NetworkSecurityManagerCustomerAPI / Client / create_policy

create_policy

NetworkSecurityManagerCustomerAPI.Client.create_policy(**kwargs)

Creates a policy. A policy combines templates and rules with enforcement settings for a firewall type, such as AWS WAF or AWS Shield Advanced. Use isPublished to create the policy in published ( ACTIVE) or draft ( DRAFT) state.

See also: AWS API Documentation

Request Syntax

response = client.create_policy(
    clientToken='string',
    policyName='string',
    policyDescription='string',
    priority=123,
    associatedTemplateAndRuleList=[
        {
            'templateIdentifier': 'string',
            'ruleIdentifier': 'string'
        },
    ],
    firewallType='WAF'|'SHIELD_ADVANCED',
    policyConfiguration={
        'remediationEnabled': True|False,
        'resourcesCleanUp': True|False,
        'wafConfig': {
            'existingCustomerWebACLResolution': 'RETROFIT'|'OVERRIDE_ASSOCIATION'|'NO_REMEDIATION',
            'conflictResolution': 'MERGE_WHERE_APPLICABLE'
        }
    },
    isPublished=True|False,
    tags={
        'string': 'string'
    }
)
Parameters:

  • clientToken (string) –

    A unique, case-sensitive token that you provide to ensure that the operation completes no more than one time. If you retry a request with the same client token and the same parameters, the service returns the result of the original successful request.

    This field is autopopulated if not provided.

  • policyName (string) –

    [REQUIRED]

    The name of the policy.

  • policyDescription (string) – A description of the policy.

  • priority (integer) –

    [REQUIRED]

    The priority of the resource. A lower number indicates a higher priority.

  • associatedTemplateAndRuleList (list) –

    The templates and rules to associate with the policy. For AWS WAF policies, specify 1 to 100 templates or rules, of which at most 2 can be templates. For AWS Shield Advanced policies, this list must be empty.

    • (dict) –

      A reference to either a template or a rule in a create or update request. Set exactly one of templateIdentifier or ruleIdentifier.

      Note

      This is a Tagged Union structure. Only one of the following top level keys can be set: templateIdentifier, ruleIdentifier.

      • templateIdentifier (string) –

        The identifier of the template. This is the template’s Amazon Resource Name (ARN).

      • ruleIdentifier (string) –

        The identifier of the rule. This is the rule’s Amazon Resource Name (ARN).

  • firewallType (string) –

    [REQUIRED]

    The firewall type associated with the resource.

  • policyConfiguration (dict) –

    [REQUIRED]

    The configuration settings that control the policy’s behavior, including remediation and firewall-type-specific settings.

    • remediationEnabled (boolean) – [REQUIRED]

      Specifies whether AWS Network Security Manager automatically remediates noncompliant resources. Default: false.

    • resourcesCleanUp (boolean) – [REQUIRED]

      Specifies whether AWS Network Security Manager automatically removes the resources it created when they are no longer needed. Default: false.

    • wafConfig (dict) –

      AWS WAF-specific policy settings. This is populated only for AWS WAF policies.

      • existingCustomerWebACLResolution (string) – [REQUIRED]

        Determines how AWS Network Security Manager handles remediation when a resource already has a customer-created web ACL. Required for AWS WAF policies.

      • conflictResolution (string) – [REQUIRED]

        The conflict-resolution strategy for AWS WAF policies. Required for AWS WAF policies.

  • isPublished (boolean) – Specifies whether to publish the resource. When true, the resource is saved in published ( ACTIVE) state. When false, it is saved as a draft ( DRAFT). Default: true.

  • tags (dict) –

    The tags to add to the resource when it is created.

    • (string) –

      • (string) –

Return type:

dict

Returns:

Response Syntax

{
    'policyId': 'string',
    'policyArn': 'string',
    'policyName': 'string',
    'policyDescription': 'string',
    'status': 'DRAFT'|'ACTIVE'|'DISABLED',
    'priority': 123,
    'associatedTemplateAndRuleList': [
        {
            'templateArn': 'string',
            'ruleArn': 'string'
        },
    ],
    'version': 'string',
    'updateToken': 'string',
    'isSnapshot': True|False,
    'hasPublishedVersion': True|False,
    'firewallType': 'WAF'|'SHIELD_ADVANCED',
    'policyConfiguration': {
        'remediationEnabled': True|False,
        'resourcesCleanUp': True|False,
        'wafConfig': {
            'existingCustomerWebACLResolution': 'RETROFIT'|'OVERRIDE_ASSOCIATION'|'NO_REMEDIATION',
            'conflictResolution': 'MERGE_WHERE_APPLICABLE'
        }
    },
    'updatedAt': datetime(2015, 1, 1)
}

Response Structure

  • (dict) –

    • policyId (string) –

      The service-generated id of the policy.

    • policyArn (string) –

      The Amazon Resource Name (ARN) of the policy.

    • policyName (string) –

      The name of the policy.

    • policyDescription (string) –

      A description of the policy.

    • status (string) –

      The current status of the resource: DRAFT (unpublished, editable) or ACTIVE (published, in use).

    • priority (integer) –

      The priority of the resource. A lower number indicates a higher priority.

    • associatedTemplateAndRuleList (list) –

      The templates and rules associated with the policy. For AWS WAF policies, this list contains 1 to 100 templates or rules, of which at most 2 can be templates. For AWS Shield Advanced policies, this list is empty.

      • (dict) –

        An association between a policy and either a template or a rule, as returned in outputs. Exactly one of templateArn or ruleArn is set. The corresponding request structure is TemplateOrRuleReference.

        Note

        This is a Tagged Union structure. Only one of the following top level keys will be set: templateArn, ruleArn. If a client receives an unknown member it will set SDK_UNKNOWN_MEMBER as the top level key, which maps to the name or tag of the unknown member. The structure of SDK_UNKNOWN_MEMBER is as follows:

        'SDK_UNKNOWN_MEMBER': {'name': 'UnknownMemberName'}

        • templateArn (string) –

          The ARN of the associated template.

        • ruleArn (string) –

          The ARN of the associated rule.

    • version (string) –

      The version of the resource.

    • updateToken (string) –

      A token used for optimistic concurrency control. Each read and write returns an updateToken. Provide the most recent value on your next update to detect and prevent conflicting concurrent modifications.

    • isSnapshot (boolean) –

      Specifies whether the resource is a snapshot of a published version.

    • hasPublishedVersion (boolean) –

      Specifies whether a published version of the resource exists.

    • firewallType (string) –

      The firewall type associated with the resource.

    • policyConfiguration (dict) –

      The configuration settings that control the policy’s behavior, including remediation and firewall-type-specific settings.

      • remediationEnabled (boolean) –

        Specifies whether AWS Network Security Manager automatically remediates noncompliant resources. Default: false.

      • resourcesCleanUp (boolean) –

        Specifies whether AWS Network Security Manager automatically removes the resources it created when they are no longer needed. Default: false.

      • wafConfig (dict) –

        AWS WAF-specific policy settings. This is populated only for AWS WAF policies.

        • existingCustomerWebACLResolution (string) –

          Determines how AWS Network Security Manager handles remediation when a resource already has a customer-created web ACL. Required for AWS WAF policies.

        • conflictResolution (string) –

          The conflict-resolution strategy for AWS WAF policies. Required for AWS WAF policies.

    • updatedAt (datetime) –

      The time when the resource was last updated.

Exceptions