Firewall Manager

3 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

FMSNotificationChannel # CLOUD CONTROL · AWS::FMS::NotificationChannel

FMSNotificationChannel manages AWS::FMS::NotificationChannel through the AWS Cloud Control API.

kubectl get fmsnotificationchannels · example on GitHub

Example

# FMSNotificationChannel — Firewall Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/fms.html#fmsnotificationchannel
apiVersion: aws.konfig.io/v1alpha1
kind: FMSNotificationChannel
metadata:
  name: example-fmsnotificationchannel
  namespace: default
spec:
  providerRef:
    name: example-fmsnotificationchannel
    region: us-east-1
  snsRoleName: example-fmsnotificationchannel
  snsTopicArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`snsRoleName`	string	yes
`snsTopicArn`	string	yes	Create-only in AWS: changing it requires replacing the resource.

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

FMSPolicy # CLOUD CONTROL · AWS::FMS::Policy

FMSPolicy manages AWS::FMS::Policy through the AWS Cloud Control API.

kubectl get fmspolicies · example on GitHub

Example

# FMSPolicy — Firewall Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/fms.html#fmspolicy
apiVersion: aws.konfig.io/v1alpha1
kind: FMSPolicy
metadata:
  name: example-fmspolicy
  namespace: default
spec:
  deleteAllPolicyResources: false
  excludeMap:
    account:
    - example
    orgunit:
    - example
  excludeResourceTags: false
  includeMap:
    account:
    - example
    orgunit:
    - example
  policyDescription: Managed by konfig-konector
  policyName: example-fmspolicy
  providerRef:
    name: example-fmspolicy
    region: us-east-1
  remediationEnabled: true
  resourceSetIds:
  - example
  resourceTagLogicalOperator: AND
  resourceTags:
  - key: example
    value: example
  resourceType: example
  resourceTypeList:
  - example
  resourcesCleanUp: false
  securityServicePolicyData:
    managedServiceData: example
    policyOption:
      networkAclCommonPolicy:
        networkAclEntrySet:
          firstEntries:
          - cidrBlock: 10.0.0.0/16
            egress: false
            ipv6CidrBlock: 2001:db8::/56
            protocol: example
            ruleAction: allow
          forceRemediateForFirstEntries: false
          forceRemediateForLastEntries: false
          lastEntries:
          - cidrBlock: 10.0.0.0/16
            egress: false
            ipv6CidrBlock: 2001:db8::/56
            protocol: example
            ruleAction: allow
      networkFirewallPolicy:
        firewallDeploymentModel: DISTRIBUTED
      thirdPartyFirewallPolicy:
        firewallDeploymentModel: DISTRIBUTED
    type: WAF
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`deleteAllPolicyResources`	boolean	—
`excludeMap`	object	—	FMSPolicyIEMap is a nested property type of AWS::FMS::Policy.
`excludeMap.account`	array<string>	—
`excludeMap.orgunit`	array<string>	—
`excludeResourceTags`	boolean	yes
`includeMap`	object	—	FMSPolicyIEMap is a nested property type of AWS::FMS::Policy.
`includeMap.account`	array<string>	—
`includeMap.orgunit`	array<string>	—
`policyDescription`	string	—
`policyName`	string	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`remediationEnabled`	boolean	yes
`resourceSetIds`	array<string>	—
`resourceTagLogicalOperator`	enum	—	Allowed: `AND, OR`
`resourceTags`	array<object>	—
`resourceTags[].key`	string	yes
`resourceTags[].value`	string	yes
`resourceType`	string	—
`resourceTypeList`	array<string>	—
`resourcesCleanUp`	boolean	—
`securityServicePolicyData`	object	yes	FMSPolicySecurityServicePolicyData is a nested property type of AWS::FMS::Policy.
`securityServicePolicyData.managedServiceData`	string	—
`securityServicePolicyData.policyOption`	object	—	FMSPolicyPolicyOption is a nested property type of AWS::FMS::Policy.
`securityServicePolicyData.policyOption.networkAclCommonPolicy`	object	—	FMSPolicyNetworkAclCommonPolicy is a nested property type of AWS::FMS::Policy.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet`	object	yes	FMSPolicyNetworkAclEntrySet is a nested property type of AWS::FMS::Policy.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.firstEntries`	array<object>	—
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.firstEntries[].cidrBlock`	string	—	CIDR block.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.firstEntries[].egress`	boolean	yes	Whether the entry is an egress entry.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.firstEntries[].icmpTypeCode`	object	—	ICMP type and code.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.firstEntries[].ipv6CidrBlock`	string	—	IPv6 CIDR block.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.firstEntries[].portRange`	object	—	Port range.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.firstEntries[].protocol`	string	yes	Protocol.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.firstEntries[].ruleAction`	enum	yes	Rule Action. Allowed: `allow, deny`
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.forceRemediateForFirstEntries`	boolean	yes
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.forceRemediateForLastEntries`	boolean	yes
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.lastEntries`	array<object>	—
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.lastEntries[].cidrBlock`	string	—	CIDR block.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.lastEntries[].egress`	boolean	yes	Whether the entry is an egress entry.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.lastEntries[].icmpTypeCode`	object	—	ICMP type and code.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.lastEntries[].ipv6CidrBlock`	string	—	IPv6 CIDR block.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.lastEntries[].portRange`	object	—	Port range.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.lastEntries[].protocol`	string	yes	Protocol.
`securityServicePolicyData.policyOption.networkAclCommonPolicy.networkAclEntrySet.lastEntries[].ruleAction`	enum	yes	Rule Action. Allowed: `allow, deny`
`securityServicePolicyData.policyOption.networkFirewallPolicy`	object	—	FMSPolicyNetworkFirewallPolicy is a nested property type of AWS::FMS::Policy.
`securityServicePolicyData.policyOption.networkFirewallPolicy.firewallDeploymentModel`	enum	yes	Allowed: `DISTRIBUTED, CENTRALIZED`
`securityServicePolicyData.policyOption.thirdPartyFirewallPolicy`	object	—	FMSPolicyThirdPartyFirewallPolicy is a nested property type of AWS::FMS::Policy.
`securityServicePolicyData.policyOption.thirdPartyFirewallPolicy.firewallDeploymentModel`	enum	yes	Allowed: `DISTRIBUTED, CENTRALIZED`
`securityServicePolicyData.type`	enum	yes	Allowed: `WAF, WAFV2, SHIELD_ADVANCED, SECURITY_GROUPS_COMMON, SECURITY_GROUPS_CONTENT_AUDIT, SECURITY_GROUPS_USAGE_AUDIT, NETWORK_FIREWALL, THIRD_PARTY_FIREWALL…`
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`arn`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

FMSResourceSet # CLOUD CONTROL · AWS::FMS::ResourceSet

FMSResourceSet manages AWS::FMS::ResourceSet through the AWS Cloud Control API.

kubectl get fmsresourcesets · example on GitHub

Example

# FMSResourceSet — Firewall Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/fms.html#fmsresourceset
apiVersion: aws.konfig.io/v1alpha1
kind: FMSResourceSet
metadata:
  name: example-fmsresourceset
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-fmsresourceset
  providerRef:
    name: example-fmsresourceset
    region: us-east-1
  resourceTypeList:
  - example
  resources:
  - example
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`description`	string	—
`name`	string	yes
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceTypeList`	array<string>	yes
`resources`	array<string>	—
`tags`	array<object>	—
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`id`	string	—	Read-only: reported by AWS after creation.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.