Skip to content

Commit 75febc1

Browse files
author
awstools
committed
feat(client-fms): AWS Firewall Manager adds support for network ACL policies to manage Amazon Virtual Private Cloud (VPC) network access control lists (ACLs) for accounts in your organization.
1 parent c7872e2 commit 75febc1

11 files changed

+1451
-125
lines changed

‎clients/client-fms/src/commands/GetAdminScopeCommand.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ export interface GetAdminScopeCommandInput extends GetAdminScopeRequest {}
2727
export interface GetAdminScopeCommandOutput extends GetAdminScopeResponse, __MetadataBearer {}
2828

2929
/**
30-
* <p>Returns information about the specified account's administrative scope. The admistrative scope defines the resources that an Firewall Manager administrator can manage.</p>
30+
* <p>Returns information about the specified account's administrative scope. The administrative scope defines the resources that an Firewall Manager administrator can manage.</p>
3131
* @example
3232
* Use a bare-bones client and the command you need to make an API call.
3333
* ```javascript
@@ -63,7 +63,7 @@ export interface GetAdminScopeCommandOutput extends GetAdminScopeResponse, __Met
6363
* // },
6464
* // PolicyTypeScope: { // PolicyTypeScope
6565
* // PolicyTypes: [ // SecurityServiceTypeList
66-
* // "WAF" || "WAFV2" || "SHIELD_ADVANCED" || "SECURITY_GROUPS_COMMON" || "SECURITY_GROUPS_CONTENT_AUDIT" || "SECURITY_GROUPS_USAGE_AUDIT" || "NETWORK_FIREWALL" || "DNS_FIREWALL" || "THIRD_PARTY_FIREWALL" || "IMPORT_NETWORK_FIREWALL",
66+
* // "WAF" || "WAFV2" || "SHIELD_ADVANCED" || "SECURITY_GROUPS_COMMON" || "SECURITY_GROUPS_CONTENT_AUDIT" || "SECURITY_GROUPS_USAGE_AUDIT" || "NETWORK_FIREWALL" || "DNS_FIREWALL" || "THIRD_PARTY_FIREWALL" || "IMPORT_NETWORK_FIREWALL" || "NETWORK_ACL_COMMON",
6767
* // ],
6868
* // AllPolicyTypesEnabled: true || false,
6969
* // },

‎clients/client-fms/src/commands/GetComplianceDetailCommand.ts

Lines changed: 2 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -29,28 +29,7 @@ export interface GetComplianceDetailCommandOutput extends GetComplianceDetailRes
2929
/**
3030
* <p>Returns detailed compliance information about the specified member account. Details
3131
* include resources that are in and out of compliance with the specified policy. </p>
32-
* <ul>
33-
* <li>
34-
* <p>Resources are
35-
* considered noncompliant for WAF and Shield Advanced policies if the specified policy has
36-
* not been applied to them.</p>
37-
* </li>
38-
* <li>
39-
* <p>Resources are considered noncompliant for security group policies if
40-
* they are in scope of the policy, they violate one or more of the policy rules, and remediation
41-
* is disabled or not possible.</p>
42-
* </li>
43-
* <li>
44-
* <p>Resources are considered noncompliant for Network Firewall policies
45-
* if a firewall is missing in the VPC, if the firewall endpoint isn't set up in an expected Availability Zone and subnet,
46-
* if a subnet created by the Firewall Manager doesn't have the expected route table,
47-
* and for modifications to a firewall policy that violate the Firewall Manager policy's rules.</p>
48-
* </li>
49-
* <li>
50-
* <p>Resources are considered noncompliant for DNS Firewall policies
51-
* if a DNS Firewall rule group is missing from the rule group associations for the VPC. </p>
52-
* </li>
53-
* </ul>
32+
* <p>The reasons for resources being considered compliant depend on the Firewall Manager policy type. </p>
5433
* @example
5534
* Use a bare-bones client and the command you need to make an API call.
5635
* ```javascript
@@ -71,7 +50,7 @@ export interface GetComplianceDetailCommandOutput extends GetComplianceDetailRes
7150
* // Violators: [ // ComplianceViolators
7251
* // { // ComplianceViolator
7352
* // ResourceId: "STRING_VALUE",
74-
* // ViolationReason: "WEB_ACL_MISSING_RULE_GROUP" || "RESOURCE_MISSING_WEB_ACL" || "RESOURCE_INCORRECT_WEB_ACL" || "RESOURCE_MISSING_SHIELD_PROTECTION" || "RESOURCE_MISSING_WEB_ACL_OR_SHIELD_PROTECTION" || "RESOURCE_MISSING_SECURITY_GROUP" || "RESOURCE_VIOLATES_AUDIT_SECURITY_GROUP" || "SECURITY_GROUP_UNUSED" || "SECURITY_GROUP_REDUNDANT" || "FMS_CREATED_SECURITY_GROUP_EDITED" || "MISSING_FIREWALL" || "MISSING_FIREWALL_SUBNET_IN_AZ" || "MISSING_EXPECTED_ROUTE_TABLE" || "NETWORK_FIREWALL_POLICY_MODIFIED" || "FIREWALL_SUBNET_IS_OUT_OF_SCOPE" || "INTERNET_GATEWAY_MISSING_EXPECTED_ROUTE" || "FIREWALL_SUBNET_MISSING_EXPECTED_ROUTE" || "UNEXPECTED_FIREWALL_ROUTES" || "UNEXPECTED_TARGET_GATEWAY_ROUTES" || "TRAFFIC_INSPECTION_CROSSES_AZ_BOUNDARY" || "INVALID_ROUTE_CONFIGURATION" || "MISSING_TARGET_GATEWAY" || "INTERNET_TRAFFIC_NOT_INSPECTED" || "BLACK_HOLE_ROUTE_DETECTED" || "BLACK_HOLE_ROUTE_DETECTED_IN_FIREWALL_SUBNET" || "RESOURCE_MISSING_DNS_FIREWALL" || "ROUTE_HAS_OUT_OF_SCOPE_ENDPOINT" || "FIREWALL_SUBNET_MISSING_VPCE_ENDPOINT",
53+
* // ViolationReason: "WEB_ACL_MISSING_RULE_GROUP" || "RESOURCE_MISSING_WEB_ACL" || "RESOURCE_INCORRECT_WEB_ACL" || "RESOURCE_MISSING_SHIELD_PROTECTION" || "RESOURCE_MISSING_WEB_ACL_OR_SHIELD_PROTECTION" || "RESOURCE_MISSING_SECURITY_GROUP" || "RESOURCE_VIOLATES_AUDIT_SECURITY_GROUP" || "SECURITY_GROUP_UNUSED" || "SECURITY_GROUP_REDUNDANT" || "FMS_CREATED_SECURITY_GROUP_EDITED" || "MISSING_FIREWALL" || "MISSING_FIREWALL_SUBNET_IN_AZ" || "MISSING_EXPECTED_ROUTE_TABLE" || "NETWORK_FIREWALL_POLICY_MODIFIED" || "FIREWALL_SUBNET_IS_OUT_OF_SCOPE" || "INTERNET_GATEWAY_MISSING_EXPECTED_ROUTE" || "FIREWALL_SUBNET_MISSING_EXPECTED_ROUTE" || "UNEXPECTED_FIREWALL_ROUTES" || "UNEXPECTED_TARGET_GATEWAY_ROUTES" || "TRAFFIC_INSPECTION_CROSSES_AZ_BOUNDARY" || "INVALID_ROUTE_CONFIGURATION" || "MISSING_TARGET_GATEWAY" || "INTERNET_TRAFFIC_NOT_INSPECTED" || "BLACK_HOLE_ROUTE_DETECTED" || "BLACK_HOLE_ROUTE_DETECTED_IN_FIREWALL_SUBNET" || "RESOURCE_MISSING_DNS_FIREWALL" || "ROUTE_HAS_OUT_OF_SCOPE_ENDPOINT" || "FIREWALL_SUBNET_MISSING_VPCE_ENDPOINT" || "INVALID_NETWORK_ACL_ENTRY",
7554
* // ResourceType: "STRING_VALUE",
7655
* // Metadata: { // ComplianceViolatorMetadata
7756
* // "<keys>": "STRING_VALUE",

‎clients/client-fms/src/commands/GetPolicyCommand.ts

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ export interface GetPolicyCommandOutput extends GetPolicyResponse, __MetadataBea
4545
* // PolicyName: "STRING_VALUE", // required
4646
* // PolicyUpdateToken: "STRING_VALUE",
4747
* // SecurityServicePolicyData: { // SecurityServicePolicyData
48-
* // Type: "WAF" || "WAFV2" || "SHIELD_ADVANCED" || "SECURITY_GROUPS_COMMON" || "SECURITY_GROUPS_CONTENT_AUDIT" || "SECURITY_GROUPS_USAGE_AUDIT" || "NETWORK_FIREWALL" || "DNS_FIREWALL" || "THIRD_PARTY_FIREWALL" || "IMPORT_NETWORK_FIREWALL", // required
48+
* // Type: "WAF" || "WAFV2" || "SHIELD_ADVANCED" || "SECURITY_GROUPS_COMMON" || "SECURITY_GROUPS_CONTENT_AUDIT" || "SECURITY_GROUPS_USAGE_AUDIT" || "NETWORK_FIREWALL" || "DNS_FIREWALL" || "THIRD_PARTY_FIREWALL" || "IMPORT_NETWORK_FIREWALL" || "NETWORK_ACL_COMMON", // required
4949
* // ManagedServiceData: "STRING_VALUE",
5050
* // PolicyOption: { // PolicyOption
5151
* // NetworkFirewallPolicy: { // NetworkFirewallPolicy
@@ -54,6 +54,46 @@ export interface GetPolicyCommandOutput extends GetPolicyResponse, __MetadataBea
5454
* // ThirdPartyFirewallPolicy: { // ThirdPartyFirewallPolicy
5555
* // FirewallDeploymentModel: "CENTRALIZED" || "DISTRIBUTED",
5656
* // },
57+
* // NetworkAclCommonPolicy: { // NetworkAclCommonPolicy
58+
* // NetworkAclEntrySet: { // NetworkAclEntrySet
59+
* // FirstEntries: [ // NetworkAclEntries
60+
* // { // NetworkAclEntry
61+
* // IcmpTypeCode: { // NetworkAclIcmpTypeCode
62+
* // Code: Number("int"),
63+
* // Type: Number("int"),
64+
* // },
65+
* // Protocol: "STRING_VALUE", // required
66+
* // PortRange: { // NetworkAclPortRange
67+
* // From: Number("int"),
68+
* // To: Number("int"),
69+
* // },
70+
* // CidrBlock: "STRING_VALUE",
71+
* // Ipv6CidrBlock: "STRING_VALUE",
72+
* // RuleAction: "allow" || "deny", // required
73+
* // Egress: true || false, // required
74+
* // },
75+
* // ],
76+
* // ForceRemediateForFirstEntries: true || false, // required
77+
* // LastEntries: [
78+
* // {
79+
* // IcmpTypeCode: {
80+
* // Code: Number("int"),
81+
* // Type: Number("int"),
82+
* // },
83+
* // Protocol: "STRING_VALUE", // required
84+
* // PortRange: {
85+
* // From: Number("int"),
86+
* // To: Number("int"),
87+
* // },
88+
* // CidrBlock: "STRING_VALUE",
89+
* // Ipv6CidrBlock: "STRING_VALUE",
90+
* // RuleAction: "allow" || "deny", // required
91+
* // Egress: true || false, // required
92+
* // },
93+
* // ],
94+
* // ForceRemediateForLastEntries: true || false, // required
95+
* // },
96+
* // },
5797
* // },
5898
* // },
5999
* // ResourceType: "STRING_VALUE", // required

‎clients/client-fms/src/commands/GetProtectionStatusCommand.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ export interface GetProtectionStatusCommandOutput extends GetProtectionStatusRes
4747
* const response = await client.send(command);
4848
* // { // GetProtectionStatusResponse
4949
* // AdminAccountId: "STRING_VALUE",
50-
* // ServiceType: "WAF" || "WAFV2" || "SHIELD_ADVANCED" || "SECURITY_GROUPS_COMMON" || "SECURITY_GROUPS_CONTENT_AUDIT" || "SECURITY_GROUPS_USAGE_AUDIT" || "NETWORK_FIREWALL" || "DNS_FIREWALL" || "THIRD_PARTY_FIREWALL" || "IMPORT_NETWORK_FIREWALL",
50+
* // ServiceType: "WAF" || "WAFV2" || "SHIELD_ADVANCED" || "SECURITY_GROUPS_COMMON" || "SECURITY_GROUPS_CONTENT_AUDIT" || "SECURITY_GROUPS_USAGE_AUDIT" || "NETWORK_FIREWALL" || "DNS_FIREWALL" || "THIRD_PARTY_FIREWALL" || "IMPORT_NETWORK_FIREWALL" || "NETWORK_ACL_COMMON",
5151
* // Data: "STRING_VALUE",
5252
* // NextToken: "STRING_VALUE",
5353
* // };

0 commit comments

Comments
 (0)