delete-policy¶

Description¶

Permanently deletes an Firewall Manager policy.

Synopsis¶

  delete-policy
--policy-id <value>
[--delete-all-policy-resources | --no-delete-all-policy-resources]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]

Options¶

--policy-id (string)

The ID of the policy that you want to delete. You can retrieve this ID from PutPolicy and ListPolicies .

--delete-all-policy-resources | --no-delete-all-policy-resources (boolean)

If True , the request performs cleanup according to the policy type.

For WAF and Shield Advanced policies, the cleanup does the following:

Deletes rule groups created by Firewall Manager

Removes web ACLs from in-scope resources

Deletes web ACLs that contain no rules or rule groups

For security group policies, the cleanup does the following for each security group in the policy:

Disassociates the security group from in-scope resources

Deletes the security group if it was created through Firewall Manager and if it’s no longer associated with any resources through another policy

After the cleanup, in-scope resources are no longer protected by web ACLs in this policy. Protection of out-of-scope resources remains unchanged. Scope is determined by tags that you create and accounts that you associate with the policy. When creating the policy, if you specify that only resources in specific accounts or with specific tags are in scope of the policy, those accounts and resources are handled by the policy. All others are out of scope. If you don’t specify tags or accounts, all resources are in scope.

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

See ‘aws help’ for descriptions of global parameters.

Examples¶

Note

To use the following examples, you must have the AWS CLI installed and configured. See the Getting started guide in the AWS CLI User Guide for more information.

Unless otherwise stated, all examples have unix-like quotation rules. These examples will need to be adapted to your terminal’s quoting rules. See Using quotation marks with strings in the AWS CLI User Guide .

To delete a Firewall Manager policy

The following delete-policy example removes the policy with the specified ID, along with all of its resources.

aws fms delete-policy \
    --policy-id a1b2c3d4-5678-90ab-cdef-EXAMPLE11111 \
    --delete-all-policy-resources

This command produces no output.

For more information, see Working with AWS Firewall Manager Policies in the AWS WAF, AWS Firewall Manager, and AWS Shield Advanced Developer Guide.

Output¶

None

Table of Contents

Feedback

User Guide