Shield

4 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

ShieldDRTAccess # CLOUD CONTROL · AWS::Shield::DRTAccess

ShieldDRTAccess manages AWS::Shield::DRTAccess through the AWS Cloud Control API.

kubectl get shielddrtaccesses · example on GitHub

Example

# ShieldDRTAccess — Shield
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/shield.html#shielddrtaccess
apiVersion: aws.konfig.io/v1alpha1
kind: ShieldDRTAccess
metadata:
  name: example-shielddrtaccess
  namespace: default
spec:
  logBucketList:
  - example
  providerRef:
    name: example-shielddrtaccess
    region: us-east-1
  roleArn: arn:aws:iam::123456789012:role/example-role

Spec

Field	Type	Required	Description
`logBucketList`	array<string>	—	Authorizes the Shield Response Team (SRT) to access the specified Amazon S3 bucket containing log data such as Application Load Balancer access logs, CloudFront logs, or logs from third party sources.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`roleArn`	string	yes	Authorizes the Shield Response Team (SRT) using the specified role, to access your AWS account to assist with DDoS attack mitigation during potential attacks.

Status

Field	Type	Required	Description
`accountId`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

ShieldProactiveEngagement # CLOUD CONTROL · AWS::Shield::ProactiveEngagement

ShieldProactiveEngagement manages AWS::Shield::ProactiveEngagement through the AWS Cloud Control API.

kubectl get shieldproactiveengagements · example on GitHub

Example

# ShieldProactiveEngagement — Shield
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/shield.html#shieldproactiveengagement
apiVersion: aws.konfig.io/v1alpha1
kind: ShieldProactiveEngagement
metadata:
  name: example-shieldproactiveengagement
  namespace: default
spec:
  emergencyContactList:
  - contactNotes: example
    emailAddress: ops@example.com
    phoneNumber: example
  proactiveEngagementStatus: ENABLED
  providerRef:
    name: example-shieldproactiveengagement
    region: us-east-1

Spec

Field	Type	Required	Description
`emergencyContactList`	array<object>	yes	A list of email addresses and phone numbers that the Shield Response Team (SRT) can use to contact you for escalations to the SRT and to initiate proactive customer support.
`emergencyContactList[].contactNotes`	string	—	Additional notes regarding the contact.
`emergencyContactList[].emailAddress`	string	yes	The email address for the contact.
`emergencyContactList[].phoneNumber`	string	—	The phone number for the contact
`proactiveEngagementStatus`	enum	yes	If `ENABLED`, the Shield Response Team (SRT) will use email and phone to notify contacts about escalations to the SRT and to initiate proactive customer support. Allowed: `ENABLED, DISABLED`
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`accountId`	string	—	Read-only: reported by AWS after creation.
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.

ShieldProtection # GA

ShieldProtection is the Schema for managing AWS Shield Advanced protections.

kubectl get shieldprotections · example on GitHub

Example

# ShieldProtection — Shield
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/shield.html#shieldprotection
apiVersion: aws.konfig.io/v1alpha1
kind: ShieldProtection
metadata:
  name: example-shieldprotection
  namespace: default
spec:
  name: example-shieldprotection
  providerRef:
    name: example-shieldprotection
    region: us-east-1
  resourceARN: arn:aws:iam::123456789012:role/example-role
  tags:
    environment: dev
    team: platform

Spec

Field	Type	Required	Description
`name`	string	yes	Name is the friendly name of the protection.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceARN`	string	yes	ResourceARN is the ARN of the resource to protect.
`tags`	map<string>	—	Tags are metadata tags for the protection.

Status

Field	Type	Required	Description
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is when the resource was last successfully reconciled.
`observedGeneration`	integer	—	ObservedGeneration is the most recent .metadata.generation reconciled.
`protectionArn`	string	—	ProtectionARN is the ARN of the protection.
`protectionID`	string	—	ProtectionID is the unique identifier of the Shield protection.

ShieldProtectionGroup # CLOUD CONTROL · AWS::Shield::ProtectionGroup

ShieldProtectionGroup manages AWS::Shield::ProtectionGroup through the AWS Cloud Control API.

kubectl get shieldprotectiongroups · example on GitHub

Example

# ShieldProtectionGroup — Shield
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/shield.html#shieldprotectiongroup
apiVersion: aws.konfig.io/v1alpha1
kind: ShieldProtectionGroup
metadata:
  name: example-shieldprotectiongroup
  namespace: default
spec:
  aggregation: SUM
  members:
  - example
  pattern: ALL
  protectionGroupId: example-id
  providerRef:
    name: example-shieldprotectiongroup
    region: us-east-1
  resourceType: CLOUDFRONT_DISTRIBUTION
  tags:
  - key: example
    value: example

Spec

Field	Type	Required	Description
`aggregation`	enum	yes	Defines how AWS Shield combines resource data for the group in order to detect, mitigate, and report events. Allowed: `SUM, MEAN, MAX`
`members`	array<string>	—	The Amazon Resource Names (ARNs) of the resources to include in the protection group.
`pattern`	enum	yes	The criteria to use to choose the protected resources for inclusion in the group. Allowed: `ALL, ARBITRARY, BY_RESOURCE_TYPE`
`protectionGroupId`	string	yes	The name of the protection group.
`providerRef`	object	—	ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
`providerRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`providerRef.region`	string	—	Region overrides the provider's region for this resource only.
`resourceType`	enum	—	The resource type to include in the protection group. Allowed: `CLOUDFRONT_DISTRIBUTION, ROUTE_53_HOSTED_ZONE, ELASTIC_IP_ALLOCATION, CLASSIC_LOAD_BALANCER, APPLICATION_LOAD_BALANCER, GLOBAL_ACCELERATOR`
`tags`	array<object>	—	One or more tag key-value pairs for the Protection object.
`tags[].key`	string	yes
`tags[].value`	string	yes

Status

Field	Type	Required	Description
`attempt`	integer	—	Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
`awsProvider`	object	—	AWSProvider confirms the account and region this resource was reconciled against.
`awsProvider.accountId`	string	—	AccountID the resource lives in.
`awsProvider.name`	string	—	Name of the AWSProvider used; empty when the operator's own credentials were used.
`awsProvider.region`	string	—	Region the resource lives in (empty for global services).
`conditions`	array<object>	—	Conditions describe the current state of the resource.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`identifier`	string	—	Identifier is the Cloud Control primary identifier of the resource.
`lastSyncTime`	string	—
`observedGeneration`	integer	—
`operation`	string	—	Operation is the in-flight operation (CREATE, UPDATE, DELETE).
`operationStatus`	string	—	OperationStatus is the last reported operation status.
`protectionGroupArn`	string	—	The ARN (Amazon Resource Name) of the protection group.
`requestToken`	string	—	RequestToken tracks an in-flight asynchronous operation.