityServiceType) Values() []SecurityServiceType

Values returns all known values for SecurityServiceType. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

type StatefulRuleGroup added in v0.30.0 

type StatefulRuleGroup struct {

	// The resource ID of the rule group.
	ResourceId *string

	// The name of the rule group.
	RuleGroupName *string
}

AWS Network Firewall stateful rule group, used in a NetworkFirewallPolicyDescription.

type StatelessRuleGroup added in v0.30.0 

type StatelessRuleGroup struct {

	// The priority of the rule group. AWS Network Firewall evaluates the stateless
	// rule groups in a firewall policy starting from the lowest priority setting.
	Priority int32

	// The resource ID of the rule group.
	ResourceId *string

	// The name of the rule group.
	RuleGroupName *string
}

AWS Network Firewall stateless rule group, used in a NetworkFirewallPolicyDescription.

type Tag 

type Tag struct {

	// Part of the key:value pair that defines a tag. You can use a tag key to describe
	// a category of information, such as "customer." Tag keys are case-sensitive.
	//
	// This member is required.
	Key *string

	// Part of the key:value pair that defines a tag. You can use a tag value to
	// describe a specific value within a category, such as "companyA" or "companyB."
	// Tag values are case-sensitive.
	//
	// This member is required.
	Value *string
}

A collection of key:value pairs associated with an AWS resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each AWS resource.

type ViolationDetail 

type ViolationDetail struct {

	// The AWS account that the violation details were requested for.
	//
	// This member is required.
	MemberAccount *string

	// The ID of the AWS Firewall Manager policy that the violation details were
	// requested for.
	//
	// This member is required.
	PolicyId *string

	// The resource ID that the violation details were requested for.
	//
	// This member is required.
	ResourceId *string

	// The resource type that the violation details were requested for.
	//
	// This member is required.
	ResourceType *string

	// List of violations for the requested resource.
	//
	// This member is required.
	ResourceViolations []ResourceViolation

	// Brief description for the requested resource.
	ResourceDescription *string

	// The ResourceTag objects associated with the resource.
	ResourceTags []Tag
}

Violations for a resource based on the specified AWS Firewall Manager policy and AWS account.

type ViolationReason 

type ViolationReason string
const (
	ViolationReasonWebAclMissingRuleGroup                  ViolationReason = "WEB_ACL_MISSING_RULE_GROUP"
	ViolationReasonResourceMissingWebAcl                   ViolationReason = "RESOURCE_MISSING_WEB_ACL"
	ViolationReasonResourceIncorrectWebAcl                 ViolationReason = "RESOURCE_INCORRECT_WEB_ACL"
	ViolationReasonResourceMissingShieldProtection         ViolationReason = "RESOURCE_MISSING_SHIELD_PROTECTION"
	ViolationReasonResourceMissingWebaclOrShieldProtection ViolationReason = "RESOURCE_MISSING_WEB_ACL_OR_SHIELD_PROTECTION"
	ViolationReasonResourceMissingSecurityGroup            ViolationReason = "RESOURCE_MISSING_SECURITY_GROUP"
	ViolationReasonResourceViolatesAuditSecurityGroup      ViolationReason = "RESOURCE_VIOLATES_AUDIT_SECURITY_GROUP"
	ViolationReasonSecurityGroupUnused                     ViolationReason = "SECURITY_GROUP_UNUSED"
	ViolationReasonSecurityGroupRedundant                  ViolationReason = "SECURITY_GROUP_REDUNDANT"
	ViolationReasonFMSCreatedSecurityGroupEdited           ViolationReason = "FMS_CREATED_SECURITY_GROUP_EDITED"
	ViolationReasonMissingFirewall                         ViolationReason = "MISSING_FIREWALL"
	ViolationReasonMissingFirewallSubnetInAZ               ViolationReason = "MISSING_FIREWALL_SUBNET_IN_AZ"
	ViolationReasonMissingExpectedRouteTable               ViolationReason = "MISSING_EXPECTED_ROUTE_TABLE"
	ViolationReasonNetworkFirewallPolicyModified           ViolationReason = "NETWORK_FIREWALL_POLICY_MODIFIED"
	ViolationReasonResourceMissingDnsFirewall              ViolationReason = "RESOURCE_MISSING_DNS_FIREWALL"
)

Enum values for ViolationReason

func (ViolationReason) Values added in v0.29.0 

func (ViolationReason) Values() []ViolationReason

Values returns all known values for ViolationReason. Note that this can be expanded in the future, and so it is only as up to date as the client. The ordering of this slice is not guaranteed to be stable across updates.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.