fms-shield-resource-policy-check
Note
This rule is currently in the deprecation process. We do not recommend that you use them directly.
Checks if resources that AWS Shield Advanced can protect are protected by Shield Advanced. The rule is NON_COMPLIANT if a specified resource is not protected.
Identifier: FMS_SHIELD_RESOURCE_POLICY_CHECK
Resource Types: AWS::CloudFront::Distribution, AWS::ElasticLoadBalancingV2::LoadBalancer, AWS::WAFRegional::WebACL, AWS::EC2::EIP, AWS::ElasticLoadBalancing::LoadBalancer, AWS::ShieldRegional::Protection, AWS::Shield::Protection
Trigger type: Configuration changes
AWS Region: All supported AWS regions except China (Beijing), Asia Pacific (Thailand), Asia Pacific (Jakarta), Asia Pacific (Malaysia), Mexico (Central), Asia Pacific (Taipei), Canada West (Calgary), China (Ningxia) Region
Parameters:
- resourceTypes
- Type: String
-
The resource scope which this config rule will be applied to.
- webACLId
- Type: String
-
The WebACLId of the web ACL.
- excludeResourceTags (Optional)
- Type: boolean
-
If true, exclude the resources that match the resourceTags. If false, include all the resources that match the resourceTags.
- fmsManagedToken (Optional)
- Type: String
-
A token generated by AWS Firewall Manager when creating the rule in your account. AWS Config ignores this parameter when you create this rule.
- fmsRemediationEnabled (Optional)
- Type: boolean
-
If true, AWS Firewall Manager will update NON_COMPLIANT resources according to FMS policy. AWS Config ignores this parameter when you create this rule.
- resourceTags (Optional)
- Type: String
-
The resource tags that the rule should be associated with (for example, { "tagKey1" : ["tagValue1"], "tagKey2" : ["tagValue2", "tagValue3"] }).
AWS CloudFormation template
To create AWS Config managed rules with AWS CloudFormation templates, see Creating AWS Config Managed Rules With AWS CloudFormation Templates.
