EC2 / Client / get_ipam_route_protection_findings

get_ipam_route_protection_findings¶

EC2.Client.get_ipam_route_protection_findings(**kwargs)¶

Retrieves route protection findings for an IPAM. Route protection findings show the Resource Public Key Infrastructure (RPKI) validation status of your Bring Your Own IP (BYOIP) routes. Findings identify routes that have valid, invalid, or unknown validation states. We recommend using pagination to ensure that the operation returns quickly and successfully.

Request Syntax

response = client.get_ipam_route_protection_findings(
    DryRun=True|False,
    IpamId='string',
    Filters=[
        {
            'Name': 'string',
            'Values': [
                'string',
            ]
        },
    ],
    NextToken='string',
    MaxResults=123
)

Parameters:

DryRun (boolean) – Checks whether you have the required permissions for the operation, without actually making the request, and provides an error response. If you have the required permissions, the error response is DryRunOperation. Otherwise, it is UnauthorizedOperation.
IpamId (string) –
[REQUIRED]

The ID of the IPAM to retrieve route protection findings for.
Filters (list) –
One or more filters to apply to the results.
- (dict) –
  
  A filter name and value pair that is used to return a more specific list of results from a describe operation. Filters can be used to match a set of resources by specific criteria, such as tags, attributes, or IDs.
  
  If you specify multiple filters, the filters are joined with an AND, and the request returns only results that match all of the specified filters.
  
  For more information, see List and filter using the CLI and API in the Amazon EC2 User Guide.
  - Name (string) –
    
    The name of the filter. Filter names are case-sensitive.
  - Values (list) –
    
    The filter values. Filter values are case-sensitive. If you specify multiple values for a filter, the values are joined with an OR, and the request returns all results that match any of the specified values.
    - (string) –
NextToken (string) – The token for the next page of results.
MaxResults (integer) – The maximum number of results to return in a single call. If not specified, all available results are returned. To retrieve the remaining results, make another call with the returned nextToken value.

Return type:

dict

Returns:

Response Syntax

{
    'IpamId': 'string',
    'RouteProtectionFindings': [
        {
            'ResourceOwnerId': 'string',
            'ResourceRegion': 'string',
            'IpamPoolId': 'string',
            'Cidr': 'string',
            'State': 'advertised'|'deprovisioned'|'failed-deprovision'|'failed-provision'|'pending-advertising'|'pending-deprovision'|'pending-provision'|'pending-withdrawal'|'provisioned'|'provisioned-not-publicly-advertisable',
            'AdvertisementType': 'regional'|'global',
            'NetworkBorderGroup': 'string',
            'PoolId': 'string',
            'Asn': 'string',
            'RpkiStatus': 'valid'|'invalid'|'unknown',
            'RpkiStrength': 'strict'|'permissive',
            'Roas': [
                {
                    'Asn': 'string',
                    'Prefix': 'string',
                    'MaxLength': 123,
                    'Match': True|False,
                    'Expiration': datetime(2015, 1, 1)
                },
            ],
            'RouteOverlaps': [
                {
                    'Prefix': 'string',
                    'Asn': 'string',
                    'DetectedAt': datetime(2015, 1, 1)
                },
            ],
            'SampleTime': datetime(2015, 1, 1),
            'RoaSampleTime': datetime(2015, 1, 1)
        },
    ],
    'NextToken': 'string'
}

Response Structure

(dict) –
- IpamId (string) –
  
  The ID of the IPAM.
- RouteProtectionFindings (list) –
  
  The route protection findings.
  - (dict) –
    
    Contains information about a route protection finding, including the RPKI validation status of a BYOIP route announcement.
    - ResourceOwnerId (string) –
      
      The ID of the resource owner.
    - ResourceRegion (string) –
      
      The Amazon Web Services Region of the resource.
    - IpamPoolId (string) –
      
      The ID of the IPAM pool associated with the finding.
    - Cidr (string) –
      
      The IP address prefix in CIDR notation.
    - State (string) –
      
      The state of the BYOIP CIDR. Possible values:
      - advertised - The CIDR is being advertised.
      - deprovisioned - The CIDR has been deprovisioned.
      - failed-deprovision - Deprovisioning failed.
      - failed-provision - Provisioning failed.
      - pending-deprovision - Deprovisioning is in progress.
      - pending-provision - Provisioning is in progress.
      - provisioned - The CIDR is provisioned.
      - provisioned-not-publicly-advertisable - The CIDR is provisioned but not publicly advertisable.
    - AdvertisementType (string) –
      
      The advertisement type. Possible values:
      - regional - The IP address is advertised from a single location (regional services such as Amazon EC2).
      - global - The IP address is advertised from multiple global locations simultaneously (global services such as Amazon CloudFront).
    - NetworkBorderGroup (string) –
      
      The network border group.
    - PoolId (string) –
      
      The ID of the BYOIP pool.
    - Asn (string) –
      
      The Autonomous System Number (ASN) that originates the route.
    - RpkiStatus (string) –
      
      The RPKI validation status of the route. Possible values:
      - valid - The route has a matching ROA that covers the prefix and origin ASN.
      - invalid - The route has a ROA for the prefix, but the origin ASN or prefix length does not match.
      - unknown - No ROA exists for the prefix, so RPKI validation cannot be performed.
    - RpkiStrength (string) –
      
      The RPKI enforcement strength for the route. Possible values:
      - strict - Invalid routes are rejected.
      - permissive - Invalid routes are accepted but flagged.
    - Roas (list) –
      
      The Route Origin Authorizations (ROAs) that cover the prefix.
      - (dict) –
        
        Contains information about a Route Origin Authorization (ROA) published in the RPKI. A ROA cryptographically attests that a specific ASN is authorized to originate a specific IP address prefix.
        
        Asn (string) –
        
        The Autonomous System Number (ASN) authorized by the ROA.
        
        Prefix (string) –
        
        The IP address prefix authorized by the ROA in CIDR notation.
        
        MaxLength (integer) –
        
        The maximum prefix length that the ASN is authorized to announce.
        
        Match (boolean) –
        
        Specifies whether the ROA matches the route announcement.
        
        Expiration (datetime) –
        
        The expiration date of the ROA.
    - RouteOverlaps (list) –
      
      The overlapping routes detected for this prefix.
      - (dict) –
        
        Contains information about an overlapping route detected for a BYOIP prefix.
        
        Prefix (string) –
        
        The overlapping IP address prefix in CIDR notation.
        
        Asn (string) –
        
        The ASN originating the overlapping route.
        
        DetectedAt (datetime) –
        
        The time when the overlap was detected.
    - SampleTime (datetime) –
      
      The time when the route was last sampled.
    - RoaSampleTime (datetime) –
      
      The time when the ROA data was last sampled.
- NextToken (string) –
  
  The token to use to retrieve the next page of results.