aws-sdk-fms 1.83.0 → 1.85.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a4350f124f6631da08efaf179d839996f76dc474c553830d484cebd8f678cc38
-  data.tar.gz: 88775caf6d61c6d6ac0d7296bbacd5e6bb078a77d2be428ea22d634fd3f74d09
+  metadata.gz: 7d2561eef33bdc50c82844067358b74031daf4bb6b946e82824aa0e49507391c
+  data.tar.gz: 9cd91805243df01cb41440aecf5ccb6069957218402413cce948a261e029fcc9
 SHA512:
-  metadata.gz: 36565efd24e10484a992dc275053b1969506d3fa7cff1d014f3a1319e54eb54fc7e9afd09f91332997aa71ec885f15070937cf4c23d52e6fd3c9aed9c293f785
-  data.tar.gz: 6c9d91942aa1e6630c03f99e929fbc624df281ddfa158a58b9060499d5137079dbaca41f7158922acc0ce6f2d1f62a17a0bbc285e5171498eda5c354d3862212
+  metadata.gz: 964db7321c8846752e8d5710dbc34733130954261190264f8affb6829712b34c6f0eed4a9d9007aef2e3e6e78e05d7ae3320091fb55e046e12079b85d98e0f98
+  data.tar.gz: cab1eef3b037a2597ff6a97901ce887b7af8cf9aec8240646869089a6efc25202c7a524797a848b23826b580c95d6c38687e7c0ac90e6e8793d2ee7540217d9e

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 Unreleased Changes
 ------------------
 
+1.85.0 (2024-11-06)
+------------------
+
+* Feature - Code Generated Changes, see `./build_tools` or `aws-sdk-core`'s CHANGELOG.md for details.
+
+1.84.0 (2024-10-21)
+------------------
+
+* Feature - Update AWS WAF policy - add the option to retrofit existing web ACLs instead of creating all new web ACLs.
+
 1.83.0 (2024-10-18)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.83.0
+1.85.0

data/lib/aws-sdk-fms/client.rb

@@ -954,7 +954,7 @@ module Aws::FMS
     #   resp.policy_compliance_detail.member_account #=> String
     #   resp.policy_compliance_detail.violators #=> Array
     #   resp.policy_compliance_detail.violators[0].resource_id #=> String
-    #   resp.policy_compliance_detail.violators[0].violation_reason #=> String, one of "WEB_ACL_MISSING_RULE_GROUP", "RESOURCE_MISSING_WEB_ACL", "RESOURCE_INCORRECT_WEB_ACL", "RESOURCE_MISSING_SHIELD_PROTECTION", "RESOURCE_MISSING_WEB_ACL_OR_SHIELD_PROTECTION", "RESOURCE_MISSING_SECURITY_GROUP", "RESOURCE_VIOLATES_AUDIT_SECURITY_GROUP", "SECURITY_GROUP_UNUSED", "SECURITY_GROUP_REDUNDANT", "FMS_CREATED_SECURITY_GROUP_EDITED", "MISSING_FIREWALL", "MISSING_FIREWALL_SUBNET_IN_AZ", "MISSING_EXPECTED_ROUTE_TABLE", "NETWORK_FIREWALL_POLICY_MODIFIED", "FIREWALL_SUBNET_IS_OUT_OF_SCOPE", "INTERNET_GATEWAY_MISSING_EXPECTED_ROUTE", "FIREWALL_SUBNET_MISSING_EXPECTED_ROUTE", "UNEXPECTED_FIREWALL_ROUTES", "UNEXPECTED_TARGET_GATEWAY_ROUTES", "TRAFFIC_INSPECTION_CROSSES_AZ_BOUNDARY", "INVALID_ROUTE_CONFIGURATION", "MISSING_TARGET_GATEWAY", "INTERNET_TRAFFIC_NOT_INSPECTED", "BLACK_HOLE_ROUTE_DETECTED", "BLACK_HOLE_ROUTE_DETECTED_IN_FIREWALL_SUBNET", "RESOURCE_MISSING_DNS_FIREWALL", "ROUTE_HAS_OUT_OF_SCOPE_ENDPOINT", "FIREWALL_SUBNET_MISSING_VPCE_ENDPOINT", "INVALID_NETWORK_ACL_ENTRY"
+    #   resp.policy_compliance_detail.violators[0].violation_reason #=> String, one of "WEB_ACL_MISSING_RULE_GROUP", "RESOURCE_MISSING_WEB_ACL", "RESOURCE_INCORRECT_WEB_ACL", "RESOURCE_MISSING_SHIELD_PROTECTION", "RESOURCE_MISSING_WEB_ACL_OR_SHIELD_PROTECTION", "RESOURCE_MISSING_SECURITY_GROUP", "RESOURCE_VIOLATES_AUDIT_SECURITY_GROUP", "SECURITY_GROUP_UNUSED", "SECURITY_GROUP_REDUNDANT", "FMS_CREATED_SECURITY_GROUP_EDITED", "MISSING_FIREWALL", "MISSING_FIREWALL_SUBNET_IN_AZ", "MISSING_EXPECTED_ROUTE_TABLE", "NETWORK_FIREWALL_POLICY_MODIFIED", "FIREWALL_SUBNET_IS_OUT_OF_SCOPE", "INTERNET_GATEWAY_MISSING_EXPECTED_ROUTE", "FIREWALL_SUBNET_MISSING_EXPECTED_ROUTE", "UNEXPECTED_FIREWALL_ROUTES", "UNEXPECTED_TARGET_GATEWAY_ROUTES", "TRAFFIC_INSPECTION_CROSSES_AZ_BOUNDARY", "INVALID_ROUTE_CONFIGURATION", "MISSING_TARGET_GATEWAY", "INTERNET_TRAFFIC_NOT_INSPECTED", "BLACK_HOLE_ROUTE_DETECTED", "BLACK_HOLE_ROUTE_DETECTED_IN_FIREWALL_SUBNET", "RESOURCE_MISSING_DNS_FIREWALL", "ROUTE_HAS_OUT_OF_SCOPE_ENDPOINT", "FIREWALL_SUBNET_MISSING_VPCE_ENDPOINT", "INVALID_NETWORK_ACL_ENTRY", "WEB_ACL_CONFIGURATION_OR_SCOPE_OF_USE"
     #   resp.policy_compliance_detail.violators[0].resource_type #=> String
     #   resp.policy_compliance_detail.violators[0].metadata #=> Hash
     #   resp.policy_compliance_detail.violators[0].metadata["LengthBoundedString"] #=> String
@@ -1265,6 +1265,8 @@ module Aws::FMS
     #   The ID of the Firewall Manager policy that you want the details for.
     #   You can get violation details for the following policy types:
     #
+    #   * WAF
+    #
     #   * DNS Firewall
     #
     #   * Imported Network Firewall
@@ -1286,9 +1288,9 @@ module Aws::FMS
     # @option params [required, String] :resource_type
     #   The resource type. This is in the format shown in the [Amazon Web
     #   Services Resource Types Reference][1]. Supported resource types are:
-    #   `AWS::EC2::Instance`, `AWS::EC2::NetworkInterface`,
-    #   `AWS::EC2::SecurityGroup`, `AWS::NetworkFirewall::FirewallPolicy`, and
-    #   `AWS::EC2::Subnet`.
+    #   `AWS::WAFv2::WebACL`, `AWS::EC2::Instance`,
+    #   `AWS::EC2::NetworkInterface`, `AWS::EC2::SecurityGroup`,
+    #   `AWS::NetworkFirewall::FirewallPolicy`, and `AWS::EC2::Subnet`.
     #
     #
     #
@@ -1708,6 +1710,11 @@ module Aws::FMS
     #   resp.violation_detail.resource_violations[0].possible_remediation_actions.actions[0].ordered_remediation_actions[0].remediation_action.delete_network_acl_entries_action.fms_can_remediate #=> Boolean
     #   resp.violation_detail.resource_violations[0].possible_remediation_actions.actions[0].ordered_remediation_actions[0].order #=> Integer
     #   resp.violation_detail.resource_violations[0].possible_remediation_actions.actions[0].is_default_action #=> Boolean
+    #   resp.violation_detail.resource_violations[0].web_acl_has_incompatible_configuration_violation.web_acl_arn #=> String
+    #   resp.violation_detail.resource_violations[0].web_acl_has_incompatible_configuration_violation.description #=> String
+    #   resp.violation_detail.resource_violations[0].web_acl_has_out_of_scope_resources_violation.web_acl_arn #=> String
+    #   resp.violation_detail.resource_violations[0].web_acl_has_out_of_scope_resources_violation.out_of_scope_resource_list #=> Array
+    #   resp.violation_detail.resource_violations[0].web_acl_has_out_of_scope_resources_violation.out_of_scope_resource_list[0] #=> String
     #   resp.violation_detail.resource_tags #=> Array
     #   resp.violation_detail.resource_tags[0].key #=> String
     #   resp.violation_detail.resource_tags[0].value #=> String
@@ -2947,7 +2954,7 @@ module Aws::FMS
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-fms'
-      context[:gem_version] = '1.83.0'
+      context[:gem_version] = '1.85.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-fms/client_api.rb

@@ -248,6 +248,7 @@ module Aws::FMS
     ReplaceNetworkAclAssociationAction = Shapes::StructureShape.new(name: 'ReplaceNetworkAclAssociationAction')
     Resource = Shapes::StructureShape.new(name: 'Resource')
     ResourceArn = Shapes::StringShape.new(name: 'ResourceArn')
+    ResourceArnList = Shapes::ListShape.new(name: 'ResourceArnList')
     ResourceCount = Shapes::IntegerShape.new(name: 'ResourceCount')
     ResourceDescription = Shapes::StringShape.new(name: 'ResourceDescription')
     ResourceId = Shapes::StringShape.new(name: 'ResourceId')
@@ -310,6 +311,8 @@ module Aws::FMS
     ViolationDetail = Shapes::StructureShape.new(name: 'ViolationDetail')
     ViolationReason = Shapes::StringShape.new(name: 'ViolationReason')
     ViolationTarget = Shapes::StringShape.new(name: 'ViolationTarget')
+    WebACLHasIncompatibleConfigurationViolation = Shapes::StructureShape.new(name: 'WebACLHasIncompatibleConfigurationViolation')
+    WebACLHasOutOfScopeResourcesViolation = Shapes::StructureShape.new(name: 'WebACLHasOutOfScopeResourcesViolation')
 
     AWSAccountIdList.member = Shapes::ShapeRef.new(shape: AWSAccountId)
 
@@ -1119,6 +1122,8 @@ module Aws::FMS
     Resource.add_member(:account_id, Shapes::ShapeRef.new(shape: AWSAccountId, location_name: "AccountId"))
     Resource.struct_class = Types::Resource
 
+    ResourceArnList.member = Shapes::ShapeRef.new(shape: ResourceArn)
+
     ResourceIdList.member = Shapes::ShapeRef.new(shape: ResourceId)
 
     ResourceList.member = Shapes::ShapeRef.new(shape: Resource)
@@ -1178,6 +1183,8 @@ module Aws::FMS
     ResourceViolation.add_member(:firewall_subnet_missing_vpc_endpoint_violation, Shapes::ShapeRef.new(shape: FirewallSubnetMissingVPCEndpointViolation, location_name: "FirewallSubnetMissingVPCEndpointViolation"))
     ResourceViolation.add_member(:invalid_network_acl_entries_violation, Shapes::ShapeRef.new(shape: InvalidNetworkAclEntriesViolation, location_name: "InvalidNetworkAclEntriesViolation"))
     ResourceViolation.add_member(:possible_remediation_actions, Shapes::ShapeRef.new(shape: PossibleRemediationActions, location_name: "PossibleRemediationActions"))
+    ResourceViolation.add_member(:web_acl_has_incompatible_configuration_violation, Shapes::ShapeRef.new(shape: WebACLHasIncompatibleConfigurationViolation, location_name: "WebACLHasIncompatibleConfigurationViolation"))
+    ResourceViolation.add_member(:web_acl_has_out_of_scope_resources_violation, Shapes::ShapeRef.new(shape: WebACLHasOutOfScopeResourcesViolation, location_name: "WebACLHasOutOfScopeResourcesViolation"))
     ResourceViolation.struct_class = Types::ResourceViolation
 
     ResourceViolations.member = Shapes::ShapeRef.new(shape: ResourceViolation)
@@ -1305,6 +1312,14 @@ module Aws::FMS
     ViolationDetail.add_member(:resource_description, Shapes::ShapeRef.new(shape: LengthBoundedString, location_name: "ResourceDescription"))
     ViolationDetail.struct_class = Types::ViolationDetail
 
+    WebACLHasIncompatibleConfigurationViolation.add_member(:web_acl_arn, Shapes::ShapeRef.new(shape: ResourceArn, location_name: "WebACLArn"))
+    WebACLHasIncompatibleConfigurationViolation.add_member(:description, Shapes::ShapeRef.new(shape: LengthBoundedString, location_name: "Description"))
+    WebACLHasIncompatibleConfigurationViolation.struct_class = Types::WebACLHasIncompatibleConfigurationViolation
+
+    WebACLHasOutOfScopeResourcesViolation.add_member(:web_acl_arn, Shapes::ShapeRef.new(shape: ResourceArn, location_name: "WebACLArn"))
+    WebACLHasOutOfScopeResourcesViolation.add_member(:out_of_scope_resource_list, Shapes::ShapeRef.new(shape: ResourceArnList, location_name: "OutOfScopeResourceList"))
+    WebACLHasOutOfScopeResourcesViolation.struct_class = Types::WebACLHasOutOfScopeResourcesViolation
+
 
     # @api private
     API = Seahorse::Model::Api.new.tap do |api|

data/lib/aws-sdk-fms/types.rb

@@ -1813,6 +1813,8 @@ module Aws::FMS
     #   The ID of the Firewall Manager policy that you want the details for.
     #   You can get violation details for the following policy types:
     #
+    #   * WAF
+    #
     #   * DNS Firewall
     #
     #   * Imported Network Firewall
@@ -1837,9 +1839,9 @@ module Aws::FMS
     # @!attribute [rw] resource_type
     #   The resource type. This is in the format shown in the [Amazon Web
     #   Services Resource Types Reference][1]. Supported resource types are:
-    #   `AWS::EC2::Instance`, `AWS::EC2::NetworkInterface`,
-    #   `AWS::EC2::SecurityGroup`, `AWS::NetworkFirewall::FirewallPolicy`,
-    #   and `AWS::EC2::Subnet`.
+    #   `AWS::WAFv2::WebACL`, `AWS::EC2::Instance`,
+    #   `AWS::EC2::NetworkInterface`, `AWS::EC2::SecurityGroup`,
+    #   `AWS::NetworkFirewall::FirewallPolicy`, and `AWS::EC2::Subnet`.
     #
     #
     #
@@ -3487,17 +3489,16 @@ module Aws::FMS
     #   You can specify account IDs, OUs, or a combination:
     #
     #   * Specify account IDs by setting the key to `ACCOUNT`. For example,
-    #     the following is a valid map: `\{“ACCOUNT” : [“accountID1”,
-    #     “accountID2”]\}`.
+    #     the following is a valid map: `{“ACCOUNT” : [“accountID1”,
+    #     “accountID2”]}`.
     #
     #   * Specify OUs by setting the key to `ORG_UNIT`. For example, the
-    #     following is a valid map: `\{“ORG_UNIT” : [“ouid111”,
-    #     “ouid112”]\}`.
+    #     following is a valid map: `{“ORG_UNIT” : [“ouid111”, “ouid112”]}`.
     #
     #   * Specify accounts and OUs together in a single map, separated with
-    #     a comma. For example, the following is a valid map: `\{“ACCOUNT” :
+    #     a comma. For example, the following is a valid map: `{“ACCOUNT” :
     #     [“accountID1”, “accountID2”], “ORG_UNIT” : [“ouid111”,
-    #     “ouid112”]\}`.
+    #     “ouid112”]}`.
     #   @return [Hash<String,Array<String>>]
     #
     # @!attribute [rw] exclude_map
@@ -3517,17 +3518,16 @@ module Aws::FMS
     #   You can specify account IDs, OUs, or a combination:
     #
     #   * Specify account IDs by setting the key to `ACCOUNT`. For example,
-    #     the following is a valid map: `\{“ACCOUNT” : [“accountID1”,
-    #     “accountID2”]\}`.
+    #     the following is a valid map: `{“ACCOUNT” : [“accountID1”,
+    #     “accountID2”]}`.
     #
     #   * Specify OUs by setting the key to `ORG_UNIT`. For example, the
-    #     following is a valid map: `\{“ORG_UNIT” : [“ouid111”,
-    #     “ouid112”]\}`.
+    #     following is a valid map: `{“ORG_UNIT” : [“ouid111”, “ouid112”]}`.
     #
     #   * Specify accounts and OUs together in a single map, separated with
-    #     a comma. For example, the following is a valid map: `\{“ACCOUNT” :
+    #     a comma. For example, the following is a valid map: `{“ACCOUNT” :
     #     [“accountID1”, “accountID2”], “ORG_UNIT” : [“ouid111”,
-    #     “ouid112”]\}`.
+    #     “ouid112”]}`.
     #   @return [Hash<String,Array<String>>]
     #
     # @!attribute [rw] resource_set_ids
@@ -4588,6 +4588,16 @@ module Aws::FMS
     #   actions.
     #   @return [Types::PossibleRemediationActions]
     #
+    # @!attribute [rw] web_acl_has_incompatible_configuration_violation
+    #   The violation details for a web ACL whose configuration is
+    #   incompatible with the Firewall Manager policy.
+    #   @return [Types::WebACLHasIncompatibleConfigurationViolation]
+    #
+    # @!attribute [rw] web_acl_has_out_of_scope_resources_violation
+    #   The violation details for a web ACL that's associated with at least
+    #   one resource that's out of scope of the Firewall Manager policy.
+    #   @return [Types::WebACLHasOutOfScopeResourcesViolation]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/fms-2018-01-01/ResourceViolation AWS API Documentation
     #
     class ResourceViolation < Struct.new(
@@ -4614,7 +4624,9 @@ module Aws::FMS
       :third_party_firewall_missing_expected_route_table_violation,
       :firewall_subnet_missing_vpc_endpoint_violation,
       :invalid_network_acl_entries_violation,
-      :possible_remediation_actions)
+      :possible_remediation_actions,
+      :web_acl_has_incompatible_configuration_violation,
+      :web_acl_has_out_of_scope_resources_violation)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -4810,7 +4822,7 @@ module Aws::FMS
     #
     #   * Example: `DNS_FIREWALL`
     #
-    #     `"\{"type":"DNS_FIREWALL","preProcessRuleGroups":[\{"ruleGroupId":"rslvr-frg-1","priority":10\}],"postProcessRuleGroups":[\{"ruleGroupId":"rslvr-frg-2","priority":9911\}]\}"`
+    #     `"{"type":"DNS_FIREWALL","preProcessRuleGroups":[{"ruleGroupId":"rslvr-frg-1","priority":10}],"postProcessRuleGroups":[{"ruleGroupId":"rslvr-frg-2","priority":9911}]}"`
     #
     #     <note markdown="1"> Valid values for `preProcessRuleGroups` are between 1 and 99.
     #     Valid values for `postProcessRuleGroups` are between 9901 and
@@ -4820,9 +4832,9 @@ module Aws::FMS
     #
     #   * Example: `IMPORT_NETWORK_FIREWALL`
     #
-    #     `"\{"type":"IMPORT_NETWORK_FIREWALL","awsNetworkFirewallConfig":\{"networkFirewallStatelessRuleGroupReferences":[\{"resourceARN":"arn:aws:network-firewall:us-west-2:000000000000:stateless-rulegroup\/rg1","priority":1\}],"networkFirewallStatelessDefaultActions":["aws:drop"],"networkFirewallStatelessFragmentDefaultActions":["aws:pass"],"networkFirewallStatelessCustomActions":[],"networkFirewallStatefulRuleGroupReferences":[\{"resourceARN":"arn:aws:network-firewall:us-west-2:aws-managed:stateful-rulegroup\/ThreatSignaturesEmergingEventsStrictOrder","priority":8\}],"networkFirewallStatefulEngineOptions":\{"ruleOrder":"STRICT_ORDER"\},"networkFirewallStatefulDefaultActions":["aws:drop_strict"]\}\}"`
+    #     `"{"type":"IMPORT_NETWORK_FIREWALL","awsNetworkFirewallConfig":{"networkFirewallStatelessRuleGroupReferences":[{"resourceARN":"arn:aws:network-firewall:us-west-2:000000000000:stateless-rulegroup\/rg1","priority":1}],"networkFirewallStatelessDefaultActions":["aws:drop"],"networkFirewallStatelessFragmentDefaultActions":["aws:pass"],"networkFirewallStatelessCustomActions":[],"networkFirewallStatefulRuleGroupReferences":[{"resourceARN":"arn:aws:network-firewall:us-west-2:aws-managed:stateful-rulegroup\/ThreatSignaturesEmergingEventsStrictOrder","priority":8}],"networkFirewallStatefulEngineOptions":{"ruleOrder":"STRICT_ORDER"},"networkFirewallStatefulDefaultActions":["aws:drop_strict"]}}"`
     #
-    #     `"\{"type":"DNS_FIREWALL","preProcessRuleGroups":[\{"ruleGroupId":"rslvr-frg-1","priority":10\}],"postProcessRuleGroups":[\{"ruleGroupId":"rslvr-frg-2","priority":9911\}]\}"`
+    #     `"{"type":"DNS_FIREWALL","preProcessRuleGroups":[{"ruleGroupId":"rslvr-frg-1","priority":10}],"postProcessRuleGroups":[{"ruleGroupId":"rslvr-frg-2","priority":9911}]}"`
     #
     #     <note markdown="1"> Valid values for `preProcessRuleGroups` are between 1 and 99.
     #     Valid values for `postProcessRuleGroups` are between 9901 and
@@ -4832,7 +4844,7 @@ module Aws::FMS
     #
     #   * Example: `NETWORK_FIREWALL` - Centralized deployment model
     #
-    #     `"\{"type":"NETWORK_FIREWALL","awsNetworkFirewallConfig":\{"networkFirewallStatelessRuleGroupReferences":[\{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test","priority":1\}],"networkFirewallStatelessDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessFragmentDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessCustomActions":[\{"actionName":"customActionName","actionDefinition":\{"publishMetricAction":\{"dimensions":[\{"value":"metricdimensionvalue"\}]\}\}\}],"networkFirewallStatefulRuleGroupReferences":[\{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test"\}],"networkFirewallLoggingConfiguration":\{"logDestinationConfigs":[\{"logDestinationType":"S3","logType":"ALERT","logDestination":\{"bucketName":"s3-bucket-name"\}\},\{"logDestinationType":"S3","logType":"FLOW","logDestination":\{"bucketName":"s3-bucket-name"\}\}],"overrideExistingConfig":true\}\},"firewallDeploymentModel":\{"centralizedFirewallDeploymentModel":\{"centralizedFirewallOrchestrationConfig":\{"inspectionVpcIds":[\{"resourceId":"vpc-1234","accountId":"123456789011"\}],"firewallCreationConfig":\{"endpointLocation":\{"availabilityZoneConfigList":[\{"availabilityZoneId":null,"availabilityZoneName":"us-east-1a","allowedIPV4CidrList":["10.0.0.0/28"]\}]\}\},"allowedIPV4CidrList":[]\}\}\}\}"`
+    #     `"{"type":"NETWORK_FIREWALL","awsNetworkFirewallConfig":{"networkFirewallStatelessRuleGroupReferences":[{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test","priority":1}],"networkFirewallStatelessDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessFragmentDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessCustomActions":[{"actionName":"customActionName","actionDefinition":{"publishMetricAction":{"dimensions":[{"value":"metricdimensionvalue"}]}}}],"networkFirewallStatefulRuleGroupReferences":[{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test"}],"networkFirewallLoggingConfiguration":{"logDestinationConfigs":[{"logDestinationType":"S3","logType":"ALERT","logDestination":{"bucketName":"s3-bucket-name"}},{"logDestinationType":"S3","logType":"FLOW","logDestination":{"bucketName":"s3-bucket-name"}}],"overrideExistingConfig":true}},"firewallDeploymentModel":{"centralizedFirewallDeploymentModel":{"centralizedFirewallOrchestrationConfig":{"inspectionVpcIds":[{"resourceId":"vpc-1234","accountId":"123456789011"}],"firewallCreationConfig":{"endpointLocation":{"availabilityZoneConfigList":[{"availabilityZoneId":null,"availabilityZoneName":"us-east-1a","allowedIPV4CidrList":["10.0.0.0/28"]}]}},"allowedIPV4CidrList":[]}}}}"`
     #
     #     To use the centralized deployment model, you must set
     #     [PolicyOption][1] to `CENTRALIZED`.
@@ -4841,7 +4853,7 @@ module Aws::FMS
     #     automatic Availability Zone configuration
     #
     #     `
-    #     "\{"type":"NETWORK_FIREWALL","networkFirewallStatelessRuleGroupReferences":[\{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test","priority":1\}],"networkFirewallStatelessDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessFragmentDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessCustomActions":[\{"actionName":"customActionName","actionDefinition":\{"publishMetricAction":\{"dimensions":[\{"value":"metricdimensionvalue"\}]\}\}\}],"networkFirewallStatefulRuleGroupReferences":[\{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test"\}],"networkFirewallOrchestrationConfig":\{"singleFirewallEndpointPerVPC":false,"allowedIPV4CidrList":["10.0.0.0/28","192.168.0.0/28"],"routeManagementAction":"OFF"\},"networkFirewallLoggingConfiguration":\{"logDestinationConfigs":[\{"logDestinationType":"S3","logType":"ALERT","logDestination":\{"bucketName":"s3-bucket-name"\}\},\{"logDestinationType":"S3","logType":"FLOW","logDestination":\{"bucketName":"s3-bucket-name"\}\}],"overrideExistingConfig":true\}\}"
+    #     "{"type":"NETWORK_FIREWALL","networkFirewallStatelessRuleGroupReferences":[{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test","priority":1}],"networkFirewallStatelessDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessFragmentDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessCustomActions":[{"actionName":"customActionName","actionDefinition":{"publishMetricAction":{"dimensions":[{"value":"metricdimensionvalue"}]}}}],"networkFirewallStatefulRuleGroupReferences":[{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test"}],"networkFirewallOrchestrationConfig":{"singleFirewallEndpointPerVPC":false,"allowedIPV4CidrList":["10.0.0.0/28","192.168.0.0/28"],"routeManagementAction":"OFF"},"networkFirewallLoggingConfiguration":{"logDestinationConfigs":[{"logDestinationType":"S3","logType":"ALERT","logDestination":{"bucketName":"s3-bucket-name"}},{"logDestinationType":"S3","logType":"FLOW","logDestination":{"bucketName":"s3-bucket-name"}}],"overrideExistingConfig":true}}"
     #     `
     #
     #     With automatic Availbility Zone configuration, Firewall Manager
@@ -4853,8 +4865,8 @@ module Aws::FMS
     #     automatic Availability Zone configuration and route management
     #
     #     `
-    #     "\{"type":"NETWORK_FIREWALL","networkFirewallStatelessRuleGroupReferences":[\{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test","priority":1\}],"networkFirewallStatelessDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessFragmentDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessCustomActions":[\{"actionName":"customActionName","actionDefinition":\{"publishMetricAction":\{"dimensions":[\{"value":"metricdimensionvalue"\}]\}\}\}],"networkFirewallStatefulRuleGroupReferences":[\{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test"\}],"networkFirewallOrchestrationConfig":\{"singleFirewallEndpointPerVPC":false,"allowedIPV4CidrList":["10.0.0.0/28","192.168.0.0/28"],"routeManagementAction":"MONITOR","routeManagementTargetTypes":["InternetGateway"]\},"networkFirewallLoggingConfiguration":\{"logDestinationConfigs":[\{"logDestinationType":"S3","logType":"ALERT","logDestination":\{"bucketName":"s3-bucket-name"\}\},\{"logDestinationType":"S3","logType":
-    #     "FLOW","logDestination":\{"bucketName":"s3-bucket-name"\}\}],"overrideExistingConfig":true\}\}"
+    #     "{"type":"NETWORK_FIREWALL","networkFirewallStatelessRuleGroupReferences":[{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test","priority":1}],"networkFirewallStatelessDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessFragmentDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessCustomActions":[{"actionName":"customActionName","actionDefinition":{"publishMetricAction":{"dimensions":[{"value":"metricdimensionvalue"}]}}}],"networkFirewallStatefulRuleGroupReferences":[{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test"}],"networkFirewallOrchestrationConfig":{"singleFirewallEndpointPerVPC":false,"allowedIPV4CidrList":["10.0.0.0/28","192.168.0.0/28"],"routeManagementAction":"MONITOR","routeManagementTargetTypes":["InternetGateway"]},"networkFirewallLoggingConfiguration":{"logDestinationConfigs":[{"logDestinationType":"S3","logType":"ALERT","logDestination":{"bucketName":"s3-bucket-name"}},{"logDestinationType":"S3","logType":
+    #     "FLOW","logDestination":{"bucketName":"s3-bucket-name"}}],"overrideExistingConfig":true}}"
     #     `
     #
     #     To use the distributed deployment model, you must set
@@ -4863,11 +4875,11 @@ module Aws::FMS
     #   * Example: `NETWORK_FIREWALL` - Distributed deployment model with
     #     custom Availability Zone configuration
     #
-    #     `"\{"type":"NETWORK_FIREWALL","networkFirewallStatelessRuleGroupReferences":[\{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test","priority":1\}],"networkFirewallStatelessDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessFragmentDefaultActions":["aws:forward_to_sfe","fragmentcustomactionname"],"networkFirewallStatelessCustomActions":[\{"actionName":"customActionName",
-    #     "actionDefinition":\{"publishMetricAction":\{"dimensions":[\{"value":"metricdimensionvalue"\}]\}\}\},\{"actionName":"fragmentcustomactionname","actionDefinition":\{"publishMetricAction":\{"dimensions":[\{"value":"fragmentmetricdimensionvalue"\}]\}\}\}],"networkFirewallStatefulRuleGroupReferences":[\{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test"\}],"networkFirewallOrchestrationConfig":\{"firewallCreationConfig":\{
-    #     "endpointLocation":\{"availabilityZoneConfigList":[\{"availabilityZoneName":"us-east-1a","allowedIPV4CidrList":["10.0.0.0/28"]\},\{"availabilityZoneName":"us-east-1b","allowedIPV4CidrList":[
-    #     "10.0.0.0/28"]\}]\}
-    #     \},"singleFirewallEndpointPerVPC":false,"allowedIPV4CidrList":null,"routeManagementAction":"OFF","networkFirewallLoggingConfiguration":\{"logDestinationConfigs":[\{"logDestinationType":"S3","logType":"ALERT","logDestination":\{"bucketName":"s3-bucket-name"\}\},\{"logDestinationType":"S3","logType":"FLOW","logDestination":\{"bucketName":"s3-bucket-name"\}\}],"overrideExistingConfig":boolean\}\}"
+    #     `"{"type":"NETWORK_FIREWALL","networkFirewallStatelessRuleGroupReferences":[{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test","priority":1}],"networkFirewallStatelessDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessFragmentDefaultActions":["aws:forward_to_sfe","fragmentcustomactionname"],"networkFirewallStatelessCustomActions":[{"actionName":"customActionName",
+    #     "actionDefinition":{"publishMetricAction":{"dimensions":[{"value":"metricdimensionvalue"}]}}},{"actionName":"fragmentcustomactionname","actionDefinition":{"publishMetricAction":{"dimensions":[{"value":"fragmentmetricdimensionvalue"}]}}}],"networkFirewallStatefulRuleGroupReferences":[{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test"}],"networkFirewallOrchestrationConfig":{"firewallCreationConfig":{
+    #     "endpointLocation":{"availabilityZoneConfigList":[{"availabilityZoneName":"us-east-1a","allowedIPV4CidrList":["10.0.0.0/28"]},{"availabilityZoneName":"us-east-1b","allowedIPV4CidrList":[
+    #     "10.0.0.0/28"]}]}
+    #     },"singleFirewallEndpointPerVPC":false,"allowedIPV4CidrList":null,"routeManagementAction":"OFF","networkFirewallLoggingConfiguration":{"logDestinationConfigs":[{"logDestinationType":"S3","logType":"ALERT","logDestination":{"bucketName":"s3-bucket-name"}},{"logDestinationType":"S3","logType":"FLOW","logDestination":{"bucketName":"s3-bucket-name"}}],"overrideExistingConfig":boolean}}"
     #     `
     #
     #     With custom Availability Zone configuration, you define which
@@ -4883,7 +4895,7 @@ module Aws::FMS
     #   * Example: `NETWORK_FIREWALL` - Distributed deployment model with
     #     custom Availability Zone configuration and route management
     #
-    #     `"\{"type":"NETWORK_FIREWALL","networkFirewallStatelessRuleGroupReferences":[\{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test","priority":1\}],"networkFirewallStatelessDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessFragmentDefaultActions":["aws:forward_to_sfe","fragmentcustomactionname"],"networkFirewallStatelessCustomActions":[\{"actionName":"customActionName","actionDefinition":\{"publishMetricAction":\{"dimensions":[\{"value":"metricdimensionvalue"\}]\}\}\},\{"actionName":"fragmentcustomactionname","actionDefinition":\{"publishMetricAction":\{"dimensions":[\{"value":"fragmentmetricdimensionvalue"\}]\}\}\}],"networkFirewallStatefulRuleGroupReferences":[\{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test"\}],"networkFirewallOrchestrationConfig":\{"firewallCreationConfig":\{"endpointLocation":\{"availabilityZoneConfigList":[\{"availabilityZoneName":"us-east-1a","allowedIPV4CidrList":["10.0.0.0/28"]\},\{"availabilityZoneName":"us-east-1b","allowedIPV4CidrList":["10.0.0.0/28"]\}]\}\},"singleFirewallEndpointPerVPC":false,"allowedIPV4CidrList":null,"routeManagementAction":"MONITOR","routeManagementTargetTypes":["InternetGateway"],"routeManagementConfig":\{"allowCrossAZTrafficIfNoEndpoint":true\}\},"networkFirewallLoggingConfiguration":\{"logDestinationConfigs":[\{"logDestinationType":"S3","logType":"ALERT","logDestination":\{"bucketName":"s3-bucket-name"\}\},\{"logDestinationType":"S3","logType":"FLOW","logDestination":\{"bucketName":"s3-bucket-name"\}\}],"overrideExistingConfig":boolean\}\}"
+    #     `"{"type":"NETWORK_FIREWALL","networkFirewallStatelessRuleGroupReferences":[{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test","priority":1}],"networkFirewallStatelessDefaultActions":["aws:forward_to_sfe","customActionName"],"networkFirewallStatelessFragmentDefaultActions":["aws:forward_to_sfe","fragmentcustomactionname"],"networkFirewallStatelessCustomActions":[{"actionName":"customActionName","actionDefinition":{"publishMetricAction":{"dimensions":[{"value":"metricdimensionvalue"}]}}},{"actionName":"fragmentcustomactionname","actionDefinition":{"publishMetricAction":{"dimensions":[{"value":"fragmentmetricdimensionvalue"}]}}}],"networkFirewallStatefulRuleGroupReferences":[{"resourceARN":"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test"}],"networkFirewallOrchestrationConfig":{"firewallCreationConfig":{"endpointLocation":{"availabilityZoneConfigList":[{"availabilityZoneName":"us-east-1a","allowedIPV4CidrList":["10.0.0.0/28"]},{"availabilityZoneName":"us-east-1b","allowedIPV4CidrList":["10.0.0.0/28"]}]}},"singleFirewallEndpointPerVPC":false,"allowedIPV4CidrList":null,"routeManagementAction":"MONITOR","routeManagementTargetTypes":["InternetGateway"],"routeManagementConfig":{"allowCrossAZTrafficIfNoEndpoint":true}},"networkFirewallLoggingConfiguration":{"logDestinationConfigs":[{"logDestinationType":"S3","logType":"ALERT","logDestination":{"bucketName":"s3-bucket-name"}},{"logDestinationType":"S3","logType":"FLOW","logDestination":{"bucketName":"s3-bucket-name"}}],"overrideExistingConfig":boolean}}"
     #     `
     #
     #     To use the distributed deployment model, you must set
@@ -4891,14 +4903,12 @@ module Aws::FMS
     #
     #   * Example: `SECURITY_GROUPS_COMMON`
     #
-    #     `"\{"type":"SECURITY_GROUPS_COMMON","revertManualSecurityGroupChanges":false,"exclusiveResourceSecurityGroupManagement":false,
-    #     "applyToAllEC2InstanceENIs":false,"securityGroups":[\{"id":"
-    #     sg-000e55995d61a06bd"\}]\}"`
+    #     `"{"type":"SECURITY_GROUPS_COMMON","securityGroups":[{"id":"sg-03b1f67d69ed00197"}],"revertManualSecurityGroupChanges":true,"exclusiveResourceSecurityGroupManagement":true,"applyToAllEC2InstanceENIs":false,"includeSharedVPC":true,"enableSecurityGroupReferencesDistribution":true}"`
     #
     #   * Example: `SECURITY_GROUPS_COMMON` - Security group tag
     #     distribution
     #
-    #     `""\{"type":"SECURITY_GROUPS_COMMON","securityGroups":[\{"id":"sg-000e55995d61a06bd"\}],"revertManualSecurityGroupChanges":true,"exclusiveResourceSecurityGroupManagement":false,"applyToAllEC2InstanceENIs":false,"includeSharedVPC":false,"enableTagDistribution":true\}""`
+    #     `""{"type":"SECURITY_GROUPS_COMMON","securityGroups":[{"id":"sg-000e55995d61a06bd"}],"revertManualSecurityGroupChanges":true,"exclusiveResourceSecurityGroupManagement":false,"applyToAllEC2InstanceENIs":false,"includeSharedVPC":false,"enableTagDistribution":true}""`
     #
     #     Firewall Manager automatically distributes tags from the primary
     #     group to the security groups created by this policy. To use
@@ -4916,13 +4926,13 @@ module Aws::FMS
     #   * Example: Shared VPCs. Apply the preceding policy to resources in
     #     shared VPCs as well as to those in VPCs that the account owns
     #
-    #     `"\{"type":"SECURITY_GROUPS_COMMON","revertManualSecurityGroupChanges":false,"exclusiveResourceSecurityGroupManagement":false,
-    #     "applyToAllEC2InstanceENIs":false,"includeSharedVPC":true,"securityGroups":[\{"id":"
-    #     sg-000e55995d61a06bd"\}]\}"`
+    #     `"{"type":"SECURITY_GROUPS_COMMON","revertManualSecurityGroupChanges":false,"exclusiveResourceSecurityGroupManagement":false,
+    #     "applyToAllEC2InstanceENIs":false,"includeSharedVPC":true,"securityGroups":[{"id":"
+    #     sg-000e55995d61a06bd"}]}"`
     #
     #   * Example: `SECURITY_GROUPS_CONTENT_AUDIT`
     #
-    #     `"\{"type":"SECURITY_GROUPS_CONTENT_AUDIT","securityGroups":[\{"id":"sg-000e55995d61a06bd"\}],"securityGroupAction":\{"type":"ALLOW"\}\}"`
+    #     `"{"type":"SECURITY_GROUPS_CONTENT_AUDIT","preManagedOptions":[{"denyProtocolAllValue":true},{"auditSgDirection":{"type":"ALL"}}],"securityGroups":[{"id":"sg-049b2393a25468971"}],"securityGroupAction":{"type":"ALLOW"}}"`
     #
     #     The security group action for content audit can be `ALLOW` or
     #     `DENY`. For `ALLOW`, all in-scope security group rules must be
@@ -4933,11 +4943,11 @@ module Aws::FMS
     #
     #   * Example: `SECURITY_GROUPS_USAGE_AUDIT`
     #
-    #     `"\{"type":"SECURITY_GROUPS_USAGE_AUDIT","deleteUnusedSecurityGroups":true,"coalesceRedundantSecurityGroups":true\}"`
+    #     `"{"type":"SECURITY_GROUPS_USAGE_AUDIT","deleteUnusedSecurityGroups":true,"coalesceRedundantSecurityGroups":true,"optionalDelayForUnusedInMinutes":60}"`
     #
     #   * Example: `SHIELD_ADVANCED` with web ACL management
     #
-    #     `"\{"type":"SHIELD_ADVANCED","optimizeUnassociatedWebACL":true\}"`
+    #     `"{"type":"SHIELD_ADVANCED","optimizeUnassociatedWebACL":true}"`
     #
     #     If you set `optimizeUnassociatedWebACL` to `true`, Firewall
     #     Manager creates web ACLs in accounts within the policy scope if
@@ -4964,16 +4974,16 @@ module Aws::FMS
     #   * Specification for `SHIELD_ADVANCED` for Amazon CloudFront
     #     distributions
     #
-    #     `"\{"type":"SHIELD_ADVANCED","automaticResponseConfiguration":
-    #     \{"automaticResponseStatus":"ENABLED|IGNORED|DISABLED",
-    #     "automaticResponseAction":"BLOCK|COUNT"\},
+    #     `"{"type":"SHIELD_ADVANCED","automaticResponseConfiguration":
+    #     {"automaticResponseStatus":"ENABLED|IGNORED|DISABLED",
+    #     "automaticResponseAction":"BLOCK|COUNT"},
     #     "overrideCustomerWebaclClassic":true|false,
-    #     "optimizeUnassociatedWebACL":true|false\}"`
+    #     "optimizeUnassociatedWebACL":true|false}"`
     #
     #     For example:
-    #     `"\{"type":"SHIELD_ADVANCED","automaticResponseConfiguration":
-    #     \{"automaticResponseStatus":"ENABLED",
-    #     "automaticResponseAction":"COUNT"\}\}"`
+    #     `"{"type":"SHIELD_ADVANCED","automaticResponseConfiguration":
+    #     {"automaticResponseStatus":"ENABLED",
+    #     "automaticResponseAction":"COUNT"}}"`
     #
     #     The default value for `automaticResponseStatus` is `IGNORED`. The
     #     value for `automaticResponseAction` is only required when
@@ -4989,23 +4999,22 @@ module Aws::FMS
     #     Replace `THIRD_PARTY_FIREWALL_NAME` with the name of the
     #     third-party firewall.
     #
-    #     `"\{ "type":"THIRD_PARTY_FIREWALL",
+    #     `"{ "type":"THIRD_PARTY_FIREWALL",
     #     "thirdPartyFirewall":"THIRD_PARTY_FIREWALL_NAME",
-    #     "thirdPartyFirewallConfig":\{
-    #     "thirdPartyFirewallPolicyList":["global-1"] \},
-    #     "firewallDeploymentModel":\{
-    #     "distributedFirewallDeploymentModel":\{
-    #     "distributedFirewallOrchestrationConfig":\{
-    #     "firewallCreationConfig":\{ "endpointLocation":\{
-    #     "availabilityZoneConfigList":[ \{
-    #     "availabilityZoneName":"$\{AvailabilityZone\}" \} ] \} \},
-    #     "allowedIPV4CidrList":[ ] \} \} \} \}"`
+    #     "thirdPartyFirewallConfig":{
+    #     "thirdPartyFirewallPolicyList":["global-1"] },
+    #     "firewallDeploymentModel":{ "distributedFirewallDeploymentModel":{
+    #     "distributedFirewallOrchestrationConfig":{
+    #     "firewallCreationConfig":{ "endpointLocation":{
+    #     "availabilityZoneConfigList":[ {
+    #     "availabilityZoneName":"${AvailabilityZone}" } ] } },
+    #     "allowedIPV4CidrList":[ ] } } } }"`
     #
     #   * Example: `WAFV2` - Account takeover prevention, Bot Control
     #     managed rule groups, optimize unassociated web ACL, and rule
     #     action override
     #
-    #     `"\{"type":"WAFV2","preProcessRuleGroups":[\{"ruleGroupArn":null,"overrideAction":\{"type":"NONE"\},"managedRuleGroupIdentifier":\{"versionEnabled":null,"version":null,"vendorName":"AWS","managedRuleGroupName":"AWSManagedRulesATPRuleSet","managedRuleGroupConfigs":[\{"awsmanagedRulesATPRuleSet":\{"loginPath":"/loginpath","requestInspection":\{"payloadType":"FORM_ENCODED|JSON","usernameField":\{"identifier":"/form/username"\},"passwordField":\{"identifier":"/form/password"\}\}\}\}]\},"ruleGroupType":"ManagedRuleGroup","excludeRules":[],"sampledRequestsEnabled":true\},\{"ruleGroupArn":null,"overrideAction":\{"type":"NONE"\},"managedRuleGroupIdentifier":\{"versionEnabled":null,"version":null,"vendorName":"AWS","managedRuleGroupName":"AWSManagedRulesBotControlRuleSet","managedRuleGroupConfigs":[\{"awsmanagedRulesBotControlRuleSet":\{"inspectionLevel":"TARGETED|COMMON"\}\}]\},"ruleGroupType":"ManagedRuleGroup","excludeRules":[],"sampledRequestsEnabled":true,"ruleActionOverrides":[\{"name":"Rule1","actionToUse":\{"allow|block|count|captcha|challenge":\{\}\}\},\{"name":"Rule2","actionToUse":\{"allow|block|count|captcha|challenge":\{\}\}\}]\}],"postProcessRuleGroups":[],"defaultAction":\{"type":"ALLOW"\},"customRequestHandling":null,"customResponse":null,"overrideCustomerWebACLAssociation":false,"loggingConfiguration":null,"sampledRequestsEnabledForDefaultActions":true,"optimizeUnassociatedWebACL":true\}"`
+    #     `"{"type":"WAFV2","preProcessRuleGroups":[{"ruleGroupArn":null,"overrideAction":{"type":"NONE"},"managedRuleGroupIdentifier":{"versionEnabled":null,"version":null,"vendorName":"AWS","managedRuleGroupName":"AWSManagedRulesATPRuleSet","managedRuleGroupConfigs":[{"awsmanagedRulesATPRuleSet":{"loginPath":"/loginpath","requestInspection":{"payloadType":"FORM_ENCODED|JSON","usernameField":{"identifier":"/form/username"},"passwordField":{"identifier":"/form/password"}}}}]},"ruleGroupType":"ManagedRuleGroup","excludeRules":[],"sampledRequestsEnabled":true},{"ruleGroupArn":null,"overrideAction":{"type":"NONE"},"managedRuleGroupIdentifier":{"versionEnabled":null,"version":null,"vendorName":"AWS","managedRuleGroupName":"AWSManagedRulesBotControlRuleSet","managedRuleGroupConfigs":[{"awsmanagedRulesBotControlRuleSet":{"inspectionLevel":"TARGETED|COMMON"}}]},"ruleGroupType":"ManagedRuleGroup","excludeRules":[],"sampledRequestsEnabled":true,"ruleActionOverrides":[{"name":"Rule1","actionToUse":{"allow|block|count|captcha|challenge":{}}},{"name":"Rule2","actionToUse":{"allow|block|count|captcha|challenge":{}}}]}],"postProcessRuleGroups":[],"defaultAction":{"type":"ALLOW"},"customRequestHandling":null,"customResponse":null,"overrideCustomerWebACLAssociation":false,"loggingConfiguration":null,"sampledRequestsEnabledForDefaultActions":true,"optimizeUnassociatedWebACL":true}"`
     #
     #     * Bot Control - For information about
     #       `AWSManagedRulesBotControlRuleSet` managed rule groups, see
@@ -5049,7 +5058,7 @@ module Aws::FMS
     #
     #   * Example: `WAFV2` - `CAPTCHA` and `Challenge` configs
     #
-    #     `"\{"type":"WAFV2","preProcessRuleGroups":[\{"ruleGroupArn":null,"overrideAction":\{"type":"NONE"\},"managedRuleGroupIdentifier":\{"versionEnabled":null,"version":null,"vendorName":"AWS","managedRuleGroupName":"AWSManagedRulesAdminProtectionRuleSet"\},"ruleGroupType":"ManagedRuleGroup","excludeRules":[],"sampledRequestsEnabled":true\}],"postProcessRuleGroups":[],"defaultAction":\{"type":"ALLOW"\},"customRequestHandling":null,"customResponse":null,"overrideCustomerWebACLAssociation":false,"loggingConfiguration":null,"sampledRequestsEnabledForDefaultActions":true,"captchaConfig":\{"immunityTimeProperty":\{"immunityTime":500\}\},"challengeConfig":\{"immunityTimeProperty":\{"immunityTime":800\}\},"tokenDomains":["google.com","amazon.com"],"associationConfig":\{"requestBody":\{"CLOUDFRONT":\{"defaultSizeInspectionLimit":"KB_16"\}\}\}\}"`
+    #     `"{"type":"WAFV2","preProcessRuleGroups":[{"ruleGroupArn":null,"overrideAction":{"type":"NONE"},"managedRuleGroupIdentifier":{"versionEnabled":null,"version":null,"vendorName":"AWS","managedRuleGroupName":"AWSManagedRulesAdminProtectionRuleSet"},"ruleGroupType":"ManagedRuleGroup","excludeRules":[],"sampledRequestsEnabled":true}],"postProcessRuleGroups":[],"defaultAction":{"type":"ALLOW"},"customRequestHandling":null,"customResponse":null,"overrideCustomerWebACLAssociation":false,"loggingConfiguration":null,"sampledRequestsEnabledForDefaultActions":true,"captchaConfig":{"immunityTimeProperty":{"immunityTime":500}},"challengeConfig":{"immunityTimeProperty":{"immunityTime":800}},"tokenDomains":["google.com","amazon.com"],"associationConfig":{"requestBody":{"CLOUDFRONT":{"defaultSizeInspectionLimit":"KB_16"}}}}"`
     #
     #     * `CAPTCHA` and `Challenge` configs - If you update the policy's
     #       values for `associationConfig`, `captchaConfig`,
@@ -5072,7 +5081,7 @@ module Aws::FMS
     #   * Example: `WAFV2` - Firewall Manager support for WAF managed rule
     #     group versioning
     #
-    #     `"\{"type":"WAFV2","preProcessRuleGroups":[\{"ruleGroupArn":null,"overrideAction":\{"type":"NONE"\},"managedRuleGroupIdentifier":\{"versionEnabled":true,"version":"Version_2.0","vendorName":"AWS","managedRuleGroupName":"AWSManagedRulesCommonRuleSet"\},"ruleGroupType":"ManagedRuleGroup","excludeRules":[\{"name":"NoUserAgent_HEADER"\}]\}],"postProcessRuleGroups":[],"defaultAction":\{"type":"ALLOW"\},"overrideCustomerWebACLAssociation":false,"loggingConfiguration":\{"logDestinationConfigs":["arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination"],"redactedFields":[\{"redactedFieldType":"SingleHeader","redactedFieldValue":"Cookies"\},\{"redactedFieldType":"Method"\}]\}\}"`
+    #     `"{"preProcessRuleGroups":[{"ruleGroupType":"ManagedRuleGroup","overrideAction":{"type":"NONE"},"sampledRequestsEnabled":true,"managedRuleGroupIdentifier":{"managedRuleGroupName":"AWSManagedRulesAdminProtectionRuleSet","vendorName":"AWS","managedRuleGroupConfigs":null}}],"postProcessRuleGroups":[],"defaultAction":{"type":"ALLOW"},"customRequestHandling":null,"tokenDomains":null,"customResponse":null,"type":"WAFV2","overrideCustomerWebACLAssociation":false,"sampledRequestsEnabledForDefaultActions":true,"optimizeUnassociatedWebACL":true,"webACLSource":"RETROFIT_EXISTING"}"`
     #
     #     To use a specific version of a WAF managed rule group in your
     #     Firewall Manager policy, you must set `versionEnabled` to `true`,
@@ -5083,21 +5092,21 @@ module Aws::FMS
     #
     #   * Example: `WAFV2` - Logging configurations
     #
-    #     `"\{"type":"WAFV2","preProcessRuleGroups":[\{"ruleGroupArn":null,
-    #     "overrideAction":\{"type":"NONE"\},"managedRuleGroupIdentifier":
-    #     \{"versionEnabled":null,"version":null,"vendorName":"AWS",
-    #     "managedRuleGroupName":"AWSManagedRulesAdminProtectionRuleSet"\}
+    #     `"{"type":"WAFV2","preProcessRuleGroups":[{"ruleGroupArn":null,
+    #     "overrideAction":{"type":"NONE"},"managedRuleGroupIdentifier":
+    #     {"versionEnabled":null,"version":null,"vendorName":"AWS",
+    #     "managedRuleGroupName":"AWSManagedRulesAdminProtectionRuleSet"}
     #     ,"ruleGroupType":"ManagedRuleGroup","excludeRules":[],
-    #     "sampledRequestsEnabled":true\}],"postProcessRuleGroups":[],
-    #     "defaultAction":\{"type":"ALLOW"\},"customRequestHandling"
+    #     "sampledRequestsEnabled":true}],"postProcessRuleGroups":[],
+    #     "defaultAction":{"type":"ALLOW"},"customRequestHandling"
     #     \:null,"customResponse":null,"overrideCustomerWebACLAssociation"
-    #     \:false,"loggingConfiguration":\{"logDestinationConfigs":
+    #     \:false,"loggingConfiguration":{"logDestinationConfigs":
     #     ["arn:aws:s3:::aws-waf-logs-example-bucket"]
-    #     ,"redactedFields":[],"loggingFilterConfigs":\{"defaultBehavior":"KEEP",
-    #     "filters":[\{"behavior":"KEEP","requirement":"MEETS_ALL",
-    #     "conditions":[\{"actionCondition":"CAPTCHA"\},\{"actionCondition":
-    #     "CHALLENGE"\},
-    #     \{"actionCondition":"EXCLUDED_AS_COUNT"\}]\}]\}\},"sampledRequestsEnabledForDefaultActions":true\}"`
+    #     ,"redactedFields":[],"loggingFilterConfigs":{"defaultBehavior":"KEEP",
+    #     "filters":[{"behavior":"KEEP","requirement":"MEETS_ALL",
+    #     "conditions":[{"actionCondition":"CAPTCHA"},{"actionCondition":
+    #     "CHALLENGE"},
+    #     {"actionCondition":"EXCLUDED_AS_COUNT"}]}]}},"sampledRequestsEnabledForDefaultActions":true}"`
     #
     #     Firewall Manager supports Amazon Kinesis Data Firehose and Amazon
     #     S3 as the `logDestinationConfigs` in your `loggingConfiguration`.
@@ -5111,10 +5120,7 @@ module Aws::FMS
     #
     #   * Example: `WAF Classic`
     #
-    #     `"\{"type": "WAF", "ruleGroups":
-    #     [\{"id":"12345678-1bcd-9012-efga-0987654321ab",
-    #     "overrideAction" : \{"type": "COUNT"\}\}],
-    #     "defaultAction": \{"type": "BLOCK"\}\}"`
+    #     `"{"ruleGroups":[{"id":"78cb36c0-1b5e-4d7d-82b2-cf48d3ad9659","overrideAction":{"type":"NONE"}}],"overrideCustomerWebACLAssociation":true,"defaultAction":{"type":"ALLOW"},"type":"WAF"}"`
     #
     #
     #
@@ -5542,6 +5548,48 @@ module Aws::FMS
       include Aws::Structure
     end
 
+    # The violation details for a web ACL whose configuration is
+    # incompatible with the Firewall Manager policy.
+    #
+    # @!attribute [rw] web_acl_arn
+    #   The Amazon Resource Name (ARN) of the web ACL.
+    #   @return [String]
+    #
+    # @!attribute [rw] description
+    #   Information about the problems that Firewall Manager encountered
+    #   with the web ACL configuration.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/fms-2018-01-01/WebACLHasIncompatibleConfigurationViolation AWS API Documentation
+    #
+    class WebACLHasIncompatibleConfigurationViolation < Struct.new(
+      :web_acl_arn,
+      :description)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # The violation details for a web ACL that's associated with at least
+    # one resource that's out of scope of the Firewall Manager policy.
+    #
+    # @!attribute [rw] web_acl_arn
+    #   The Amazon Resource Name (ARN) of the web ACL.
+    #   @return [String]
+    #
+    # @!attribute [rw] out_of_scope_resource_list
+    #   An array of Amazon Resource Name (ARN) for the resources that are
+    #   out of scope of the policy and are associated with the web ACL.
+    #   @return [Array<String>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/fms-2018-01-01/WebACLHasOutOfScopeResourcesViolation AWS API Documentation
+    #
+    class WebACLHasOutOfScopeResourcesViolation < Struct.new(
+      :web_acl_arn,
+      :out_of_scope_resource_list)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
   end
 end
 

data/lib/aws-sdk-fms.rb

@@ -54,7 +54,7 @@ module Aws::FMS
   autoload :EndpointProvider, 'aws-sdk-fms/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-fms/endpoints'
 
-  GEM_VERSION = '1.83.0'
+  GEM_VERSION = '1.85.0'
 
 end
 

data/sig/types.rbs

@@ -123,7 +123,7 @@ module Aws::FMS
 
     class ComplianceViolator
       attr_accessor resource_id: ::String
-      attr_accessor violation_reason: ("WEB_ACL_MISSING_RULE_GROUP" | "RESOURCE_MISSING_WEB_ACL" | "RESOURCE_INCORRECT_WEB_ACL" | "RESOURCE_MISSING_SHIELD_PROTECTION" | "RESOURCE_MISSING_WEB_ACL_OR_SHIELD_PROTECTION" | "RESOURCE_MISSING_SECURITY_GROUP" | "RESOURCE_VIOLATES_AUDIT_SECURITY_GROUP" | "SECURITY_GROUP_UNUSED" | "SECURITY_GROUP_REDUNDANT" | "FMS_CREATED_SECURITY_GROUP_EDITED" | "MISSING_FIREWALL" | "MISSING_FIREWALL_SUBNET_IN_AZ" | "MISSING_EXPECTED_ROUTE_TABLE" | "NETWORK_FIREWALL_POLICY_MODIFIED" | "FIREWALL_SUBNET_IS_OUT_OF_SCOPE" | "INTERNET_GATEWAY_MISSING_EXPECTED_ROUTE" | "FIREWALL_SUBNET_MISSING_EXPECTED_ROUTE" | "UNEXPECTED_FIREWALL_ROUTES" | "UNEXPECTED_TARGET_GATEWAY_ROUTES" | "TRAFFIC_INSPECTION_CROSSES_AZ_BOUNDARY" | "INVALID_ROUTE_CONFIGURATION" | "MISSING_TARGET_GATEWAY" | "INTERNET_TRAFFIC_NOT_INSPECTED" | "BLACK_HOLE_ROUTE_DETECTED" | "BLACK_HOLE_ROUTE_DETECTED_IN_FIREWALL_SUBNET" | "RESOURCE_MISSING_DNS_FIREWALL" | "ROUTE_HAS_OUT_OF_SCOPE_ENDPOINT" | "FIREWALL_SUBNET_MISSING_VPCE_ENDPOINT" | "INVALID_NETWORK_ACL_ENTRY")
+      attr_accessor violation_reason: ("WEB_ACL_MISSING_RULE_GROUP" | "RESOURCE_MISSING_WEB_ACL" | "RESOURCE_INCORRECT_WEB_ACL" | "RESOURCE_MISSING_SHIELD_PROTECTION" | "RESOURCE_MISSING_WEB_ACL_OR_SHIELD_PROTECTION" | "RESOURCE_MISSING_SECURITY_GROUP" | "RESOURCE_VIOLATES_AUDIT_SECURITY_GROUP" | "SECURITY_GROUP_UNUSED" | "SECURITY_GROUP_REDUNDANT" | "FMS_CREATED_SECURITY_GROUP_EDITED" | "MISSING_FIREWALL" | "MISSING_FIREWALL_SUBNET_IN_AZ" | "MISSING_EXPECTED_ROUTE_TABLE" | "NETWORK_FIREWALL_POLICY_MODIFIED" | "FIREWALL_SUBNET_IS_OUT_OF_SCOPE" | "INTERNET_GATEWAY_MISSING_EXPECTED_ROUTE" | "FIREWALL_SUBNET_MISSING_EXPECTED_ROUTE" | "UNEXPECTED_FIREWALL_ROUTES" | "UNEXPECTED_TARGET_GATEWAY_ROUTES" | "TRAFFIC_INSPECTION_CROSSES_AZ_BOUNDARY" | "INVALID_ROUTE_CONFIGURATION" | "MISSING_TARGET_GATEWAY" | "INTERNET_TRAFFIC_NOT_INSPECTED" | "BLACK_HOLE_ROUTE_DETECTED" | "BLACK_HOLE_ROUTE_DETECTED_IN_FIREWALL_SUBNET" | "RESOURCE_MISSING_DNS_FIREWALL" | "ROUTE_HAS_OUT_OF_SCOPE_ENDPOINT" | "FIREWALL_SUBNET_MISSING_VPCE_ENDPOINT" | "INVALID_NETWORK_ACL_ENTRY" | "WEB_ACL_CONFIGURATION_OR_SCOPE_OF_USE")
       attr_accessor resource_type: ::String
       attr_accessor metadata: ::Hash[::String, ::String]
       SENSITIVE: []
@@ -1081,6 +1081,8 @@ module Aws::FMS
       attr_accessor firewall_subnet_missing_vpc_endpoint_violation: Types::FirewallSubnetMissingVPCEndpointViolation
       attr_accessor invalid_network_acl_entries_violation: Types::InvalidNetworkAclEntriesViolation
       attr_accessor possible_remediation_actions: Types::PossibleRemediationActions
+      attr_accessor web_acl_has_incompatible_configuration_violation: Types::WebACLHasIncompatibleConfigurationViolation
+      attr_accessor web_acl_has_out_of_scope_resources_violation: Types::WebACLHasOutOfScopeResourcesViolation
       SENSITIVE: []
     end
 
@@ -1224,5 +1226,17 @@ module Aws::FMS
       attr_accessor resource_description: ::String
       SENSITIVE: []
     end
+
+    class WebACLHasIncompatibleConfigurationViolation
+      attr_accessor web_acl_arn: ::String
+      attr_accessor description: ::String
+      SENSITIVE: []
+    end
+
+    class WebACLHasOutOfScopeResourcesViolation
+      attr_accessor web_acl_arn: ::String
+      attr_accessor out_of_scope_resource_list: ::Array[::String]
+      SENSITIVE: []
+    end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-fms
 version: !ruby/object:Gem::Version
-  version: 1.83.0
+  version: 1.85.0
 platform: ruby
 authors:
 - Amazon Web Services
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-10-18 00:00:00.000000000 Z
+date: 2024-11-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-sdk-core