AWS.FMS reference

AdminAccount

Source: src/AWS/FMS/AdminAccount.ts

The AWS Firewall Manager administrator account — an organization-level singleton that designates which account manages FMS security policies.

Caution

FMS requires the caller to be the AWS Organizations management account, and the organization must have AWS Config enabled. On accounts that are not an Organizations management account this resource fails at association time with a typed InvalidOperationException.

FMS admin-account APIs are served only from the us-east-1 endpoint; this resource pins every control-plane call there regardless of the ambient stack region.

This is a capture-and-restore singleton: FMS exposes no tags, so ownership is tracked by Alchemy state — adopting a pre-existing admin account that Alchemy did not create requires --adopt, and destroy disassociates the admin.

AdminAccount: Designating the FMS admin

Designate the caller as the FMS admin

const admin = yield* FMS.AdminAccount("FmsAdmin", {});

Designate a specific member account

const admin = yield* FMS.AdminAccount("FmsAdmin", {
  adminAccount: "123456789012",
});

AssociateThirdPartyFirewall

Source: src/AWS/FMS/AssociateThirdPartyFirewall.ts

Runtime binding for fms:AssociateThirdPartyFirewall.

Sets the Firewall Manager policy administrator as a tenant administrator of a third-party firewall service (Palo Alto Networks Cloud NGFW or Fortigate Cloud Native Firewall). Requires an active AWS Marketplace subscription to the vendor. Provide the implementation with Effect.provide(AWS.FMS.AssociateThirdPartyFirewallHttp).

AssociateThirdPartyFirewall: Third-Party Firewalls

// init — account-level binding takes no resource
const associateThirdPartyFirewall = yield* AWS.FMS.AssociateThirdPartyFirewall();

// runtime
const result = yield* associateThirdPartyFirewall({
  ThirdPartyFirewall: "PALO_ALTO_NETWORKS_CLOUD_NGFW",
});
console.log(result.ThirdPartyFirewallStatus);

BatchAssociateResource

Source: src/AWS/FMS/BatchAssociateResource.ts

Runtime binding for fms:BatchAssociateResource.

Associates resources with the specified Firewall Manager resource set, reporting per-item failures. Provide the implementation with Effect.provide(AWS.FMS.BatchAssociateResourceHttp).

BatchAssociateResource: Resource Sets

// init — account-level binding takes no resource
const batchAssociateResource = yield* AWS.FMS.BatchAssociateResource();

// runtime
const result = yield* batchAssociateResource({
  ResourceSetIdentifier: resourceSetId,
  Items: [firewallArn],
});
console.log(result.FailedItems.length);

BatchDisassociateResource

Source: src/AWS/FMS/BatchDisassociateResource.ts

Runtime binding for fms:BatchDisassociateResource.

Disassociates resources from the specified Firewall Manager resource set, reporting per-item failures. Provide the implementation with Effect.provide(AWS.FMS.BatchDisassociateResourceHttp).

BatchDisassociateResource: Resource Sets

// init — account-level binding takes no resource
const batchDisassociateResource = yield* AWS.FMS.BatchDisassociateResource();

// runtime
const result = yield* batchDisassociateResource({
  ResourceSetIdentifier: resourceSetId,
  Items: [firewallArn],
});
console.log(result.FailedItems.length);

DeleteAppsList

Source: src/AWS/FMS/DeleteAppsList.ts

Runtime binding for fms:DeleteAppsList.

Permanently deletes the specified Firewall Manager applications list. Provide the implementation with Effect.provide(AWS.FMS.DeleteAppsListHttp).

DeleteAppsList: Applications Lists

// init — account-level binding takes no resource
const deleteAppsList = yield* AWS.FMS.DeleteAppsList();

// runtime
yield* deleteAppsList({ ListId: listId });

DeleteNotificationChannel

Source: src/AWS/FMS/DeleteNotificationChannel.ts

Runtime binding for fms:DeleteNotificationChannel.

Deletes the Firewall Manager association with the IAM role and SNS topic used to record SNS logs. Provide the implementation with Effect.provide(AWS.FMS.DeleteNotificationChannelHttp).

DeleteNotificationChannel: Notification Channel

// init — account-level binding takes no resource
const deleteNotificationChannel = yield* AWS.FMS.DeleteNotificationChannel();

// runtime
yield* deleteNotificationChannel();

DeletePolicy

Source: src/AWS/FMS/DeletePolicy.ts

Runtime binding for fms:DeletePolicy.

Permanently deletes the specified Firewall Manager policy, optionally cleaning up the resources it created in member accounts. Provide the implementation with Effect.provide(AWS.FMS.DeletePolicyHttp).

DeletePolicy: Managing Policies

// init — account-level binding takes no resource
const deletePolicy = yield* AWS.FMS.DeletePolicy();

// runtime
yield* deletePolicy({ PolicyId: policyId, DeleteAllPolicyResources: true });

DeleteProtocolsList

Source: src/AWS/FMS/DeleteProtocolsList.ts

Runtime binding for fms:DeleteProtocolsList.

Permanently deletes the specified Firewall Manager protocols list. Provide the implementation with Effect.provide(AWS.FMS.DeleteProtocolsListHttp).

DeleteProtocolsList: Protocols Lists

// init — account-level binding takes no resource
const deleteProtocolsList = yield* AWS.FMS.DeleteProtocolsList();

// runtime
yield* deleteProtocolsList({ ListId: listId });

DeleteResourceSet

Source: src/AWS/FMS/DeleteResourceSet.ts

Runtime binding for fms:DeleteResourceSet.

Permanently deletes the specified Firewall Manager resource set. Provide the implementation with Effect.provide(AWS.FMS.DeleteResourceSetHttp).

DeleteResourceSet: Resource Sets

// init — account-level binding takes no resource
const deleteResourceSet = yield* AWS.FMS.DeleteResourceSet();

// runtime
yield* deleteResourceSet({ Identifier: resourceSetId });

DisassociateThirdPartyFirewall

Source: src/AWS/FMS/DisassociateThirdPartyFirewall.ts

Runtime binding for fms:DisassociateThirdPartyFirewall.

Disassociates a Firewall Manager policy administrator from a third-party firewall tenant. The third-party vendor deletes all of the firewalls associated with the account. Provide the implementation with Effect.provide(AWS.FMS.DisassociateThirdPartyFirewallHttp).

DisassociateThirdPartyFirewall: Third-Party Firewalls

// init — account-level binding takes no resource
const disassociateThirdPartyFirewall = yield* AWS.FMS.DisassociateThirdPartyFirewall();

// runtime
const result = yield* disassociateThirdPartyFirewall({
  ThirdPartyFirewall: "PALO_ALTO_NETWORKS_CLOUD_NGFW",
});
console.log(result.ThirdPartyFirewallStatus);

GetAdminScope

Source: src/AWS/FMS/GetAdminScope.ts

Runtime binding for fms:GetAdminScope.

Returns information about the specified account’s administrative scope — the resources a Firewall Manager administrator can manage. Provide the implementation with Effect.provide(AWS.FMS.GetAdminScopeHttp).

GetAdminScope: Administrator Management

// init — account-level binding takes no resource
const getAdminScope = yield* AWS.FMS.GetAdminScope();

// runtime
const result = yield* getAdminScope({ AdminAccount: accountId });
console.log(result.Status, result.AdminScope?.PolicyTypeScope);

GetAppsList

Source: src/AWS/FMS/GetAppsList.ts

Runtime binding for fms:GetAppsList.

Returns the specified Firewall Manager applications list. Provide the implementation with Effect.provide(AWS.FMS.GetAppsListHttp).

GetAppsList: Applications Lists

// init — account-level binding takes no resource
const getAppsList = yield* AWS.FMS.GetAppsList();

// runtime
const result = yield* getAppsList({ ListId: listId });
console.log(result.AppsList?.AppsList?.length);

GetComplianceDetail

Source: src/AWS/FMS/GetComplianceDetail.ts

Runtime binding for fms:GetComplianceDetail.

Returns detailed compliance information about the specified member account — the resources that are in and out of compliance with the specified policy. Provide the implementation with Effect.provide(AWS.FMS.GetComplianceDetailHttp).

GetComplianceDetail: Compliance and Protection Status

// init — account-level binding takes no resource
const getComplianceDetail = yield* AWS.FMS.GetComplianceDetail();

// runtime
const result = yield* getComplianceDetail({
  PolicyId: policyId,
  MemberAccount: accountId,
});
console.log(result.PolicyComplianceDetail?.Violators?.length);

GetNotificationChannel

Source: src/AWS/FMS/GetNotificationChannel.ts

Runtime binding for fms:GetNotificationChannel.

Returns the SNS topic that is used to record Firewall Manager SNS logs. Provide the implementation with Effect.provide(AWS.FMS.GetNotificationChannelHttp).

GetNotificationChannel: Notification Channel

// init — account-level binding takes no resource
const getNotificationChannel = yield* AWS.FMS.GetNotificationChannel();

// runtime
const result = yield* getNotificationChannel();
console.log(result.SnsTopicArn);

GetPolicy

Source: src/AWS/FMS/GetPolicy.ts

Runtime binding for fms:GetPolicy.

Returns the specified Firewall Manager policy. Provide the implementation with Effect.provide(AWS.FMS.GetPolicyHttp).

GetPolicy: Reading Policies

// init — account-level binding takes no resource
const getPolicy = yield* AWS.FMS.GetPolicy();

// runtime
const result = yield* getPolicy({ PolicyId: policyId });
console.log(result.Policy?.PolicyName);

GetProtectionStatus

Source: src/AWS/FMS/GetProtectionStatus.ts

Runtime binding for fms:GetProtectionStatus.

Returns policy-level attack summary information for Shield Advanced policies — DDoS attacks detected during the specified time period. Provide the implementation with Effect.provide(AWS.FMS.GetProtectionStatusHttp).

GetProtectionStatus: Compliance and Protection Status

// init — account-level binding takes no resource
const getProtectionStatus = yield* AWS.FMS.GetProtectionStatus();

// runtime
const result = yield* getProtectionStatus({ PolicyId: policyId });
console.log(result.ServiceType, result.Data);

GetProtocolsList

Source: src/AWS/FMS/GetProtocolsList.ts

Runtime binding for fms:GetProtocolsList.

Returns the specified Firewall Manager protocols list. Provide the implementation with Effect.provide(AWS.FMS.GetProtocolsListHttp).

GetProtocolsList: Protocols Lists

// init — account-level binding takes no resource
const getProtocolsList = yield* AWS.FMS.GetProtocolsList();

// runtime
const result = yield* getProtocolsList({ ListId: listId });
console.log(result.ProtocolsList?.ProtocolsList);

GetResourceSet

Source: src/AWS/FMS/GetResourceSet.ts

Runtime binding for fms:GetResourceSet.

Returns the specified Firewall Manager resource set. Provide the implementation with Effect.provide(AWS.FMS.GetResourceSetHttp).

GetResourceSet: Resource Sets

// init — account-level binding takes no resource
const getResourceSet = yield* AWS.FMS.GetResourceSet();

// runtime
const result = yield* getResourceSet({ Identifier: resourceSetId });
console.log(result.ResourceSet.Name);

GetThirdPartyFirewallAssociationStatus

Source: src/AWS/FMS/GetThirdPartyFirewallAssociationStatus.ts

Runtime binding for fms:GetThirdPartyFirewallAssociationStatus.

Returns the onboarding status of the Firewall Manager admin account with a third-party firewall vendor tenant, including the AWS Marketplace subscription status. Provide the implementation with Effect.provide(AWS.FMS.GetThirdPartyFirewallAssociationStatusHttp).

GetThirdPartyFirewallAssociationStatus: Third-Party Firewalls

// init — account-level binding takes no resource
const getThirdPartyFirewallAssociationStatus =
  yield* AWS.FMS.GetThirdPartyFirewallAssociationStatus();

// runtime
const result = yield* getThirdPartyFirewallAssociationStatus({
  ThirdPartyFirewall: "PALO_ALTO_NETWORKS_CLOUD_NGFW",
});
console.log(
  result.ThirdPartyFirewallStatus,
  result.MarketplaceOnboardingStatus,
);

GetViolationDetails

Source: src/AWS/FMS/GetViolationDetails.ts

Runtime binding for fms:GetViolationDetails.

Returns violation details for the specified resource covered by a Firewall Manager network ACL, security group, Network Firewall, DNS Firewall, or third-party firewall policy. Provide the implementation with Effect.provide(AWS.FMS.GetViolationDetailsHttp).

GetViolationDetails: Compliance and Protection Status

// init — account-level binding takes no resource
const getViolationDetails = yield* AWS.FMS.GetViolationDetails();

// runtime
const result = yield* getViolationDetails({
  PolicyId: policyId,
  MemberAccount: accountId,
  ResourceId: instanceId,
  ResourceType: "AWS::EC2::Instance",
});
console.log(result.ViolationDetail?.ResourceViolations.length);

ListAdminAccountsForOrganization

Source: src/AWS/FMS/ListAdminAccountsForOrganization.ts

Runtime binding for fms:ListAdminAccountsForOrganization.

Returns the Firewall Manager administrator accounts in the organization — only usable by the organization’s management account. Provide the implementation with Effect.provide(AWS.FMS.ListAdminAccountsForOrganizationHttp).

ListAdminAccountsForOrganization: Administrator Management

// init — account-level binding takes no resource
const listAdminAccountsForOrganization = yield* AWS.FMS.ListAdminAccountsForOrganization();

// runtime
const result = yield* listAdminAccountsForOrganization();
console.log(result.AdminAccounts?.length);

ListAdminsManagingAccount

Source: src/AWS/FMS/ListAdminsManagingAccount.ts

Runtime binding for fms:ListAdminsManagingAccount.

Returns the administrators who have the calling account within their administrative scope — usable by any member account to see who manages it. Provide the implementation with Effect.provide(AWS.FMS.ListAdminsManagingAccountHttp).

ListAdminsManagingAccount: Administrator Management

// init — account-level binding takes no resource
const listAdminsManagingAccount = yield* AWS.FMS.ListAdminsManagingAccount();

// runtime
const result = yield* listAdminsManagingAccount();
console.log(result.AdminAccounts?.length);

ListAppsLists

Source: src/AWS/FMS/ListAppsLists.ts

Runtime binding for fms:ListAppsLists.

Returns an array of AppsListDataSummary objects for the applications lists in the administrator’s account. Provide the implementation with Effect.provide(AWS.FMS.ListAppsListsHttp).

ListAppsLists: Applications Lists

// init — account-level binding takes no resource
const listAppsLists = yield* AWS.FMS.ListAppsLists();

// runtime
const result = yield* listAppsLists({ MaxResults: 25 });
console.log(result.AppsLists?.length);

ListComplianceStatus

Source: src/AWS/FMS/ListComplianceStatus.ts

Runtime binding for fms:ListComplianceStatus.

Returns an array of PolicyComplianceStatus objects — use it to get a summary of which member accounts are protected by the specified policy. Provide the implementation with Effect.provide(AWS.FMS.ListComplianceStatusHttp).

ListComplianceStatus: Compliance and Protection Status

// init — account-level binding takes no resource
const listComplianceStatus = yield* AWS.FMS.ListComplianceStatus();

// runtime
const result = yield* listComplianceStatus({ PolicyId: policyId });
console.log(result.PolicyComplianceStatusList?.length);

ListDiscoveredResources

Source: src/AWS/FMS/ListDiscoveredResources.ts

Runtime binding for fms:ListDiscoveredResources.

Returns an array of resources in the organization’s accounts that are available to be associated with a resource set. Provide the implementation with Effect.provide(AWS.FMS.ListDiscoveredResourcesHttp).

ListDiscoveredResources: Resource Sets

// init — account-level binding takes no resource
const listDiscoveredResources = yield* AWS.FMS.ListDiscoveredResources();

// runtime
const result = yield* listDiscoveredResources({
  MemberAccountIds: [accountId],
  ResourceType: "AWS::EC2::Instance",
});
console.log(result.Items?.length);

ListMemberAccounts

Source: src/AWS/FMS/ListMemberAccounts.ts

Runtime binding for fms:ListMemberAccounts.

Returns the member account ids in the administrator’s Amazon Web Services organization — only usable by the organization’s management account or a delegated administrator. Provide the implementation with Effect.provide(AWS.FMS.ListMemberAccountsHttp).

ListMemberAccounts: Compliance and Protection Status

// init — account-level binding takes no resource
const listMemberAccounts = yield* AWS.FMS.ListMemberAccounts();

// runtime
const result = yield* listMemberAccounts();
console.log(result.MemberAccounts?.length);

ListPolicies

Source: src/AWS/FMS/ListPolicies.ts

Runtime binding for fms:ListPolicies.

Returns the PolicySummary list for the Firewall Manager policies in the administrator’s account. Provide the implementation with Effect.provide(AWS.FMS.ListPoliciesHttp).

ListPolicies: Reading Policies

// init — account-level binding takes no resource
const listPolicies = yield* AWS.FMS.ListPolicies();

// runtime
const result = yield* listPolicies();
console.log(result.PolicyList?.length);

ListProtocolsLists

Source: src/AWS/FMS/ListProtocolsLists.ts

Runtime binding for fms:ListProtocolsLists.

Returns an array of ProtocolsListDataSummary objects for the protocols lists in the administrator’s account. Provide the implementation with Effect.provide(AWS.FMS.ListProtocolsListsHttp).

ListProtocolsLists: Protocols Lists

// init — account-level binding takes no resource
const listProtocolsLists = yield* AWS.FMS.ListProtocolsLists();

// runtime
const result = yield* listProtocolsLists({ MaxResults: 25 });
console.log(result.ProtocolsLists?.length);

ListResourceSetResources

Source: src/AWS/FMS/ListResourceSetResources.ts

Runtime binding for fms:ListResourceSetResources.

Returns an array of the resources associated with the specified Firewall Manager resource set. Provide the implementation with Effect.provide(AWS.FMS.ListResourceSetResourcesHttp).

ListResourceSetResources: Resource Sets

// init — account-level binding takes no resource
const listResourceSetResources = yield* AWS.FMS.ListResourceSetResources();

// runtime
const result = yield* listResourceSetResources({ Identifier: resourceSetId });
console.log(result.Items.length);

ListResourceSets

Source: src/AWS/FMS/ListResourceSets.ts

Runtime binding for fms:ListResourceSets.

Returns an array of ResourceSetSummary objects for the resource sets in the administrator’s account. Provide the implementation with Effect.provide(AWS.FMS.ListResourceSetsHttp).

ListResourceSets: Resource Sets

// init — account-level binding takes no resource
const listResourceSets = yield* AWS.FMS.ListResourceSets();

// runtime
const result = yield* listResourceSets();
console.log(result.ResourceSets?.length);

ListThirdPartyFirewallFirewallPolicies

Source: src/AWS/FMS/ListThirdPartyFirewallFirewallPolicies.ts

Runtime binding for fms:ListThirdPartyFirewallFirewallPolicies.

Retrieves a list of all of the third-party firewall policies that are associated with the third-party firewall administrator’s account. Provide the implementation with Effect.provide(AWS.FMS.ListThirdPartyFirewallFirewallPoliciesHttp).

ListThirdPartyFirewallFirewallPolicies: Third-Party Firewalls

// init — account-level binding takes no resource
const listThirdPartyFirewallFirewallPolicies =
  yield* AWS.FMS.ListThirdPartyFirewallFirewallPolicies();

// runtime
const result = yield* listThirdPartyFirewallFirewallPolicies({
  ThirdPartyFirewall: "PALO_ALTO_NETWORKS_CLOUD_NGFW",
  MaxResults: 10,
});
console.log(result.ThirdPartyFirewallFirewallPolicies);

PutAppsList

Source: src/AWS/FMS/PutAppsList.ts

Runtime binding for fms:PutAppsList.

Creates or updates a Firewall Manager applications list. Provide the implementation with Effect.provide(AWS.FMS.PutAppsListHttp).

PutAppsList: Applications Lists

// init — account-level binding takes no resource
const putAppsList = yield* AWS.FMS.PutAppsList();

// runtime
const result = yield* putAppsList({
  AppsList: {
    ListName: "allowed-apps",
    AppsList: [{ AppName: "web", Protocol: "TCP", Port: 443 }],
  },
});
console.log(result.AppsList?.ListId);

PutNotificationChannel

Source: src/AWS/FMS/PutNotificationChannel.ts

Runtime binding for fms:PutNotificationChannel.

Designates the SNS topic and IAM role that Firewall Manager uses to record SNS logs — the channel through which Firewall Manager notifications flow. Provide the implementation with Effect.provide(AWS.FMS.PutNotificationChannelHttp).

PutNotificationChannel: Notification Channel

// init — account-level binding takes no resource
const putNotificationChannel = yield* AWS.FMS.PutNotificationChannel();

// runtime
yield* putNotificationChannel({
  SnsTopicArn: topicArn,
  SnsRoleName: roleArn,
});

PutPolicy

Source: src/AWS/FMS/PutPolicy.ts

Runtime binding for fms:PutPolicy.

Creates or updates a Firewall Manager policy — a WAF, Shield Advanced, security group, Network Firewall, DNS Firewall, or network ACL policy applied across the organization’s accounts. Provide the implementation with Effect.provide(AWS.FMS.PutPolicyHttp).

PutPolicy: Managing Policies

// init — account-level binding takes no resource
const putPolicy = yield* AWS.FMS.PutPolicy();

// runtime
const result = yield* putPolicy({
  Policy: {
    PolicyName: "org-waf-baseline",
    SecurityServicePolicyData: { Type: "WAFV2", ManagedServiceData: "..." },
    ResourceType: "AWS::ElasticLoadBalancingV2::LoadBalancer",
    ExcludeResourceTags: false,
    RemediationEnabled: true,
  },
});
console.log(result.Policy?.PolicyId);

PutProtocolsList

Source: src/AWS/FMS/PutProtocolsList.ts

Runtime binding for fms:PutProtocolsList.

Creates or updates a Firewall Manager protocols list. Provide the implementation with Effect.provide(AWS.FMS.PutProtocolsListHttp).

PutProtocolsList: Protocols Lists

// init — account-level binding takes no resource
const putProtocolsList = yield* AWS.FMS.PutProtocolsList();

// runtime
const result = yield* putProtocolsList({
  ProtocolsList: { ListName: "allowed-protocols", ProtocolsList: ["TCP", "UDP"] },
});
console.log(result.ProtocolsList?.ListId);

PutResourceSet

Source: src/AWS/FMS/PutResourceSet.ts

Runtime binding for fms:PutResourceSet.

Creates or updates a Firewall Manager resource set — a collection of resources that a Firewall Manager policy can protect as a unit. Provide the implementation with Effect.provide(AWS.FMS.PutResourceSetHttp).

PutResourceSet: Resource Sets

// init — account-level binding takes no resource
const putResourceSet = yield* AWS.FMS.PutResourceSet();

// runtime
const result = yield* putResourceSet({
  ResourceSet: {
    Name: "edge-resources",
    ResourceTypeList: ["AWS::NetworkFirewall::Firewall"],
  },
});
console.log(result.ResourceSet.Id);