flow_operations

Creates, updates, deletes, gets or lists a flow_operations resource.

Overview

Name	flow_operations
Type	Resource
Id	aws.network_firewall.flow_operations

Fields

The following fields are returned by SELECT queries:

describe_flow_operation

Name	Datatype	Description
availability_zone	string	The ID of the Availability Zone where the firewall is located. For example, us-east-2a. Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation.
firewall_arn	string	The Amazon Resource Name (ARN) of the firewall. (pattern: <code>^arn:aws.*</code>)
flow_operation	object	Returns key information about a flow operation, such as related statuses, unique identifiers, and all filters defined in the operation.
flow_operation_id	string	A unique identifier for the flow operation. This ID is returned in the responses to start and list commands. You provide to describe commands. (pattern: <code>^([0-9a-f]{8})-([0-9a-f]{4}-){3}([0-9a-f]{12})$</code>)
flow_operation_status	string	Returns the status of the flow operation. This string is returned in the responses to start, list, and describe commands. If the status is COMPLETED_WITH_ERRORS, results may be returned with any number of Flows missing from the response. If the status is FAILED, Flows returned will be empty. (COMPLETED, IN_PROGRESS, FAILED, COMPLETED_WITH_ERRORS)
flow_operation_type	string	Defines the type of FlowOperation. (FLOW_FLUSH, FLOW_CAPTURE)
flow_request_timestamp	string (date-time)	A timestamp indicating when the Suricata engine identified flows impacted by an operation.
status_message	string	If the asynchronous operation fails, Network Firewall populates this with the reason for the error or failure. Options include Flow operation error and Flow timeout. (pattern: <code>^[a-zA-Z0-9- ]+$</code>)
vpc_endpoint_association_arn	string	The Amazon Resource Name (ARN) of a VPC endpoint association. (pattern: <code>^arn:aws.*</code>)
vpc_endpoint_id	string	A unique identifier for the primary endpoint associated with a firewall. (pattern: <code>^vpce-[a-zA-Z0-9]*$</code>)

list_flow_operations

Name	Datatype	Description
flow_operation_id	string	A unique identifier for the flow operation. This ID is returned in the responses to start and list commands. You provide to describe commands. (pattern: <code>^([0-9a-f]{8})-([0-9a-f]{4}-){3}([0-9a-f]{12})$</code>)
flow_operation_status	string	Returns the status of the flow operation. This string is returned in the responses to start, list, and describe commands. If the status is COMPLETED_WITH_ERRORS, results may be returned with any number of Flows missing from the response. If the status is FAILED, Flows returned will be empty. (COMPLETED, IN_PROGRESS, FAILED, COMPLETED_WITH_ERRORS)
flow_operation_type	string	Defines the type of FlowOperation. (FLOW_FLUSH, FLOW_CAPTURE)
flow_request_timestamp	string (date-time)	A timestamp indicating when the Suricata engine identified flows impacted by an operation.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_flow_operation	select	region		Returns key information about a specific flow operation.
list_flow_operations	select	region		Returns a list of all flow operations ran in a specific firewall. You can optionally narrow the request scope by specifying the operation type or Availability Zone associated with a firewall's flow operations. Flow operations let you manage the flows tracked in the flow table, also known as the firewall table. A flow is network traffic that is monitored by a firewall, either by stateful or stateless rules. For traffic to be considered part of a flow, it must share Destination, DestinationPort, Direction, Protocol, Source, and SourcePort.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_flow_operation

Returns key information about a specific flow operation.

SELECT
availability_zone,
firewall_arn,
flow_operation,
flow_operation_id,
flow_operation_status,
flow_operation_type,
flow_request_timestamp,
status_message,
vpc_endpoint_association_arn,
vpc_endpoint_id
FROM aws.network_firewall.flow_operations
WHERE region = '{{ region }}' -- required
;

list_flow_operations

Returns a list of all flow operations ran in a specific firewall. You can optionally narrow the request scope by specifying the operation type or Availability Zone associated with a firewall's flow operations. Flow operations let you manage the flows tracked in the flow table, also known as the firewall table. A flow is network traffic that is monitored by a firewall, either by stateful or stateless rules. For traffic to be considered part of a flow, it must share Destination, DestinationPort, Direction, Protocol, Source, and SourcePort.

SELECT
flow_operation_id,
flow_operation_status,
flow_operation_type,
flow_request_timestamp
FROM aws.network_firewall.flow_operations
WHERE region = '{{ region }}' -- required
;