Begins the flushing of traffic from the firewall, according to the filters you define. When the operation starts, impacted flows are temporarily marked as timed out before the Suricata engine prunes, or flushes, the flows from the firewall table.
While the flush completes, impacted flows are processed as midstream traffic. This may result in a temporary increase in midstream traffic metrics. We recommend that you double check your stream exception policy before you perform a flush operation.
Parameters:
-
firewall_arn
(ResourceArn)
–
The Amazon Resource Name (ARN) of the firewall.
-
availability_zone
(Optional[AvailabilityZone], default:
None
)
–
The ID of the Availability Zone where the firewall is located. For example, us-east-2a.
Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation.
-
vpc_endpoint_association_arn
(Optional[ResourceArn], default:
None
)
–
The Amazon Resource Name (ARN) of a VPC endpoint association.
-
vpc_endpoint_id
(Optional[VpcEndpointId], default:
None
)
–
A unique identifier for the primary endpoint associated with a firewall.
-
minimum_flow_age_in_seconds
(Optional[Age], default:
None
)
–
The reqested FlowOperation ignores flows with an age (in seconds) lower than MinimumFlowAgeInSeconds. You provide this for start commands.
-
flow_filters
(FlowFilters)
–
Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation.
Raises:
-
InternalServerError
–
Your request is valid, but Network Firewall couldn't perform the operation because of a system problem. Retry your request.
-
InvalidRequestException
–
The operation failed because of a problem with your request. Examples include:
-
You specified an unsupported parameter name or value.
-
You tried to update a property with a value that isn't among the available types.
-
Your request references an ARN that is malformed, or corresponds to a resource that isn't valid in the context of the request.
-
ResourceNotFoundException
–
Unable to locate a resource using the parameters that you provided.
-
ThrottlingException
–
Unable to process the request due to throttling limitations.
-
UnknownServiceError
–
The service returned an error code this client does not model.
Source code in docs_src/capo_network_firewall/_services/network_firewall.py
| def start_flow_flush(
self,
firewall_arn: "capo_network_firewall.types.resource_arn.ResourceArn",
flow_filters: "capo_network_firewall.types.flow_filters.FlowFilters",
*,
config_overrides: Optional[NetworkFirewallClientConfig] = None,
availability_zone: Optional[
"capo_network_firewall.types.availability_zone.AvailabilityZone"
] = None,
vpc_endpoint_association_arn: Optional[
"capo_network_firewall.types.resource_arn.ResourceArn"
] = None,
vpc_endpoint_id: Optional[
"capo_network_firewall.types.vpc_endpoint_id.VpcEndpointId"
] = None,
minimum_flow_age_in_seconds: Optional[
"capo_network_firewall.types.age.Age"
] = None,
) -> "capo_network_firewall.types.start_flow_flush_response.StartFlowFlushResponse":
"""<p>Begins the flushing of traffic from the firewall, according to the filters you define. When the operation starts, impacted flows are temporarily marked as timed out before the Suricata engine prunes, or flushes, the flows from the firewall table.</p> <important> <p>While the flush completes, impacted flows are processed as midstream traffic. This may result in a temporary increase in midstream traffic metrics. We recommend that you double check your stream exception policy before you perform a flush operation.</p> </important>
Args:
firewall_arn: <p>The Amazon Resource Name (ARN) of the firewall.</p>
availability_zone: <p>The ID of the Availability Zone where the firewall is located. For example, <code>us-east-2a</code>.</p> <p>Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation.</p>
vpc_endpoint_association_arn: <p>The Amazon Resource Name (ARN) of a VPC endpoint association.</p>
vpc_endpoint_id: <p>A unique identifier for the primary endpoint associated with a firewall.</p>
minimum_flow_age_in_seconds: <p>The reqested <code>FlowOperation</code> ignores flows with an age (in seconds) lower than <code>MinimumFlowAgeInSeconds</code>. You provide this for start commands.</p>
flow_filters: <p>Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation.</p>
Raises:
capo_network_firewall.errors.internal_server_error.InternalServerError: <p>Your request is valid, but Network Firewall couldn't perform the operation because of a system problem. Retry your request. </p>
capo_network_firewall.errors.invalid_request_exception.InvalidRequestException: <p>The operation failed because of a problem with your request. Examples include: </p> <ul> <li> <p>You specified an unsupported parameter name or value.</p> </li> <li> <p>You tried to update a property with a value that isn't among the available types.</p> </li> <li> <p>Your request references an ARN that is malformed, or corresponds to a resource that isn't valid in the context of the request.</p> </li> </ul>
capo_network_firewall.errors.resource_not_found_exception.ResourceNotFoundException: <p>Unable to locate a resource using the parameters that you provided.</p>
capo_network_firewall.errors.throttling_exception.ThrottlingException: <p>Unable to process the request due to throttling limitations.</p>
capo_network_firewall.errors.UnknownServiceError: The service returned an error code this client does not model.
"""
def _handler(
req: "OperationRequest[capo_network_firewall.types.start_flow_flush_request.StartFlowFlushRequest]",
) -> OperationResponse[
"capo_network_firewall.types.start_flow_flush_response.StartFlowFlushResponse"
]:
import capo_network_firewall._operations.network_firewall_20201112.start_flow_flush
output, http_response = (
capo_network_firewall._operations.network_firewall_20201112.start_flow_flush.start_flow_flush(
req.options, req.input
)
)
return OperationResponse(output=output, response=http_response)
interceptors_, options_ = self.operation_options(
config_overrides, OperationLogging("StartFlowFlush")
)
input_: capo_network_firewall.types.start_flow_flush_request.StartFlowFlushRequest = {
"firewall_arn": firewall_arn,
"flow_filters": flow_filters,
}
if availability_zone is not None:
input_["availability_zone"] = availability_zone
if vpc_endpoint_association_arn is not None:
input_["vpc_endpoint_association_arn"] = vpc_endpoint_association_arn
if vpc_endpoint_id is not None:
input_["vpc_endpoint_id"] = vpc_endpoint_id
if minimum_flow_age_in_seconds is not None:
input_["minimum_flow_age_in_seconds"] = minimum_flow_age_in_seconds
response = execute_pipeline(
OperationRequest(input=input_, options=options_),
handler=_handler,
interceptors=list(interceptors_),
)
response.response.close()
return response.output
|