[ aws . fms ]

get-protection-status

Description

If you created a Shield Advanced policy, returns policy-level attack summary information in the event of a potential DDoS attack. Other policy types are currently unsupported.

See also: AWS API Documentation

See ‘aws help’ for descriptions of global parameters.

Synopsis

  get-protection-status
--policy-id <value>
[--member-account-id <value>]
[--start-time <value>]
[--end-time <value>]
[--next-token <value>]
[--max-results <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]

Options

--policy-id (string)

The ID of the policy for which you want to get the attack information.

--member-account-id (string)

The AWS account that is in scope of the policy that you want to get the details for.

--start-time (timestamp)

The start of the time period to query for the attacks. This is a timestamp type. The request syntax listing indicates a number type because the default used by AWS Firewall Manager is Unix time in seconds. However, any valid timestamp format is allowed.

--end-time (timestamp)

The end of the time period to query for the attacks. This is a timestamp type. The request syntax listing indicates a number type because the default used by AWS Firewall Manager is Unix time in seconds. However, any valid timestamp format is allowed.

--next-token (string)

If you specify a value for MaxResults and you have more objects than the number that you specify for MaxResults , AWS Firewall Manager returns a NextToken value in the response, which you can use to retrieve another group of objects. For the second and subsequent GetProtectionStatus requests, specify the value of NextToken from the previous response to get information about another batch of objects.

--max-results (integer)

Specifies the number of objects that you want AWS Firewall Manager to return for this request. If you have more objects than the number that you specify for MaxResults , the response includes a NextToken value that you can use to get another batch of objects.

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command.

See ‘aws help’ for descriptions of global parameters.

Output

AdminAccountId -> (string)

The ID of the AWS Firewall administrator account for this policy.

ServiceType -> (string)

The service type that is protected by the policy. Currently, this is always SHIELD_ADVANCED .

Data -> (string)

Details about the attack, including the following:

• Attack type

• Account ID

• ARN of the resource attacked

• Start time of the attack

• End time of the attack (ongoing attacks will not have an end time)

The details are in JSON format.

NextToken -> (string)

If you have more objects than the number that you specified for MaxResults in the request, the response includes a NextToken value. To list more objects, submit another GetProtectionStatus request, and specify the NextToken value from the response in the NextToken value in the next request.

AWS SDKs provide auto-pagination that identify NextToken in a response and make subsequent request calls automatically on your behalf. However, this feature is not supported by GetProtectionStatus . You must submit subsequent requests with NextToken using your own processes.