You are viewing documentation for version 3 of the AWS SDK for Ruby. Version 2 documentation can be found here.

Class: Aws::FMS::Client

Inherits:
Seahorse::Client::Base show all
Includes:
ClientStubs
Defined in:
gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb

Instance Attribute Summary

Attributes inherited from Seahorse::Client::Base

#config, #handlers

API Operations collapse

Instance Method Summary collapse

Methods included from ClientStubs

#api_requests, #stub_data, #stub_responses

Methods inherited from Seahorse::Client::Base

add_plugin, api, clear_plugins, define, new, #operation_names, plugins, remove_plugin, set_api, set_plugins

Methods included from Seahorse::Client::HandlerBuilder

#handle, #handle_request, #handle_response

Constructor Details

#initialize(options) ⇒ Client

Returns a new instance of Client

Parameters:

  • options (Hash)

Options Hash (options):

  • :credentials (required, Aws::CredentialProvider) —

    Your AWS credentials. This can be an instance of any one of the following classes:

    • Aws::Credentials - Used for configuring static, non-refreshing credentials.

    • Aws::InstanceProfileCredentials - Used for loading credentials from an EC2 IMDS on an EC2 instance.

    • Aws::SharedCredentials - Used for loading credentials from a shared file, such as ~/.aws/config.

    • Aws::AssumeRoleCredentials - Used when you need to assume a role.

    When :credentials are not configured directly, the following locations will be searched for credentials:

    • Aws.config[:credentials]
    • The :access_key_id, :secret_access_key, and :session_token options.
    • ENV['AWS_ACCESS_KEY_ID'], ENV['AWS_SECRET_ACCESS_KEY']
    • ~/.aws/credentials
    • ~/.aws/config
    • EC2 IMDS instance profile - When used by default, the timeouts are very aggressive. Construct and pass an instance of Aws::InstanceProfileCredentails to enable retries and extended timeouts.
  • :region (required, String) —

    The AWS region to connect to. The configured :region is used to determine the service :endpoint. When not passed, a default :region is search for in the following locations:

    • Aws.config[:region]
    • ENV['AWS_REGION']
    • ENV['AMAZON_REGION']
    • ENV['AWS_DEFAULT_REGION']
    • ~/.aws/credentials
    • ~/.aws/config
  • :access_key_id (String)
  • :active_endpoint_cache (Boolean) — default: false —

    When set to true, a thread polling for endpoints will be running in the background every 60 secs (default). Defaults to false.

  • :client_side_monitoring (Boolean) — default: false —

    When true, client-side metrics will be collected for all API requests from this client.

  • :client_side_monitoring_client_id (String) — default: "" —

    Allows you to provide an identifier for this client which will be attached to all generated client side metrics. Defaults to an empty string.

  • :client_side_monitoring_host (String) — default: "127.0.0.1" —

    Allows you to specify the DNS hostname or IPv4 or IPv6 address that the client side monitoring agent is running on, where client metrics will be published via UDP.

  • :client_side_monitoring_port (Integer) — default: 31000 —

    Required for publishing client metrics. The port that the client side monitoring agent is running on, where client metrics will be published via UDP.

  • :client_side_monitoring_publisher (Aws::ClientSideMonitoring::Publisher) — default: Aws::ClientSideMonitoring::Publisher —

    Allows you to provide a custom client-side monitoring publisher class. By default, will use the Client Side Monitoring Agent Publisher.

  • :convert_params (Boolean) — default: true —

    When true, an attempt is made to coerce request parameters into the required types.

  • :disable_host_prefix_injection (Boolean) — default: false —

    Set to true to disable SDK automatically adding host prefix to default service endpoint when available.

  • :endpoint (String) —

    The client endpoint is normally constructed from the :region option. You should only configure an :endpoint when connecting to test endpoints. This should be avalid HTTP(S) URI.

  • :endpoint_cache_max_entries (Integer) — default: 1000 —

    Used for the maximum size limit of the LRU cache storing endpoints data for endpoint discovery enabled operations. Defaults to 1000.

  • :endpoint_cache_max_threads (Integer) — default: 10 —

    Used for the maximum threads in use for polling endpoints to be cached, defaults to 10.

  • :endpoint_cache_poll_interval (Integer) — default: 60 —

    When :endpoint_discovery and :active_endpoint_cache is enabled, Use this option to config the time interval in seconds for making requests fetching endpoints information. Defaults to 60 sec.

  • :endpoint_discovery (Boolean) — default: false —

    When set to true, endpoint discovery will be enabled for operations when available. Defaults to false.

  • :log_formatter (Aws::Log::Formatter) — default: Aws::Log::Formatter.default —

    The log formatter.

  • :log_level (Symbol) — default: :info —

    The log level to send messages to the :logger at.

  • :logger (Logger) —

    The Logger instance to send log messages to. If this option is not set, logging will be disabled.

  • :profile (String) — default: "default" —

    Used when loading credentials from the shared credentials file at HOME/.aws/credentials. When not specified, 'default' is used.

  • :retry_base_delay (Float) — default: 0.3 —

    The base delay in seconds used by the default backoff function.

  • :retry_jitter (Symbol) — default: :none —

    A delay randomiser function used by the default backoff function. Some predefined functions can be referenced by name - :none, :equal, :full, otherwise a Proc that takes and returns a number.

    @see https://www.awsarchitectureblog.com/2015/03/backoff.html

  • :retry_limit (Integer) — default: 3 —

    The maximum number of times to retry failed requests. Only ~ 500 level server errors and certain ~ 400 level client errors are retried. Generally, these are throttling errors, data checksum errors, networking errors, timeout errors and auth errors from expired credentials.

  • :retry_max_delay (Integer) — default: 0 —

    The maximum number of seconds to delay between retries (0 for no limit) used by the default backoff function.

  • :secret_access_key (String)
  • :session_token (String)
  • :simple_json (Boolean) — default: false —

    Disables request parameter conversion, validation, and formatting. Also disable response data type conversions. This option is useful when you want to ensure the highest level of performance by avoiding overhead of walking request parameters and response data structures.

    When :simple_json is enabled, the request parameters hash must be formatted exactly as the DynamoDB API expects.

  • :stub_responses (Boolean) — default: false —

    Causes the client to return stubbed responses. By default fake responses are generated and returned. You can specify the response data to return or errors to raise by calling ClientStubs#stub_responses. See ClientStubs for more information.

    Please note When response stubbing is enabled, no HTTP requests are made, and retries are disabled.

  • :validate_params (Boolean) — default: true —

    When true, request parameters are validated before sending the request.

  • :http_proxy (URI::HTTP, String) —

    A proxy to send requests through. Formatted like 'http://proxy.com:123'.

  • :http_open_timeout (Float) — default: 15 —

    The number of seconds to wait when opening a HTTP session before rasing a Timeout::Error.

  • :http_read_timeout (Integer) — default: 60 —

    The default number of seconds to wait for response data. This value can safely be set per-request on the session yeidled by #session_for.

  • :http_idle_timeout (Float) — default: 5 —

    The number of seconds a connection is allowed to sit idble before it is considered stale. Stale connections are closed and removed from the pool before making a request.

  • :http_continue_timeout (Float) — default: 1 —

    The number of seconds to wait for a 100-continue response before sending the request body. This option has no effect unless the request has "Expect" header set to "100-continue". Defaults to nil which disables this behaviour. This value can safely be set per request on the session yeidled by #session_for.

  • :http_wire_trace (Boolean) — default: false —

    When true, HTTP debug output will be sent to the :logger.

  • :ssl_verify_peer (Boolean) — default: true —

    When true, SSL peer certificates are verified when establishing a connection.

  • :ssl_ca_bundle (String) —

    Full path to the SSL certificate authority bundle file that should be used when verifying peer certificates. If you do not pass :ssl_ca_bundle or :ssl_ca_directory the the system default will be used if available.

  • :ssl_ca_directory (String) —

    Full path of the directory that contains the unbundled SSL certificate authority files for verifying peer certificates. If you do not pass :ssl_ca_bundle or :ssl_ca_directory the the system default will be used if available.



261
262
263
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 261

def initialize(*args)
  super
end

Instance Method Details

#associate_admin_account(params = {}) ⇒ Struct

Sets the AWS Firewall Manager administrator account. AWS Firewall Manager must be associated with the master account your AWS organization or associated with a member account that has the appropriate permissions. If the account ID that you submit is not an AWS Organizations master account, AWS Firewall Manager will set the appropriate permissions for the given member account.

The account that you associate with AWS Firewall Manager is called the AWS Firewall Manager administrator account.

Examples:

Request syntax with placeholder values


resp = client.({
  admin_account: "AWSAccountId", # required
})

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Options Hash (params):

  • :admin_account (required, String) —

    The AWS account ID to associate with AWS Firewall Manager as the AWS Firewall Manager administrator account. This can be an AWS Organizations master account or a member account. For more information about AWS Organizations and master accounts, see Managing the AWS Accounts in Your Organization.

Returns:

  • (Struct) —

    Returns an empty response.

See Also:



300
301
302
303
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 300

def (params = {}, options = {})
  req = build_request(:associate_admin_account, params)
  req.send_request(options)
end

#delete_notification_channel(params = {}) ⇒ Struct

Deletes an AWS Firewall Manager association with the IAM role and the Amazon Simple Notification Service (SNS) topic that is used to record AWS Firewall Manager SNS logs.

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Returns:

  • (Struct) —

    Returns an empty response.

See Also:



315
316
317
318
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 315

def delete_notification_channel(params = {}, options = {})
  req = build_request(:delete_notification_channel, params)
  req.send_request(options)
end

#delete_policy(params = {}) ⇒ Struct

Permanently deletes an AWS Firewall Manager policy.

Examples:

Request syntax with placeholder values


resp = client.delete_policy({
  policy_id: "PolicyId", # required
  delete_all_policy_resources: false,
})

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Options Hash (params):

  • :policy_id (required, String) —

    The ID of the policy that you want to delete. PolicyId is returned by PutPolicy and by ListPolicies.

  • :delete_all_policy_resources (Boolean) —

    If True, the request will also perform a clean-up process that will:

    • Delete rule groups created by AWS Firewall Manager

    • Remove web ACLs from in-scope resources

    • Delete web ACLs that contain no rules or rule groups

    After the cleanup, in-scope resources will no longer be protected by web ACLs in this policy. Protection of out-of-scope resources will remain unchanged. Scope is determined by tags and accounts associated with the policy. When creating the policy, if you specified that only resources in specific accounts or with specific tags be protected by the policy, those resources are in-scope. All others are out of scope. If you did not specify tags or accounts, all resources are in-scope.

Returns:

  • (Struct) —

    Returns an empty response.

See Also:



356
357
358
359
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 356

def delete_policy(params = {}, options = {})
  req = build_request(:delete_policy, params)
  req.send_request(options)
end

#disassociate_admin_account(params = {}) ⇒ Struct

Disassociates the account that has been set as the AWS Firewall Manager administrator account. To set a different account as the administrator account, you must submit an AssociateAdminAccount request .

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Returns:

  • (Struct) —

    Returns an empty response.

See Also:



372
373
374
375
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 372

def (params = {}, options = {})
  req = build_request(:disassociate_admin_account, params)
  req.send_request(options)
end

#get_admin_account(params = {}) ⇒ Types::GetAdminAccountResponse

Returns the AWS Organizations master account that is associated with AWS Firewall Manager as the AWS Firewall Manager administrator.

Examples:

Response structure


resp. #=> String
resp.role_status #=> String, one of "READY", "CREATING", "PENDING_DELETION", "DELETING", "DELETED"

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Returns:

See Also:



394
395
396
397
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 394

def (params = {}, options = {})
  req = build_request(:get_admin_account, params)
  req.send_request(options)
end

#get_compliance_detail(params = {}) ⇒ Types::GetComplianceDetailResponse

Returns detailed compliance information about the specified member account. Details include resources that are in and out of compliance with the specified policy. Resources are considered non-compliant if the specified policy has not been applied to them.

Examples:

Request syntax with placeholder values


resp = client.get_compliance_detail({
  policy_id: "PolicyId", # required
  member_account: "AWSAccountId", # required
})

Response structure


resp.policy_compliance_detail.policy_owner #=> String
resp.policy_compliance_detail.policy_id #=> String
resp.policy_compliance_detail. #=> String
resp.policy_compliance_detail.violators #=> Array
resp.policy_compliance_detail.violators[0].resource_id #=> String
resp.policy_compliance_detail.violators[0].violation_reason #=> String, one of "WEB_ACL_MISSING_RULE_GROUP", "RESOURCE_MISSING_WEB_ACL", "RESOURCE_INCORRECT_WEB_ACL", "RESOURCE_MISSING_SHIELD_PROTECTION"
resp.policy_compliance_detail.violators[0].resource_type #=> String
resp.policy_compliance_detail.evaluation_limit_exceeded #=> Boolean
resp.policy_compliance_detail.expired_at #=> Time
resp.policy_compliance_detail.issue_info_map #=> Hash
resp.policy_compliance_detail.issue_info_map["DependentServiceName"] #=> String

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Options Hash (params):

  • :policy_id (required, String) —

    The ID of the policy that you want to get the details for. PolicyId is returned by PutPolicy and by ListPolicies.

  • :member_account (required, String) —

    The AWS account that owns the resources that you want to get the details for.

Returns:

See Also:



441
442
443
444
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 441

def get_compliance_detail(params = {}, options = {})
  req = build_request(:get_compliance_detail, params)
  req.send_request(options)
end

#get_notification_channel(params = {}) ⇒ Types::GetNotificationChannelResponse

Returns information about the Amazon Simple Notification Service (SNS) topic that is used to record AWS Firewall Manager SNS logs.

Examples:

Response structure


resp.sns_topic_arn #=> String
resp.sns_role_name #=> String

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Returns:

See Also:



463
464
465
466
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 463

def get_notification_channel(params = {}, options = {})
  req = build_request(:get_notification_channel, params)
  req.send_request(options)
end

#get_policy(params = {}) ⇒ Types::GetPolicyResponse

Returns information about the specified AWS Firewall Manager policy.

Examples:

Request syntax with placeholder values


resp = client.get_policy({
  policy_id: "PolicyId", # required
})

Response structure


resp.policy.policy_id #=> String
resp.policy.policy_name #=> String
resp.policy.policy_update_token #=> String
resp.policy.security_service_policy_data.type #=> String, one of "WAF", "SHIELD_ADVANCED"
resp.policy.security_service_policy_data.managed_service_data #=> String
resp.policy.resource_type #=> String
resp.policy.resource_type_list #=> Array
resp.policy.resource_type_list[0] #=> String
resp.policy.resource_tags #=> Array
resp.policy.resource_tags[0].key #=> String
resp.policy.resource_tags[0].value #=> String
resp.policy.exclude_resource_tags #=> Boolean
resp.policy.remediation_enabled #=> Boolean
resp.policy.include_map #=> Hash
resp.policy.include_map["CustomerPolicyScopeIdType"] #=> Array
resp.policy.include_map["CustomerPolicyScopeIdType"][0] #=> String
resp.policy.exclude_map #=> Hash
resp.policy.exclude_map["CustomerPolicyScopeIdType"] #=> Array
resp.policy.exclude_map["CustomerPolicyScopeIdType"][0] #=> String
resp.policy_arn #=> String

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Options Hash (params):

  • :policy_id (required, String) —

    The ID of the AWS Firewall Manager policy that you want the details for.

Returns:

See Also:



512
513
514
515
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 512

def get_policy(params = {}, options = {})
  req = build_request(:get_policy, params)
  req.send_request(options)
end

#get_protection_status(params = {}) ⇒ Types::GetProtectionStatusResponse

If you created a Shield Advanced policy, returns policy-level attack summary information in the event of a potential DDoS attack.

Examples:

Request syntax with placeholder values


resp = client.get_protection_status({
  policy_id: "PolicyId", # required
  member_account_id: "AWSAccountId",
  start_time: Time.now,
  end_time: Time.now,
  next_token: "PaginationToken",
  max_results: 1,
})

Response structure


resp. #=> String
resp.service_type #=> String, one of "WAF", "SHIELD_ADVANCED"
resp.data #=> String
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Options Hash (params):

  • :policy_id (required, String) —

    The ID of the policy for which you want to get the attack information.

  • :member_account_id (String) —

    The AWS account that is in scope of the policy that you want to get the details for.

  • :start_time (Time, DateTime, Date, Integer, String) —

    The start of the time period to query for the attacks. This is a timestamp type. The sample request above indicates a number type because the default used by AWS Firewall Manager is Unix time in seconds. However, any valid timestamp format is allowed.

  • :end_time (Time, DateTime, Date, Integer, String) —

    The end of the time period to query for the attacks. This is a timestamp type. The sample request above indicates a number type because the default used by AWS Firewall Manager is Unix time in seconds. However, any valid timestamp format is allowed.

  • :next_token (String) —

    If you specify a value for MaxResults and you have more objects than the number that you specify for MaxResults, AWS Firewall Manager returns a NextToken value in the response that allows you to list another group of objects. For the second and subsequent GetProtectionStatus requests, specify the value of NextToken from the previous response to get information about another batch of objects.

  • :max_results (Integer) —

    Specifies the number of objects that you want AWS Firewall Manager to return for this request. If you have more objects than the number that you specify for MaxResults, the response includes a NextToken value that you can use to get another batch of objects.

Returns:

See Also:



583
584
585
586
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 583

def get_protection_status(params = {}, options = {})
  req = build_request(:get_protection_status, params)
  req.send_request(options)
end

#list_compliance_status(params = {}) ⇒ Types::ListComplianceStatusResponse

Returns an array of PolicyComplianceStatus objects in the response. Use PolicyComplianceStatus to get a summary of which member accounts are protected by the specified policy.

Examples:

Request syntax with placeholder values


resp = client.list_compliance_status({
  policy_id: "PolicyId", # required
  next_token: "PaginationToken",
  max_results: 1,
})

Response structure


resp.policy_compliance_status_list #=> Array
resp.policy_compliance_status_list[0].policy_owner #=> String
resp.policy_compliance_status_list[0].policy_id #=> String
resp.policy_compliance_status_list[0].policy_name #=> String
resp.policy_compliance_status_list[0]. #=> String
resp.policy_compliance_status_list[0].evaluation_results #=> Array
resp.policy_compliance_status_list[0].evaluation_results[0].compliance_status #=> String, one of "COMPLIANT", "NON_COMPLIANT"
resp.policy_compliance_status_list[0].evaluation_results[0].violator_count #=> Integer
resp.policy_compliance_status_list[0].evaluation_results[0].evaluation_limit_exceeded #=> Boolean
resp.policy_compliance_status_list[0].last_updated #=> Time
resp.policy_compliance_status_list[0].issue_info_map #=> Hash
resp.policy_compliance_status_list[0].issue_info_map["DependentServiceName"] #=> String
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Options Hash (params):

  • :policy_id (required, String) —

    The ID of the AWS Firewall Manager policy that you want the details for.

  • :next_token (String) —

    If you specify a value for MaxResults and you have more PolicyComplianceStatus objects than the number that you specify for MaxResults, AWS Firewall Manager returns a NextToken value in the response that allows you to list another group of PolicyComplianceStatus objects. For the second and subsequent ListComplianceStatus requests, specify the value of NextToken from the previous response to get information about another batch of PolicyComplianceStatus objects.

  • :max_results (Integer) —

    Specifies the number of PolicyComplianceStatus objects that you want AWS Firewall Manager to return for this request. If you have more PolicyComplianceStatus objects than the number that you specify for MaxResults, the response includes a NextToken value that you can use to get another batch of PolicyComplianceStatus objects.

Returns:

See Also:



646
647
648
649
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 646

def list_compliance_status(params = {}, options = {})
  req = build_request(:list_compliance_status, params)
  req.send_request(options)
end

#list_member_accounts(params = {}) ⇒ Types::ListMemberAccountsResponse

Returns a MemberAccounts object that lists the member accounts in the administrator's AWS organization.

The ListMemberAccounts must be submitted by the account that is set as the AWS Firewall Manager administrator.

Examples:

Request syntax with placeholder values


resp = client.list_member_accounts({
  next_token: "PaginationToken",
  max_results: 1,
})

Response structure


resp.member_accounts #=> Array
resp.member_accounts[0] #=> String
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Options Hash (params):

  • :next_token (String) —

    If you specify a value for MaxResults and you have more account IDs than the number that you specify for MaxResults, AWS Firewall Manager returns a NextToken value in the response that allows you to list another group of IDs. For the second and subsequent ListMemberAccountsRequest requests, specify the value of NextToken from the previous response to get information about another batch of member account IDs.

  • :max_results (Integer) —

    Specifies the number of member account IDs that you want AWS Firewall Manager to return for this request. If you have more IDs than the number that you specify for MaxResults, the response includes a NextToken value that you can use to get another batch of member account IDs.

Returns:

See Also:



695
696
697
698
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 695

def list_member_accounts(params = {}, options = {})
  req = build_request(:list_member_accounts, params)
  req.send_request(options)
end

#list_policies(params = {}) ⇒ Types::ListPoliciesResponse

Returns an array of PolicySummary objects in the response.

Examples:

Request syntax with placeholder values


resp = client.list_policies({
  next_token: "PaginationToken",
  max_results: 1,
})

Response structure


resp.policy_list #=> Array
resp.policy_list[0].policy_arn #=> String
resp.policy_list[0].policy_id #=> String
resp.policy_list[0].policy_name #=> String
resp.policy_list[0].resource_type #=> String
resp.policy_list[0].security_service_type #=> String, one of "WAF", "SHIELD_ADVANCED"
resp.policy_list[0].remediation_enabled #=> Boolean
resp.next_token #=> String

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Options Hash (params):

  • :next_token (String) —

    If you specify a value for MaxResults and you have more PolicySummary objects than the number that you specify for MaxResults, AWS Firewall Manager returns a NextToken value in the response that allows you to list another group of PolicySummary objects. For the second and subsequent ListPolicies requests, specify the value of NextToken from the previous response to get information about another batch of PolicySummary objects.

  • :max_results (Integer) —

    Specifies the number of PolicySummary objects that you want AWS Firewall Manager to return for this request. If you have more PolicySummary objects than the number that you specify for MaxResults, the response includes a NextToken value that you can use to get another batch of PolicySummary objects.

Returns:

See Also:



745
746
747
748
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 745

def list_policies(params = {}, options = {})
  req = build_request(:list_policies, params)
  req.send_request(options)
end

#put_notification_channel(params = {}) ⇒ Struct

Designates the IAM role and Amazon Simple Notification Service (SNS) topic that AWS Firewall Manager uses to record SNS logs.

Examples:

Request syntax with placeholder values


resp = client.put_notification_channel({
  sns_topic_arn: "ResourceArn", # required
  sns_role_name: "ResourceArn", # required
})

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Options Hash (params):

  • :sns_topic_arn (required, String) —

    The Amazon Resource Name (ARN) of the SNS topic that collects notifications from AWS Firewall Manager.

  • :sns_role_name (required, String) —

    The Amazon Resource Name (ARN) of the IAM role that allows Amazon SNS to record AWS Firewall Manager activity.

Returns:

  • (Struct) —

    Returns an empty response.

See Also:



774
775
776
777
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 774

def put_notification_channel(params = {}, options = {})
  req = build_request(:put_notification_channel, params)
  req.send_request(options)
end

#put_policy(params = {}) ⇒ Types::PutPolicyResponse

Creates an AWS Firewall Manager policy.

Firewall Manager provides two types of policies: A Shield Advanced policy, which applies Shield Advanced protection to specified accounts and resources, or a WAF policy, which contains a rule group and defines which resources are to be protected by that rule group. A policy is specific to either WAF or Shield Advanced. If you want to enforce both WAF rules and Shield Advanced protection across accounts, you can create multiple policies. You can create one or more policies for WAF rules, and one or more policies for Shield Advanced.

You must be subscribed to Shield Advanced to create a Shield Advanced policy. For more information on subscribing to Shield Advanced, see CreateSubscription.

Examples:

Request syntax with placeholder values


resp = client.put_policy({
  policy: { # required
    policy_id: "PolicyId",
    policy_name: "ResourceName", # required
    policy_update_token: "PolicyUpdateToken",
    security_service_policy_data: { # required
      type: "WAF", # required, accepts WAF, SHIELD_ADVANCED
      managed_service_data: "ManagedServiceData",
    },
    resource_type: "ResourceType", # required
    resource_type_list: ["ResourceType"],
    resource_tags: [
      {
        key: "TagKey", # required
        value: "TagValue",
      },
    ],
    exclude_resource_tags: false, # required
    remediation_enabled: false, # required
    include_map: {
      "ACCOUNT" => ["CustomerPolicyScopeId"],
    },
    exclude_map: {
      "ACCOUNT" => ["CustomerPolicyScopeId"],
    },
  },
})

Response structure


resp.policy.policy_id #=> String
resp.policy.policy_name #=> String
resp.policy.policy_update_token #=> String
resp.policy.security_service_policy_data.type #=> String, one of "WAF", "SHIELD_ADVANCED"
resp.policy.security_service_policy_data.managed_service_data #=> String
resp.policy.resource_type #=> String
resp.policy.resource_type_list #=> Array
resp.policy.resource_type_list[0] #=> String
resp.policy.resource_tags #=> Array
resp.policy.resource_tags[0].key #=> String
resp.policy.resource_tags[0].value #=> String
resp.policy.exclude_resource_tags #=> Boolean
resp.policy.remediation_enabled #=> Boolean
resp.policy.include_map #=> Hash
resp.policy.include_map["CustomerPolicyScopeIdType"] #=> Array
resp.policy.include_map["CustomerPolicyScopeIdType"][0] #=> String
resp.policy.exclude_map #=> Hash
resp.policy.exclude_map["CustomerPolicyScopeIdType"] #=> Array
resp.policy.exclude_map["CustomerPolicyScopeIdType"][0] #=> String
resp.policy_arn #=> String

Parameters:

  • params (Hash) (defaults to: {}) —

    ({})

Options Hash (params):

  • :policy (required, Types::Policy) —

    The details of the AWS Firewall Manager policy to be created.

Returns:

See Also:



863
864
865
866
 
# File 'gems/aws-sdk-fms/lib/aws-sdk-fms/client.rb', line 863

def put_policy(params = {}, options = {})
  req = build_request(:put_policy, params)
  req.send_request(options)
end