protections

Creates, updates, deletes, gets or lists a protections resource.

Overview

Name	protections
Type	Resource
Id	aws.shield.protections

Fields

The following fields are returned by SELECT queries:

describe_protection

Name	Datatype	Description
application_layer_automatic_response_configuration	object	The automatic application layer DDoS mitigation settings for the protection. This configuration determines whether Shield Advanced automatically manages rules in the web ACL in order to respond to application layer events that Shield Advanced determines to be DDoS attacks.
health_check_ids	array	The unique identifier (ID) for the Route 53 health check that's associated with the protection.
id	string	The unique identifier (ID) of the protection. (pattern: <code>[a-zA-Z0-9\-]*</code>)
name	string	The name of the protection. For example, My CloudFront distributions. (pattern: <code>[ a-zA-Z0-9_\.\-]*</code>)
protection_arn	string	The ARN (Amazon Resource Name) of the protection. (pattern: <code>^arn:aws.*</code>)
resource_arn	string	The ARN (Amazon Resource Name) of the Amazon Web Services resource that is protected. (pattern: <code>^arn:aws.*</code>)

list_protections

Name	Datatype	Description
application_layer_automatic_response_configuration	object	The automatic application layer DDoS mitigation settings for the protection. This configuration determines whether Shield Advanced automatically manages rules in the web ACL in order to respond to application layer events that Shield Advanced determines to be DDoS attacks.
health_check_ids	array	The unique identifier (ID) for the Route 53 health check that's associated with the protection.
id	string	The unique identifier (ID) of the protection. (pattern: <code>[a-zA-Z0-9\-]*</code>)
name	string	The name of the protection. For example, My CloudFront distributions. (pattern: <code>[ a-zA-Z0-9_\.\-]*</code>)
protection_arn	string	The ARN (Amazon Resource Name) of the protection. (pattern: <code>^arn:aws.*</code>)
resource_arn	string	The ARN (Amazon Resource Name) of the Amazon Web Services resource that is protected. (pattern: <code>^arn:aws.*</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_protection	select	region		Lists the details of a Protection object.
list_protections	select	region		Retrieves Protection objects for the account. You can retrieve all protections or you can provide filtering criteria and retrieve just the subset of protections that match the criteria.
create_protection	insert	region, ResourceArn		Enables Shield Advanced for a specific Amazon Web Services resource. The resource can be an Amazon CloudFront distribution, Amazon Route 53 hosted zone, Global Accelerator standard accelerator, Elastic IP Address, Application Load Balancer, or a Classic Load Balancer. You can protect Amazon EC2 instances and Network Load Balancers by association with protected Amazon EC2 Elastic IP addresses. You can add protection to only a single resource with each CreateProtection request. You can add protection to multiple resources at once through the Shield Advanced console at https:​//console.aws.amazon.com/wafv2/shieldv2#/. For more information see Getting Started with Shield Advanced and Adding Shield Advanced protection to Amazon Web Services resources.
associate_health_check	update	region, ProtectionId, HealthCheckArn		Adds health-based detection to the Shield Advanced protection for a resource. Shield Advanced health-based detection uses the health of your Amazon Web Services resource to improve responsiveness and accuracy in attack detection and response. You define the health check in Route 53 and then associate it with your Shield Advanced protection. For more information, see Shield Advanced Health-Based Detection in the WAF Developer Guide.
delete_protection	delete	region		Deletes an Shield Advanced Protection.
disassociate_health_check	exec	region, ProtectionId, HealthCheckArn		Removes health-based detection from the Shield Advanced protection for a resource. Shield Advanced health-based detection uses the health of your Amazon Web Services resource to improve responsiveness and accuracy in attack detection and response. You define the health check in Route 53 and then associate or disassociate it with your Shield Advanced protection. For more information, see Shield Advanced Health-Based Detection in the WAF Developer Guide.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_protection

Lists the details of a Protection object.

SELECT
application_layer_automatic_response_configuration,
health_check_ids,
id,
name,
protection_arn,
resource_arn
FROM aws.shield.protections
WHERE region = '{{ region }}' -- required
;

list_protections

Retrieves Protection objects for the account. You can retrieve all protections or you can provide filtering criteria and retrieve just the subset of protections that match the criteria.

SELECT
application_layer_automatic_response_configuration,
health_check_ids,
id,
name,
protection_arn,
resource_arn
FROM aws.shield.protections
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_protection

Enables Shield Advanced for a specific Amazon Web Services resource. The resource can be an Amazon CloudFront distribution, Amazon Route 53 hosted zone, Global Accelerator standard accelerator, Elastic IP Address, Application Load Balancer, or a Classic Load Balancer. You can protect Amazon EC2 instances and Network Load Balancers by association with protected Amazon EC2 Elastic IP addresses. You can add protection to only a single resource with each CreateProtection request. You can add protection to multiple resources at once through the Shield Advanced console at https://console.aws.amazon.com/wafv2/shieldv2#/. For more information see Getting Started with Shield Advanced and Adding Shield Advanced protection to Amazon Web Services resources.

INSERT INTO aws.shield.protections (
Name,
ResourceArn,
Tags,
region
)
SELECT 
'{{ Name }}',
'{{ ResourceArn }}' /* required */,
'{{ Tags }}',
'{{ region }}'
RETURNING
protection_id
;

Manifest

# Description fields are for documentation purposes
- name: protections
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the protections resource.
  - name: Name
    value: "{{ Name }}"
    description: |
      Friendly name for the Protection you are creating.
  - name: ResourceArn
    value: "{{ ResourceArn }}"
    description: |
      The ARN (Amazon Resource Name) of the resource to be protected. The ARN should be in one of the following formats: For an Application Load Balancer: arn:aws:elasticloadbalancing:region:account-id:loadbalancer/app/load-balancer-name/load-balancer-id For an Elastic Load Balancer (Classic Load Balancer): arn:aws:elasticloadbalancing:region:account-id:loadbalancer/load-balancer-name For an Amazon CloudFront distribution: arn:aws:cloudfront::account-id:distribution/distribution-id For an Global Accelerator standard accelerator: arn:aws:globalaccelerator::account-id:accelerator/accelerator-id For Amazon Route 53: arn:aws:route53:::hostedzone/hosted-zone-id For an Elastic IP address: arn:aws:ec2:region:account-id:eip-allocation/allocation-id
  - name: Tags
    description: |
      One or more tag key-value pairs for the Protection object that is created.
    value:
      - Key: "{{ Key }}"
        Value: "{{ Value }}"

UPDATE examples

associate_health_check

Adds health-based detection to the Shield Advanced protection for a resource. Shield Advanced health-based detection uses the health of your Amazon Web Services resource to improve responsiveness and accuracy in attack detection and response. You define the health check in Route 53 and then associate it with your Shield Advanced protection. For more information, see Shield Advanced Health-Based Detection in the WAF Developer Guide.

UPDATE aws.shield.protections
SET 
ProtectionId = '{{ ProtectionId }}',
HealthCheckArn = '{{ HealthCheckArn }}'
WHERE 
region = '{{ region }}' --required
AND ProtectionId = '{{ ProtectionId }}' --required
AND HealthCheckArn = '{{ HealthCheckArn }}' --required;

DELETE examples

delete_protection

Deletes an Shield Advanced Protection.

DELETE FROM aws.shield.protections
WHERE region = '{{ region }}' --required
;

Lifecycle Methods

disassociate_health_check

Removes health-based detection from the Shield Advanced protection for a resource. Shield Advanced health-based detection uses the health of your Amazon Web Services resource to improve responsiveness and accuracy in attack detection and response. You define the health check in Route 53 and then associate or disassociate it with your Shield Advanced protection. For more information, see Shield Advanced Health-Based Detection in the WAF Developer Guide.

EXEC aws.shield.protections.disassociate_health_check 
@region='{{ region }}' --required 
@@json=
'{
"ProtectionId": "{{ ProtectionId }}", 
"HealthCheckArn": "{{ HealthCheckArn }}"
}'
;