Amazon Network Firewall Network Firewall Container Association API

openapi: 3.2.0
info:
  title: AWS Network Firewall Container Association API
  version: '2020-11-12'
  description: Generated from AWS's published Smithy model for AWS Network Firewall. 5 operation(s).
  contact:
    name: Amazon Web Services
    url: https://aws.amazon.com/contact-us/
  license:
    name: Apache 2.0
    identifier: Apache-2.0
    url: https://github.com/aws/api-models-aws/blob/main/LICENSE
servers:
- url: https://network-firewall.{region}.amazonaws.com
  variables:
    region:
      default: us-east-1
security:
- sigv4: []
tags:
- name: Container Association
paths:
  /#CreateContainerAssociation:
    post:
      operationId: CreateContainerAssociation
      summary: Create Container Association
      description: Creates a Network Firewall container association. The association monitors container lifecycle events in your Amazon ECS or Amazon EKS clusters and resolves running container addresses for use in firewall rules.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/CreateContainerAssociationResponse'
        '500':
          description: InsufficientCapacityException; InternalServerError
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InsufficientCapacityException'
        '400':
          description: InvalidRequestException; LimitExceededException; ThrottlingException
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InvalidRequestException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - NetworkFirewall_20201112.CreateContainerAssociation
      requestBody:
        required: true
        content:
          application/x-amz-json-1.0:
            schema:
              $ref: '#/components/schemas/CreateContainerAssociationRequest'
      tags:
      - Container Association
  /#DeleteContainerAssociation:
    post:
      operationId: DeleteContainerAssociation
      summary: Delete Container Association
      description: Deletes a container association. The resource transitions to a DELETING state. Deletion is asynchronous - Network Firewall returns immediately while cleanup proceeds in the background. You can't delete a container association while a rule group references it.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/DeleteContainerAssociationResponse'
        '500':
          description: InternalServerError
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InternalServerError'
        '400':
          description: InvalidOperationException; InvalidRequestException; ResourceNotFoundException; ThrottlingException
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InvalidOperationException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - NetworkFirewall_20201112.DeleteContainerAssociation
      requestBody:
        required: true
        content:
          application/x-amz-json-1.0:
            schema:
              $ref: '#/components/schemas/DeleteContainerAssociationRequest'
      tags:
      - Container Association
  /#DescribeContainerAssociation:
    post:
      operationId: DescribeContainerAssociation
      summary: Describe Container Association
      description: Retrieves the configuration and status of a container association.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/DescribeContainerAssociationResponse'
        '500':
          description: InternalServerError
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InternalServerError'
        '400':
          description: InvalidRequestException; ResourceNotFoundException; ThrottlingException
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InvalidRequestException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - NetworkFirewall_20201112.DescribeContainerAssociation
      requestBody:
        required: true
        content:
          application/x-amz-json-1.0:
            schema:
              $ref: '#/components/schemas/DescribeContainerAssociationRequest'
      tags:
      - Container Association
  /#ListContainerAssociations:
    post:
      operationId: ListContainerAssociations
      summary: List Container Associations
      description: Lists the container associations in your account and Region. Use the NextToken parameter in subsequent requests to retrieve additional results.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/ListContainerAssociationsResponse'
        '500':
          description: InternalServerError
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InternalServerError'
        '400':
          description: InvalidRequestException; ThrottlingException
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InvalidRequestException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - NetworkFirewall_20201112.ListContainerAssociations
      requestBody:
        required: true
        content:
          application/x-amz-json-1.0:
            schema:
              $ref: '#/components/schemas/ListContainerAssociationsRequest'
      tags:
      - Container Association
  /#UpdateContainerAssociation:
    post:
      operationId: UpdateContainerAssociation
      summary: Update Container Association
      description: Updates the monitoring configurations and description of a container association. You can't change the container type after creation. Provide an update token to enable optimistic concurrency control.
      responses:
        '200':
          description: Success
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/UpdateContainerAssociationResponse'
        '500':
          description: InternalServerError
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InternalServerError'
        '400':
          description: InvalidRequestException; InvalidTokenException; LimitExceededException; ResourceNotFoundException; ThrottlingException
          content:
            application/x-amz-json-1.0:
              schema:
                $ref: '#/components/schemas/InvalidRequestException'
      parameters:
      - name: X-Amz-Target
        in: header
        required: true
        schema:
          type: string
          enum:
          - NetworkFirewall_20201112.UpdateContainerAssociation
      requestBody:
        required: true
        content:
          application/x-amz-json-1.0:
            schema:
              $ref: '#/components/schemas/UpdateContainerAssociationRequest'
      tags:
      - Container Association
components:
  schemas:
    ContainerMonitoringConfiguration:
      type: object
      properties:
        ClusterArn:
          type: string
          description: The ARN of the Amazon ECS or Amazon EKS cluster to monitor. The cluster must be in the same Region and account as the container association.
        AttributeFilters:
          type: array
          items:
            $ref: '#/components/schemas/ContainerAttribute'
          description: Key-value pairs that filter which containers are tracked. For Amazon EKS, you can filter by namespace and Kubernetes labels. For Amazon ECS, you can filter by container instance attributes (EC2 launch type only). Attribute values can contain wildcard patterns, for example payments-*. Attribute keys must match exactly.
      required:
      - ClusterArn
    InternalServerError:
      type: object
      properties:
        Message:
          type: string
    Tag:
      type: object
      properties:
        Key:
          type: string
          description: The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive.
        Value:
          type: string
          description: The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.
      required:
      - Key
      - Value
    UpdateContainerAssociationRequest:
      type: object
      properties:
        ContainerAssociationName:
          type: string
          description: The descriptive name of the container association. You must specify the ARN or the name, and you can specify both.
        ContainerAssociationArn:
          type: string
          description: The Amazon Resource Name (ARN) of the container association. You must specify the ARN or the name, and you can specify both.
        Description:
          type: string
          description: A description of the container association. When omitted, the existing description remains unchanged. To clear the description, pass an empty string.
        Type:
          type: string
          enum:
          - ECS
          - EKS
          description: 'The container type. This value must match the existing type and can''t be changed. Valid values: ECS - Amazon Elastic Container Service EKS - Amazon Elastic Kubernetes Service'
        ContainerMonitoringConfigurations:
          type: array
          items:
            $ref: '#/components/schemas/ContainerMonitoringConfiguration'
          description: The updated monitoring configurations for the container association. Each configuration specifies an Amazon ECS or Amazon EKS cluster to monitor and optional attribute filters.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: The key:value pairs to associate with the resource.
        UpdateToken:
          type: string
          description: A token used for optimistic locking. Network Firewall returns a token to your requests that access the container association. The token marks the state of the container association resource at the time of the request. To make changes to the container association, you provide the token in your request. Network Firewall uses the token to ensure that the container association hasn't changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the container association again to get a current copy of it with a current token. Re
      required:
      - Type
      - ContainerMonitoringConfigurations
      - UpdateToken
    InvalidOperationException:
      type: object
      properties:
        Message:
          type: string
    DescribeContainerAssociationRequest:
      type: object
      properties:
        ContainerAssociationName:
          type: string
          description: The descriptive name of the container association. You must specify the ARN or the name, and you can specify both.
        ContainerAssociationArn:
          type: string
          description: The Amazon Resource Name (ARN) of the container association. You must specify the ARN or the name, and you can specify both.
    ListContainerAssociationsResponse:
      type: object
      properties:
        ContainerAssociations:
          type: array
          items:
            $ref: '#/components/schemas/ContainerAssociationSummary'
          description: The container association metadata objects for the account and Region.
        NextToken:
          type: string
          description: When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken value in the response. To retrieve the next batch of objects, use the token returned from the prior request in your next request.
    DeleteContainerAssociationResponse:
      type: object
      properties:
        ContainerAssociationName:
          type: string
          description: The descriptive name of the container association.
        ContainerAssociationArn:
          type: string
          description: The Amazon Resource Name (ARN) of the container association.
        Status:
          type: string
          enum:
          - ACTIVE
          - CREATING
          - DELETING
          - UPDATING
          description: The current status of the container association. After deletion is initiated, the status is DELETING.
    ContainerAssociationSummary:
      type: object
      properties:
        Arn:
          type: string
          description: The Amazon Resource Name (ARN) of the container association.
        Name:
          type: string
          description: The descriptive name of the container association.
    UpdateContainerAssociationResponse:
      type: object
      properties:
        ContainerAssociationName:
          type: string
          description: The descriptive name of the container association.
        ContainerAssociationArn:
          type: string
          description: The Amazon Resource Name (ARN) of the container association.
        Description:
          type: string
          description: A description of the container association.
        Type:
          type: string
          enum:
          - ECS
          - EKS
          description: 'The container type. Valid values: ECS - Amazon Elastic Container Service EKS - Amazon Elastic Kubernetes Service'
        ContainerMonitoringConfigurations:
          type: array
          items:
            $ref: '#/components/schemas/ContainerMonitoringConfiguration'
          description: The monitoring configurations for the container association.
        Status:
          type: string
          enum:
          - ACTIVE
          - CREATING
          - DELETING
          - UPDATING
          description: The current status of the container association.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: The key:value pairs to associate with the resource.
        UpdateToken:
          type: string
          description: A token used for optimistic locking. Network Firewall returns a token to your requests that access the container association. The token marks the state of the container association resource at the time of the request. To make changes to the container association, you provide the token in your request. Network Firewall uses the token to ensure that the container association hasn't changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the container association again to get a current copy of it with a current token. Re
    CreateContainerAssociationResponse:
      type: object
      properties:
        ContainerAssociationName:
          type: string
          description: The descriptive name of the container association.
        ContainerAssociationArn:
          type: string
          description: The Amazon Resource Name (ARN) of the container association.
        Description:
          type: string
          description: A description of the container association.
        Type:
          type: string
          enum:
          - ECS
          - EKS
          description: 'The container type. Valid values: ECS - Amazon Elastic Container Service EKS - Amazon Elastic Kubernetes Service'
        ContainerMonitoringConfigurations:
          type: array
          items:
            $ref: '#/components/schemas/ContainerMonitoringConfiguration'
          description: The monitoring configurations for the container association.
        Status:
          type: string
          enum:
          - ACTIVE
          - CREATING
          - DELETING
          - UPDATING
          description: The current status of the container association. For a new container association, the status is CREATING.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: The key:value pairs to associate with the resource.
        UpdateToken:
          type: string
          description: A token used for optimistic locking. Network Firewall returns a token to your requests that access the container association. The token marks the state of the container association resource at the time of the request. To make changes to the container association, you provide the token in your request. Network Firewall uses the token to ensure that the container association hasn't changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the container association again to get a current copy of it with a current token. Re
    ListContainerAssociationsRequest:
      type: object
      properties:
        MaxResults:
          type: integer
          description: The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in a subsequent call to get the next batch of objects.
        NextToken:
          type: string
          description: When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken value in the response. To retrieve the next batch of objects, use the token returned from the prior request in your next request.
    CreateContainerAssociationRequest:
      type: object
      properties:
        ContainerAssociationName:
          type: string
          description: The descriptive name of the container association. You can't change the name of a container association after you create it.
        Description:
          type: string
          description: A description of the container association.
        Type:
          type: string
          enum:
          - ECS
          - EKS
          description: 'The type of containers to monitor. You can''t change the container type after creation. Valid values: ECS - Amazon Elastic Container Service EKS - Amazon Elastic Kubernetes Service'
        ContainerMonitoringConfigurations:
          type: array
          items:
            $ref: '#/components/schemas/ContainerMonitoringConfiguration'
          description: The monitoring configurations for the container association. Each configuration specifies an Amazon ECS or Amazon EKS cluster to monitor and optional attribute filters to narrow which containers are tracked.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: The key:value pairs to associate with the resource.
      required:
      - ContainerAssociationName
      - Type
      - ContainerMonitoringConfigurations
    InsufficientCapacityException:
      type: object
      properties:
        Message:
          type: string
    InvalidRequestException:
      type: object
      properties:
        Message:
          type: string
    ContainerAttribute:
      type: object
      properties:
        Key:
          type: string
          description: The attribute key to filter on. For Amazon EKS, specify namespace to filter by namespace, or specify a Kubernetes label key. For Amazon ECS, specify a container instance attribute name. Keys don't support wildcards. Valid characters are letters, numbers, spaces, hyphens (-), underscores (_), periods (.), forward slashes (/), and colons (:).
        Value:
          type: string
          description: 'The attribute value to match. You can specify an exact value, such as payments-api, or a wildcard pattern, such as payments-*. Valid characters are letters, numbers, spaces, hyphens (-), underscores (_), periods (.), forward slashes (/), colons (:), asterisks (*), and backslashes (\). Network Firewall evaluates the value using the following rules: An asterisk (*) matches zero or more characters. For example, payments-* matches payments-, payments-api, and payments-api-v2, and *-prod matches web-prod. The pattern must match the entire value. For example, payments-* doesn''t match my-payments-api'
      required:
      - Key
      - Value
    DescribeContainerAssociationResponse:
      type: object
      properties:
        ContainerAssociationName:
          type: string
          description: The descriptive name of the container association.
        ContainerAssociationArn:
          type: string
          description: The Amazon Resource Name (ARN) of the container association.
        Description:
          type: string
          description: A description of the container association.
        Type:
          type: string
          enum:
          - ECS
          - EKS
          description: 'The container type. Valid values: ECS - Amazon Elastic Container Service EKS - Amazon Elastic Kubernetes Service'
        ContainerMonitoringConfigurations:
          type: array
          items:
            $ref: '#/components/schemas/ContainerMonitoringConfiguration'
          description: The monitoring configurations for the container association.
        Status:
          type: string
          enum:
          - ACTIVE
          - CREATING
          - DELETING
          - UPDATING
          description: The current status of the container association.
        ResolvedCidrCount:
          type: integer
          description: The number of CIDR blocks resolved from the monitored containers.
        LastUpdatedTime:
          type: string
          format: date-time
          description: The most recent time that Network Firewall updated the container association.
        Tags:
          type: array
          items:
            $ref: '#/components/schemas/Tag'
          description: The key:value pairs to associate with the resource.
        UpdateToken:
          type: string
          description: A token used for optimistic locking. Network Firewall returns a token to your requests that access the container association. The token marks the state of the container association resource at the time of the request. To make changes to the container association, you provide the token in your request. Network Firewall uses the token to ensure that the container association hasn't changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the container association again to get a current copy of it with a current token. Re
    DeleteContainerAssociationRequest:
      type: object
      properties:
        ContainerAssociationName:
          type: string
          description: The descriptive name of the container association. You must specify the ARN or the name, and you can specify both.
        ContainerAssociationArn:
          type: string
          description: The Amazon Resource Name (ARN) of the container association. You must specify the ARN or the name, and you can specify both.
  securitySchemes:
    sigv4:
      type: apiKey
      in: header
      name: Authorization
      description: AWS Signature Version 4. The Authorization header carries an AWS4-HMAC-SHA256 signature over the canonical request, with X-Amz-Date (and X-Amz-Security-Token for temporary credentials). Not a bearer token.
      x-aws-sigv4:
        signingName: network-firewall
x-provenance:
  method: harvested
  publisher: Amazon Web Services
  source: https://raw.githubusercontent.com/aws/api-models-aws/582e55931c45b944739742a2c1620b6026dd2d13/models/network-firewall/service/2020-11-12/network-firewall-2020-11-12.json
  note: converted by smithy-to-openapi.py from AWS's Smithy model (roadmap#1001)