AWS::NetworkFirewall::ContainerAssociation ContainerAttribute - AWS CloudFormation
SyntaxProperties
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

This is the new CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the AWS CloudFormation User Guide.

AWS::NetworkFirewall::ContainerAssociation ContainerAttribute

A key-value filter pair used in container association monitoring configurations to narrow which containers are tracked. The key must match exactly. The value can be an exact value or a wildcard pattern.

Syntax

To declare this entity in your CloudFormation template, use the following syntax:

JSON

{
  "Key" : String,
  "Value" : String
}

YAML

  Key: String
  Value: String

Properties

Key

The attribute key to filter on. For Amazon EKS, specify namespace to filter by namespace, or specify a Kubernetes label key. For Amazon ECS, specify a container instance attribute name. Keys don't support wildcards.

Valid characters are letters, numbers, spaces, hyphens (-), underscores (_), periods (.), forward slashes (/), and colons (:).

Required: Yes

Type: String

Pattern: ^\S+$

Minimum: 1

Maximum: 256

Update requires: No interruption

Value

The attribute value to match. You can specify an exact value, such as payments-api, or a wildcard pattern, such as payments-*.

Valid characters are letters, numbers, spaces, hyphens (-), underscores (_), periods (.), forward slashes (/), colons (:), asterisks (*), and backslashes (\).

Network Firewall evaluates the value using the following rules:

  • An asterisk (*) matches zero or more characters. For example, payments-* matches payments-, payments-api, and payments-api-v2, and *-prod matches web-prod.

  • The pattern must match the entire value. For example, payments-* doesn't match my-payments-api. To match a value that contains payments anywhere, use *payments*.

  • Matching is case sensitive. For example, Payments-* doesn't match payments-api.

  • To match a literal asterisk, escape it with a backslash (\*). To match a literal backslash, use \\. A backslash followed by any other character matches a literal backslash followed by that character.

  • A wildcard pattern matches only containers that have the attribute. For example, a filter with key app and value * matches every container that has an app label, but doesn't match a container without an app label.

  • A value that doesn't contain * or \ matches only that exact value.

A value can contain at most 10 unescaped asterisks. Escaped asterisks (\*) don't count toward this limit. A value can't end with a single unescaped backslash.

Required: Yes

Type: String

Pattern: ^\S+$

Minimum: 1

Maximum: 256

Update requires: No interruption