| Column Name | Column Data Type |
|---|
listener_arn Input Column
The Amazon Resource Name (ARN) of the listener. | VARCHAR |
rule_arns Input Column
The Amazon Resource Names (ARN) of the rules. | VARCHAR[] |
Show child fields- rule_arns[]
|
_aws_profile Input Column
The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role. | STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
) |
Show child fields- _aws_profile.account_id
The AWS account id - _aws_profile.assumed_role_arn
The ARN of the assumed role - _aws_profile.name
The unique name of the profile. - _aws_profile.organization
Information about this profile's membership in the AWS organization. Show child fields- _aws_profile.organization.account_name
The name of account speciifed by the organization - _aws_profile.organization.id
The organization id - _aws_profile.organization.master_account
Show child fields- _aws_profile.organization.master_account.email
The organization master account email address - _aws_profile.organization.master_account.id
The organization master account id
- _aws_profile.organization.parents[]
Show child fields- _aws_profile.organization.parents[].id
The id of the parent - _aws_profile.organization.parents[].name
The name of the parent - _aws_profile.organization.parents[].tags[]
Show child fields- _aws_profile.organization.parents[].tags[].key
- _aws_profile.organization.parents[].tags[].value
- _aws_profile.organization.parents[].type
The type of parent can be an organization unit or a root
- _aws_profile.organization.tags[]
Show child fields- _aws_profile.organization.tags[].key
- _aws_profile.organization.tags[].value
- _aws_profile.type
The type of profile, either 'credentials' or 'assumed_role' - _aws_profile.via_profile_name
This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.
|
actions
The actions. Each rule must include exactly one of the following types of actions: forward, redirect, or fixed-response, and it must be the last action to be performed. | STRUCT(
"type" VARCHAR,
"target_group_arn" VARCHAR,
"authenticate_oidc_config" STRUCT(
"issuer" VARCHAR,
"authorization_endpoint" VARCHAR,
"token_endpoint" VARCHAR,
"user_info_endpoint" VARCHAR,
"client_id" VARCHAR,
"client_secret" VARCHAR,
"session_cookie_name" VARCHAR,
"scope" VARCHAR,
"session_timeout" BIGINT,
"authentication_request_extra_params" MAP(VARCHAR, VARCHAR),
"on_unauthenticated_request" VARCHAR,
"use_existing_client_secret" BOOLEAN
),
"authenticate_cognito_config" STRUCT(
"user_pool_arn" VARCHAR,
"user_pool_client_id" VARCHAR,
"user_pool_domain" VARCHAR,
"session_cookie_name" VARCHAR,
"scope" VARCHAR,
"session_timeout" BIGINT,
"authentication_request_extra_params" MAP(VARCHAR, VARCHAR),
"on_unauthenticated_request" VARCHAR
),
"order" BIGINT,
"redirect_config" STRUCT(
"protocol" VARCHAR,
"port" VARCHAR,
"host" VARCHAR,
"path" VARCHAR,
"query" VARCHAR,
"status_code" VARCHAR
),
"fixed_response_config" STRUCT(
"message_body" VARCHAR,
"status_code" VARCHAR,
"content_type" VARCHAR
),
"forward_config" STRUCT(
"target_groups" STRUCT(
"target_group_arn" VARCHAR,
"weight" BIGINT
)[],
"target_group_stickiness_config" STRUCT(
"enabled" BOOLEAN,
"duration_seconds" BIGINT
)
)
)[] |
Show child fields- actions[]
Show child fields- actions[].authenticate_cognito_config
[HTTPS listeners] Information for using Amazon Cognito to authenticate users. Specify only when Type is authenticate-cognito. Show child fields- actions[].authenticate_cognito_config.authentication_request_extra_params
The query parameters (up to 10) to include in the redirect request to the authorization endpoint. - actions[].authenticate_cognito_config.on_unauthenticated_request
The behavior if the user is not authenticated. The following are possible values: -
deny - Return an HTTP 401 Unauthorized error. -
allow - Allow the request to be forwarded to the target. -
authenticate - Redirect the request to the IdP authorization endpoint. This is the default value. - actions[].authenticate_cognito_config.scope
The set of user claims to be requested from the IdP. The default is openid. To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP. - actions[].authenticate_cognito_config.session_cookie_name
The name of the cookie used to maintain session information. The default is AWSELBAuthSessionCookie. - actions[].authenticate_cognito_config.session_timeout
The maximum duration of the authentication session, in seconds. The default is 604800 seconds (7 days). - actions[].authenticate_cognito_config.user_pool_arn
The Amazon Resource Name (ARN) of the Amazon Cognito user pool. - actions[].authenticate_cognito_config.user_pool_client_id
The ID of the Amazon Cognito user pool client. - actions[].authenticate_cognito_config.user_pool_domain
The domain prefix or fully-qualified domain name of the Amazon Cognito user pool.
- actions[].authenticate_oidc_config
[HTTPS listeners] Information about an identity provider that is compliant with OpenID Connect (OIDC). Specify only when Type is authenticate-oidc. Show child fields- actions[].authenticate_oidc_config.authentication_request_extra_params
The query parameters (up to 10) to include in the redirect request to the authorization endpoint. - actions[].authenticate_oidc_config.authorization_endpoint
The authorization endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path. - actions[].authenticate_oidc_config.client_id
The OAuth 2.0 client identifier. - actions[].authenticate_oidc_config.client_secret
The OAuth 2.0 client secret. This parameter is required if you are creating a rule. If you are modifying a rule, you can omit this parameter if you set UseExistingClientSecret to true. - actions[].authenticate_oidc_config.issuer
The OIDC issuer identifier of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path. - actions[].authenticate_oidc_config.on_unauthenticated_request
The behavior if the user is not authenticated. The following are possible values: -
deny - Return an HTTP 401 Unauthorized error. -
allow - Allow the request to be forwarded to the target. -
authenticate - Redirect the request to the IdP authorization endpoint. This is the default value. - actions[].authenticate_oidc_config.scope
The set of user claims to be requested from the IdP. The default is openid. To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP. - actions[].authenticate_oidc_config.session_cookie_name
The name of the cookie used to maintain session information. The default is AWSELBAuthSessionCookie. - actions[].authenticate_oidc_config.session_timeout
The maximum duration of the authentication session, in seconds. The default is 604800 seconds (7 days). - actions[].authenticate_oidc_config.token_endpoint
The token endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path. - actions[].authenticate_oidc_config.use_existing_client_secret
Indicates whether to use the existing client secret when modifying a rule. If you are creating a rule, you can omit this parameter or set it to false. - actions[].authenticate_oidc_config.user_info_endpoint
The user info endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.
- actions[].fixed_response_config
[Application Load Balancer] Information for creating an action that returns a custom HTTP response. Specify only when Type is fixed-response. Show child fields- actions[].fixed_response_config.content_type
The content type. Valid Values: text/plain | text/css | text/html | application/javascript | application/json - actions[].fixed_response_config.message_body
The message. - actions[].fixed_response_config.status_code
The HTTP response code (2XX, 4XX, or 5XX).
- actions[].forward_config
Information for creating an action that distributes requests among one or more target groups. For Network Load Balancers, you can specify a single target group. Specify only when Type is forward. If you specify both ForwardConfig and TargetGroupArn, you can specify only one target group using ForwardConfig and it must be the same target group specified in TargetGroupArn. Show child fields- actions[].forward_config.target_group_stickiness_config
The target group stickiness for the rule. Show child fields- actions[].forward_config.target_group_stickiness_config.duration_seconds
The time period, in seconds, during which requests from a client should be routed to the same target group. The range is 1-604800 seconds (7 days). - actions[].forward_config.target_group_stickiness_config.enabled
Indicates whether target group stickiness is enabled.
- actions[].forward_config.target_groups[]
Show child fields- actions[].forward_config.target_groups[].target_group_arn
The Amazon Resource Name (ARN) of the target group. - actions[].forward_config.target_groups[].weight
The weight. The range is 0 to 999.
- actions[].order
The order for the action. This value is required for rules with multiple actions. The action with the lowest value for order is performed first. - actions[].redirect_config
[Application Load Balancer] Information for creating a redirect action. Specify only when Type is redirect. Show child fields- actions[].redirect_config.host
The hostname. This component is not percent-encoded. The hostname can contain #{host}. - actions[].redirect_config.path
The absolute path, starting with the leading "/". This component is not percent-encoded. The path can contain #{host}, #{path}, and #{port}. - actions[].redirect_config.port
The port. You can specify a value from 1 to 65535 or #{port}. - actions[].redirect_config.protocol
The protocol. You can specify HTTP, HTTPS, or #{protocol}. You can redirect HTTP to HTTP, HTTP to HTTPS, and HTTPS to HTTPS. You cannot redirect HTTPS to HTTP. - actions[].redirect_config.query
The query parameters, URL-encoded when necessary, but not percent-encoded. Do not include the leading "?", as it is automatically added. You can specify any of the reserved keywords. - actions[].redirect_config.status_code
The HTTP redirect code. The redirect is either permanent (HTTP 301) or temporary (HTTP 302).
- actions[].target_group_arn
The Amazon Resource Name (ARN) of the target group. Specify only when Type is forward and you want to route to a single target group. To route to one or more target groups, use ForwardConfig instead. - actions[].type
The type of action.
|
conditions
The conditions. Each rule can include zero or one of the following conditions: http-request-method, host-header, path-pattern, and source-ip, and zero or more of the following conditions: http-header and query-string. | STRUCT(
"field" VARCHAR,
"values" VARCHAR[],
"host_header_config" STRUCT(
"values" VARCHAR[]
),
"path_pattern_config" STRUCT(
"values" VARCHAR[]
),
"http_header_config" STRUCT(
"http_header_name" VARCHAR,
"values" VARCHAR[]
),
"query_string_config" STRUCT(
"values" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
),
"http_request_method_config" STRUCT(
"values" VARCHAR[]
),
"source_ip_config" STRUCT(
"values" VARCHAR[]
)
)[] |
Show child fields- conditions[]
Show child fields- conditions[].field
The field in the HTTP request. The following are the possible values: -
http-header -
http-request-method -
host-header -
path-pattern -
query-string -
source-ip - conditions[].host_header_config
Information for a host header condition. Specify only when Field is host-header. Show child fields- conditions[].host_header_config.values[]
- conditions[].http_header_config
Information for an HTTP header condition. Specify only when Field is http-header. Show child fields- conditions[].http_header_config.http_header_name
The name of the HTTP header field. The maximum size is 40 characters. The header name is case insensitive. The allowed characters are specified by RFC 7230. Wildcards are not supported. You can't use an HTTP header condition to specify the host header. Use HostHeaderConditionConfig to specify a host header condition. - conditions[].http_header_config.values[]
- conditions[].http_request_method_config
Information for an HTTP method condition. Specify only when Field is http-request-method. Show child fields- conditions[].http_request_method_config.values[]
- conditions[].path_pattern_config
Information for a path pattern condition. Specify only when Field is path-pattern. Show child fields- conditions[].path_pattern_config.values[]
- conditions[].query_string_config
Information for a query string condition. Specify only when Field is query-string. Show child fields- conditions[].query_string_config.values[]
Show child fields- conditions[].query_string_config.values[].key
The key. You can omit the key. - conditions[].query_string_config.values[].value
The value.
- conditions[].source_ip_config
Information for a source IP condition. Specify only when Field is source-ip. Show child fields- conditions[].source_ip_config.values[]
- conditions[].values[]
|
is_default
Indicates whether this is the default rule. | BOOLEAN |
priority
The priority. | VARCHAR |
rule_arn
The Amazon Resource Name (ARN) of the rule. | VARCHAR |