[ aws . route53resolver ]

create-firewall-rule-group

Description

Creates an empty DNS Firewall rule group for filtering DNS network traffic in a VPC. You can add rules to the new rule group by calling CreateFirewallRule .

See also: AWS API Documentation

See ‘aws help’ for descriptions of global parameters.

Synopsis

  create-firewall-rule-group
[--creator-request-id <value>]
--name <value>
[--tags <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]

Options

--creator-request-id (string)

A unique string defined by you to identify the request. This allows you to retry failed requests without the risk of running the operation twice. This can be any unique string, for example, a timestamp.

--name (string)

A name that lets you identify the rule group, to manage and use it.

--tags (list)

A list of the tag keys and values that you want to associate with the rule group.

(structure)

One tag that you want to add to the specified resource. A tag consists of a Key (a name for the tag) and a Value .

Key -> (string)

The name for the tag. For example, if you want to associate Resolver resources with the account IDs of your customers for billing purposes, the value of Key might be account-id .

Value -> (string)

The value for the tag. For example, if Key is account-id , then Value might be the ID of the customer account that you’re creating the resource for.

Shorthand Syntax:

Key=string,Value=string ...

JSON Syntax:

[
  {
    "Key": "string",
    "Value": "string"
  }
  ...
]

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command.

See ‘aws help’ for descriptions of global parameters.

Examples

To create a Firewall rule group

The following create-firewall-rule-group example creates a DNS Firewall rule group.

aws route53resolver create-firewall-rule-group \
    --creator-request-id my-request-id \
    --name test

Output:

{
    "FirewallRuleGroup": {
        "Id": "rslvr-frg-47f93271fexample",
        "Arn": "arn:aws:route53resolver:us-west-2:123456789012:firewall-rule-group/rslvr-frg-47f93271fexample",
        "Name": "test",
        "RuleCount": 0,
        "Status": "COMPLETE",
        "StatusMessage": "Created Firewall Rule Group",
        "OwnerId": "123456789012",
        "CreatorRequestId": "my-request-id",
        "ShareStatus": "NOT_SHARED",
        "CreationTime": "2021-05-25T18:59:26.490017Z",
        "ModificationTime": "2021-05-25T18:59:26.490017Z"
    }
}

For more information, see Managing rule groups and rules in DNS Firewall in the Amazon Route 53 Developer Guide.

Output

FirewallRuleGroup -> (structure)

A collection of rules used to filter DNS network traffic.

Id -> (string)

The ID of the rule group.

Arn -> (string)

The ARN (Amazon Resource Name) of the rule group.

Name -> (string)

The name of the rule group.

RuleCount -> (integer)

The number of rules in the rule group.

Status -> (string)

The status of the domain list.

StatusMessage -> (string)

Additional information about the status of the rule group, if available.

OwnerId -> (string)

The Amazon Web Services account ID for the account that created the rule group. When a rule group is shared with your account, this is the account that has shared the rule group with you.

CreatorRequestId -> (string)

A unique string defined by you to identify the request. This allows you to retry failed requests without the risk of running the operation twice. This can be any unique string, for example, a timestamp.

ShareStatus -> (string)

Whether the rule group is shared with other Amazon Web Services accounts, or was shared with the current account by another Amazon Web Services account. Sharing is configured through Resource Access Manager (RAM).

CreationTime -> (string)

The date and time that the rule group was created, in Unix time format and Coordinated Universal Time (UTC).

ModificationTime -> (string)

The date and time that the rule group was last modified, in Unix time format and Coordinated Universal Time (UTC).