NetworkFirewall / Client / create_container_association

create_container_association¶

NetworkFirewall.Client.create_container_association(**kwargs)¶

Creates a Network Firewall container association. The association monitors container lifecycle events in your Amazon ECS or Amazon EKS clusters and resolves running container addresses for use in firewall rules.

Request Syntax

response = client.create_container_association(
    ContainerAssociationName='string',
    Description='string',
    Type='ECS'|'EKS',
    ContainerMonitoringConfigurations=[
        {
            'ClusterArn': 'string',
            'AttributeFilters': [
                {
                    'Key': 'string',
                    'Value': 'string'
                },
            ]
        },
    ],
    Tags=[
        {
            'Key': 'string',
            'Value': 'string'
        },
    ]
)

Parameters:

ContainerAssociationName (string) –
[REQUIRED]

The descriptive name of the container association. You can’t change the name of a container association after you create it.
Description (string) – A description of the container association.
Type (string) –
[REQUIRED]

The type of containers to monitor. You can’t change the container type after creation. Valid values:
- ECS - Amazon Elastic Container Service
- EKS - Amazon Elastic Kubernetes Service
ContainerMonitoringConfigurations (list) –
[REQUIRED]

The monitoring configurations for the container association. Each configuration specifies an Amazon ECS or Amazon EKS cluster to monitor and optional attribute filters to narrow which containers are tracked.
- (dict) –
  
  Contains the monitoring configuration for a single cluster in a container association. Specifies the cluster ARN and optional attribute filters to narrow which containers are tracked.
  - ClusterArn (string) – [REQUIRED]
    
    The ARN of the Amazon ECS or Amazon EKS cluster to monitor. The cluster must be in the same Region and account as the container association.
  - AttributeFilters (list) –
    
    Key-value pairs that filter which containers are tracked. For Amazon EKS, you can filter by namespace and Kubernetes labels. For Amazon ECS, you can filter by container instance attributes (EC2 launch type only).
    - (dict) –
      
      A key-value filter pair used in container association monitoring configurations to narrow which containers are tracked.
      - Key (string) – [REQUIRED]
        
        The attribute key to filter on.
      - Value (string) – [REQUIRED]
        
        The attribute value to match.
Tags (list) –
The key:value pairs to associate with the resource.
- (dict) –
  
  A key:value pair associated with an Amazon Web Services resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as “environment”) and the tag value represents a specific value within that category (such as “test,” “development,” or “production”). You can add up to 50 tags to each Amazon Web Services resource.
  - Key (string) – [REQUIRED]
    
    The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as “customer.” Tag keys are case-sensitive.
  - Value (string) – [REQUIRED]
    
    The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as “companyA” or “companyB.” Tag values are case-sensitive.

Return type:

dict

Returns:

Response Syntax

{
    'ContainerAssociationName': 'string',
    'ContainerAssociationArn': 'string',
    'Description': 'string',
    'Type': 'ECS'|'EKS',
    'ContainerMonitoringConfigurations': [
        {
            'ClusterArn': 'string',
            'AttributeFilters': [
                {
                    'Key': 'string',
                    'Value': 'string'
                },
            ]
        },
    ],
    'Status': 'ACTIVE'|'CREATING'|'DELETING'|'UPDATING',
    'Tags': [
        {
            'Key': 'string',
            'Value': 'string'
        },
    ],
    'UpdateToken': 'string'
}

Response Structure

(dict) –
- ContainerAssociationName (string) –
  
  The descriptive name of the container association.
- ContainerAssociationArn (string) –
  
  The Amazon Resource Name (ARN) of the container association.
- Description (string) –
  
  A description of the container association.
- Type (string) –
  
  The container type. Valid values:
  - ECS - Amazon Elastic Container Service
  - EKS - Amazon Elastic Kubernetes Service
- ContainerMonitoringConfigurations (list) –
  
  The monitoring configurations for the container association.
  - (dict) –
    
    Contains the monitoring configuration for a single cluster in a container association. Specifies the cluster ARN and optional attribute filters to narrow which containers are tracked.
    - ClusterArn (string) –
      
      The ARN of the Amazon ECS or Amazon EKS cluster to monitor. The cluster must be in the same Region and account as the container association.
    - AttributeFilters (list) –
      
      Key-value pairs that filter which containers are tracked. For Amazon EKS, you can filter by namespace and Kubernetes labels. For Amazon ECS, you can filter by container instance attributes (EC2 launch type only).
      - (dict) –
        
        A key-value filter pair used in container association monitoring configurations to narrow which containers are tracked.
        
        Key (string) –
        
        The attribute key to filter on.
        
        Value (string) –
        
        The attribute value to match.
- Status (string) –
  
  The current status of the container association. For a new container association, the status is CREATING.
- Tags (list) –
  
  The key:value pairs to associate with the resource.
  - (dict) –
    
    A key:value pair associated with an Amazon Web Services resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as “environment”) and the tag value represents a specific value within that category (such as “test,” “development,” or “production”). You can add up to 50 tags to each Amazon Web Services resource.
    - Key (string) –
      
      The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as “customer.” Tag keys are case-sensitive.
    - Value (string) –
      
      The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as “companyA” or “companyB.” Tag values are case-sensitive.
- UpdateToken (string) –
  
  A token used for optimistic locking. Network Firewall returns a token to your requests that access the container association. The token marks the state of the container association resource at the time of the request.
  
  To make changes to the container association, you provide the token in your request. Network Firewall uses the token to ensure that the container association hasn’t changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the container association again to get a current copy of it with a current token. Reapply your changes as needed, then try the operation again using the new token.

Exceptions

NetworkFirewall.Client.exceptions.LimitExceededException
NetworkFirewall.Client.exceptions.InvalidRequestException
NetworkFirewall.Client.exceptions.ThrottlingException
NetworkFirewall.Client.exceptions.InternalServerError
NetworkFirewall.Client.exceptions.InsufficientCapacityException