Begins capturing the flows in a firewall, according to the filters you define. Captures are similar, but not identical to snapshots. Capture operations provide visibility into flows that are not closed and are tracked by a firewall's flow table. Unlike snapshots, captures are a time-boxed view.
A flow is network traffic that is monitored by a firewall, either by stateful or stateless rules. For traffic to be considered part of a flow, it must share Destination, DestinationPort, Direction, Protocol, Source, and SourcePort.
To avoid encountering operation limits, you should avoid starting captures with broad filters, like wide IP ranges. Instead, we recommend you define more specific criteria with FlowFilters, like narrow IP ranges, ports, or protocols.
Parameters:
-
firewall_arn
(ResourceArn)
–
The Amazon Resource Name (ARN) of the firewall.
-
availability_zone
(Optional[AvailabilityZone], default:
None
)
–
The ID of the Availability Zone where the firewall is located. For example, us-east-2a.
Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation.
-
vpc_endpoint_association_arn
(Optional[ResourceArn], default:
None
)
–
The Amazon Resource Name (ARN) of a VPC endpoint association.
-
vpc_endpoint_id
(Optional[VpcEndpointId], default:
None
)
–
A unique identifier for the primary endpoint associated with a firewall.
-
minimum_flow_age_in_seconds
(Optional[Age], default:
None
)
–
The reqested FlowOperation ignores flows with an age (in seconds) lower than MinimumFlowAgeInSeconds. You provide this for start commands.
We recommend setting this value to at least 1 minute (60 seconds) to reduce chance of capturing flows that are not yet established.
-
flow_filters
(FlowFilters)
–
Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation.
Raises:
-
InternalServerError
–
Your request is valid, but Network Firewall couldn't perform the operation because of a system problem. Retry your request.
-
InvalidRequestException
–
The operation failed because of a problem with your request. Examples include:
-
You specified an unsupported parameter name or value.
-
You tried to update a property with a value that isn't among the available types.
-
Your request references an ARN that is malformed, or corresponds to a resource that isn't valid in the context of the request.
-
ResourceNotFoundException
–
Unable to locate a resource using the parameters that you provided.
-
ThrottlingException
–
Unable to process the request due to throttling limitations.
-
UnknownServiceError
–
The service returned an error code this client does not model.
Source code in docs_src/capo_network_firewall/_services/async_network_firewall.py
| async def start_flow_capture(
self,
firewall_arn: "capo_network_firewall.types.resource_arn.ResourceArn",
flow_filters: "capo_network_firewall.types.flow_filters.FlowFilters",
*,
config_overrides: Optional[AsyncNetworkFirewallClientConfig] = None,
availability_zone: Optional[
"capo_network_firewall.types.availability_zone.AvailabilityZone"
] = None,
vpc_endpoint_association_arn: Optional[
"capo_network_firewall.types.resource_arn.ResourceArn"
] = None,
vpc_endpoint_id: Optional[
"capo_network_firewall.types.vpc_endpoint_id.VpcEndpointId"
] = None,
minimum_flow_age_in_seconds: Optional[
"capo_network_firewall.types.age.Age"
] = None,
) -> "capo_network_firewall.types.start_flow_capture_response.StartFlowCaptureResponse":
"""<p>Begins capturing the flows in a firewall, according to the filters you define. Captures are similar, but not identical to snapshots. Capture operations provide visibility into flows that are not closed and are tracked by a firewall's flow table. Unlike snapshots, captures are a time-boxed view. </p> <p>A flow is network traffic that is monitored by a firewall, either by stateful or stateless rules. For traffic to be considered part of a flow, it must share Destination, DestinationPort, Direction, Protocol, Source, and SourcePort. </p> <note> <p>To avoid encountering operation limits, you should avoid starting captures with broad filters, like wide IP ranges. Instead, we recommend you define more specific criteria with <code>FlowFilters</code>, like narrow IP ranges, ports, or protocols.</p> </note>
Args:
firewall_arn: <p>The Amazon Resource Name (ARN) of the firewall.</p>
availability_zone: <p>The ID of the Availability Zone where the firewall is located. For example, <code>us-east-2a</code>.</p> <p>Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation.</p>
vpc_endpoint_association_arn: <p>The Amazon Resource Name (ARN) of a VPC endpoint association.</p>
vpc_endpoint_id: <p>A unique identifier for the primary endpoint associated with a firewall.</p>
minimum_flow_age_in_seconds: <p>The reqested <code>FlowOperation</code> ignores flows with an age (in seconds) lower than <code>MinimumFlowAgeInSeconds</code>. You provide this for start commands.</p> <note> <p>We recommend setting this value to at least 1 minute (60 seconds) to reduce chance of capturing flows that are not yet established.</p> </note>
flow_filters: <p>Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation.</p>
Raises:
capo_network_firewall.errors.internal_server_error.InternalServerError: <p>Your request is valid, but Network Firewall couldn't perform the operation because of a system problem. Retry your request. </p>
capo_network_firewall.errors.invalid_request_exception.InvalidRequestException: <p>The operation failed because of a problem with your request. Examples include: </p> <ul> <li> <p>You specified an unsupported parameter name or value.</p> </li> <li> <p>You tried to update a property with a value that isn't among the available types.</p> </li> <li> <p>Your request references an ARN that is malformed, or corresponds to a resource that isn't valid in the context of the request.</p> </li> </ul>
capo_network_firewall.errors.resource_not_found_exception.ResourceNotFoundException: <p>Unable to locate a resource using the parameters that you provided.</p>
capo_network_firewall.errors.throttling_exception.ThrottlingException: <p>Unable to process the request due to throttling limitations.</p>
capo_network_firewall.errors.UnknownServiceError: The service returned an error code this client does not model.
"""
async def _handler(
req: "AsyncOperationRequest[capo_network_firewall.types.start_flow_capture_request.StartFlowCaptureRequest]",
) -> AsyncOperationResponse[
"capo_network_firewall.types.start_flow_capture_response.StartFlowCaptureResponse"
]:
import capo_network_firewall._operations.network_firewall_20201112.start_flow_capture
(
output,
http_response,
) = await capo_network_firewall._operations.network_firewall_20201112.start_flow_capture.async_start_flow_capture(
req.options, req.input
)
return AsyncOperationResponse(output=output, response=http_response)
interceptors_, options_ = self.operation_options(
config_overrides, OperationLogging("StartFlowCapture")
)
input_: capo_network_firewall.types.start_flow_capture_request.StartFlowCaptureRequest = {
"firewall_arn": firewall_arn,
"flow_filters": flow_filters,
}
if availability_zone is not None:
input_["availability_zone"] = availability_zone
if vpc_endpoint_association_arn is not None:
input_["vpc_endpoint_association_arn"] = vpc_endpoint_association_arn
if vpc_endpoint_id is not None:
input_["vpc_endpoint_id"] = vpc_endpoint_id
if minimum_flow_age_in_seconds is not None:
input_["minimum_flow_age_in_seconds"] = minimum_flow_age_in_seconds
response = await aexecute_pipeline(
AsyncOperationRequest(input=input_, options=options_),
handler=_handler,
interceptors=list(interceptors_),
)
await response.response.aclose()
return response.output
|