Skip to content

Commit f029d2d

Browse files
author
AWS
committed
Firewall Management Service Update: Added Firewall Manager policy support for AWS Route 53 Resolver DNS Firewall.
1 parent 0214c27 commit f029d2d

File tree

2 files changed

+95
-2
lines changed

2 files changed

+95
-2
lines changed

‎.changes/next-release/feature-FirewallManagementService-5336ae7.json

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
{
2+
"type": "feature",
3+
"category": "Firewall Management Service",
4+
"contributor": "",
5+
"description": "Added Firewall Manager policy support for AWS Route 53 Resolver DNS Firewall."
6+
}

‎services/fms/src/main/resources/codegen-resources/service-2.json

Lines changed: 89 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -585,6 +585,11 @@
585585
},
586586
"documentation":"<p>Details of the rule violation in a security group when compared to the master security group of the AWS Firewall Manager policy.</p>"
587587
},
588+
"BasicInteger":{
589+
"type":"integer",
590+
"max":2147483647,
591+
"min":-2147483648
592+
},
588593
"Boolean":{"type":"boolean"},
589594
"CIDR":{
590595
"type":"string",
@@ -695,6 +700,73 @@
695700
"members":{
696701
}
697702
},
703+
"DnsDuplicateRuleGroupViolation":{
704+
"type":"structure",
705+
"members":{
706+
"ViolationTarget":{
707+
"shape":"ViolationTarget",
708+
"documentation":"<p>The ID of the VPC. </p>"
709+
},
710+
"ViolationTargetDescription":{
711+
"shape":"LengthBoundedString",
712+
"documentation":"<p>A description of the violation that specifies the rule group and VPC.</p>"
713+
}
714+
},
715+
"documentation":"<p>A DNS Firewall rule group that Firewall Manager tried to associate with a VPC is already associated with the VPC and can't be associated again. </p>"
716+
},
717+
"DnsRuleGroupLimitExceededViolation":{
718+
"type":"structure",
719+
"members":{
720+
"ViolationTarget":{
721+
"shape":"ViolationTarget",
722+
"documentation":"<p>The ID of the VPC. </p>"
723+
},
724+
"ViolationTargetDescription":{
725+
"shape":"LengthBoundedString",
726+
"documentation":"<p>A description of the violation that specifies the rule group and VPC.</p>"
727+
},
728+
"NumberOfRuleGroupsAlreadyAssociated":{
729+
"shape":"BasicInteger",
730+
"documentation":"<p>The number of rule groups currently associated with the VPC. </p>"
731+
}
732+
},
733+
"documentation":"<p>The VPC that Firewall Manager was applying a DNS Fireall policy to reached the limit for associated DNS Firewall rule groups. Firewall Manager tried to associate another rule group with the VPC and failed due to the limit. </p>"
734+
},
735+
"DnsRuleGroupPriorities":{
736+
"type":"list",
737+
"member":{"shape":"DnsRuleGroupPriority"}
738+
},
739+
"DnsRuleGroupPriority":{
740+
"type":"integer",
741+
"max":10000,
742+
"min":0
743+
},
744+
"DnsRuleGroupPriorityConflictViolation":{
745+
"type":"structure",
746+
"members":{
747+
"ViolationTarget":{
748+
"shape":"ViolationTarget",
749+
"documentation":"<p>The ID of the VPC. </p>"
750+
},
751+
"ViolationTargetDescription":{
752+
"shape":"LengthBoundedString",
753+
"documentation":"<p>A description of the violation that specifies the VPC and the rule group that's already associated with it.</p>"
754+
},
755+
"ConflictingPriority":{
756+
"shape":"DnsRuleGroupPriority",
757+
"documentation":"<p>The priority setting of the two conflicting rule groups.</p>"
758+
},
759+
"ConflictingPolicyId":{
760+
"shape":"PolicyId",
761+
"documentation":"<p>The ID of the Firewall Manager DNS Firewall policy that was already applied to the VPC. This policy contains the rule group that's already associated with the VPC. </p>"
762+
},
763+
"UnavailablePriorities":{
764+
"shape":"DnsRuleGroupPriorities",
765+
"documentation":"<p>The priorities of rule groups that are already associated with the VPC. To retry your operation, choose priority settings that aren't in this list for the rule groups in your new DNS Firewall policy. </p>"
766+
}
767+
},
768+
"documentation":"<p>A rule group that Firewall Manager tried to associate with a VPC has the same priority as a rule group that's already associated. </p>"
769+
},
698770
"ErrorMessage":{"type":"string"},
699771
"EvaluationResult":{
700772
"type":"structure",
@@ -1829,6 +1901,18 @@
18291901
"NetworkFirewallPolicyModifiedViolation":{
18301902
"shape":"NetworkFirewallPolicyModifiedViolation",
18311903
"documentation":"<p>Violation detail for an Network Firewall policy that indicates that a firewall policy in an individual account has been modified in a way that makes it noncompliant. For example, the individual account owner might have deleted a rule group, changed the priority of a stateless rule group, or changed a policy default action.</p>"
1904+
},
1905+
"DnsRuleGroupPriorityConflictViolation":{
1906+
"shape":"DnsRuleGroupPriorityConflictViolation",
1907+
"documentation":"<p>Violation detail for a DNS Firewall policy that indicates that a rule group that Firewall Manager tried to associate with a VPC has the same priority as a rule group that's already associated. </p>"
1908+
},
1909+
"DnsDuplicateRuleGroupViolation":{
1910+
"shape":"DnsDuplicateRuleGroupViolation",
1911+
"documentation":"<p>Violation detail for a DNS Firewall policy that indicates that a rule group that Firewall Manager tried to associate with a VPC is already associated with the VPC and can't be associated again. </p>"
1912+
},
1913+
"DnsRuleGroupLimitExceededViolation":{
1914+
"shape":"DnsRuleGroupLimitExceededViolation",
1915+
"documentation":"<p>Violation details for a DNS Firewall policy that indicates that the VPC reached the limit for associated DNS Firewall rule groups. Firewall Manager tried to associate another rule group with the VPC and failed. </p>"
18321916
}
18331917
},
18341918
"documentation":"<p>Violation detail based on resource type.</p>"
@@ -1917,7 +2001,8 @@
19172001
"SECURITY_GROUPS_COMMON",
19182002
"SECURITY_GROUPS_CONTENT_AUDIT",
19192003
"SECURITY_GROUPS_USAGE_AUDIT",
1920-
"NETWORK_FIREWALL"
2004+
"NETWORK_FIREWALL",
2005+
"DNS_FIREWALL"
19212006
]
19222007
},
19232008
"StatefulRuleGroup":{
@@ -2121,10 +2206,12 @@
21212206
"RESOURCE_VIOLATES_AUDIT_SECURITY_GROUP",
21222207
"SECURITY_GROUP_UNUSED",
21232208
"SECURITY_GROUP_REDUNDANT",
2209+
"FMS_CREATED_SECURITY_GROUP_EDITED",
21242210
"MISSING_FIREWALL",
21252211
"MISSING_FIREWALL_SUBNET_IN_AZ",
21262212
"MISSING_EXPECTED_ROUTE_TABLE",
2127-
"NETWORK_FIREWALL_POLICY_MODIFIED"
2213+
"NETWORK_FIREWALL_POLICY_MODIFIED",
2214+
"RESOURCE_MISSING_DNS_FIREWALL"
21282215
]
21292216
},
21302217
"ViolationTarget":{

0 commit comments

Comments
 (0)