container_associations

Creates, updates, deletes, gets or lists a container_associations resource.

Overview

Name	container_associations
Type	Resource
Id	aws.network_firewall.container_associations

Fields

The following fields are returned by SELECT queries:

describe_container_association

Name	Datatype	Description
container_association_arn	string	The Amazon Resource Name (ARN) of the container association. (pattern: <code>^arn:aws.*</code>)
container_association_name	string	The descriptive name of the container association. (pattern: <code>^[a-zA-Z0-9-]+$</code>)
container_monitoring_configurations	array	The monitoring configurations for the container association.
description	string	A description of the container association. (pattern: <code>^.*$</code>)
last_updated_time	string (date-time)	The most recent time that Network Firewall updated the container association.
resolved_cidr_count	integer	The number of CIDR blocks resolved from the monitored containers.
status	string	The current status of the container association. (ACTIVE, CREATING, DELETING, UPDATING)
tags	array	The key:value pairs to associate with the resource.
type	string	The container type. Valid values: ECS - Amazon Elastic Container Service EKS - Amazon Elastic Kubernetes Service (ECS, EKS)
update_token	string	A token used for optimistic locking. Network Firewall returns a token to your requests that access the container association. The token marks the state of the container association resource at the time of the request. To make changes to the container association, you provide the token in your request. Network Firewall uses the token to ensure that the container association hasn't changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the container association again to get a current copy of it with a current token. Reapply your changes as needed, then try the operation again using the new token. (pattern: <code>^([0-9a-f]{8})-([0-9a-f]{4}-){3}([0-9a-f]{12})$</code>)

list_container_associations

Name	Datatype	Description
arn	string	The Amazon Resource Name (ARN) of the container association. (pattern: <code>^arn:aws.*</code>)
name	string	The descriptive name of the container association. (pattern: <code>^[a-zA-Z0-9-]+$</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_container_association	select	region		Retrieves the configuration and status of a container association.
list_container_associations	select	region		Lists the container associations in your account and Region. Use the NextToken parameter in subsequent requests to retrieve additional results.
create_container_association	insert	region, ContainerAssociationName, ContainerMonitoringConfigurations		Creates a Network Firewall container association. The association monitors container lifecycle events in your Amazon ECS or Amazon EKS clusters and resolves running container addresses for use in firewall rules.
update_container_association	update	region, ContainerMonitoringConfigurations, UpdateToken		Updates the monitoring configurations and description of a container association. You can't change the container type after creation. Provide an update token to enable optimistic concurrency control.
delete_container_association	delete	region		Deletes a container association. The resource transitions to a DELETING state. Deletion is asynchronous - Network Firewall returns immediately while cleanup proceeds in the background. You can't delete a container association while a rule group references it.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_container_association

Retrieves the configuration and status of a container association.

SELECT
container_association_arn,
container_association_name,
container_monitoring_configurations,
description,
last_updated_time,
resolved_cidr_count,
status,
tags,
type,
update_token
FROM aws.network_firewall.container_associations
WHERE region = '{{ region }}' -- required
;

list_container_associations

Lists the container associations in your account and Region. Use the NextToken parameter in subsequent requests to retrieve additional results.

SELECT
arn,
name
FROM aws.network_firewall.container_associations
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_container_association

Creates a Network Firewall container association. The association monitors container lifecycle events in your Amazon ECS or Amazon EKS clusters and resolves running container addresses for use in firewall rules.

INSERT INTO aws.network_firewall.container_associations (
ContainerAssociationName,
Description,
Type,
ContainerMonitoringConfigurations,
Tags,
region
)
SELECT 
'{{ ContainerAssociationName }}' /* required */,
'{{ Description }}',
'{{ Type }}',
'{{ ContainerMonitoringConfigurations }}' /* required */,
'{{ Tags }}',
'{{ region }}'
RETURNING
container_association_arn,
container_association_name,
container_monitoring_configurations,
description,
status,
tags,
type,
update_token
;

Manifest

# Description fields are for documentation purposes
- name: container_associations
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the container_associations resource.
  - name: ContainerAssociationName
    value: "{{ ContainerAssociationName }}"
    description: |
      The descriptive name of the container association. You can't change the name of a container association after you create it.
  - name: Description
    value: "{{ Description }}"
    description: |
      A description of the container association.
  - name: Type
    value: "{{ Type }}"
    description: |
      The type of containers to monitor. You can't change the container type after creation. Valid values: ECS - Amazon Elastic Container Service EKS - Amazon Elastic Kubernetes Service
    valid_values: ['ECS', 'EKS']
  - name: ContainerMonitoringConfigurations
    description: |
      The monitoring configurations for the container association. Each configuration specifies an Amazon ECS or Amazon EKS cluster to monitor and optional attribute filters to narrow which containers are tracked.
    value:
      - ClusterArn: "{{ ClusterArn }}"
        AttributeFilters: "{{ AttributeFilters }}"
  - name: Tags
    description: |
      The key:value pairs to associate with the resource.
    value:
      - Key: "{{ Key }}"
        Value: "{{ Value }}"

UPDATE examples

update_container_association

Updates the monitoring configurations and description of a container association. You can't change the container type after creation. Provide an update token to enable optimistic concurrency control.

UPDATE aws.network_firewall.container_associations
SET 
ContainerAssociationName = '{{ ContainerAssociationName }}',
ContainerAssociationArn = '{{ ContainerAssociationArn }}',
Description = '{{ Description }}',
Type = '{{ Type }}',
ContainerMonitoringConfigurations = '{{ ContainerMonitoringConfigurations }}',
Tags = '{{ Tags }}',
UpdateToken = '{{ UpdateToken }}'
WHERE 
region = '{{ region }}' --required
AND ContainerMonitoringConfigurations = '{{ ContainerMonitoringConfigurations }}' --required
AND UpdateToken = '{{ UpdateToken }}' --required
RETURNING
container_association_arn,
container_association_name,
container_monitoring_configurations,
description,
status,
tags,
type,
update_token;

DELETE examples

delete_container_association

Deletes a container association. The resource transitions to a DELETING state. Deletion is asynchronous - Network Firewall returns immediately while cleanup proceeds in the background. You can't delete a container association while a rule group references it.

DELETE FROM aws.network_firewall.container_associations
WHERE region = '{{ region }}' --required
;