policies

Creates, updates, deletes or gets a policy resource or lists policies in a region

Overview

Name	policies
Type	Resource
Description	Creates an AWS Firewall Manager policy.
Id	aws.fms.policies

Fields

Name	Datatype	Description
exclude_map	object	An FMS includeMap or excludeMap.
exclude_resource_tags	boolean
include_map	object	An FMS includeMap or excludeMap.
id	string
policy_name	string
policy_description	string
remediation_enabled	boolean
resource_tags	array
resource_type	string	An AWS resource type
resource_type_list	array
resource_set_ids	array
security_service_policy_data	object	Firewall security service policy data.
arn	string	A resource ARN.
delete_all_policy_resources	boolean
resources_clean_up	boolean
tags	array
region	string	AWS region.

Methods

Name	Accessible by	Required Params
create_resource	INSERT	ExcludeResourceTags, PolicyName, RemediationEnabled, SecurityServicePolicyData, region
delete_resource	DELETE	data__Identifier, region
update_resource	UPDATE	data__Identifier, data__PatchDocument, region
list_resources	SELECT	region
get_resource	SELECT	data__Identifier, region

SELECT examples

Gets all policies in a region.

SELECT
region,
exclude_map,
exclude_resource_tags,
include_map,
id,
policy_name,
policy_description,
remediation_enabled,
resource_tags,
resource_type,
resource_type_list,
resource_set_ids,
security_service_policy_data,
arn,
delete_all_policy_resources,
resources_clean_up,
tags
FROM aws.fms.policies
WHERE region = 'us-east-1';

Gets all properties from an individual policy.

SELECT
region,
exclude_map,
exclude_resource_tags,
include_map,
id,
policy_name,
policy_description,
remediation_enabled,
resource_tags,
resource_type,
resource_type_list,
resource_set_ids,
security_service_policy_data,
arn,
delete_all_policy_resources,
resources_clean_up,
tags
FROM aws.fms.policies
WHERE region = 'us-east-1' AND data__Identifier = '<Id>';

INSERT example

Use the following StackQL query and manifest file to create a new policy resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO aws.fms.policies (
 ExcludeResourceTags,
 PolicyName,
 RemediationEnabled,
 SecurityServicePolicyData,
 region
)
SELECT 
'{{ ExcludeResourceTags }}',
 '{{ PolicyName }}',
 '{{ RemediationEnabled }}',
 '{{ SecurityServicePolicyData }}',
'{{ region }}';

All Properties

/*+ create */
INSERT INTO aws.fms.policies (
 ExcludeMap,
 ExcludeResourceTags,
 IncludeMap,
 PolicyName,
 PolicyDescription,
 RemediationEnabled,
 ResourceTags,
 ResourceType,
 ResourceTypeList,
 ResourceSetIds,
 SecurityServicePolicyData,
 DeleteAllPolicyResources,
 ResourcesCleanUp,
 Tags,
 region
)
SELECT 
 '{{ ExcludeMap }}',
 '{{ ExcludeResourceTags }}',
 '{{ IncludeMap }}',
 '{{ PolicyName }}',
 '{{ PolicyDescription }}',
 '{{ RemediationEnabled }}',
 '{{ ResourceTags }}',
 '{{ ResourceType }}',
 '{{ ResourceTypeList }}',
 '{{ ResourceSetIds }}',
 '{{ SecurityServicePolicyData }}',
 '{{ DeleteAllPolicyResources }}',
 '{{ ResourcesCleanUp }}',
 '{{ Tags }}',
 '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: policy
    props:
      - name: ExcludeMap
        value:
          ACCOUNT:
            - '{{ ACCOUNT[0] }}'
          ORGUNIT:
            - '{{ ORGUNIT[0] }}'
      - name: ExcludeResourceTags
        value: '{{ ExcludeResourceTags }}'
      - name: IncludeMap
        value: null
      - name: PolicyName
        value: '{{ PolicyName }}'
      - name: PolicyDescription
        value: '{{ PolicyDescription }}'
      - name: RemediationEnabled
        value: '{{ RemediationEnabled }}'
      - name: ResourceTags
        value:
          - Key: '{{ Key }}'
            Value: '{{ Value }}'
      - name: ResourceType
        value: '{{ ResourceType }}'
      - name: ResourceTypeList
        value:
          - null
      - name: ResourceSetIds
        value:
          - '{{ ResourceSetIds[0] }}'
      - name: SecurityServicePolicyData
        value:
          ManagedServiceData: '{{ ManagedServiceData }}'
          Type: '{{ Type }}'
          PolicyOption:
            NetworkFirewallPolicy:
              FirewallDeploymentModel: '{{ FirewallDeploymentModel }}'
            ThirdPartyFirewallPolicy:
              FirewallDeploymentModel: null
            NetworkAclCommonPolicy:
              NetworkAclEntrySet:
                FirstEntries:
                  - CidrBlock: '{{ CidrBlock }}'
                    Egress: '{{ Egress }}'
                    IcmpTypeCode:
                      Code: '{{ Code }}'
                      Type: '{{ Type }}'
                    Ipv6CidrBlock: '{{ Ipv6CidrBlock }}'
                    PortRange:
                      From: '{{ From }}'
                      To: '{{ To }}'
                    Protocol: '{{ Protocol }}'
                    RuleAction: '{{ RuleAction }}'
                ForceRemediateForFirstEntries: '{{ ForceRemediateForFirstEntries }}'
                LastEntries: null
                ForceRemediateForLastEntries: '{{ ForceRemediateForLastEntries }}'
      - name: DeleteAllPolicyResources
        value: '{{ DeleteAllPolicyResources }}'
      - name: ResourcesCleanUp
        value: '{{ ResourcesCleanUp }}'
      - name: Tags
        value:
          - Key: '{{ Key }}'
            Value: '{{ Value }}'

DELETE example

/*+ delete */
DELETE FROM aws.fms.policies
WHERE data__Identifier = '<Id>'
AND region = 'us-east-1';

Permissions

To operate on the policies resource, the following permissions are required:

Create

fms:PutPolicy,
fms:TagResource,
waf-regional:ListRuleGroups,
wafv2:CheckCapacity,
wafv2:ListRuleGroups,
wafv2:ListAvailableManagedRuleGroups,
wafv2:ListAvailableManagedRuleGroupVersions,
network-firewall:DescribeRuleGroup,
network-firewall:DescribeRuleGroupMetadata,
route53resolver:ListFirewallRuleGroups,
ec2:DescribeAvailabilityZones,
s3:PutBucketPolicy,
s3:GetBucketPolicy

Update

fms:PutPolicy,
fms:GetPolicy,
fms:TagResource,
fms:UntagResource,
fms:ListTagsForResource,
waf-regional:ListRuleGroups,
wafv2:CheckCapacity,
wafv2:ListRuleGroups,
wafv2:ListAvailableManagedRuleGroups,
wafv2:ListAvailableManagedRuleGroupVersions,
network-firewall:DescribeRuleGroup,
network-firewall:DescribeRuleGroupMetadata,
route53resolver:ListFirewallRuleGroups,
ec2:DescribeAvailabilityZones,
s3:PutBucketPolicy,
s3:GetBucketPolicy

Read

fms:GetPolicy,
fms:ListTagsForResource

Delete

fms:DeletePolicy

List

fms:ListPolicies,
fms:ListTagsForResource