Skip to content

Begins capturing the flows in a firewall, according to the filters you define

Description

Begins capturing the flows in a firewall, according to the filters you define. Captures are similar, but not identical to snapshots. Capture operations provide visibility into flows that are not closed and are tracked by a firewall's flow table. Unlike snapshots, captures are a time-boxed view.

A flow is network traffic that is monitored by a firewall, either by stateful or stateless rules. For traffic to be considered part of a flow, it must share Destination, DestinationPort, Direction, Protocol, Source, and SourcePort.

To avoid encountering operation limits, you should avoid starting captures with broad filters, like wide IP ranges. Instead, we recommend you define more specific criteria with FlowFilters, like narrow IP ranges, ports, or protocols.

Usage

networkfirewall_start_flow_capture(FirewallArn, AvailabilityZone,
  VpcEndpointAssociationArn, VpcEndpointId, MinimumFlowAgeInSeconds,
  FlowFilters)

Arguments

  • FirewallArn

    [required] The Amazon Resource Name (ARN) of the firewall.

  • AvailabilityZone

    The ID of the Availability Zone where the firewall is located. For example, us-east-2a.

    Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation.

  • VpcEndpointAssociationArn

    The Amazon Resource Name (ARN) of a VPC endpoint association.

  • VpcEndpointId

    A unique identifier for the primary endpoint associated with a firewall.

  • MinimumFlowAgeInSeconds

    The reqested FlowOperation ignores flows with an age (in seconds) lower than MinimumFlowAgeInSeconds. You provide this for start commands.

    We recommend setting this value to at least 1 minute (60 seconds) to reduce chance of capturing flows that are not yet established.

  • FlowFilters

    [required] Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation.

Value

A list with the following syntax:

list(
  FirewallArn = "string",
  FlowOperationId = "string",
  FlowOperationStatus = "COMPLETED"|"IN_PROGRESS"|"FAILED"|"COMPLETED_WITH_ERRORS"
)

Request syntax

svc$start_flow_capture(
  FirewallArn = "string",
  AvailabilityZone = "string",
  VpcEndpointAssociationArn = "string",
  VpcEndpointId = "string",
  MinimumFlowAgeInSeconds = 123,
  FlowFilters = list(
    list(
      SourceAddress = list(
        AddressDefinition = "string"
      ),
      DestinationAddress = list(
        AddressDefinition = "string"
      ),
      SourcePort = "string",
      DestinationPort = "string",
      Protocols = list(
        "string"
      )
    )
  )
)