shield

package
v1.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 3, 2026 License: MIT Imports: 22 Imported by: 0

README

Shield

Parity grade: A · SDK aws-sdk-go-v2/service/shield@v1.34.20 · last audited 2026-07-24 (9a28a0bb7)

Coverage

Metric Value
Operations audited 36 (36 ok)
Feature families 8 (8 ok)
Known gaps 5
Deferred items 0
Resource leaks clean
Known gaps
  • DescribeAttack/ListAttacks never populate AttackDetail.AttackProperties or AttackDetail.SubResources (both optional AWS fields); simulated/internal attacks only carry AttackVectors/AttackCounters/Mitigations. Acceptable for a synthetic-attack emulator but noted for completeness. NOT fixed this sweep: AttackProperty requires modeling AttackLayer/AttackPropertyIdentifier/TopContributors enums with plausible synthetic per-contributor traffic data, which is a meaningfully larger feature than a wire-shape fix and was judged out of scope for this pass; DescribeAttack/ListAttacks remain fully AWS-shape-correct for every field they DO populate.
  • LockedSubscriptionException (subscription's first-year AutoRenew lock, changeable only in the last 30 days of the commitment) is not modeled -- UpdateSubscription always allows changing AutoRenew. Deliberately NOT implemented: gopherstack subscriptions are always "fresh" (no historical passage of time), so enforcing the real 335-day lock would make UpdateSubscription permanently fail for every subscription in the emulator, which is worse for testability than the current permissive behavior. Documented gap, not a wire bug.
  • OptimisticLockException (concurrent-modification detection via a resource version/etag) is not modeled anywhere -- CreateProtectionGroup/UpdateProtectionGroup/DeleteProtectionGroup/ AssociateDRTLogBucket/DisassociateDRTLogBucket/UpdateEmergencyContactSettings all declare it in their real error catalogs but gopherstack's coarse per-backend lock (lockmetrics.RWMutex) makes every mutation atomic, so the race window OptimisticLockException exists to protect against never occurs in this emulator. Not implemented; low value for a single-process in-memory backend.
  • AccessDeniedException / AccessDeniedForDependencyException are never returned -- gopherstack does not model IAM permission checks for any service, Shield included. Consistent with the rest of the codebase; not a Shield-specific gap.
  • InvalidResourceException (thrown by real AWS when a ResourceArn is a well-formed ARN for a supported type but the underlying resource doesn't exist / isn't accessible) is not distinguished from InvalidParameterException (used for malformed/unsupported-type ARNs) because gopherstack has no cross-service resource-existence oracle to check against. Would require wiring Shield's CreateProtection to query other services' backends (elbv2/cloudfront/route53/ec2/globalaccelerator) for resource existence -- out of scope for this pass.

More

Documentation

Index

Constants

View Source
const (
	AggregationSum  = "SUM"
	AggregationMean = "MEAN"
	AggregationMax  = "MAX"
)

Aggregation values for protection groups.

View Source
const (
	PatternAll            = "ALL"
	PatternArbitrary      = "ARBITRARY"
	PatternByResourceType = "BY_RESOURCE_TYPE"
)

Pattern values for protection groups.

View Source
const (
	AutoRenewEnabled  = "ENABLED"
	AutoRenewDisabled = "DISABLED"
)

AutoRenew values for subscriptions.

View Source
const (
	ResourceTypeCloudFrontDistribution  = "CLOUDFRONT_DISTRIBUTION"
	ResourceTypeRoute53HostedZone       = "ROUTE_53_HOSTED_ZONE"
	ResourceTypeApplicationLoadBalancer = "APPLICATION_LOAD_BALANCER"
	ResourceTypeClassicLoadBalancer     = "CLASSIC_LOAD_BALANCER"
	ResourceTypeElasticIPAllocation     = "ELASTIC_IP_ALLOCATION"
	ResourceTypeGlobalAccelerator       = "GLOBAL_ACCELERATOR"
)

ResourceType values for Shield Advanced protected resources.

View Source
const (
	ProactiveEngagementEnabled  = "ENABLED"
	ProactiveEngagementDisabled = "DISABLED"
	ProactiveEngagementPending  = "PENDING"
)

ProactiveEngagementStatus values.

Variables

View Source
var (
	// ErrProtectionNotFound is returned when a protection does not exist.
	ErrProtectionNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrProtectionAlreadyExists is returned when a protection for the resource already exists.
	ErrProtectionAlreadyExists = awserr.New("ResourceAlreadyExistsException", awserr.ErrConflict)
	// ErrSubscriptionAlreadyExists is returned when a Shield Advanced subscription already exists.
	ErrSubscriptionAlreadyExists = awserr.New("ResourceAlreadyExistsException", awserr.ErrConflict)
	// ErrSubscriptionNotFound is returned when no subscription exists.
	ErrSubscriptionNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrSubscriptionRequired is returned when an operation requires an active Shield Advanced
	// subscription. It wraps awserr.ErrConflict for backward-compatible errors.Is matching against
	// generic conflict handling, but handler.go's handleError special-cases it (via a direct
	// errors.Is(err, ErrSubscriptionRequired) check ahead of the generic ErrConflict case) to the
	// wire-correct "InvalidOperationException" __type -- the real Shield API code for "operation
	// would not cause any change to occur" / requires-prerequisite errors, not
	// "ResourceAlreadyExistsException".
	ErrSubscriptionRequired = awserr.New("InvalidOperationException: subscription required", awserr.ErrConflict)
	// ErrProtectionGroupNotFound is returned when a protection group does not exist.
	ErrProtectionGroupNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrProtectionGroupAlreadyExists is returned when a protection group with the same ID already exists.
	ErrProtectionGroupAlreadyExists = awserr.New("ResourceAlreadyExistsException", awserr.ErrConflict)
	// ErrAttackNotFound is returned when an attack does not exist.
	ErrAttackNotFound = awserr.New("ResourceNotFoundException", awserr.ErrNotFound)
	// ErrValidation is returned when input validation fails.
	ErrValidation = awserr.New("InvalidParameterException", awserr.ErrInvalidParameter)
	// ErrLimitExceeded is returned when an operation would exceed a Shield Advanced subscription
	// quota (e.g. subscriptionMaxProtections, subscriptionMaxProtectionGroups,
	// subscriptionMaxMembersPerGroup, or the 10-bucket DRT log bucket cap). Maps to the real
	// LimitsExceededException wire type -- distinct from ErrValidation/InvalidParameterException
	// because AWS Shield uses a dedicated error family for quota violations.
	ErrLimitExceeded = errors.New("shield: limit exceeded")
	// ErrNoAssociatedRole is returned when a DRT operation (AssociateDRTLogBucket) requires an IAM
	// role to already be associated via AssociateDRTRole first. Maps to the real
	// NoAssociatedRoleException wire type.
	ErrNoAssociatedRole = errors.New("shield: no DRT role associated")
)
View Source
var ErrNilAppContext = errors.New("shield: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

Functions

This section is empty.

Types

type ALARConfig

type ALARConfig struct {
	// ResourceARN identifies the protected resource this ALAR configuration
	// applies to. It is tagged json:"-" because ALARConfig has no natural
	// identity field of its own -- it was only ever reached via the external
	// map[string]*ALARConfig key. The alarConfigs Table's keyFn derives its
	// key from this field (see store_setup.go), and persistence.go's
	// alarConfigDTO carries it as a real JSON field so Snapshot/Restore
	// round-trips correctly.
	ResourceARN string `json:"-"`
	// Action is either "BLOCK" or "COUNT".
	Action  string `json:"action"`
	Enabled bool   `json:"enabled"`
}

ALARConfig holds Application Layer Automatic Response configuration for a protection.

type Attack

type Attack struct {
	StartTime      time.Time       `json:"startTime"`
	EndTime        time.Time       `json:"endTime"`
	AttackID       string          `json:"attackId"`
	ResourceARN    string          `json:"resourceArn"`
	AttackVectors  []AttackVector  `json:"attackVectors,omitempty"`
	AttackCounters []AttackCounter `json:"attackCounters,omitempty"`
	Mitigations    []Mitigation    `json:"mitigations,omitempty"`
}

Attack represents a Shield Advanced attack event.

type AttackCounter

type AttackCounter struct {
	Name    string  `json:"Name"`
	Unit    string  `json:"Unit"`
	Max     float64 `json:"Max"`
	Average float64 `json:"Average"`
	Sum     float64 `json:"Sum"`
	N       int64   `json:"N"`
}

type AttackStatistics

type AttackStatistics struct {
	DataItems []AttackStatisticsItem `json:"dataItems"`
	TimeRange AttackTimeRange        `json:"timeRange"`
}

AttackStatistics represents Shield Advanced attack statistics.

type AttackStatisticsItem

type AttackStatisticsItem struct {
	AttackVolume *AttackVolume `json:"AttackVolume,omitempty"`
	AttackCount  int64         `json:"AttackCount"`
}

AttackStatisticsItem is a single item in attack statistics.

type AttackTimeRange

type AttackTimeRange struct {
	FromInclusive int64 `json:"fromInclusive"`
	ToExclusive   int64 `json:"toExclusive"`
}

AttackTimeRange represents a time range for attack statistics.

type AttackVector

type AttackVector struct {
	VectorType string `json:"VectorType"`
}

AttackVector represents a type of attack traffic seen during an attack.

type AttackVolume

type AttackVolume struct {
	BitsPerSecond     *AttackVolumeStatistics `json:"BitsPerSecond,omitempty"`
	PacketsPerSecond  *AttackVolumeStatistics `json:"PacketsPerSecond,omitempty"`
	RequestsPerSecond *AttackVolumeStatistics `json:"RequestsPerSecond,omitempty"`
}

AttackVolume represents volume metrics in attack statistics.

type AttackVolumeStatistics

type AttackVolumeStatistics struct {
	Max float64 `json:"Max"`
}

AttackVolumeStatistics is a single volume metric.

type DRTAccess

type DRTAccess struct {
	RoleArn       string   `json:"roleArn"`
	LogBucketList []string `json:"logBucketList"`
}

DRTAccess holds DRT log bucket and role configuration.

type EmergencyContact

type EmergencyContact struct {
	EmailAddress string `json:"emailAddress"`
	PhoneNumber  string `json:"phoneNumber,omitempty"`
	ContactNotes string `json:"contactNotes,omitempty"`
}

EmergencyContact represents an emergency contact for proactive engagement.

type Handler

type Handler struct {
	Backend StorageBackend
}

Handler is the HTTP handler for the AWS Shield Advanced API.

func NewHandler

func NewHandler(backend StorageBackend) *Handler

NewHandler creates a new Shield handler.

func (*Handler) ChaosOperations

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this handler handles.

func (*Handler) ChaosServiceName

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the operation name from the X-Amz-Target header.

func (*Handler) ExtractResource

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the resource identifier from the request.

func (*Handler) GetSupportedOperations

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported Shield operations.

func (*Handler) Handler

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for Shield requests.

func (*Handler) MatchPriority

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset

func (h *Handler) Reset()

Reset clears all handler state by delegating to the backend.

func (*Handler) Restore

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Shield API requests. Requests are identified by the X-Amz-Target header prefix "AWSShield_20160616.".

func (*Handler) Snapshot

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type InMemoryBackend

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is an in-memory store for Shield Advanced resources.

protections, protectionGroups, and attacks are *store.Table[T] (see store_setup.go), with the former one-to-one ARN/name reverse-lookup maps replaced by companion *store.Index values on protections. alarConfigs is also a *store.Table[ALARConfig] but is not registered on registry -- see store_setup.go's file doc comment.

func NewInMemoryBackend

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new in-memory Shield backend.

func (*InMemoryBackend) AccountID

func (b *InMemoryBackend) AccountID() string

AccountID returns the AWS account ID this backend is configured for.

func (*InMemoryBackend) AddAttackInternal

func (b *InMemoryBackend) AddAttackInternal(attackID, resourceARN string) *Attack

AddAttackInternal creates an attack record directly (for tests).

func (*InMemoryBackend) AddProtectionGroupInternal

func (b *InMemoryBackend) AddProtectionGroupInternal(id, aggregation, pattern string) *ProtectionGroup

AddProtectionGroupInternal creates a protection group directly (for tests).

func (*InMemoryBackend) AddProtectionInternal

func (b *InMemoryBackend) AddProtectionInternal(name, resourceARN string) *Protection

AddProtectionInternal creates a protection directly (for tests).

func (*InMemoryBackend) AddSubscriptionInternal

func (b *InMemoryBackend) AddSubscriptionInternal()

AddSubscriptionInternal creates a subscription directly (for tests).

func (*InMemoryBackend) AssociateDRTLogBucket

func (b *InMemoryBackend) AssociateDRTLogBucket(bucket string) error

AssociateDRTLogBucket associates an S3 log bucket with the DRT. Per real AWS behavior, the SRT must already have an IAM role associated (via AssociateDRTRole) before a log bucket can be shared -- otherwise the real API returns NoAssociatedRoleException. Also enforces the documented 10-bucket cap via LimitsExceededException.

func (*InMemoryBackend) AssociateDRTRole

func (b *InMemoryBackend) AssociateDRTRole(roleARN string) error

AssociateDRTRole associates an IAM role with the DRT.

func (*InMemoryBackend) AssociateHealthCheck

func (b *InMemoryBackend) AssociateHealthCheck(protectionID, healthCheckARN string) error

AssociateHealthCheck associates a Route 53 health check with a protection.

func (*InMemoryBackend) AssociateProactiveEngagementDetails

func (b *InMemoryBackend) AssociateProactiveEngagementDetails(contacts []EmergencyContact) error

AssociateProactiveEngagementDetails stores emergency contact details for proactive engagement. Sets status to PENDING when transitioning from DISABLED or empty.

func (*InMemoryBackend) CreateProtection

func (b *InMemoryBackend) CreateProtection(name, resourceARN string, tags map[string]string) (*Protection, error)

CreateProtection creates a new Shield protection for the given resource ARN.

func (*InMemoryBackend) CreateProtectionGroup

func (b *InMemoryBackend) CreateProtectionGroup(
	id, aggregation, pattern, resourceType string,
	members []string,
) (*ProtectionGroup, error)

CreateProtectionGroup creates a new Shield Advanced protection group.

func (*InMemoryBackend) CreateSubscription

func (b *InMemoryBackend) CreateSubscription() error

CreateSubscription enables Shield Advanced. Returns an error if already subscribed.

func (*InMemoryBackend) DeleteProtection

func (b *InMemoryBackend) DeleteProtection(protectionID string) error

DeleteProtection deletes a protection by ID. ApplicationLayerAutomaticResponseConfiguration is a field of the real AWS Protection object (see types.Protection), so gopherstack's separate alarConfigs table -- keyed by the protection's ResourceARN -- must be cascade-cleaned here to avoid an orphaned row that a future protection for the same resource ARN would incorrectly inherit.

func (*InMemoryBackend) DeleteProtectionGroup

func (b *InMemoryBackend) DeleteProtectionGroup(protectionGroupID string) error

DeleteProtectionGroup removes a Shield Advanced protection group.

func (*InMemoryBackend) DeleteSubscription

func (b *InMemoryBackend) DeleteSubscription() error

DeleteSubscription cancels the active Shield Advanced subscription.

func (*InMemoryBackend) DescribeAttack

func (b *InMemoryBackend) DescribeAttack(attackID string) (*Attack, error)

DescribeAttack returns the details of a specific attack.

func (*InMemoryBackend) DescribeAttackStatistics

func (b *InMemoryBackend) DescribeAttackStatistics() *AttackStatistics

DescribeAttackStatistics returns summary statistics about attacks, bucketed by month.

func (*InMemoryBackend) DescribeDRTAccess

func (b *InMemoryBackend) DescribeDRTAccess() *DRTAccess

DescribeDRTAccess returns the current DRT access configuration.

func (*InMemoryBackend) DescribeEmergencyContactSettings

func (b *InMemoryBackend) DescribeEmergencyContactSettings() []EmergencyContact

DescribeEmergencyContactSettings returns the current emergency contacts.

func (*InMemoryBackend) DescribeProtection

func (b *InMemoryBackend) DescribeProtection(protectionID, resourceARN string) (*Protection, error)

DescribeProtection returns a protection by ID or resource ARN.

func (*InMemoryBackend) DescribeProtectionGroup

func (b *InMemoryBackend) DescribeProtectionGroup(id string) (*ProtectionGroup, error)

DescribeProtectionGroup returns a single protection group by ID.

func (*InMemoryBackend) DescribeSubscription

func (b *InMemoryBackend) DescribeSubscription() (*Subscription, error)

DescribeSubscription returns the current Shield Advanced subscription.

func (*InMemoryBackend) DisableApplicationLayerAutomaticResponse

func (b *InMemoryBackend) DisableApplicationLayerAutomaticResponse(resourceARN string) error

DisableApplicationLayerAutomaticResponse disables ALAR for the given resource ARN.

func (*InMemoryBackend) DisableProactiveEngagement

func (b *InMemoryBackend) DisableProactiveEngagement() error

DisableProactiveEngagement disables proactive engagement for the subscription.

func (*InMemoryBackend) DisassociateDRTLogBucket

func (b *InMemoryBackend) DisassociateDRTLogBucket(bucket string) error

DisassociateDRTLogBucket removes an S3 log bucket from the DRT.

func (*InMemoryBackend) DisassociateDRTRole

func (b *InMemoryBackend) DisassociateDRTRole() error

DisassociateDRTRole removes the IAM role association from the DRT. Idempotent per AWS.

func (*InMemoryBackend) DisassociateHealthCheck

func (b *InMemoryBackend) DisassociateHealthCheck(protectionID, healthCheckARN string) error

DisassociateHealthCheck removes a Route 53 health check from a protection.

func (*InMemoryBackend) EnableApplicationLayerAutomaticResponse

func (b *InMemoryBackend) EnableApplicationLayerAutomaticResponse(resourceARN, action string) error

EnableApplicationLayerAutomaticResponse enables ALAR for the given resource ARN. action must be "BLOCK" or "COUNT".

func (*InMemoryBackend) EnableProactiveEngagement

func (b *InMemoryBackend) EnableProactiveEngagement() error

EnableProactiveEngagement enables proactive engagement for the subscription. Requires at least one emergency contact to be configured.

func (*InMemoryBackend) GetALARConfig

func (b *InMemoryBackend) GetALARConfig(resourceARN string) *ALARConfig

GetALARConfig returns the ALAR config for a resource ARN, or nil if none.

func (*InMemoryBackend) GetProactiveEngagementStatus

func (b *InMemoryBackend) GetProactiveEngagementStatus() string

GetProactiveEngagementStatus returns the current proactive engagement status.

func (*InMemoryBackend) GetSubscriptionState

func (b *InMemoryBackend) GetSubscriptionState() string

GetSubscriptionState returns ACTIVE or INACTIVE.

func (*InMemoryBackend) ListAttacks

func (b *InMemoryBackend) ListAttacks(resourceARNs []string, startTime, endTime int64) []*Attack

ListAttacks returns all attacks, optionally filtered by resource ARNs (match any). start and end are optional Unix epoch seconds (0 = not filtered).

func (*InMemoryBackend) ListProtectionGroups

func (b *InMemoryBackend) ListProtectionGroups() []*ProtectionGroup

ListProtectionGroups returns all protection groups sorted by ID. Clones are built under RLock; sorting happens after the lock is released.

func (*InMemoryBackend) ListProtections

func (b *InMemoryBackend) ListProtections() []*Protection

ListProtections returns all protections sorted by name. Clones are built under RLock; sorting happens after the lock is released.

func (*InMemoryBackend) ListResourcesInProtectionGroup

func (b *InMemoryBackend) ListResourcesInProtectionGroup(protectionGroupID string) ([]string, error)

ListResourcesInProtectionGroup returns the member ARNs for a protection group. For Pattern=ALL returns all protections; for Pattern=BY_RESOURCE_TYPE derives members by resource type.

func (*InMemoryBackend) ListTagsForResource

func (b *InMemoryBackend) ListTagsForResource(resourceARN string) (map[string]string, error)

ListTagsForResource returns the tags for a protection.

func (*InMemoryBackend) Region

func (b *InMemoryBackend) Region() string

Region returns the AWS region this backend is configured for.

func (*InMemoryBackend) Reset

func (b *InMemoryBackend) Reset()

Reset clears all Shield protections and subscription state atomically.

func (*InMemoryBackend) Restore

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot.

func (*InMemoryBackend) SimulateAttack

func (b *InMemoryBackend) SimulateAttack(resourceARN string, attackVectorTypes []string) (*Attack, error)

SimulateAttack creates a synthetic attack record reachable via the API. attackVectorTypes may be empty; defaults to SYN_FLOOD if omitted.

func (*InMemoryBackend) Snapshot

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON.

func (*InMemoryBackend) TagResource

func (b *InMemoryBackend) TagResource(resourceARN string, tags map[string]string) error

TagResource adds tags to a protection, keyed by Shield protection ARN or resource ARN. Requires an active subscription. Enforces 50-tag cap and key/value length limits.

func (*InMemoryBackend) UntagResource

func (b *InMemoryBackend) UntagResource(resourceARN string, tagKeys []string) error

UntagResource removes tags from a protection.

func (*InMemoryBackend) UpdateApplicationLayerAutomaticResponse

func (b *InMemoryBackend) UpdateApplicationLayerAutomaticResponse(resourceARN, action string) error

UpdateApplicationLayerAutomaticResponse updates the ALAR action for a resource ARN.

func (*InMemoryBackend) UpdateEmergencyContactSettings

func (b *InMemoryBackend) UpdateEmergencyContactSettings(contacts []EmergencyContact) error

UpdateEmergencyContactSettings replaces the emergency contact list. Enforces: max 10 contacts, non-empty EmailAddress required.

func (*InMemoryBackend) UpdateProtectionGroup

func (b *InMemoryBackend) UpdateProtectionGroup(
	id, aggregation, pattern, resourceType string,
	members []string,
) error

UpdateProtectionGroup updates the aggregation, pattern, resource type, and members of a group.

func (*InMemoryBackend) UpdateSubscription

func (b *InMemoryBackend) UpdateSubscription(autoRenew string) error

UpdateSubscription updates the auto-renew setting of the active subscription.

type Mitigation

type Mitigation struct {
	MitigationName string `json:"MitigationName"`
}

Mitigation represents a mitigation applied during an attack.

type Protection

type Protection struct {
	CreationTime   time.Time         `json:"creationTime"`
	Tags           map[string]string `json:"tags,omitempty"`
	ID             string            `json:"id"`
	ProtectionArn  string            `json:"protectionArn"`
	Name           string            `json:"name"`
	ResourceARN    string            `json:"resourceARN"`
	HealthCheckIDs []string          `json:"healthCheckIds,omitempty"`
}

Protection represents an AWS Shield Advanced protection.

type ProtectionGroup

type ProtectionGroup struct {
	CreationTime       time.Time `json:"creationTime"`
	ID                 string    `json:"id"`
	ProtectionGroupArn string    `json:"protectionGroupArn"`
	Aggregation        string    `json:"aggregation"`
	Pattern            string    `json:"pattern"`
	ResourceType       string    `json:"resourceType,omitempty"`
	Members            []string  `json:"members"`
}

ProtectionGroup represents a Shield Advanced protection group.

type Provider

type Provider struct{}

Provider implements service.Provider for AWS Shield Advanced.

func (*Provider) Init

Init initializes the Shield service backend and handler.

func (*Provider) Name

func (p *Provider) Name() string

Name returns the provider name.

type StorageBackend

type StorageBackend interface {
	CreateSubscription() error
	DeleteSubscription() error
	UpdateSubscription(autoRenew string) error
	DescribeSubscription() (*Subscription, error)
	GetSubscriptionState() string
	CreateProtection(name, resourceARN string, tags map[string]string) (*Protection, error)
	DescribeProtection(protectionID, resourceARN string) (*Protection, error)
	DeleteProtection(protectionID string) error
	ListProtections() []*Protection
	AssociateHealthCheck(protectionID, healthCheckARN string) error
	DisassociateHealthCheck(protectionID, healthCheckARN string) error
	TagResource(resourceARN string, tags map[string]string) error
	ListTagsForResource(resourceARN string) (map[string]string, error)
	UntagResource(resourceARN string, tagKeys []string) error
	AssociateDRTLogBucket(bucket string) error
	DisassociateDRTLogBucket(bucket string) error
	AssociateDRTRole(roleARN string) error
	DisassociateDRTRole() error
	DescribeDRTAccess() *DRTAccess
	AssociateProactiveEngagementDetails(contacts []EmergencyContact) error
	UpdateEmergencyContactSettings(contacts []EmergencyContact) error
	DescribeEmergencyContactSettings() []EmergencyContact
	EnableProactiveEngagement() error
	DisableProactiveEngagement() error
	CreateProtectionGroup(id, aggregation, pattern, resourceType string, members []string) (*ProtectionGroup, error)
	DescribeProtectionGroup(id string) (*ProtectionGroup, error)
	ListProtectionGroups() []*ProtectionGroup
	UpdateProtectionGroup(id, aggregation, pattern, resourceType string, members []string) error
	DeleteProtectionGroup(protectionGroupID string) error
	ListAttacks(resourceARNs []string, startTime, endTime int64) []*Attack
	DescribeAttack(attackID string) (*Attack, error)
	DescribeAttackStatistics() *AttackStatistics
	SimulateAttack(resourceARN string, attackVectorTypes []string) (*Attack, error)
	EnableApplicationLayerAutomaticResponse(resourceARN, action string) error
	DisableApplicationLayerAutomaticResponse(resourceARN string) error
	UpdateApplicationLayerAutomaticResponse(resourceARN, action string) error
	ListResourcesInProtectionGroup(protectionGroupID string) ([]string, error)
	GetProactiveEngagementStatus() string
	GetALARConfig(resourceARN string) *ALARConfig
	AccountID() string
	Region() string
	Reset()
	Snapshot(ctx context.Context) []byte
	Restore(ctx context.Context, data []byte) error
}

StorageBackend is the interface for Shield Advanced storage operations.

type Subscription

type Subscription struct {
	StartTime            time.Time `json:"startTime"`
	EndTime              time.Time `json:"endTime"`
	AutoRenew            string    `json:"autoRenew"`
	TimeCommitmentInDays int64     `json:"timeCommitmentInDays"`
}

Subscription represents an AWS Shield Advanced subscription.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL