attacks

Creates, updates, deletes, gets or lists an attacks resource.

Overview

Name	attacks
Type	Resource
Id	aws.shield.attacks

Fields

The following fields are returned by SELECT queries:

describe_attack

Name	Datatype	Description
attack_counters	array	List of counters that describe the attack for the specified time period.
attack_id	string	The unique identifier (ID) of the attack. (pattern: <code>[a-zA-Z0-9\-]*</code>)
attack_properties	array	The array of objects that provide details of the Shield event. For infrastructure layer events (L3 and L4 events), you can view metrics for top contributors in Amazon CloudWatch metrics. For more information, see Shield metrics and alarms in the WAF Developer Guide.
end_time	string (date-time)	The time the attack ended, in Unix time in seconds.
mitigations	array	List of mitigation actions taken for the attack.
resource_arn	string	The ARN (Amazon Resource Name) of the resource that was attacked. (pattern: <code>^arn:aws.*</code>)
start_time	string (date-time)	The time the attack started, in Unix time in seconds.
sub_resources	array	If applicable, additional detail about the resource being attacked, for example, IP address or URL.

list_attacks

Name	Datatype	Description
attack_id	string	The unique identifier (ID) of the attack.
attack_vectors	array	The list of attacks for a specified time period.
end_time	string (date-time)	The end time of the attack, in Unix time in seconds.
resource_arn	string	The ARN (Amazon Resource Name) of the resource that was attacked.
start_time	string (date-time)	The start time of the attack, in Unix time in seconds.

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_attack	select	region		Describes the details of a DDoS attack.
list_attacks	select	region		Returns all ongoing DDoS attacks or all DDoS attacks during a specified time period.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_attack

Describes the details of a DDoS attack.

SELECT
attack_counters,
attack_id,
attack_properties,
end_time,
mitigations,
resource_arn,
start_time,
sub_resources
FROM aws.shield.attacks
WHERE region = '{{ region }}' -- required
;

list_attacks

Returns all ongoing DDoS attacks or all DDoS attacks during a specified time period.

SELECT
attack_id,
attack_vectors,
end_time,
resource_arn,
start_time
FROM aws.shield.attacks
WHERE region = '{{ region }}' -- required
;