policies

Creates, updates, deletes, gets or lists a policies resource.

Overview

Name	policies
Type	Resource
Id	aws.fms.policies

Fields

The following fields are returned by SELECT queries:

get_policy

Name	Datatype	Description
policy	object	Information about the specified Firewall Manager policy.
policy_arn	string	The Amazon Resource Name (ARN) of the specified policy. (pattern: <code>^([\p{L}\p{Z}\p{N}_.:/=+-@]*)$</code>)

list_policies

Name	Datatype	Description
delete_unused_fm_managed_resources	boolean	Indicates whether Firewall Manager should automatically remove protections from resources that leave the policy scope and clean up resources that Firewall Manager is managing for accounts when those accounts leave policy scope. For example, Firewall Manager will disassociate a Firewall Manager managed web ACL from a protected customer resource when the customer resource leaves policy scope. By default, Firewall Manager doesn't remove protections or delete Firewall Manager managed resources. This option is not available for Shield Advanced or WAF Classic policies.
policy_arn	string	The Amazon Resource Name (ARN) of the specified policy. (pattern: <code>^([\p{L}\p{Z}\p{N}_.:/=+-@]*)$</code>)
policy_id	string	The ID of the specified policy. (pattern: <code>^[a-z0-9A-Z-]{36}$</code>)
policy_name	string	The name of the specified policy. (pattern: <code>^([\p{L}\p{Z}\p{N}_.:/=+-@]*)$</code>)
policy_status	string	Indicates whether the policy is in or out of an admin's policy or Region scope. ACTIVE - The administrator can manage and delete the policy. OUT_OF_ADMIN_SCOPE - The administrator can view the policy, but they can't edit or delete the policy. Existing policy protections stay in place. Any new resources that come into scope of the policy won't be protected. (ACTIVE, OUT_OF_ADMIN_SCOPE)
remediation_enabled	boolean	Indicates if the policy should be automatically applied to new resources.
resource_type	string	The type of resource protected by or in scope of the policy. This is in the format shown in the Amazon Web Services Resource Types Reference. (pattern: <code>^([\p{L}\p{Z}\p{N}_.:/=+-@]*)$</code>)
security_service_type	string	The service that the policy is using to protect the resources. This specifies the type of policy that is created, either an WAF policy, a Shield Advanced policy, or a security group policy. (WAF, WAFV2, SHIELD_ADVANCED, SECURITY_GROUPS_COMMON, SECURITY_GROUPS_CONTENT_AUDIT, SECURITY_GROUPS_USAGE_AUDIT, NETWORK_FIREWALL, DNS_FIREWALL, THIRD_PARTY_FIREWALL, IMPORT_NETWORK_FIREWALL, NETWORK_ACL_COMMON)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_policy	select	region		Returns information about the specified Firewall Manager policy.
list_policies	select	region		Returns an array of PolicySummary objects.
put_policy	replace	region		Creates an Firewall Manager policy. A Firewall Manager policy is specific to the individual policy type. If you want to enforce multiple policy types across accounts, you can create multiple policies. You can create more than one policy for each type. If you add a new account to an organization that you created with Organizations, Firewall Manager automatically applies the policy to the resources in that account that are within scope of the policy. Firewall Manager provides the following types of policies: WAF policy - This policy applies WAF web ACL protections to specified accounts and resources. Shield Advanced policy - This policy applies Shield Advanced protection to specified accounts and resources. Security Groups policy - This type of policy gives you control over security groups that are in use throughout your organization in Organizations and lets you enforce a baseline set of rules across your organization. Network ACL policy - This type of policy gives you control over the network ACLs that are in use throughout your organization in Organizations and lets you enforce a baseline set of first and last network ACL rules across your organization. Network Firewall policy - This policy applies Network Firewall protection to your organization's VPCs. DNS Firewall policy - This policy applies Amazon Route 53 Resolver DNS Firewall protections to your organization's VPCs. Third-party firewall policy - This policy applies third-party firewall protections. Third-party firewalls are available by subscription through the Amazon Web Services Marketplace console at Amazon Web Services Marketplace. Palo Alto Networks Cloud NGFW policy - This policy applies Palo Alto Networks Cloud Next Generation Firewall (NGFW) protections and Palo Alto Networks Cloud NGFW rulestacks to your organization's VPCs. Fortigate CNF policy - This policy applies Fortigate Cloud Native Firewall (CNF) protections. Fortigate CNF is a cloud-centered solution that blocks Zero-Day threats and secures cloud infrastructures with industry-leading advanced threat prevention, smart web application firewalls (WAF), and API protection.
delete_policy	delete	region		Permanently deletes an Firewall Manager policy.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

get_policy

Returns information about the specified Firewall Manager policy.

SELECT
policy,
policy_arn
FROM aws.fms.policies
WHERE region = '{{ region }}' -- required
;

list_policies

Returns an array of PolicySummary objects.

SELECT
delete_unused_fm_managed_resources,
policy_arn,
policy_id,
policy_name,
policy_status,
remediation_enabled,
resource_type,
security_service_type
FROM aws.fms.policies
WHERE region = '{{ region }}' -- required
;

REPLACE examples

put_policy

Creates an Firewall Manager policy. A Firewall Manager policy is specific to the individual policy type. If you want to enforce multiple policy types across accounts, you can create multiple policies. You can create more than one policy for each type. If you add a new account to an organization that you created with Organizations, Firewall Manager automatically applies the policy to the resources in that account that are within scope of the policy. Firewall Manager provides the following types of policies: WAF policy - This policy applies WAF web ACL protections to specified accounts and resources. Shield Advanced policy - This policy applies Shield Advanced protection to specified accounts and resources. Security Groups policy - This type of policy gives you control over security groups that are in use throughout your organization in Organizations and lets you enforce a baseline set of rules across your organization. Network ACL policy - This type of policy gives you control over the network ACLs that are in use throughout your organization in Organizations and lets you enforce a baseline set of first and last network ACL rules across your organization. Network Firewall policy - This policy applies Network Firewall protection to your organization's VPCs. DNS Firewall policy - This policy applies Amazon Route 53 Resolver DNS Firewall protections to your organization's VPCs. Third-party firewall policy - This policy applies third-party firewall protections. Third-party firewalls are available by subscription through the Amazon Web Services Marketplace console at Amazon Web Services Marketplace. Palo Alto Networks Cloud NGFW policy - This policy applies Palo Alto Networks Cloud Next Generation Firewall (NGFW) protections and Palo Alto Networks Cloud NGFW rulestacks to your organization's VPCs. Fortigate CNF policy - This policy applies Fortigate Cloud Native Firewall (CNF) protections. Fortigate CNF is a cloud-centered solution that blocks Zero-Day threats and secures cloud infrastructures with industry-leading advanced threat prevention, smart web application firewalls (WAF), and API protection.

REPLACE aws.fms.policies
SET 
Policy = '{{ Policy }}',
TagList = '{{ TagList }}'
WHERE 
region = '{{ region }}' --required
RETURNING
policy,
policy_arn;

DELETE examples

delete_policy

Permanently deletes an Firewall Manager policy.

DELETE FROM aws.fms.policies
WHERE region = '{{ region }}' --required
;