CreateDeployment

$result = $client->createDeployment([/* ... */]);
$promise = $client->createDeploymentAsync([/* ... */]);

Creates a deployment. A deployment applies one or more policies to the accounts and resources selected by a scope. Use isPublished to create the deployment in published (ACTIVE) or draft (DRAFT) state. The response includes coverage information and any warnings about the deployment.

Parameter Syntax

$result = $client->createDeployment([
    'associatedPolicyList' => [ // REQUIRED
        [
            'policyIdentifier' => '<string>', // REQUIRED
        ],
        // ...
    ],
    'associatedScopeList' => [ // REQUIRED
        [
            'scopeIdentifier' => '<string>', // REQUIRED
        ],
        // ...
    ],
    'clientToken' => '<string>',
    'deploymentConfiguration' => [ // REQUIRED
        'enableCrossAccountVisibility' => true || false, // REQUIRED
    ],
    'deploymentDescription' => '<string>',
    'deploymentName' => '<string>', // REQUIRED
    'isPublished' => true || false,
    'tags' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'associatedPolicyList' => [
        [
            'policyArn' => '<string>',
        ],
        // ...
    ],
    'associatedScopeList' => [
        [
            'scopeArn' => '<string>',
        ],
        // ...
    ],
    'deploymentArn' => '<string>',
    'deploymentConfiguration' => [
        'enableCrossAccountVisibility' => true || false,
    ],
    'deploymentCoverage' => [
        [
            'firewallType' => 'WAF|SHIELD_ADVANCED',
            'inScopeResourceTypes' => ['<string>', ...],
            'policyArns' => ['<string>', ...],
        ],
        // ...
    ],
    'deploymentDescription' => '<string>',
    'deploymentId' => '<string>',
    'deploymentName' => '<string>',
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
    'warnings' => [
        [
            'code' => '<string>',
            'message' => '<string>',
            'policyArn' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ServiceQuotaExceededException:

The request would exceed a service quota.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

ServiceUnavailableException:

The service is temporarily unavailable. This is a retryable error.

TagPolicyViolationException:

The request violates a tag policy that is in effect for the account or organization.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Create a deployment

Creates a new deployment in draft state.

$result = $client->createDeployment([
    'associatedPolicyList' => [
        [
            'policyIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
        ],
    ],
    'associatedScopeList' => [
        [
            'scopeIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123',
        ],
    ],
    'clientToken' => '550e8400-e29b-41d4-a716-446655440003',
    'deploymentConfiguration' => [
        'enableCrossAccountVisibility' => ,
    ],
    'deploymentDescription' => 'Production deployment for US East 1 region',
    'deploymentName' => 'prod-us-east-1-deployment',
    'isPublished' => ,
]);

Result syntax:

[
    'version' => '1',
    'associatedPolicyList' => [
        [
            'policyArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
        ],
    ],
    'associatedScopeList' => [
        [
            'scopeArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123',
        ],
    ],
    'deploymentArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456',
    'deploymentConfiguration' => [
        'enableCrossAccountVisibility' => ,
    ],
    'deploymentDescription' => 'Production deployment for US East 1 region',
    'deploymentId' => 'def456',
    'deploymentName' => 'prod-us-east-1-deployment',
    'hasPublishedVersion' => ,
    'isSnapshot' => ,
    'status' => 'DRAFT',
    'updateToken' => 'f4a5b6c7-7d8e-4f9a-8b1c-1d2e3f4a5b6c',
]

CreateDeploymentSnapshot

$result = $client->createDeploymentSnapshot([/* ... */]);
$promise = $client->createDeploymentSnapshotAsync([/* ... */]);

Creates a snapshot of the current published version of the specified deployment.

Parameter Syntax

$result = $client->createDeploymentSnapshot([
    'clientToken' => '<string>',
    'deploymentIdentifier' => '<string>', // REQUIRED
    'tags' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'associatedPolicyList' => [
        [
            'policyArn' => '<string>',
        ],
        // ...
    ],
    'associatedScopeList' => [
        [
            'scopeArn' => '<string>',
        ],
        // ...
    ],
    'deploymentArn' => '<string>',
    'deploymentConfiguration' => [
        'enableCrossAccountVisibility' => true || false,
    ],
    'deploymentDescription' => '<string>',
    'deploymentId' => '<string>',
    'deploymentName' => '<string>',
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ServiceQuotaExceededException:

The request would exceed a service quota.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Create a deployment snapshot

Creates an immutable snapshot of the current published version of a deployment. The snapshot is addressable by a version-qualified ARN.

$result = $client->createDeploymentSnapshot([
    'clientToken' => '550e8400-e29b-41d4-a716-446655440014',
    'deploymentIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456',
]);

Result syntax:

[
    'version' => '2',
    'associatedPolicyList' => [
        [
            'policyArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
        ],
    ],
    'associatedScopeList' => [
        [
            'scopeArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123',
        ],
    ],
    'deploymentArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456:2',
    'deploymentConfiguration' => [
        'enableCrossAccountVisibility' => 1,
    ],
    'deploymentId' => 'def456',
    'deploymentName' => 'prod-us-east-1-deployment',
    'isSnapshot' => 1,
    'status' => 'ACTIVE',
    'updatedAt' => ,
]

CreatePolicy

$result = $client->createPolicy([/* ... */]);
$promise = $client->createPolicyAsync([/* ... */]);

Creates a policy. A policy combines templates and rules with enforcement settings for a firewall type, such as AWS WAF or AWS Shield Advanced. Use isPublished to create the policy in published (ACTIVE) or draft (DRAFT) state.

Parameter Syntax

$result = $client->createPolicy([
    'associatedTemplateAndRuleList' => [
        [
            'ruleIdentifier' => '<string>',
            'templateIdentifier' => '<string>',
        ],
        // ...
    ],
    'clientToken' => '<string>',
    'firewallType' => 'WAF|SHIELD_ADVANCED', // REQUIRED
    'isPublished' => true || false,
    'policyConfiguration' => [ // REQUIRED
        'remediationEnabled' => true || false, // REQUIRED
        'resourcesCleanUp' => true || false, // REQUIRED
        'wafConfig' => [
            'conflictResolution' => 'MERGE_WHERE_APPLICABLE', // REQUIRED
            'existingCustomerWebACLResolution' => 'RETROFIT|OVERRIDE_ASSOCIATION|NO_REMEDIATION', // REQUIRED
        ],
    ],
    'policyDescription' => '<string>',
    'policyName' => '<string>', // REQUIRED
    'priority' => <integer>, // REQUIRED
    'tags' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'associatedTemplateAndRuleList' => [
        [
            'ruleArn' => '<string>',
            'templateArn' => '<string>',
        ],
        // ...
    ],
    'firewallType' => 'WAF|SHIELD_ADVANCED',
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'policyArn' => '<string>',
    'policyConfiguration' => [
        'remediationEnabled' => true || false,
        'resourcesCleanUp' => true || false,
        'wafConfig' => [
            'conflictResolution' => 'MERGE_WHERE_APPLICABLE',
            'existingCustomerWebACLResolution' => 'RETROFIT|OVERRIDE_ASSOCIATION|NO_REMEDIATION',
        ],
    ],
    'policyDescription' => '<string>',
    'policyId' => '<string>',
    'policyName' => '<string>',
    'priority' => <integer>,
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ServiceQuotaExceededException:

The request would exceed a service quota.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

ServiceUnavailableException:

The service is temporarily unavailable. This is a retryable error.

TagPolicyViolationException:

The request violates a tag policy that is in effect for the account or organization.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Create a WAF policy

Creates a new WAF policy in draft state with a template association.

$result = $client->createPolicy([
    'associatedTemplateAndRuleList' => [
        [
            'templateIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789',
        ],
    ],
    'clientToken' => '550e8400-e29b-41d4-a716-446655440002',
    'firewallType' => 'WAF',
    'isPublished' => ,
    'policyConfiguration' => [
        'remediationEnabled' => ,
        'resourcesCleanUp' => ,
        'wafConfig' => [
            'conflictResolution' => 'MERGE_WHERE_APPLICABLE',
            'existingCustomerWebACLResolution' => 'NO_REMEDIATION',
        ],
    ],
    'policyDescription' => 'WAF policy for web application protection',
    'policyName' => 'web-app-waf-policy',
    'priority' => 1,
]);

Result syntax:

[
    'version' => '1',
    'associatedTemplateAndRuleList' => [
        [
            'templateArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789',
        ],
    ],
    'firewallType' => 'WAF',
    'hasPublishedVersion' => ,
    'isSnapshot' => ,
    'policyArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
    'policyConfiguration' => [
        'remediationEnabled' => ,
        'resourcesCleanUp' => ,
        'wafConfig' => [
            'conflictResolution' => 'MERGE_WHERE_APPLICABLE',
            'existingCustomerWebACLResolution' => 'NO_REMEDIATION',
        ],
    ],
    'policyDescription' => 'WAF policy for web application protection',
    'policyId' => 'xyz789',
    'policyName' => 'web-app-waf-policy',
    'priority' => 1,
    'status' => 'DRAFT',
    'updateToken' => 'e3f4a5b6-6c7d-4e8f-9a0b-0c1d2e3f4a5b',
]

CreatePolicySnapshot

$result = $client->createPolicySnapshot([/* ... */]);
$promise = $client->createPolicySnapshotAsync([/* ... */]);

Creates a snapshot of the current published version of the specified policy.

Parameter Syntax

$result = $client->createPolicySnapshot([
    'clientToken' => '<string>',
    'policyIdentifier' => '<string>', // REQUIRED
    'tags' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'associatedTemplateAndRuleList' => [
        [
            'ruleArn' => '<string>',
            'templateArn' => '<string>',
        ],
        // ...
    ],
    'firewallType' => 'WAF|SHIELD_ADVANCED',
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'policyArn' => '<string>',
    'policyConfiguration' => [
        'remediationEnabled' => true || false,
        'resourcesCleanUp' => true || false,
        'wafConfig' => [
            'conflictResolution' => 'MERGE_WHERE_APPLICABLE',
            'existingCustomerWebACLResolution' => 'RETROFIT|OVERRIDE_ASSOCIATION|NO_REMEDIATION',
        ],
    ],
    'policyDescription' => '<string>',
    'policyId' => '<string>',
    'policyName' => '<string>',
    'priority' => <integer>,
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ServiceQuotaExceededException:

The request would exceed a service quota.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Create a policy snapshot

Creates an immutable snapshot of the current published version of a policy. The snapshot is addressable by a version-qualified ARN.

$result = $client->createPolicySnapshot([
    'clientToken' => '550e8400-e29b-41d4-a716-446655440013',
    'policyIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
]);

Result syntax:

[
    'version' => '2',
    'associatedTemplateAndRuleList' => [
        [
            'templateArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789',
        ],
    ],
    'firewallType' => 'WAF',
    'isSnapshot' => 1,
    'policyArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789:2',
    'policyConfiguration' => [
        'remediationEnabled' => 1,
        'resourcesCleanUp' => ,
        'wafConfig' => [
            'conflictResolution' => 'MERGE_WHERE_APPLICABLE',
            'existingCustomerWebACLResolution' => 'NO_REMEDIATION',
        ],
    ],
    'policyId' => 'xyz789',
    'policyName' => 'web-app-waf-policy',
    'priority' => 2,
    'status' => 'ACTIVE',
    'updatedAt' => ,
]

CreateRule

$result = $client->createRule([/* ... */]);
$promise = $client->createRuleAsync([/* ... */]);

Creates a rule. A rule defines a network security configuration to enforce, such as an AWS WAF rule group or configuration data. Use isPublished to create the rule in published (ACTIVE) or draft (DRAFT) state.

Parameter Syntax

$result = $client->createRule([
    'clientToken' => '<string>',
    'configuration' => [ // REQUIRED
    ],
    'firewallType' => 'WAF', // REQUIRED
    'isPublished' => true || false,
    'ruleDescription' => '<string>',
    'ruleName' => '<string>', // REQUIRED
    'ruleType' => 'CONFIGURATION|INSPECTION', // REQUIRED
    'tags' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'configuration' => [
    ],
    'firewallType' => 'WAF',
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'ruleArn' => '<string>',
    'ruleDescription' => '<string>',
    'ruleId' => '<string>',
    'ruleName' => '<string>',
    'ruleType' => 'CONFIGURATION|INSPECTION',
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ServiceQuotaExceededException:

The request would exceed a service quota.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

ServiceUnavailableException:

The service is temporarily unavailable. This is a retryable error.

TagPolicyViolationException:

The request violates a tag policy that is in effect for the account or organization.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Create a WAF rule

Creates a new WAF inspection rule in draft state.

$result = $client->createRule([
    'clientToken' => '550e8400-e29b-41d4-a716-446655440000',
    'configuration' => [
    ],
    'firewallType' => 'WAF',
    'isPublished' => ,
    'ruleDescription' => 'Blocks requests from known malicious IP addresses',
    'ruleName' => 'block-known-bad-ips',
    'ruleType' => 'INSPECTION',
]);

Result syntax:

[
    'version' => '1',
    'configuration' => [
    ],
    'firewallType' => 'WAF',
    'hasPublishedVersion' => ,
    'isSnapshot' => ,
    'ruleArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123',
    'ruleDescription' => 'Blocks requests from known malicious IP addresses',
    'ruleId' => 'abc123',
    'ruleName' => 'block-known-bad-ips',
    'ruleType' => 'INSPECTION',
    'status' => 'DRAFT',
    'updateToken' => 'c1d2e3f4-4a5b-4c6d-9e7f-8a9b0c1d2e3f',
]

CreateRuleSnapshot

$result = $client->createRuleSnapshot([/* ... */]);
$promise = $client->createRuleSnapshotAsync([/* ... */]);

Creates a snapshot of the current published version of the specified rule. A snapshot is an immutable, versioned copy that other resources can reference.

Parameter Syntax

$result = $client->createRuleSnapshot([
    'clientToken' => '<string>',
    'ruleIdentifier' => '<string>', // REQUIRED
    'tags' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'configuration' => [
    ],
    'firewallType' => 'WAF',
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'ruleArn' => '<string>',
    'ruleDescription' => '<string>',
    'ruleId' => '<string>',
    'ruleName' => '<string>',
    'ruleType' => 'CONFIGURATION|INSPECTION',
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ServiceQuotaExceededException:

The request would exceed a service quota.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Create a rule snapshot

Creates an immutable snapshot of the current published version of a rule. The snapshot is addressable by a version-qualified ARN.

$result = $client->createRuleSnapshot([
    'clientToken' => '550e8400-e29b-41d4-a716-446655440011',
    'ruleIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123',
]);

Result syntax:

[
    'version' => '2',
    'configuration' => [
    ],
    'firewallType' => 'WAF',
    'isSnapshot' => 1,
    'ruleArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123:2',
    'ruleId' => 'abc123',
    'ruleName' => 'block-known-bad-ips',
    'ruleType' => 'INSPECTION',
    'status' => 'ACTIVE',
    'updatedAt' => ,
]

CreateScope

$result = $client->createScope([/* ... */]);
$promise = $client->createScopeAsync([/* ... */]);

Creates a scope. A scope selects the accounts and resources that a deployment applies to. Use isPublished to create the scope in published (ACTIVE) or draft (DRAFT) state.

Parameter Syntax

$result = $client->createScope([
    'clientToken' => '<string>',
    'isPublished' => true || false,
    'scopeConfiguration' => [ // REQUIRED
        'accountFilter' => [
            'exclude' => [
                'accountIds' => ['<string>', ...],
                'organizationalUnits' => ['<string>', ...],
            ],
            'include' => [
                'accountIds' => ['<string>', ...],
                'organizationalUnits' => ['<string>', ...],
            ],
            'includeAll' => [
            ],
        ],
        'resourceScopes' => [ // REQUIRED
            '<ScopeResourceType>' => [
                'exclude' => [
                    'explicitArns' => ['<string>', ...],
                    'expression' => [
                        'and' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                        'criteria' => [
                            'albConfig' => [
                                'ipAddressType' => 'ipv4|dualstack|dualstack-without-public-ipv4',
                                'scheme' => 'internet-facing|internal',
                            ],
                            'tags' => ['<string>', ...],
                        ],
                        'not' => [...], // RECURSIVE
                        'or' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                    ],
                ],
                'include' => [
                    'explicitArns' => ['<string>', ...],
                    'expression' => [
                        'and' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                        'criteria' => [
                            'albConfig' => [
                                'ipAddressType' => 'ipv4|dualstack|dualstack-without-public-ipv4',
                                'scheme' => 'internet-facing|internal',
                            ],
                            'tags' => ['<string>', ...],
                        ],
                        'not' => [...], // RECURSIVE
                        'or' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                    ],
                ],
                'includeAll' => true || false,
            ],
            // ...
        ],
    ],
    'scopeDescription' => '<string>',
    'scopeName' => '<string>', // REQUIRED
    'tags' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'scopeArn' => '<string>',
    'scopeConfiguration' => [
        'accountFilter' => [
            'exclude' => [
                'accountIds' => ['<string>', ...],
                'organizationalUnits' => ['<string>', ...],
            ],
            'include' => [
                'accountIds' => ['<string>', ...],
                'organizationalUnits' => ['<string>', ...],
            ],
            'includeAll' => [
            ],
        ],
        'resourceScopes' => [
            '<ScopeResourceType>' => [
                'exclude' => [
                    'explicitArns' => ['<string>', ...],
                    'expression' => [
                        'and' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                        'criteria' => [
                            'albConfig' => [
                                'ipAddressType' => 'ipv4|dualstack|dualstack-without-public-ipv4',
                                'scheme' => 'internet-facing|internal',
                            ],
                            'tags' => ['<string>', ...],
                        ],
                        'not' => [...], // RECURSIVE
                        'or' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                    ],
                ],
                'include' => [
                    'explicitArns' => ['<string>', ...],
                    'expression' => [
                        'and' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                        'criteria' => [
                            'albConfig' => [
                                'ipAddressType' => 'ipv4|dualstack|dualstack-without-public-ipv4',
                                'scheme' => 'internet-facing|internal',
                            ],
                            'tags' => ['<string>', ...],
                        ],
                        'not' => [...], // RECURSIVE
                        'or' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                    ],
                ],
                'includeAll' => true || false,
            ],
            // ...
        ],
    ],
    'scopeDescription' => '<string>',
    'scopeId' => '<string>',
    'scopeName' => '<string>',
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ServiceQuotaExceededException:

The request would exceed a service quota.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

ServiceUnavailableException:

The service is temporarily unavailable. This is a retryable error.

TagPolicyViolationException:

The request violates a tag policy that is in effect for the account or organization.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Create a scope

Creates a new scope in published (ACTIVE) state.

$result = $client->createScope([
    'clientToken' => '550e8400-e29b-41d4-a716-446655440001',
    'isPublished' => 1,
    'scopeConfiguration' => [
        'accountFilter' => [
            'includeAll' => [
            ],
        ],
        'resourceScopes' => [
        ],
    ],
    'scopeDescription' => 'Scope covering all production web application resources',
    'scopeName' => 'production-web-apps',
]);

Result syntax:

[
    'version' => '1',
    'hasPublishedVersion' => 1,
    'isSnapshot' => ,
    'scopeArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123',
    'scopeConfiguration' => [
        'accountFilter' => [
            'includeAll' => [
            ],
        ],
        'resourceScopes' => [
        ],
    ],
    'scopeDescription' => 'Scope covering all production web application resources',
    'scopeId' => 'abc123',
    'scopeName' => 'production-web-apps',
    'status' => 'ACTIVE',
    'updateToken' => 'b0c4d1e2-3f4a-4b5c-8d6e-7f8a9b0c1d2e',
]

CreateScopeSnapshot

$result = $client->createScopeSnapshot([/* ... */]);
$promise = $client->createScopeSnapshotAsync([/* ... */]);

Creates a snapshot of the current published version of the specified scope.

Parameter Syntax

$result = $client->createScopeSnapshot([
    'clientToken' => '<string>',
    'scopeIdentifier' => '<string>', // REQUIRED
    'tags' => ['<string>', ...],
]);

Parameter Details

Result Syntax

[
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'scopeArn' => '<string>',
    'scopeConfiguration' => [
        'accountFilter' => [
            'exclude' => [
                'accountIds' => ['<string>', ...],
                'organizationalUnits' => ['<string>', ...],
            ],
            'include' => [
                'accountIds' => ['<string>', ...],
                'organizationalUnits' => ['<string>', ...],
            ],
            'includeAll' => [
            ],
        ],
        'resourceScopes' => [
            '<ScopeResourceType>' => [
                'exclude' => [
                    'explicitArns' => ['<string>', ...],
                    'expression' => [
                        'and' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                        'criteria' => [
                            'albConfig' => [
                                'ipAddressType' => 'ipv4|dualstack|dualstack-without-public-ipv4',
                                'scheme' => 'internet-facing|internal',
                            ],
                            'tags' => ['<string>', ...],
                        ],
                        'not' => [...], // RECURSIVE
                        'or' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                    ],
                ],
                'include' => [
                    'explicitArns' => ['<string>', ...],
                    'expression' => [
                        'and' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                        'criteria' => [
                            'albConfig' => [
                                'ipAddressType' => 'ipv4|dualstack|dualstack-without-public-ipv4',
                                'scheme' => 'internet-facing|internal',
                            ],
                            'tags' => ['<string>', ...],
                        ],
                        'not' => [...], // RECURSIVE
                        'or' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                    ],
                ],
                'includeAll' => true || false,
            ],
            // ...
        ],
    ],
    'scopeDescription' => '<string>',
    'scopeId' => '<string>',
    'scopeName' => '<string>',
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ServiceQuotaExceededException:

The request would exceed a service quota.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Create a scope snapshot

Creates an immutable snapshot of the current published version of a scope. The snapshot is addressable by a version-qualified ARN.

$result = $client->createScopeSnapshot([
    'clientToken' => '550e8400-e29b-41d4-a716-446655440010',
    'scopeIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123',
]);

Result syntax:

[
    'version' => '2',
    'isSnapshot' => 1,
    'scopeArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123:2',
    'scopeConfiguration' => [
        'accountFilter' => [
            'includeAll' => [
            ],
        ],
        'resourceScopes' => [
        ],
    ],
    'scopeId' => 'abc123',
    'scopeName' => 'production-web-apps',
    'status' => 'ACTIVE',
    'updatedAt' => ,
]

CreateTemplate

$result = $client->createTemplate([/* ... */]);
$promise = $client->createTemplateAsync([/* ... */]);

Creates a template. A template groups one or more rules to simplify reuse across policies. You can also associate rules with a policy directly, without a template. Use isPublished to create the template in published (ACTIVE) or draft (DRAFT) state.

Parameter Syntax

$result = $client->createTemplate([
    'associatedRuleList' => [ // REQUIRED
        [
            'ruleIdentifier' => '<string>', // REQUIRED
        ],
        // ...
    ],
    'clientToken' => '<string>',
    'firewallType' => 'WAF', // REQUIRED
    'isPublished' => true || false,
    'tags' => ['<string>', ...],
    'templateDescription' => '<string>',
    'templateName' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'associatedRuleList' => [
        [
            'ruleArn' => '<string>',
        ],
        // ...
    ],
    'firewallType' => 'WAF',
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'templateArn' => '<string>',
    'templateDescription' => '<string>',
    'templateId' => '<string>',
    'templateName' => '<string>',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ServiceQuotaExceededException:

The request would exceed a service quota.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

ServiceUnavailableException:

The service is temporarily unavailable. This is a retryable error.

TagPolicyViolationException:

The request violates a tag policy that is in effect for the account or organization.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Create a WAF template

Creates a new WAF template in published (ACTIVE) state with an associated rule.

$result = $client->createTemplate([
    'associatedRuleList' => [
        [
            'ruleIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123',
        ],
    ],
    'clientToken' => '550e8400-e29b-41d4-a716-446655440004',
    'firewallType' => 'WAF',
    'isPublished' => 1,
    'templateDescription' => 'Standard WAF template with baseline rule groups',
    'templateName' => 'standard-waf-template',
]);

Result syntax:

[
    'version' => '1',
    'associatedRuleList' => [
        [
            'ruleArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123',
        ],
    ],
    'firewallType' => 'WAF',
    'hasPublishedVersion' => 1,
    'isSnapshot' => ,
    'status' => 'ACTIVE',
    'templateArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789',
    'templateDescription' => 'Standard WAF template with baseline rule groups',
    'templateId' => 'xyz789',
    'templateName' => 'standard-waf-template',
    'updateToken' => 'd2e3f4a5-5b6c-4d7e-8f9a-9b0c1d2e3f4a',
]

CreateTemplateSnapshot

$result = $client->createTemplateSnapshot([/* ... */]);
$promise = $client->createTemplateSnapshotAsync([/* ... */]);

Creates a snapshot of the current published version of the specified template.

Parameter Syntax

$result = $client->createTemplateSnapshot([
    'clientToken' => '<string>',
    'tags' => ['<string>', ...],
    'templateIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'associatedRuleList' => [
        [
            'ruleArn' => '<string>',
        ],
        // ...
    ],
    'firewallType' => 'WAF',
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'templateArn' => '<string>',
    'templateDescription' => '<string>',
    'templateId' => '<string>',
    'templateName' => '<string>',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ServiceQuotaExceededException:

The request would exceed a service quota.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Create a template snapshot

Creates an immutable snapshot of the current published version of a template. The snapshot is addressable by a version-qualified ARN.

$result = $client->createTemplateSnapshot([
    'clientToken' => '550e8400-e29b-41d4-a716-446655440012',
    'templateIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789',
]);

Result syntax:

[
    'version' => '2',
    'associatedRuleList' => [
        [
            'ruleArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123',
        ],
    ],
    'firewallType' => 'WAF',
    'isSnapshot' => 1,
    'status' => 'ACTIVE',
    'templateArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789:2',
    'templateId' => 'xyz789',
    'templateName' => 'standard-waf-template',
    'updatedAt' => ,
]

DeleteAdminAccount

$result = $client->deleteAdminAccount([/* ... */]);
$promise = $client->deleteAdminAccountAsync([/* ... */]);

Removes the specified AWS Network Security Manager administrator account.

Parameter Syntax

$result = $client->deleteAdminAccount([
    'accountId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Remove an administrator account

Removes an account's Network Security Manager administrator designation.

$result = $client->deleteAdminAccount([
    'accountId' => '234567890123',
]);

DeleteDeployment

$result = $client->deleteDeployment([/* ... */]);
$promise = $client->deleteDeploymentAsync([/* ... */]);

Deletes the specified deployment.

Parameter Syntax

$result = $client->deleteDeployment([
    'deploymentIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Delete a deployment

Deletes a deployment by its ARN. Deleting an active deployment stops enforcement and triggers cleanup of managed firewall resources.

$result = $client->deleteDeployment([
    'deploymentIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456',
]);

DeletePolicy

$result = $client->deletePolicy([/* ... */]);
$promise = $client->deletePolicyAsync([/* ... */]);

Deletes the specified policy.

Parameter Syntax

$result = $client->deletePolicy([
    'policyIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Delete a policy

Deletes a policy by its ARN. The policy must not be associated with any deployment.

$result = $client->deletePolicy([
    'policyIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
]);

DeleteRule

$result = $client->deleteRule([/* ... */]);
$promise = $client->deleteRuleAsync([/* ... */]);

Deletes the specified rule.

Parameter Syntax

$result = $client->deleteRule([
    'ruleIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Delete a rule

Deletes a rule by its ARN. The rule must not be associated with any template or policy.

$result = $client->deleteRule([
    'ruleIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123',
]);

DeleteScope

$result = $client->deleteScope([/* ... */]);
$promise = $client->deleteScopeAsync([/* ... */]);

Deletes the specified scope.

Parameter Syntax

$result = $client->deleteScope([
    'scopeIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Delete a scope

Deletes a scope by its ARN. The scope must not be associated with any deployment.

$result = $client->deleteScope([
    'scopeIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123',
]);

DeleteTemplate

$result = $client->deleteTemplate([/* ... */]);
$promise = $client->deleteTemplateAsync([/* ... */]);

Deletes the specified template.

Parameter Syntax

$result = $client->deleteTemplate([
    'templateIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Delete a template

Deletes a template by its ARN. The template must not be associated with any policy.

$result = $client->deleteTemplate([
    'templateIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789',
]);

GenerateRuleConfiguration

$result = $client->generateRuleConfiguration([/* ... */]);
$promise = $client->generateRuleConfigurationAsync([/* ... */]);

Generates a rule configuration from a natural-language description. Provide a prompt along with the rule's firewall type and rule type. The service returns a configuration that you can use when you create or update a rule. If you also provide an existing configuration, the service edits that configuration instead of generating a new one.

Parameter Syntax

$result = $client->generateRuleConfiguration([
    'clientToken' => '<string>',
    'currentConfiguration' => '<string>',
    'prompt' => '<string>', // REQUIRED
    'ruleFirewallType' => 'WAF', // REQUIRED
    'ruleType' => 'CONFIGURATION|INSPECTION', // REQUIRED
    'wafConfigDataType' => 'DefaultAction|VisibilityConfig|CaptchaConfig|ChallengeConfig|CustomResponseBodies|LoggingConfiguration|DataProtectionConfig|AssociationConfig|OnSourceDDoSProtectionConfig|TokenDomains',
]);

Parameter Details

Result Syntax

[
    'configuration' => '<string>',
    'description' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Generate a rule configuration from a description

Generates a firewall rule configuration from a natural language description. The response contains the generated configuration as a JSON string, ready to use as the configuration of a rule.

$result = $client->generateRuleConfiguration([
    'clientToken' => '550e8400-e29b-41d4-a716-446655440015',
    'prompt' => 'Create a rate limiting rule that blocks IP addresses sending more than 2000 requests in 5 minutes',
    'ruleFirewallType' => 'WAF',
    'ruleType' => 'INSPECTION',
]);

Result syntax:

[
    'configuration' => '{"name":"rate-limit-rule","priority":1,"statement":{"rateBasedStatement":{"limit":2000,"evaluationWindowSec":300,"aggregateKeyType":"IP"}},"action":{"block":{}}}',
]

GetAdminAccount

$result = $client->getAdminAccount([/* ... */]);
$promise = $client->getAdminAccountAsync([/* ... */]);

Retrieves the details of the specified AWS Network Security Manager administrator account.

Parameter Syntax

$result = $client->getAdminAccount([
    'accountId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'adminAccountDetails' => [
        'adminAccount' => '<string>',
        'adminScope' => [
            'firewallTypeScope' => [
                'allFirewallTypesEnabled' => true || false,
                'firewallTypes' => ['<string>', ...],
            ],
            'scopeFilter' => [
                'excludeOnly' => [
                    'accounts' => [
                        [
                            'accountId' => '<string>',
                            'email' => '<string>',
                            'name' => '<string>',
                        ],
                        // ...
                    ],
                    'organizationalUnits' => [
                        [
                            'name' => '<string>',
                            'ouId' => '<string>',
                        ],
                        // ...
                    ],
                ],
                'includeAll' => [
                ],
                'includeOnly' => [
                    'accounts' => [
                        [
                            'accountId' => '<string>',
                            'email' => '<string>',
                            'name' => '<string>',
                        ],
                        // ...
                    ],
                    'organizationalUnits' => [
                        [
                            'name' => '<string>',
                            'ouId' => '<string>',
                        ],
                        // ...
                    ],
                ],
            ],
        ],
        'priority' => <integer>,
        'status' => 'ONBOARDED|OFFBOARDED',
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Get an administrator account

Retrieves the details and administrative scope of a Network Security Manager administrator account.

$result = $client->getAdminAccount([
    'accountId' => '234567890123',
]);

Result syntax:

[
    'adminAccountDetails' => [
        'adminAccount' => '234567890123',
        'adminScope' => [
            'firewallTypeScope' => [
                'allFirewallTypesEnabled' => ,
                'firewallTypes' => [
                    'WAF',
                ],
            ],
            'scopeFilter' => [
                'includeOnly' => [
                    'organizationalUnits' => [
                        [
                            'name' => 'Production',
                            'ouId' => 'ou-abcd-12345678',
                        ],
                    ],
                ],
            ],
        ],
        'priority' => 2,
        'status' => 'ONBOARDED',
    ],
]

GetDeployment

$result = $client->getDeployment([/* ... */]);
$promise = $client->getDeploymentAsync([/* ... */]);

Retrieves the details of the specified deployment, including coverage information and any warnings.

Parameter Syntax

$result = $client->getDeployment([
    'deploymentIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'associatedPolicyList' => [
        [
            'policyArn' => '<string>',
        ],
        // ...
    ],
    'associatedScopeList' => [
        [
            'scopeArn' => '<string>',
        ],
        // ...
    ],
    'deploymentArn' => '<string>',
    'deploymentConfiguration' => [
        'enableCrossAccountVisibility' => true || false,
    ],
    'deploymentCoverage' => [
        [
            'firewallType' => 'WAF|SHIELD_ADVANCED',
            'inScopeResourceTypes' => ['<string>', ...],
            'policyArns' => ['<string>', ...],
        ],
        // ...
    ],
    'deploymentDescription' => '<string>',
    'deploymentId' => '<string>',
    'deploymentName' => '<string>',
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
    'warnings' => [
        [
            'code' => '<string>',
            'message' => '<string>',
            'policyArn' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Get a deployment

Retrieves the current published version of a deployment by its base ARN, including per-firewall-type coverage showing which in-scope resource types each policy protects.

$result = $client->getDeployment([
    'deploymentIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456',
]);

Result syntax:

[
    'version' => '1',
    'associatedPolicyList' => [
        [
            'policyArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
        ],
    ],
    'associatedScopeList' => [
        [
            'scopeArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123',
        ],
    ],
    'deploymentArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456',
    'deploymentConfiguration' => [
        'enableCrossAccountVisibility' => ,
    ],
    'deploymentCoverage' => [
        [
            'firewallType' => 'WAF',
            'inScopeResourceTypes' => [
                'AWS::ElasticLoadBalancingV2::LoadBalancer::application',
                'AWS::CloudFront::Distribution',
            ],
            'policyArns' => [
                'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
            ],
        ],
    ],
    'deploymentDescription' => 'Production deployment for US East 1 region',
    'deploymentId' => 'def456',
    'deploymentName' => 'prod-us-east-1-deployment',
    'hasPublishedVersion' => 1,
    'isSnapshot' => ,
    'status' => 'ACTIVE',
    'updateToken' => 'f4a5b6c7-7d8e-4f9a-8b1c-1d2e3f4a5b6c',
]

GetPolicy

$result = $client->getPolicy([/* ... */]);
$promise = $client->getPolicyAsync([/* ... */]);

Retrieves the details of the specified policy.

Parameter Syntax

$result = $client->getPolicy([
    'policyIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'associatedTemplateAndRuleList' => [
        [
            'ruleArn' => '<string>',
            'templateArn' => '<string>',
        ],
        // ...
    ],
    'firewallType' => 'WAF|SHIELD_ADVANCED',
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'policyArn' => '<string>',
    'policyConfiguration' => [
        'remediationEnabled' => true || false,
        'resourcesCleanUp' => true || false,
        'wafConfig' => [
            'conflictResolution' => 'MERGE_WHERE_APPLICABLE',
            'existingCustomerWebACLResolution' => 'RETROFIT|OVERRIDE_ASSOCIATION|NO_REMEDIATION',
        ],
    ],
    'policyDescription' => '<string>',
    'policyId' => '<string>',
    'policyName' => '<string>',
    'priority' => <integer>,
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Get a policy

Retrieves the current published version of a policy by its base ARN, including its associated templates and rules and its enforcement configuration.

$result = $client->getPolicy([
    'policyIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
]);

Result syntax:

[
    'version' => '1',
    'associatedTemplateAndRuleList' => [
        [
            'templateArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789',
        ],
    ],
    'firewallType' => 'WAF',
    'hasPublishedVersion' => 1,
    'isSnapshot' => ,
    'policyArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
    'policyConfiguration' => [
        'remediationEnabled' => 1,
        'resourcesCleanUp' => ,
        'wafConfig' => [
            'conflictResolution' => 'MERGE_WHERE_APPLICABLE',
            'existingCustomerWebACLResolution' => 'NO_REMEDIATION',
        ],
    ],
    'policyDescription' => 'WAF policy for web application protection',
    'policyId' => 'xyz789',
    'policyName' => 'web-app-waf-policy',
    'priority' => 1,
    'status' => 'ACTIVE',
    'updateToken' => 'e3f4a5b6-6c7d-4e8f-9a0b-0c1d2e3f4a5b',
]

GetRule

$result = $client->getRule([/* ... */]);
$promise = $client->getRuleAsync([/* ... */]);

Retrieves the details of the specified rule.

Parameter Syntax

$result = $client->getRule([
    'ruleIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'configuration' => [
    ],
    'firewallType' => 'WAF',
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'ruleArn' => '<string>',
    'ruleDescription' => '<string>',
    'ruleId' => '<string>',
    'ruleName' => '<string>',
    'ruleType' => 'CONFIGURATION|INSPECTION',
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Get a rule

Retrieves the current published version of a rule by its base ARN.

$result = $client->getRule([
    'ruleIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123',
]);

Result syntax:

[
    'version' => '1',
    'configuration' => [
    ],
    'firewallType' => 'WAF',
    'hasPublishedVersion' => 1,
    'isSnapshot' => ,
    'ruleArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123',
    'ruleDescription' => 'Blocks requests from known malicious IP addresses',
    'ruleId' => 'abc123',
    'ruleName' => 'block-known-bad-ips',
    'ruleType' => 'INSPECTION',
    'status' => 'ACTIVE',
    'updateToken' => 'c1d2e3f4-4a5b-4c6d-9e7f-8a9b0c1d2e3f',
]

Example 2: Get a specific version of a rule

Retrieves a specific immutable version (snapshot) of a rule using a version-qualified ARN. The response has isSnapshot set to true. Omitting the version qualifier returns the current published rule instead.

$result = $client->getRule([
    'ruleIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123:3',
]);

Result syntax:

[
    'version' => '3',
    'configuration' => [
    ],
    'firewallType' => 'WAF',
    'isSnapshot' => 1,
    'ruleArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123:3',
    'ruleDescription' => 'Blocks requests from known malicious IP addresses',
    'ruleId' => 'abc123',
    'ruleName' => 'block-known-bad-ips',
    'ruleType' => 'INSPECTION',
    'status' => 'ACTIVE',
]

GetScope

$result = $client->getScope([/* ... */]);
$promise = $client->getScopeAsync([/* ... */]);

Retrieves the details of the specified scope.

Parameter Syntax

$result = $client->getScope([
    'scopeIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'scopeArn' => '<string>',
    'scopeConfiguration' => [
        'accountFilter' => [
            'exclude' => [
                'accountIds' => ['<string>', ...],
                'organizationalUnits' => ['<string>', ...],
            ],
            'include' => [
                'accountIds' => ['<string>', ...],
                'organizationalUnits' => ['<string>', ...],
            ],
            'includeAll' => [
            ],
        ],
        'resourceScopes' => [
            '<ScopeResourceType>' => [
                'exclude' => [
                    'explicitArns' => ['<string>', ...],
                    'expression' => [
                        'and' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                        'criteria' => [
                            'albConfig' => [
                                'ipAddressType' => 'ipv4|dualstack|dualstack-without-public-ipv4',
                                'scheme' => 'internet-facing|internal',
                            ],
                            'tags' => ['<string>', ...],
                        ],
                        'not' => [...], // RECURSIVE
                        'or' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                    ],
                ],
                'include' => [
                    'explicitArns' => ['<string>', ...],
                    'expression' => [
                        'and' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                        'criteria' => [
                            'albConfig' => [
                                'ipAddressType' => 'ipv4|dualstack|dualstack-without-public-ipv4',
                                'scheme' => 'internet-facing|internal',
                            ],
                            'tags' => ['<string>', ...],
                        ],
                        'not' => [...], // RECURSIVE
                        'or' => [
                            [...], // RECURSIVE
                            // ...
                        ],
                    ],
                ],
                'includeAll' => true || false,
            ],
            // ...
        ],
    ],
    'scopeDescription' => '<string>',
    'scopeId' => '<string>',
    'scopeName' => '<string>',
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Get a scope

Retrieves the current published version of a scope by its base ARN.

$result = $client->getScope([
    'scopeIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123',
]);

Result syntax:

[
    'version' => '1',
    'hasPublishedVersion' => 1,
    'isSnapshot' => ,
    'scopeArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123',
    'scopeConfiguration' => [
        'accountFilter' => [
            'includeAll' => [
            ],
        ],
        'resourceScopes' => [
        ],
    ],
    'scopeDescription' => 'Scope covering all production web application resources',
    'scopeId' => 'abc123',
    'scopeName' => 'production-web-apps',
    'status' => 'ACTIVE',
    'updateToken' => 'b0c4d1e2-3f4a-4b5c-8d6e-7f8a9b0c1d2e',
]

GetTemplate

$result = $client->getTemplate([/* ... */]);
$promise = $client->getTemplateAsync([/* ... */]);

Retrieves the details of the specified template.

Parameter Syntax

$result = $client->getTemplate([
    'templateIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'associatedRuleList' => [
        [
            'ruleArn' => '<string>',
        ],
        // ...
    ],
    'firewallType' => 'WAF',
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'templateArn' => '<string>',
    'templateDescription' => '<string>',
    'templateId' => '<string>',
    'templateName' => '<string>',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Get a template

Retrieves the current published version of a template by its base ARN, including its associated rules.

$result = $client->getTemplate([
    'templateIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789',
]);

Result syntax:

[
    'version' => '1',
    'associatedRuleList' => [
        [
            'ruleArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123',
        ],
    ],
    'firewallType' => 'WAF',
    'hasPublishedVersion' => 1,
    'isSnapshot' => ,
    'status' => 'ACTIVE',
    'templateArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789',
    'templateDescription' => 'Standard WAF template with baseline rule groups',
    'templateId' => 'xyz789',
    'templateName' => 'standard-waf-template',
    'updateToken' => 'd2e3f4a5-5b6c-4d7e-8f9a-9b0c1d2e3f4a',
]

ListAdminAccounts

$result = $client->listAdminAccounts([/* ... */]);
$promise = $client->listAdminAccountsAsync([/* ... */]);

Lists the AWS Network Security Manager administrator accounts in the organization.

Parameter Syntax

$result = $client->listAdminAccounts([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'adminAccounts' => [
        [
            'accountId' => '<string>',
            'email' => '<string>',
            'name' => '<string>',
            'priority' => <integer>,
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List administrator accounts

Lists the Network Security Manager administrator accounts for the organization.

$result = $client->listAdminAccounts([
    'maxResults' => 10,
]);

Result syntax:

[
    'adminAccounts' => [
        [
            'accountId' => '234567890123',
            'priority' => 2,
        ],
    ],
]

ListAggregateResourceSynchronizationStatuses

$result = $client->listAggregateResourceSynchronizationStatuses([/* ... */]);
$promise = $client->listAggregateResourceSynchronizationStatusesAsync([/* ... */]);

Lists the aggregated synchronization statuses of resources across the deployments in your administrator account. You can filter the results by synchronization status and page through them.

Parameter Syntax

$result = $client->listAggregateResourceSynchronizationStatuses([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'synchronizationStatus' => 'IN_SYNC|OUT_OF_SYNC|NOT_APPLICABLE',
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'resourceSynchronizationStatuses' => [
        [
            'accountId' => '<string>',
            'deploymentArn' => '<string>',
            'evaluatedAt' => <DateTime>,
            'outOfSyncReasons' => [
                'notVisible' => [
                    'reason' => '<string>',
                ],
                'reasons' => [
                    '<PolicyFirewallType>' => [
                        'invalidFirewall' => [
                            'incorrectAppendableConfigurationOrder' => [
                                [
                                    'actualValue' => '<string>',
                                    'configurationName' => '<string>',
                                    'expectedValue' => '<string>',
                                ],
                                // ...
                            ],
                            'incorrectSingleValueConfigurations' => [
                                [
                                    'actualValue' => '<string>',
                                    'configurationName' => '<string>',
                                    'expectedValue' => '<string>',
                                ],
                                // ...
                            ],
                            'missingAppendableConfigurationValues' => [
                                [
                                    'actualValue' => '<string>',
                                    'configurationName' => '<string>',
                                    'expectedValue' => '<string>',
                                ],
                                // ...
                            ],
                            'missingMergeableConfigurationValues' => [
                                [
                                    'actualValue' => '<string>',
                                    'configurationName' => '<string>',
                                    'expectedValue' => '<string>',
                                ],
                                // ...
                            ],
                            'unexpectedAppendableConfigurationValues' => [
                                [
                                    'actualValue' => '<string>',
                                    'configurationName' => '<string>',
                                    'expectedValue' => '<string>',
                                ],
                                // ...
                            ],
                            'unexpectedMergeableConfigurationValues' => [
                                [
                                    'actualValue' => '<string>',
                                    'configurationName' => '<string>',
                                    'expectedValue' => '<string>',
                                ],
                                // ...
                            ],
                        ],
                        'missingFirewall' => '<string>',
                    ],
                    // ...
                ],
            ],
            'remediationIssues' => [
                'issues' => [
                    '<PolicyFirewallType>' => [
                        'correctiveAction' => '<string>',
                        'issueType' => '<string>',
                        'message' => '<string>',
                    ],
                    // ...
                ],
                'notVisible' => [
                    'reason' => '<string>',
                ],
            ],
            'resourceArn' => '<string>',
            'resourceType' => 'AWS::ApiGateway::Stage|AWS::CloudFront::Distribution|AWS::EC2::EIP|AWS::ElasticLoadBalancingV2::LoadBalancer::application|AWS::ElasticLoadBalancing::LoadBalancer|AWS::WAFv2::WebACL|AWS::Shield::Protection|AWS::ShieldRegional::Protection',
            'synchronizationStatus' => 'IN_SYNC|OUT_OF_SYNC|NOT_APPLICABLE',
            'updatedAt' => <DateTime>,
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List synchronization statuses across all deployments

Lists the aggregate synchronization status of resources across all deployments in the account.

$result = $client->listAggregateResourceSynchronizationStatuses([
    'maxResults' => 10,
    'synchronizationStatus' => 'IN_SYNC',
]);

Result syntax:

[
    'resourceSynchronizationStatuses' => [
        [
            'accountId' => '234567890123',
            'evaluatedAt' => ,
            'resourceArn' => 'arn:aws:elasticloadbalancing:us-east-1:234567890123:loadbalancer/app/my-alb/50dc6c495c0c9188',
            'resourceType' => 'AWS::ElasticLoadBalancingV2::LoadBalancer::application',
            'synchronizationStatus' => 'IN_SYNC',
            'updatedAt' => ,
        ],
    ],
]

ListDeploymentSnapshots

$result = $client->listDeploymentSnapshots([/* ... */]);
$promise = $client->listDeploymentSnapshotsAsync([/* ... */]);

Lists the snapshots of the specified deployment.

Parameter Syntax

$result = $client->listDeploymentSnapshots([
    'deploymentIdentifier' => '<string>', // REQUIRED
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'snapshots' => [
        [
            'deploymentArn' => '<string>',
            'deploymentId' => '<string>',
            'deploymentName' => '<string>',
            'hasPublishedVersion' => true || false,
            'status' => 'DRAFT|ACTIVE|DISABLED',
            'updatedAt' => <DateTime>,
            'version' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List the snapshots of a deployment

Lists the immutable snapshots that have been created for a deployment.

$result = $client->listDeploymentSnapshots([
    'deploymentIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456',
    'maxResults' => 10,
]);

Result syntax:

[
    'snapshots' => [
        [
            'version' => '2',
            'deploymentArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456:2',
            'deploymentId' => 'def456',
            'deploymentName' => 'prod-us-east-1-deployment',
            'status' => 'ACTIVE',
            'updatedAt' => ,
        ],
    ],
]

ListDeployments

$result = $client->listDeployments([/* ... */]);
$promise = $client->listDeploymentsAsync([/* ... */]);

Lists the deployments in the account. You can filter the results by status and page through them using maxResults and nextToken.

Parameter Syntax

$result = $client->listDeployments([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'status' => 'ACTIVE|DRAFT|DISABLED',
]);

Parameter Details

Result Syntax

[
    'deployments' => [
        [
            'deploymentArn' => '<string>',
            'deploymentId' => '<string>',
            'deploymentName' => '<string>',
            'hasPublishedVersion' => true || false,
            'status' => 'DRAFT|ACTIVE|DISABLED',
            'updatedAt' => <DateTime>,
            'version' => '<string>',
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List deployments

Lists the published deployments in the account, one page at a time.

$result = $client->listDeployments([
    'maxResults' => 10,
    'status' => 'ACTIVE',
]);

Result syntax:

[
    'deployments' => [
        [
            'version' => '2',
            'deploymentArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456',
            'deploymentId' => 'def456',
            'deploymentName' => 'prod-us-east-1-deployment',
            'hasPublishedVersion' => 1,
            'status' => 'ACTIVE',
            'updatedAt' => ,
        ],
    ],
]

ListPolicies

$result = $client->listPolicies([/* ... */]);
$promise = $client->listPoliciesAsync([/* ... */]);

Lists the policies in the account. You can filter the results by status and page through them using maxResults and nextToken.

Parameter Syntax

$result = $client->listPolicies([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'status' => 'ACTIVE|DRAFT|DISABLED',
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'policies' => [
        [
            'firewallType' => 'WAF|SHIELD_ADVANCED',
            'hasPublishedVersion' => true || false,
            'policyArn' => '<string>',
            'policyId' => '<string>',
            'policyName' => '<string>',
            'priority' => <integer>,
            'status' => 'DRAFT|ACTIVE|DISABLED',
            'updatedAt' => <DateTime>,
            'version' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List policies

Lists the published policies in the account, one page at a time.

$result = $client->listPolicies([
    'maxResults' => 10,
    'status' => 'ACTIVE',
]);

Result syntax:

[
    'policies' => [
        [
            'version' => '2',
            'firewallType' => 'WAF',
            'hasPublishedVersion' => 1,
            'policyArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
            'policyId' => 'xyz789',
            'policyName' => 'web-app-waf-policy',
            'priority' => 2,
            'status' => 'ACTIVE',
            'updatedAt' => ,
        ],
    ],
]

ListPolicySnapshots

$result = $client->listPolicySnapshots([/* ... */]);
$promise = $client->listPolicySnapshotsAsync([/* ... */]);

Lists the snapshots of the specified policy.

Parameter Syntax

$result = $client->listPolicySnapshots([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'policyIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'snapshots' => [
        [
            'firewallType' => 'WAF|SHIELD_ADVANCED',
            'hasPublishedVersion' => true || false,
            'policyArn' => '<string>',
            'policyId' => '<string>',
            'policyName' => '<string>',
            'priority' => <integer>,
            'status' => 'DRAFT|ACTIVE|DISABLED',
            'updatedAt' => <DateTime>,
            'version' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List the snapshots of a policy

Lists the immutable snapshots that have been created for a policy.

$result = $client->listPolicySnapshots([
    'maxResults' => 10,
    'policyIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
]);

Result syntax:

[
    'snapshots' => [
        [
            'version' => '2',
            'firewallType' => 'WAF',
            'policyArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789:2',
            'policyId' => 'xyz789',
            'policyName' => 'web-app-waf-policy',
            'priority' => 2,
            'status' => 'ACTIVE',
            'updatedAt' => ,
        ],
    ],
]

ListResourceAssociations

$result = $client->listResourceAssociations([/* ... */]);
$promise = $client->listResourceAssociationsAsync([/* ... */]);

Lists the resources associated with the specified resource.

Parameter Syntax

$result = $client->listResourceAssociations([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'resourceIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'resourceAssociations' => [
        [
            'arn' => '<string>',
            'resourceType' => 'Rule|Template|Policy|Deployment|Scope',
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List what references a rule

Lists the resources that reference the given rule, such as the templates and policies it is associated with.

$result = $client->listResourceAssociations([
    'maxResults' => 10,
    'resourceIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123',
]);

Result syntax:

[
    'resourceAssociations' => [
        [
            'arn' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789',
            'resourceType' => 'Template',
        ],
        [
            'arn' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
            'resourceType' => 'Policy',
        ],
    ],
]

ListResourceSynchronizationStatuses

$result = $client->listResourceSynchronizationStatuses([/* ... */]);
$promise = $client->listResourceSynchronizationStatusesAsync([/* ... */]);

Lists the synchronization statuses of the resources covered by the specified deployment. You can filter the results by synchronization status and page through them.

Parameter Syntax

$result = $client->listResourceSynchronizationStatuses([
    'deploymentIdentifier' => '<string>', // REQUIRED
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'synchronizationStatus' => 'IN_SYNC|OUT_OF_SYNC|NOT_APPLICABLE',
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'resourceSynchronizationStatuses' => [
        [
            'accountId' => '<string>',
            'deploymentArn' => '<string>',
            'evaluatedAt' => <DateTime>,
            'outOfSyncReasons' => [
                'notVisible' => [
                    'reason' => '<string>',
                ],
                'reasons' => [
                    '<PolicyFirewallType>' => [
                        'invalidFirewall' => [
                            'incorrectAppendableConfigurationOrder' => [
                                [
                                    'actualValue' => '<string>',
                                    'configurationName' => '<string>',
                                    'expectedValue' => '<string>',
                                ],
                                // ...
                            ],
                            'incorrectSingleValueConfigurations' => [
                                [
                                    'actualValue' => '<string>',
                                    'configurationName' => '<string>',
                                    'expectedValue' => '<string>',
                                ],
                                // ...
                            ],
                            'missingAppendableConfigurationValues' => [
                                [
                                    'actualValue' => '<string>',
                                    'configurationName' => '<string>',
                                    'expectedValue' => '<string>',
                                ],
                                // ...
                            ],
                            'missingMergeableConfigurationValues' => [
                                [
                                    'actualValue' => '<string>',
                                    'configurationName' => '<string>',
                                    'expectedValue' => '<string>',
                                ],
                                // ...
                            ],
                            'unexpectedAppendableConfigurationValues' => [
                                [
                                    'actualValue' => '<string>',
                                    'configurationName' => '<string>',
                                    'expectedValue' => '<string>',
                                ],
                                // ...
                            ],
                            'unexpectedMergeableConfigurationValues' => [
                                [
                                    'actualValue' => '<string>',
                                    'configurationName' => '<string>',
                                    'expectedValue' => '<string>',
                                ],
                                // ...
                            ],
                        ],
                        'missingFirewall' => '<string>',
                    ],
                    // ...
                ],
            ],
            'remediationIssues' => [
                'issues' => [
                    '<PolicyFirewallType>' => [
                        'correctiveAction' => '<string>',
                        'issueType' => '<string>',
                        'message' => '<string>',
                    ],
                    // ...
                ],
                'notVisible' => [
                    'reason' => '<string>',
                ],
            ],
            'resourceArn' => '<string>',
            'resourceType' => 'AWS::ApiGateway::Stage|AWS::CloudFront::Distribution|AWS::EC2::EIP|AWS::ElasticLoadBalancingV2::LoadBalancer::application|AWS::ElasticLoadBalancing::LoadBalancer|AWS::WAFv2::WebACL|AWS::Shield::Protection|AWS::ShieldRegional::Protection',
            'synchronizationStatus' => 'IN_SYNC|OUT_OF_SYNC|NOT_APPLICABLE',
            'updatedAt' => <DateTime>,
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List out-of-sync resources for a deployment

Lists the resources tracked by a deployment that are out of sync, including the structured reason. Here a CloudFront distribution has no web ACL where the policy requires one.

$result = $client->listResourceSynchronizationStatuses([
    'deploymentIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456',
    'maxResults' => 10,
    'synchronizationStatus' => 'OUT_OF_SYNC',
]);

Result syntax:

[
    'resourceSynchronizationStatuses' => [
        [
            'accountId' => '123456789012',
            'deploymentArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456',
            'evaluatedAt' => ,
            'outOfSyncReasons' => [
                'reasons' => [
                    'WAF' => [
                        'missingFirewall' => 'No web ACL is associated with the resource',
                    ],
                ],
            ],
            'resourceArn' => 'arn:aws:cloudfront::123456789012:distribution/EDFDVBD6EXAMPLE',
            'resourceType' => 'AWS::CloudFront::Distribution',
            'synchronizationStatus' => 'OUT_OF_SYNC',
            'updatedAt' => ,
        ],
    ],
]

ListRuleSnapshots

$result = $client->listRuleSnapshots([/* ... */]);
$promise = $client->listRuleSnapshotsAsync([/* ... */]);

Lists the snapshots of the specified rule.

Parameter Syntax

$result = $client->listRuleSnapshots([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'ruleIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'snapshots' => [
        [
            'firewallType' => 'WAF',
            'hasPublishedVersion' => true || false,
            'ruleArn' => '<string>',
            'ruleId' => '<string>',
            'ruleName' => '<string>',
            'ruleType' => 'CONFIGURATION|INSPECTION',
            'status' => 'DRAFT|ACTIVE|DISABLED',
            'updatedAt' => <DateTime>,
            'version' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List the snapshots of a rule

Lists the immutable snapshots that have been created for a rule.

$result = $client->listRuleSnapshots([
    'maxResults' => 10,
    'ruleIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123',
]);

Result syntax:

[
    'snapshots' => [
        [
            'version' => '2',
            'firewallType' => 'WAF',
            'ruleArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123:2',
            'ruleId' => 'abc123',
            'ruleName' => 'block-known-bad-ips',
            'ruleType' => 'INSPECTION',
            'status' => 'ACTIVE',
            'updatedAt' => ,
        ],
        [
            'version' => '3',
            'firewallType' => 'WAF',
            'ruleArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123:3',
            'ruleId' => 'abc123',
            'ruleName' => 'block-known-bad-ips',
            'ruleType' => 'INSPECTION',
            'status' => 'ACTIVE',
            'updatedAt' => ,
        ],
    ],
]

ListRules

$result = $client->listRules([/* ... */]);
$promise = $client->listRulesAsync([/* ... */]);

Lists the rules in the account. You can filter the results by status and page through them using maxResults and nextToken.

Parameter Syntax

$result = $client->listRules([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'status' => 'ACTIVE|DRAFT|DISABLED',
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'rules' => [
        [
            'firewallType' => 'WAF',
            'hasPublishedVersion' => true || false,
            'ruleArn' => '<string>',
            'ruleId' => '<string>',
            'ruleName' => '<string>',
            'ruleType' => 'CONFIGURATION|INSPECTION',
            'status' => 'DRAFT|ACTIVE|DISABLED',
            'updatedAt' => <DateTime>,
            'version' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List rules

Lists the published rules in the account, one page at a time.

$result = $client->listRules([
    'maxResults' => 10,
    'status' => 'ACTIVE',
]);

Result syntax:

[
    'rules' => [
        [
            'version' => '2',
            'firewallType' => 'WAF',
            'hasPublishedVersion' => 1,
            'ruleArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:rule:abc123',
            'ruleId' => 'abc123',
            'ruleName' => 'block-known-bad-ips',
            'ruleType' => 'INSPECTION',
            'status' => 'ACTIVE',
            'updatedAt' => ,
        ],
    ],
]

ListScopeSnapshots

$result = $client->listScopeSnapshots([/* ... */]);
$promise = $client->listScopeSnapshotsAsync([/* ... */]);

Lists the snapshots of the specified scope.

Parameter Syntax

$result = $client->listScopeSnapshots([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'scopeIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'snapshots' => [
        [
            'hasPublishedVersion' => true || false,
            'scopeArn' => '<string>',
            'scopeId' => '<string>',
            'scopeName' => '<string>',
            'status' => 'DRAFT|ACTIVE|DISABLED',
            'updatedAt' => <DateTime>,
            'version' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List the snapshots of a scope

Lists the immutable snapshots that have been created for a scope.

$result = $client->listScopeSnapshots([
    'maxResults' => 10,
    'scopeIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123',
]);

Result syntax:

[
    'snapshots' => [
        [
            'version' => '2',
            'scopeArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123:2',
            'scopeId' => 'abc123',
            'scopeName' => 'production-web-apps',
            'status' => 'ACTIVE',
            'updatedAt' => ,
        ],
    ],
]

ListScopes

$result = $client->listScopes([/* ... */]);
$promise = $client->listScopesAsync([/* ... */]);

Lists the scopes in the account. You can filter the results by status and page through them using maxResults and nextToken.

Parameter Syntax

$result = $client->listScopes([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'status' => 'ACTIVE|DRAFT|DISABLED',
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'scopes' => [
        [
            'hasPublishedVersion' => true || false,
            'scopeArn' => '<string>',
            'scopeId' => '<string>',
            'scopeName' => '<string>',
            'status' => 'DRAFT|ACTIVE|DISABLED',
            'updatedAt' => <DateTime>,
            'version' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List scopes

Lists the published scopes in the account, one page at a time.

$result = $client->listScopes([
    'maxResults' => 10,
    'status' => 'ACTIVE',
]);

Result syntax:

[
    'nextToken' => 'eyJsYXN0RXZhbHVhdGVkS2V5IjoiYWJjMTIzIn0=',
    'scopes' => [
        [
            'version' => '2',
            'hasPublishedVersion' => 1,
            'scopeArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123',
            'scopeId' => 'abc123',
            'scopeName' => 'production-web-apps',
            'status' => 'ACTIVE',
            'updatedAt' => ,
        ],
    ],
]

ListTagsForResource

$result = $client->listTagsForResource([/* ... */]);
$promise = $client->listTagsForResourceAsync([/* ... */]);

Lists the tags associated with the specified resource.

Parameter Syntax

$result = $client->listTagsForResource([
    'resourceArn' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'tags' => ['<string>', ...],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List the tags on a resource

Lists the tags associated with a Network Security Manager resource.

$result = $client->listTagsForResource([
    'resourceArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
]);

Result syntax:

[
    'tags' => [
        'Environment' => 'Production',
        'Team' => 'NetworkSecurity',
    ],
]

ListTemplateSnapshots

$result = $client->listTemplateSnapshots([/* ... */]);
$promise = $client->listTemplateSnapshotsAsync([/* ... */]);

Lists the snapshots of the specified template.

Parameter Syntax

$result = $client->listTemplateSnapshots([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'templateIdentifier' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'snapshots' => [
        [
            'firewallType' => 'WAF',
            'hasPublishedVersion' => true || false,
            'status' => 'DRAFT|ACTIVE|DISABLED',
            'templateArn' => '<string>',
            'templateId' => '<string>',
            'templateName' => '<string>',
            'updatedAt' => <DateTime>,
            'version' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List the snapshots of a template

Lists the immutable snapshots that have been created for a template.

$result = $client->listTemplateSnapshots([
    'maxResults' => 10,
    'templateIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789',
]);

Result syntax:

[
    'snapshots' => [
        [
            'version' => '2',
            'firewallType' => 'WAF',
            'status' => 'ACTIVE',
            'templateArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789:2',
            'templateId' => 'xyz789',
            'templateName' => 'standard-waf-template',
            'updatedAt' => ,
        ],
    ],
]

ListTemplates

$result = $client->listTemplates([/* ... */]);
$promise = $client->listTemplatesAsync([/* ... */]);

Lists the templates in the account. You can filter the results by status and page through them using maxResults and nextToken.

Parameter Syntax

$result = $client->listTemplates([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'status' => 'ACTIVE|DRAFT|DISABLED',
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'templates' => [
        [
            'firewallType' => 'WAF',
            'hasPublishedVersion' => true || false,
            'status' => 'DRAFT|ACTIVE|DISABLED',
            'templateArn' => '<string>',
            'templateId' => '<string>',
            'templateName' => '<string>',
            'updatedAt' => <DateTime>,
            'version' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: List templates

Lists the published templates in the account, one page at a time.

$result = $client->listTemplates([
    'maxResults' => 10,
    'status' => 'ACTIVE',
]);

Result syntax:

[
    'templates' => [
        [
            'version' => '2',
            'firewallType' => 'WAF',
            'hasPublishedVersion' => 1,
            'status' => 'ACTIVE',
            'templateArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:template:xyz789',
            'templateId' => 'xyz789',
            'templateName' => 'standard-waf-template',
            'updatedAt' => ,
        ],
    ],
]

PutAdminAccount

$result = $client->putAdminAccount([/* ... */]);
$promise = $client->putAdminAccountAsync([/* ... */]);

Sets the AWS account that serves as an AWS Network Security Manager administrator account, and optionally configures the scope of resources that the administrator can manage.

You can't set an administrator account again immediately after you remove it, or while the service creates its service-linked role. Retry the request after a few minutes.

Parameter Syntax

$result = $client->putAdminAccount([
    'accountId' => '<string>', // REQUIRED
    'adminScope' => [
        'firewallTypeScope' => [
            'allFirewallTypesEnabled' => true || false,
            'firewallTypes' => ['<string>', ...],
        ],
        'scopeFilter' => [
            'excludeOnly' => [
                'accounts' => ['<string>', ...],
                'organizationalUnits' => ['<string>', ...],
            ],
            'includeAll' => [
            ],
            'includeOnly' => [
                'accounts' => ['<string>', ...],
                'organizationalUnits' => ['<string>', ...],
            ],
        ],
    ],
    'priority' => <integer>, // REQUIRED
]);

Parameter Details

Result Syntax

[
    'adminAccountDetails' => [
        'adminAccount' => '<string>',
        'adminScope' => [
            'firewallTypeScope' => [
                'allFirewallTypesEnabled' => true || false,
                'firewallTypes' => ['<string>', ...],
            ],
            'scopeFilter' => [
                'excludeOnly' => [
                    'accounts' => [
                        [
                            'accountId' => '<string>',
                            'email' => '<string>',
                            'name' => '<string>',
                        ],
                        // ...
                    ],
                    'organizationalUnits' => [
                        [
                            'name' => '<string>',
                            'ouId' => '<string>',
                        ],
                        // ...
                    ],
                ],
                'includeAll' => [
                ],
                'includeOnly' => [
                    'accounts' => [
                        [
                            'accountId' => '<string>',
                            'email' => '<string>',
                            'name' => '<string>',
                        ],
                        // ...
                    ],
                    'organizationalUnits' => [
                        [
                            'name' => '<string>',
                            'ouId' => '<string>',
                        ],
                        // ...
                    ],
                ],
            ],
        ],
        'priority' => <integer>,
        'status' => 'ONBOARDED|OFFBOARDED',
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ServiceQuotaExceededException:

The request would exceed a service quota.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

ServiceUnavailableException:

The service is temporarily unavailable. This is a retryable error.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Designate an administrator account

Designates an account as a Network Security Manager administrator, scoped to a specific organizational unit and the WAF firewall type.

$result = $client->putAdminAccount([
    'accountId' => '234567890123',
    'adminScope' => [
        'firewallTypeScope' => [
            'allFirewallTypesEnabled' => ,
            'firewallTypes' => [
                'WAF',
            ],
        ],
        'scopeFilter' => [
            'includeOnly' => [
                'organizationalUnits' => [
                    'ou-abcd-12345678',
                ],
            ],
        ],
    ],
    'priority' => 2,
]);

Result syntax:

[
    'adminAccountDetails' => [
        'adminAccount' => '234567890123',
        'adminScope' => [
            'firewallTypeScope' => [
                'allFirewallTypesEnabled' => ,
                'firewallTypes' => [
                    'WAF',
                ],
            ],
            'scopeFilter' => [
                'includeOnly' => [
                    'organizationalUnits' => [
                        [
                            'name' => 'Production',
                            'ouId' => 'ou-abcd-12345678',
                        ],
                    ],
                ],
            ],
        ],
        'priority' => 2,
        'status' => 'ONBOARDED',
    ],
]

TagResource

$result = $client->tagResource([/* ... */]);
$promise = $client->tagResourceAsync([/* ... */]);

Adds or overwrites the specified tags on the given resource.

Parameter Syntax

$result = $client->tagResource([
    'resourceArn' => '<string>', // REQUIRED
    'tags' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

TagPolicyViolationException:

The request violates a tag policy that is in effect for the account or organization.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Tag a resource

Adds tags to a Network Security Manager resource.

$result = $client->tagResource([
    'resourceArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
    'tags' => [
        'Environment' => 'Production',
        'Team' => 'NetworkSecurity',
    ],
]);

UntagResource

$result = $client->untagResource([/* ... */]);
$promise = $client->untagResourceAsync([/* ... */]);

Removes the specified tags from the given resource.

Parameter Syntax

$result = $client->untagResource([
    'resourceArn' => '<string>', // REQUIRED
    'tagKeys' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

TagPolicyViolationException:

The request violates a tag policy that is in effect for the account or organization.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Remove tags from a resource

Removes the specified tag keys from a Network Security Manager resource.

$result = $client->untagResource([
    'resourceArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
    'tagKeys' => [
        'Environment',
    ],
]);

UpdateDeployment

$result = $client->updateDeployment([/* ... */]);
$promise = $client->updateDeploymentAsync([/* ... */]);

Updates the specified deployment. To prevent conflicting concurrent updates, provide the current updateToken. Use isPublished to publish the update or keep the deployment as a draft.

Parameter Syntax

$result = $client->updateDeployment([
    'associatedPolicyList' => [
        [
            'policyIdentifier' => '<string>', // REQUIRED
        ],
        // ...
    ],
    'associatedScopeList' => [
        [
            'scopeIdentifier' => '<string>', // REQUIRED
        ],
        // ...
    ],
    'clientToken' => '<string>',
    'deploymentConfiguration' => [
        'enableCrossAccountVisibility' => true || false, // REQUIRED
    ],
    'deploymentDescription' => '<string>',
    'deploymentIdentifier' => '<string>', // REQUIRED
    'isPublished' => true || false, // REQUIRED
    'updateToken' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'associatedPolicyList' => [
        [
            'policyArn' => '<string>',
        ],
        // ...
    ],
    'associatedScopeList' => [
        [
            'scopeArn' => '<string>',
        ],
        // ...
    ],
    'deploymentArn' => '<string>',
    'deploymentConfiguration' => [
        'enableCrossAccountVisibility' => true || false,
    ],
    'deploymentCoverage' => [
        [
            'firewallType' => 'WAF|SHIELD_ADVANCED',
            'inScopeResourceTypes' => ['<string>', ...],
            'policyArns' => ['<string>', ...],
        ],
        // ...
    ],
    'deploymentDescription' => '<string>',
    'deploymentId' => '<string>',
    'deploymentName' => '<string>',
    'hasPublishedVersion' => true || false,
    'isSnapshot' => true || false,
    'status' => 'DRAFT|ACTIVE|DISABLED',
    'updateToken' => '<string>',
    'updatedAt' => <DateTime>,
    'version' => '<string>',
    'warnings' => [
        [
            'code' => '<string>',
            'message' => '<string>',
            'policyArn' => '<string>',
        ],
        // ...
    ],
]

Result Details

Errors

ValidationException:

The request failed validation. For details, see the reason and fieldList members of the response.

ServiceQuotaExceededException:

The request would exceed a service quota.

ConflictException:

The request conflicts with the current state of the resource. For example, the resource was modified concurrently, or it is in a state that does not allow the requested operation.

InternalServerException:

The request processing failed because of an internal error in the service. This is a retryable error.

AccessDeniedException:

You do not have sufficient permissions to perform this action.

ResourceNotFoundException:

The specified resource was not found. Verify that the resource identifier is correct and that the resource exists, then try your request again.

ThrottlingException:

The request was denied because of request throttling. Reduce your request rate and try again.

Examples

Example 1: Update a deployment and publish it

Updates the deployment's associations and publishes the change. The response includes deploymentCoverage showing which resource types the associated policies can protect. The updateToken from the most recent read is required for optimistic locking.

$result = $client->updateDeployment([
    'associatedPolicyList' => [
        [
            'policyIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
        ],
    ],
    'associatedScopeList' => [
        [
            'scopeIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123',
        ],
    ],
    'deploymentConfiguration' => [
        'enableCrossAccountVisibility' => 1,
    ],
    'deploymentDescription' => 'Production deployment for US East 1 region - updated',
    'deploymentIdentifier' => 'arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456',
    'isPublished' => 1,
    'updateToken' => 'f4a5b6c7-7d8e-4f9a-8b1c-1d2e3f4a5b6c',
]);

Result syntax:

[
    'version' => '2',
    'associatedPolicyList' => [
        [
            'policyArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
        ],
    ],
    'associatedScopeList' => [
        [
            'scopeArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:scope:abc123',
        ],
    ],
    'deploymentArn' => 'arn:aws:network-security-manager:us-east-1:123456789012:deployment:def456',
    'deploymentConfiguration' => [
        'enableCrossAccountVisibility' => 1,
    ],
    'deploymentCoverage' => [
        [
            'firewallType' => 'WAF',
            'inScopeResourceTypes' => [
                'AWS::ElasticLoadBalancingV2::LoadBalancer::application',
                'AWS::CloudFront::Distribution',
            ],
            'policyArns' => [
                'arn:aws:network-security-manager:us-east-1:123456789012:policy:xyz789',
            ],
        ],
    ],
    'deploymentDescription' => 'Production deployment for US East 1 region - updated',
    'deploymentId' => 'def456',
    'deploymentName' => 'prod-us-east-1-deployment',
    'hasPublishedVersion' => 1,
    'isSnapshot' => ,
    'status' => 'ACTIVE',
    'updateToken' => 'a5b6c7d8-8e9f-4a0b-9c1d-2e3f4a5b6c7d',
    'updatedAt' => ,
]

UpdatePolicy

$result = $client->updatePolicy([/* ... */]);
$promise = $client->updatePolicyAsync([/* ... */]);

Updates the specified policy. To prevent conflicting concurrent updates, provide the current updateToken. Use isPublished to publish the update or keep the policy as a draft.

Parameter Syntax

$result = $client->updatePolicy([
    'associatedTemplateAndRuleList' => [
        [
            'ruleIdentifier' => '<string>',
            'templateIdentifier' => '<string>',
        ],
        // ...
    ],
    'clientToken' => '<string>',
    'isPublished' => true || false, // REQUIRED
    'policyConfiguration' => [
        'remediationEnabled' => true || false, // REQUIRED
        'resourcesCleanUp' => true || false, // REQUIRED
        'wafConfig' => [
            'conflictResolution' => 'MERGE_WHERE_APPLICABLE', // REQUIRED
            'existingCustomerWebACLResolution' => 'RETROFIT|OVERRIDE_ASSOCIATION|NO_REMEDIATION', // REQUIRED
        ],
    ],
    'policyDescription' => '<string>',
    'policyIdentifier' => '<string>', // REQUIRED
    'priority' => <integer>,
    'updateToken' => '<string>', // REQUIRED
]);

Parameter Details