protections

Creates, updates, deletes or gets a protection resource or lists protections in a region

Overview

Name	protections
Type	Resource
Description	Enables AWS Shield Advanced for a specific AWS resource. The resource can be an Amazon CloudFront distribution, Amazon Route 53 hosted zone, AWS Global Accelerator standard accelerator, Elastic IP Address, Application Load Balancer, or a Classic Load Balancer. You can protect Amazon EC2 instances and Network Load Balancers by association with protected Amazon EC2 Elastic IP addresses.
Id	aws.shield.protections

Fields

Name	Datatype	Description
protection_id	string	The unique identifier (ID) of the protection.
protection_arn	string	The ARN (Amazon Resource Name) of the protection.
name	string	Friendly name for the Protection.
resource_arn	string	The ARN (Amazon Resource Name) of the resource to be protected.
health_check_arns	array	The Amazon Resource Names (ARNs) of the health check to associate with the protection.
application_layer_automatic_response_configuration	object	The automatic application layer DDoS mitigation settings for a Protection. This configuration determines whether Shield Advanced automatically manages rules in the web ACL in order to respond to application layer events that Shield Advanced determines to be DDoS attacks.
tags	array	One or more tag key-value pairs for the Protection object.
region	string	AWS region.

Methods

Name	Accessible by	Required Params
create_resource	INSERT	Name, ResourceArn, region
delete_resource	DELETE	data__Identifier, region
update_resource	UPDATE	data__Identifier, data__PatchDocument, region
list_resources	SELECT	region
get_resource	SELECT	data__Identifier, region

SELECT examples

Gets all protections in a region.

SELECT
region,
protection_id,
protection_arn,
name,
resource_arn,
health_check_arns,
application_layer_automatic_response_configuration,
tags
FROM aws.shield.protections
;

Gets all properties from an individual protection.

SELECT
region,
protection_id,
protection_arn,
name,
resource_arn,
health_check_arns,
application_layer_automatic_response_configuration,
tags
FROM aws.shield.protections
WHERE data__Identifier = '<ProtectionArn>';

INSERT example

Use the following StackQL query and manifest file to create a new protection resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO aws.shield.protections (
 Name,
 ResourceArn,
 region
)
SELECT 
'{{ Name }}',
 '{{ ResourceArn }}',
'{{ region }}';

All Properties

/*+ create */
INSERT INTO aws.shield.protections (
 Name,
 ResourceArn,
 HealthCheckArns,
 ApplicationLayerAutomaticResponseConfiguration,
 Tags,
 region
)
SELECT 
 '{{ Name }}',
 '{{ ResourceArn }}',
 '{{ HealthCheckArns }}',
 '{{ ApplicationLayerAutomaticResponseConfiguration }}',
 '{{ Tags }}',
 '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: protection
    props:
      - name: Name
        value: '{{ Name }}'
      - name: ResourceArn
        value: '{{ ResourceArn }}'
      - name: HealthCheckArns
        value:
          - '{{ HealthCheckArns[0] }}'
      - name: ApplicationLayerAutomaticResponseConfiguration
        value:
          Action: {}
          Status: '{{ Status }}'
      - name: Tags
        value:
          - Key: '{{ Key }}'
            Value: '{{ Value }}'

DELETE example

/*+ delete */
DELETE FROM aws.shield.protections
WHERE data__Identifier = '<ProtectionArn>'
AND region = 'us-east-1';

Permissions

To operate on the protections resource, the following permissions are required:

Create

shield:CreateProtection,
shield:DeleteProtection,
shield:DescribeProtection,
shield:ListProtections,
shield:EnableApplicationLayerAutomaticResponse,
shield:AssociateHealthCheck,
shield:TagResource,
ec2:DescribeAddresses,
elasticloadbalancing:DescribeLoadBalancers,
route53:GetHealthCheck,
iam:GetRole,
iam:CreateServiceLinkedRole,
wafv2:GetWebACLForResource,
wafv2:GetWebACL

Delete

shield:DeleteProtection,
shield:UntagResource

Read

shield:DescribeProtection,
shield:ListTagsForResource

Update

shield:DescribeProtection,
shield:AssociateHealthCheck,
shield:DisassociateHealthCheck,
shield:EnableApplicationLayerAutomaticResponse,
shield:UpdateApplicationLayerAutomaticResponse,
shield:DisableApplicationLayerAutomaticResponse,
shield:ListTagsForResource,
shield:TagResource,
shield:UntagResource,
route53:GetHealthCheck,
iam:GetRole,
iam:CreateServiceLinkedRole,
wafv2:GetWebACLForResource,
wafv2:GetWebACL

List

shield:ListProtections