AWS Firewall Manager
Firewall Management (API Version 2018-01-01)

GetProtectionStatus

If you created a Shield Advanced policy, returns policy-level attack summary information in the event of a potential DDoS attack.

Request Syntax

{ "EndTime": number, "MaxResults": number, "MemberAccountId": "string", "NextToken": "string", "PolicyId": "string", "StartTime": number }

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters.

The request accepts the following data in JSON format.

EndTime

The end of the time period to query for the attacks. This is a timestamp type. The sample request above indicates a number type because the default used by AWS Firewall Manager is Unix time in seconds. However, any valid timestamp format is allowed.

Type: Timestamp

Required: No

MaxResults

Specifies the number of objects that you want AWS Firewall Manager to return for this request. If you have more objects than the number that you specify for MaxResults, the response includes a NextToken value that you can use to get another batch of objects.

Type: Integer

Valid Range: Minimum value of 1. Maximum value of 100.

Required: No

MemberAccountId

The AWS account that is in scope of the policy that you want to get the details for.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 1024.

Pattern: ^[0-9]+$

Required: No

NextToken

If you specify a value for MaxResults and you have more objects than the number that you specify for MaxResults, AWS Firewall Manager returns a NextToken value in the response that allows you to list another group of objects. For the second and subsequent GetProtectionStatus requests, specify the value of NextToken from the previous response to get information about another batch of objects.

Type: String

Length Constraints: Minimum length of 1.

Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

Required: No

PolicyId

The ID of the policy for which you want to get the attack information.

Type: String

Length Constraints: Fixed length of 36.

Pattern: ^[a-z0-9A-Z-]{36}$

Required: Yes

StartTime

The start of the time period to query for the attacks. This is a timestamp type. The sample request above indicates a number type because the default used by AWS Firewall Manager is Unix time in seconds. However, any valid timestamp format is allowed.

Type: Timestamp

Required: No

Response Syntax

{ "AdminAccountId": "string", "Data": "string", "NextToken": "string", "ServiceType": "string" }

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

AdminAccountId

The ID of the AWS Firewall administrator account for this policy.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 1024.

Pattern: ^[0-9]+$

Data

Details about the attack, including the following:

  • Attack type

  • Account ID

  • ARN of the resource attacked

  • Start time of the attack

  • End time of the attack (ongoing attacks will not have an end time)

The details are in JSON format. An example is shown in the Examples section below.

Type: String

NextToken

If you have more objects than the number that you specified for MaxResults in the request, the response includes a NextToken value. To list more objects, submit another GetProtectionStatus request, and specify the NextToken value from the response in the NextToken value in the next request.

AWS SDKs provide auto-pagination that identify NextToken in a response and make subsequent request calls automatically on your behalf. However, this feature is not supported by GetProtectionStatus. You must submit subsequent requests with NextToken using your own processes.

Type: String

Length Constraints: Minimum length of 1.

Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$

ServiceType

The service type that is protected by the policy. Currently, this is always SHIELD_ADVANCED.

Type: String

Valid Values: WAF | SHIELD_ADVANCED

Errors

For information about the errors that are common to all actions, see Common Errors.

InternalErrorException

The operation failed because of a system problem, even though the request was valid. Retry your request.

HTTP Status Code: 400

InvalidInputException

The parameters of the request were invalid.

HTTP Status Code: 400

ResourceNotFoundException

The specified resource was not found.

HTTP Status Code: 400

Example

Example response

[ { accountId: account1 attackSummaries:[ { attackId: attackId1 resourceARN: resource1 attackVector: [SYC_FLOOD, UDP_REFLECTION] startTime: 1234567890123 endTime: 1234567890123 }, { attackId: attackId2 resourceARN: resource2 attackVector: [SYC_FLOOD] startTime: 1234567890123 endTime: 1234567890123 } ] }, { accountId: account2 attackSummaries:[ { attackId: attackId3 resourceARN: resource3 attackVector: [SYC_FLOOD, UDP_REFLECTION] startTime: 1234567890123 endTime: 1234567890123 }, { attackId: attackId4 resourceARN: resource4 attackVector: [SYC_FLOOD] startTime: 1234567890123 endTime: 1234567890123 } ] }, ]

See Also

For more information about using this API in one of the language-specific AWS SDKs, see the following: