Amazon Firewall Manager Policies API

openapi: 3.1.0
info:
  title: Firewall Management Service Policies API
  version: '2018-01-01'
  description: Generated from AWS's published Smithy model for Firewall Management Service. 4 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://fms.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
paths:
  /#DeletePolicy:
    post:
      operationId: DeletePolicy
      summary: Delete Policy
      description: Permanently deletes an Firewall Manager policy.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                type: string
        '400':
          description: InternalErrorException; InvalidInputException; InvalidOperationException; LimitExceededException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalErrorException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWSFMS_20180101.DeletePolicy
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/DeletePolicyRequest'
      tags:
      - Policies
  /#GetPolicy:
    post:
      operationId: GetPolicy
      summary: Get Policy
      description: Returns information about the specified Firewall Manager policy.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/GetPolicyResponse'
        '400':
          description: InternalErrorException; InvalidOperationException; InvalidTypeException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalErrorException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWSFMS_20180101.GetPolicy
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/GetPolicyRequest'
      tags:
      - Policies
  /#ListPolicies:
    post:
      operationId: ListPolicies
      summary: List Policies
      description: Returns an array of PolicySummary objects.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/ListPoliciesResponse'
        '400':
          description: InternalErrorException; InvalidOperationException; LimitExceededException; ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalErrorException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWSFMS_20180101.ListPolicies
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/ListPoliciesRequest'
      tags:
      - Policies
  /#PutPolicy:
    post:
      operationId: PutPolicy
      summary: Put Policy
      description: 'Creates an Firewall Manager policy. A Firewall Manager policy is specific to the individual policy type.
        If you want to enforce multiple policy types across accounts, you can create multiple policies. You can create more
        than one policy for each type. If you add a new account to an organization that you created with Organizations, Firewall
        Manager automatically applies the policy to the resources in that account that are within scope of the policy. Firewall
        Manager provides the following types of policies: WAF policy - This policy applies WAF web ACL protections to specified
        accounts and resources. Shield Advanced policy - This policy applies Shield Advanced protection to specified accounts
        and resources. Security Groups policy - This type of policy gives you control over security groups that are in use
        throughout your organization in Organizations and lets you enforce a baseline set of rules across your organization.
        Network ACL policy - This type of policy gives you control over the network ACLs that are in use throughout your organization
        in Organizations and lets you enforce a baseline set of first and last network ACL rules across your organization.
        Network Firewall policy - T'
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/PutPolicyResponse'
        '400':
          description: InternalErrorException; InvalidInputException; InvalidOperationException; InvalidTypeException; LimitExceededException;
            ResourceNotFoundException
          content:
            application/x-amz-json-1.1:
              schema:
                $ref: '#/components/schemas/InternalErrorException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - AWSFMS_20180101.PutPolicy
      requestBody:
        required: true
        content:
          application/x-amz-json-1.1:
            schema:
              $ref: '#/components/schemas/PutPolicyRequest'
      tags:
      - Policies
components:
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical
        request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: fms
  schemas:
    DeletePolicyRequest:
      type: object
      properties:
        PolicyId:
          type: string
          description: The ID of the policy that you want to delete. You can retrieve this ID from PutPolicy and ListPolicies.
        DeleteAllPolicyResources:
          type: boolean
          description: 'If True, the request performs cleanup according to the policy type. For WAF and Shield Advanced policies,
            the cleanup does the following: Deletes rule groups created by Firewall Manager Removes web ACLs from in-scope
            resources Deletes web ACLs that contain no rules or rule groups For security group policies, the cleanup does
            the following for each security group in the policy: Disassociates the security group from in-scope resources
            Deletes the security group if it was created through Firewall Manager and if it''s no longer associated with any
            resources through another policy For security group'
      required:
      - PolicyId
    GetPolicyRequest:
      type: object
      properties:
        PolicyId:
          type: string
          description: The ID of the Firewall Manager policy that you want the details for.
      required:
      - PolicyId
    GetPolicyResponse:
      type: object
      properties:
        Policy:
          $ref: '#/components/schemas/Policy'
        PolicyArn:
          type: string
          description: The Amazon Resource Name (ARN) of the specified policy.
    InternalErrorException:
      type: object
      properties:
        Message:
          type: string
    ListPoliciesRequest:
      type: object
      properties:
        NextToken:
          type: string
          description: If you specify a value for MaxResults and you have more PolicySummary objects than the number that
            you specify for MaxResults, Firewall Manager returns a NextToken value in the response that allows you to list
            another group of PolicySummary objects. For the second and subsequent ListPolicies requests, specify the value
            of NextToken from the previous response to get information about another batch of PolicySummary objects.
        MaxResults:
          type: integer
          description: Specifies the number of PolicySummary objects that you want Firewall Manager to return for this request.
            If you have more PolicySummary objects than the number that you specify for MaxResults, the response includes
            a NextToken value that you can use to get another batch of PolicySummary objects.
    ListPoliciesResponse:
      type: object
      properties:
        PolicyList:
          type: array
          items:
            $ref: '#/components/schemas/PolicySummary'
          description: An array of PolicySummary objects.
        NextToken:
          type: string
          description: If you have more PolicySummary objects than the number that you specified for MaxResults in the request,
            the response includes a NextToken value. To list more PolicySummary objects, submit another ListPolicies request,
            and specify the NextToken value from the response in the NextToken value in the next request.
    NetworkAclCommonPolicy:
      type: object
      properties:
        NetworkAclEntrySet:
          $ref: '#/components/schemas/NetworkAclEntrySet'
      required:
      - NetworkAclEntrySet
    NetworkAclEntry:
      type: object
      properties:
        IcmpTypeCode:
          $ref: '#/components/schemas/NetworkAclIcmpTypeCode'
        Protocol:
          type: string
          description: The protocol number. A value of "-1" means all protocols.
        PortRange:
          $ref: '#/components/schemas/NetworkAclPortRange'
        CidrBlock:
          type: string
          description: The IPv4 network range to allow or deny, in CIDR notation.
        Ipv6CidrBlock:
          type: string
          description: The IPv6 network range to allow or deny, in CIDR notation.
        RuleAction:
          type: string
          enum:
          - allow
          - deny
          description: Indicates whether to allow or deny the traffic that matches the rule.
        Egress:
          type: boolean
          description: Indicates whether the rule is an egress, or outbound, rule (applied to traffic leaving the subnet).
            If it's not an egress rule, then it's an ingress, or inbound, rule.
      required:
      - Protocol
      - RuleAction
      - Egress
    NetworkAclEntrySet:
      type: object
      properties:
        FirstEntries:
          type: array
          items:
            $ref: '#/components/schemas/NetworkAclEntry'
          description: The rules that you want to run first in the Firewall Manager managed network ACLs. Provide these in
            the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the
            network ACLs that it creates. You must specify at least one first entry or one last entry in any network ACL policy.
        ForceRemediateForFirstEntries:
          type: boolean
          description: Applies only when remediation is enabled for the policy as a whole. Firewall Manager uses this setting
            when it finds policy violations that involve conflicts between the custom entries and the policy entries. If forced
            remediation is disabled, Firewall Manager marks the network ACL as noncompliant and does not try to remediate.
            For more information about the remediation behavior, see Remediation for managed network ACLs in the Firewall
            Manager Developer Guide.
        LastEntries:
          type: array
          items:
            $ref: '#/components/schemas/NetworkAclEntry'
          description: The rules that you want to run last in the Firewall Manager managed network ACLs. Provide these in
            the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the
            network ACLs that it creates. You must specify at least one first entry or one last entry in any network ACL policy.
        ForceRemediateForLastEntries:
          type: boolean
          description: Applies only when remediation is enabled for the policy as a whole. Firewall Manager uses this setting
            when it finds policy violations that involve conflicts between the custom entries and the policy entries. If forced
            remediation is disabled, Firewall Manager marks the network ACL as noncompliant and does not try to remediate.
            For more information about the remediation behavior, see Remediation for managed network ACLs in the Firewall
            Manager Developer Guide.
      required:
      - ForceRemediateForFirstEntries
      - ForceRemediateForLastEntries
    NetworkAclIcmpTypeCode:
      type: object
      properties:
        Code:
          type: integer
          description: ICMP code.
        Type:
          type: integer
          description: ICMP type.
    NetworkAclPortRange:
      type: object
      properties:
        From:
          type: integer
          description: The beginning port number of the range.
        To:
          type: integer
          description: The ending port number of the range.
    NetworkFirewallPolicy:
      type: object
      properties:
        FirewallDeploymentModel:
          type: string
          enum:
          - CENTRALIZED
          - DISTRIBUTED
          description: Defines the deployment model to use for the firewall policy. To use a distributed model, set PolicyOption
            to NULL.
    Policy:
      type: object
      properties:
        PolicyId:
          type: string
          description: The ID of the Firewall Manager policy.
        PolicyName:
          type: string
          description: The name of the Firewall Manager policy.
        PolicyUpdateToken:
          type: string
          description: A unique identifier for each update to the policy. When issuing a PutPolicy request, the PolicyUpdateToken
            in the request must match the PolicyUpdateToken of the current policy version. To get the PolicyUpdateToken of
            the current policy version, use a GetPolicy request.
        SecurityServicePolicyData:
          $ref: '#/components/schemas/SecurityServicePolicyData'
        ResourceType:
          type: string
          description: 'The type of resource protected by or in scope of the policy. This is in the format shown in the Amazon
            Web Services Resource Types Reference. To apply this policy to multiple resource types, specify a resource type
            of ResourceTypeList and then specify the resource types in a ResourceTypeList. The following are valid resource
            types for each Firewall Manager policy type: Amazon Web Services WAF Classic - AWS::ApiGateway::Stage, AWS::CloudFront::Distribution,
            and AWS::ElasticLoadBalancingV2::LoadBalancer. WAF - AWS::ApiGateway::Stage, AWS::ElasticLoadBalancingV2::LoadBalancer,
            and AWS::CloudFront'
        ResourceTypeList:
          type: array
          items:
            type: string
          description: An array of ResourceType objects. Use this only to specify multiple resource types. To specify a single
            resource type, use ResourceType.
        ResourceTags:
          type: array
          items:
            $ref: '#/components/schemas/ResourceTag'
          description: An array of ResourceTag objects.
        ExcludeResourceTags:
          type: boolean
          description: If set to True, resources with the tags that are specified in the ResourceTag array are not in scope
            of the policy. If set to False, and the ResourceTag array is not null, only resources with the specified tags
            are in scope of the policy.
        RemediationEnabled:
          type: boolean
          description: Indicates if the policy should be automatically applied to new resources.
        DeleteUnusedFMManagedResources:
          type: boolean
          description: Indicates whether Firewall Manager should automatically remove protections from resources that leave
            the policy scope and clean up resources that Firewall Manager is managing for accounts when those accounts leave
            policy scope. For example, Firewall Manager will disassociate a Firewall Manager managed web ACL from a protected
            customer resource when the customer resource leaves policy scope. By default, Firewall Manager doesn't remove
            protections or delete Firewall Manager managed resources. This option is not available for Shield Advanced or
            WAF Classic policies.
        IncludeMap:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
          description: Specifies the Amazon Web Services account IDs and Organizations organizational units (OUs) to include
            in the policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child
            OUs, including any child OUs and accounts that are added at a later time. You can specify inclusions or exclusions,
            but not both. If you specify an IncludeMap, Firewall Manager applies the policy to all accounts specified by the
            IncludeMap, and does not evaluate any ExcludeMap specifications. If you do not specify an IncludeMap, then Firewall
            Manager applies the policy to all accounts
        ExcludeMap:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
          description: Specifies the Amazon Web Services account IDs and Organizations organizational units (OUs) to exclude
            from the policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child
            OUs, including any child OUs and accounts that are added at a later time. You can specify inclusions or exclusions,
            but not both. If you specify an IncludeMap, Firewall Manager applies the policy to all accounts specified by the
            IncludeMap, and does not evaluate any ExcludeMap specifications. If you do not specify an IncludeMap, then Firewall
            Manager applies the policy to all accoun
        ResourceSetIds:
          type: array
          items:
            type: string
          description: The unique identifiers of the resource sets used by the policy.
        PolicyDescription:
          type: string
          description: Your description of the Firewall Manager policy.
        PolicyStatus:
          type: string
          enum:
          - ACTIVE
          - OUT_OF_ADMIN_SCOPE
          description: Indicates whether the policy is in or out of an admin's policy or Region scope. ACTIVE - The administrator
            can manage and delete the policy. OUT_OF_ADMIN_SCOPE - The administrator can view the policy, but they can't edit
            or delete the policy. Existing policy protections stay in place. Any new resources that come into scope of the
            policy won't be protected.
        ResourceTagLogicalOperator:
          type: string
          enum:
          - AND
          - OR
          description: 'Specifies whether to combine multiple resource tags with AND, so that a resource must have all tags
            to be included or excluded, or OR, so that a resource must have at least one tag. Default: AND'
      required:
      - PolicyName
      - SecurityServicePolicyData
      - ResourceType
      - ExcludeResourceTags
      - RemediationEnabled
    PolicyOption:
      type: object
      properties:
        NetworkFirewallPolicy:
          $ref: '#/components/schemas/NetworkFirewallPolicy'
        ThirdPartyFirewallPolicy:
          $ref: '#/components/schemas/ThirdPartyFirewallPolicy'
        NetworkAclCommonPolicy:
          $ref: '#/components/schemas/NetworkAclCommonPolicy'
    PolicySummary:
      type: object
      properties:
        PolicyArn:
          type: string
          description: The Amazon Resource Name (ARN) of the specified policy.
        PolicyId:
          type: string
          description: The ID of the specified policy.
        PolicyName:
          type: string
          description: The name of the specified policy.
        ResourceType:
          type: string
          description: The type of resource protected by or in scope of the policy. This is in the format shown in the Amazon
            Web Services Resource Types Reference.
        SecurityServiceType:
          type: string
          enum:
          - WAF
          - WAFV2
          - SHIELD_ADVANCED
          - SECURITY_GROUPS_COMMON
          - SECURITY_GROUPS_CONTENT_AUDIT
          - SECURITY_GROUPS_USAGE_AUDIT
          - NETWORK_FIREWALL
          - DNS_FIREWALL
          - THIRD_PARTY_FIREWALL
          - IMPORT_NETWORK_FIREWALL
          - NETWORK_ACL_COMMON
          description: The service that the policy is using to protect the resources. This specifies the type of policy that
            is created, either an WAF policy, a Shield Advanced policy, or a security group policy.
        RemediationEnabled:
          type: boolean
          description: Indicates if the policy should be automatically applied to new resources.
        DeleteUnusedFMManagedResources:
          type: boolean
          description: Indicates whether Firewall Manager should automatically remove protections from resources that leave
            the policy scope and clean up resources that Firewall Manager is managing for accounts when those accounts leave
            policy scope. For example, Firewall Manager will disassociate a Firewall Manager managed web ACL from a protected
            customer resource when the customer resource leaves policy scope. By default, Firewall Manager doesn't remove
            protections or delete Firewall Manager managed resources. This option is not available for Shield Advanced or
            WAF Classic policies.
        PolicyStatus:
          type: string
          enum:
          - ACTIVE
          - OUT_OF_ADMIN_SCOPE
          description: Indicates whether the policy is in or out of an admin's policy or Region scope. ACTIVE - The administrator
            can manage and delete the policy. OUT_OF_ADMIN_SCOPE - The administrator can view the policy, but they can't edit
            or delete the policy. Existing policy protections stay in place. Any new resources that come into scope of the
            policy won't be protected.
    PutPolicyRequest:
      type: object
      properties:
        Policy:
          $ref: '#/components/schemas/Policy'
        TagList:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: The tags to add to the Amazon Web Services resource.
      required:
      - Policy
    PutPolicyResponse:
      type: object
      properties:
        Policy:
          $ref: '#/components/schemas/Policy'
        PolicyArn:
          type: string
          description: The Amazon Resource Name (ARN) of the policy.
    ResourceTag:
      type: object
      properties:
        Key:
          type: string
          description: The resource tag key.
        Value:
          type: string
          description: The resource tag value. To specify an empty string value, either don't provide this or specify it as
            "".
      required:
      - Key
    SecurityServicePolicyData:
      type: object
      properties:
        Type:
          type: string
          enum:
          - WAF
          - WAFV2
          - SHIELD_ADVANCED
          - SECURITY_GROUPS_COMMON
          - SECURITY_GROUPS_CONTENT_AUDIT
          - SECURITY_GROUPS_USAGE_AUDIT
          - NETWORK_FIREWALL
          - DNS_FIREWALL
          - THIRD_PARTY_FIREWALL
          - IMPORT_NETWORK_FIREWALL
          - NETWORK_ACL_COMMON
          description: The service that the policy is using to protect the resources. This specifies the type of policy that
            is created, either an WAF policy, a Shield Advanced policy, or a security group policy. For security group policies,
            Firewall Manager supports one security group for each common policy and for each content audit policy. This is
            an adjustable limit that you can increase by contacting Amazon Web Services Support.
        ManagedServiceData:
          type: string
          description: 'Details about the service that are specific to the service type, in JSON format. Example: DNS_FIREWALL
            "{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"
            Valid values for preProcessRuleGroups are between 1 and 99. Valid values for postProcessRuleGroups are between
            9901 and 10000. Example: IMPORT_NETWORK_FIREWALL "{\"type\":\"IMPORT_NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:netwo'
        PolicyOption:
          $ref: '#/components/schemas/PolicyOption'
      required:
      - Type
    Tag:
      type: object
      properties:
        Key:
          type: string
          description: Part of the key:value pair that defines a tag. You can use a tag key to describe a category of information,
            such as "customer." Tag keys are case-sensitive.
        Value:
          type: string
          description: Part of the key:value pair that defines a tag. You can use a tag value to describe a specific value
            within a category, such as "companyA" or "companyB." Tag values are case-sensitive.
      required:
      - Key
      - Value
    ThirdPartyFirewallPolicy:
      type: object
      properties:
        FirewallDeploymentModel:
          type: string
          enum:
          - CENTRALIZED
          - DISTRIBUTED
          description: Defines the deployment model to use for the third-party firewall policy.
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/3cd98287b471c106254abd89279cc87308d38bfd/models/fms/service/2018-01-01/fms-2018-01-01.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)