Begins the flushing of traffic from the firewall, according to the filters you define. When the operation starts, impacted flows are temporarily marked as timed out before the Suricata engine prunes, or flushes, the flows from the firewall table.
Important
While the flush completes, impacted flows are processed as midstream traffic. This may result in a temporary increase in midstream traffic metrics. We recommend that you double check your stream exception policy before you perform a flush operation.
Request Syntax
{
"AvailabilityZone": "string",
"FirewallArn": "string",
"FlowFilters": [
{
"DestinationAddress": {
"AddressDefinition": "string"
},
"DestinationPort": "string",
"Protocols": [ "string" ],
"SourceAddress": {
"AddressDefinition": "string"
},
"SourcePort": "string"
}
],
"MinimumFlowAgeInSeconds": number
}Request Parameters
For information about the parameters that are common to all actions, see Common Parameters.
The request accepts the following data in JSON format.
- AvailabilityZone
-
The ID of the Availability Zone where the firewall is located. For example,
us-east-2a.Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation.
Type: String
Required: No
- FirewallArn
-
The Amazon Resource Name (ARN) of the firewall.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 256.
Pattern:
^arn:aws.*Required: Yes
- FlowFilters
-
Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation.
Type: Array of FlowFilter objects
Required: Yes
- MinimumFlowAgeInSeconds
-
The reqested
FlowOperationignores flows with an age (in seconds) lower thanMinimumFlowAgeInSeconds. You provide this for start commands.Type: Integer
Required: No
Response Syntax
{
"FirewallArn": "string",
"FlowOperationId": "string",
"FlowOperationStatus": "string"
}Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
- FirewallArn
-
The Amazon Resource Name (ARN) of the firewall.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 256.
Pattern:
^arn:aws.* - FlowOperationId
-
A unique identifier for the flow operation. This ID is returned in the responses to start and list commands. You provide to describe commands.
Type: String
Length Constraints: Fixed length of 36.
Pattern:
^([0-9a-f]{8})-([0-9a-f]{4}-){3}([0-9a-f]{12})$ - FlowOperationStatus
-
Returns the status of the flow operation. This string is returned in the responses to start, list, and describe commands.
If the status is
COMPLETED_WITH_ERRORS, results may be returned with any number ofFlowsmissing from the response. If the status isFAILED,Flowsreturned will be empty.Type: String
Valid Values:
COMPLETED | IN_PROGRESS | FAILED | COMPLETED_WITH_ERRORS
Errors
For information about the errors that are common to all actions, see Common Errors.
- InternalServerError
-
Your request is valid, but Network Firewall couldn't perform the operation because of a system problem. Retry your request.
HTTP Status Code: 500
- InvalidRequestException
-
The operation failed because of a problem with your request. Examples include:
-
You specified an unsupported parameter name or value.
-
You tried to update a property with a value that isn't among the available types.
-
Your request references an ARN that is malformed, or corresponds to a resource that isn't valid in the context of the request.
HTTP Status Code: 400
-
- ResourceNotFoundException
-
Unable to locate a resource using the parameters that you provided.
HTTP Status Code: 400
- ThrottlingException
-
Unable to process the request due to throttling limitations.
HTTP Status Code: 400
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
