ip_sets

Creates, updates, deletes, gets or lists an ip_sets resource.

Overview

Name	ip_sets
Type	Resource
Id	aws.guardduty.ip_sets

Fields

The following fields are returned by SELECT queries:

get_ip_set

Name	Datatype	Description
expected_bucket_owner	string	The Amazon Web Services account ID that owns the Amazon S3 bucket specified in the location parameter. This field appears in the response only if it was provided during IPSet creation or update.
format	string	The format of the file that contains the IPSet. (TXT, STIX, OTX_CSV, ALIEN_VAULT, PROOF_POINT, FIRE_EYE)
location	string	The URI of the file that contains the IPSet.
name	string	The user-friendly name for the IPSet.
status	string	The status of IPSet file that was uploaded. (INACTIVE, ACTIVATING, ACTIVE, DEACTIVATING, ERROR, DELETE_PENDING, DELETED)
tags	object	The tags of the IPSet resource.

list_ip_sets

Name	Datatype	Description
ip_set_id	string	The IDs of the IPSet resources.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get_ip_set	select	detector_id, ip_set_id, region		Retrieves the IPSet specified by the ipSetId.
list_ip_sets	select	detector_id, region	maxResults, nextToken	Lists the IPSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the IPSets returned are the IPSets from the associated administrator account.
create_ip_set	insert	detector_id, region, Activate		Creates a new IPSet, which is called a trusted IP list in the console user interface. An IPSet is a list of IP addresses that are trusted for secure communication with Amazon Web Services infrastructure and applications. GuardDuty doesn't generate findings for IP addresses that are included in IPSets. Only users from the administrator account can use this operation.
update_ip_set	update	detector_id, ip_set_id, region		Updates the IPSet specified by the IPSet ID.
delete_ip_set	delete	detector_id, ip_set_id, region		Deletes the IPSet specified by the ipSetId. IPSets are called trusted IP lists in the console user interface.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
detector_id	string	The unique ID of the detector associated with the IPSet. To find the detectorId in the current Region, see the Settings page in the GuardDuty console, or run the ListDetectors API.
ip_set_id	string	The unique ID of the IPSet to delete.
region	string	AWS region (default: us-east-1)
maxResults	integer	You can use this parameter to indicate the maximum number of items you want in the response. The default value is 50. The maximum value is 50.
nextToken	string	You can use this parameter when paginating results. Set the value of this parameter to null on your first call to the list action. For subsequent calls to the action, fill nextToken in the request with the value of NextToken from the previous response to continue listing data.

SELECT examples

get_ip_set

Retrieves the IPSet specified by the ipSetId.

SELECT
expected_bucket_owner,
format,
location,
name,
status,
tags
FROM aws.guardduty.ip_sets
WHERE detector_id = '{{ detector_id }}' -- required
AND ip_set_id = '{{ ip_set_id }}' -- required
AND region = '{{ region }}' -- required
;

list_ip_sets

Lists the IPSets of the GuardDuty service specified by the detector ID. If you use this operation from a member account, the IPSets returned are the IPSets from the associated administrator account.

SELECT
ip_set_id
FROM aws.guardduty.ip_sets
WHERE detector_id = '{{ detector_id }}' -- required
AND region = '{{ region }}' -- required
AND maxResults = '{{ maxResults }}'
AND nextToken = '{{ nextToken }}'
;

INSERT examples

create_ip_set

Creates a new IPSet, which is called a trusted IP list in the console user interface. An IPSet is a list of IP addresses that are trusted for secure communication with Amazon Web Services infrastructure and applications. GuardDuty doesn't generate findings for IP addresses that are included in IPSets. Only users from the administrator account can use this operation.

INSERT INTO aws.guardduty.ip_sets (
Name,
Format,
Location,
Activate,
ClientToken,
Tags,
ExpectedBucketOwner,
detector_id,
region
)
SELECT 
'{{ Name }}',
'{{ Format }}',
'{{ Location }}',
{{ Activate }} /* required */,
'{{ ClientToken }}',
'{{ Tags }}',
'{{ ExpectedBucketOwner }}',
'{{ detector_id }}',
'{{ region }}'
RETURNING
ip_set_id
;

Manifest

# Description fields are for documentation purposes
- name: ip_sets
props:
  - name: detector_id
    value: "{{ detector_id }}"
    description: Required parameter for the ip_sets resource.
  - name: region
    value: "{{ region }}"
    description: Required parameter for the ip_sets resource.
  - name: Name
    value: "{{ Name }}"
  - name: Format
    value: "{{ Format }}"
    valid_values: ['TXT', 'STIX', 'OTX_CSV', 'ALIEN_VAULT', 'PROOF_POINT', 'FIRE_EYE']
  - name: Location
    value: "{{ Location }}"
  - name: Activate
    value: {{ Activate }}
  - name: ClientToken
    value: "{{ ClientToken }}"
  - name: Tags
    value: "{{ Tags }}"
  - name: ExpectedBucketOwner
    value: "{{ ExpectedBucketOwner }}"

UPDATE examples

update_ip_set

Updates the IPSet specified by the IPSet ID.

UPDATE aws.guardduty.ip_sets
SET 
Name = '{{ Name }}',
Location = '{{ Location }}',
Activate = {{ Activate }},
ExpectedBucketOwner = '{{ ExpectedBucketOwner }}'
WHERE 
detector_id = '{{ detector_id }}' --required
AND ip_set_id = '{{ ip_set_id }}' --required
AND region = '{{ region }}' --required;

DELETE examples

delete_ip_set

Deletes the IPSet specified by the ipSetId. IPSets are called trusted IP lists in the console user interface.

DELETE FROM aws.guardduty.ip_sets
WHERE detector_id = '{{ detector_id }}' --required
AND ip_set_id = '{{ ip_set_id }}' --required
AND region = '{{ region }}' --required
;