AWS::Shield::ProactiveEngagement - Amazon CloudFormation
SyntaxPropertiesReturn valuesExamples
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

AWS::Shield::ProactiveEngagement

Authorizes the Shield Response Team (SRT) to use email and phone to notify contacts about escalations to the SRT and to initiate proactive customer support.

To enable proactive engagement, you must be subscribed to the Business Support plan or the Enterprise Support plan.

Configure AWS::Shield::ProactiveEngagement for one account

To configure this resource through Amazon CloudFormation, you must be subscribed to Amazon Shield Advanced. You can subscribe through the Shield Advanced console and through the APIs. For more information, see Subscribe to Amazon Shield Advanced.

See example templates for Shield Advanced in Amazon CloudFormation at aws-samples/aws-shield-advanced-examples.

Configure Shield Advanced using Amazon CloudFormation and Amazon Firewall Manager

You might be able to use Firewall Manager with Amazon CloudFormation to configure Shield Advanced across multiple accounts and protected resources. To do this, your accounts must be part of an organization in Amazon Organizations. You can use Firewall Manager to configure Shield Advanced protections for any resource types except for Amazon Route 53 or Amazon Global Accelerator.

For an example of this, see the one-click configuration guidance published by the Amazon technical community at One-click deployment of Shield Advanced.

Syntax

To declare this entity in your Amazon CloudFormation template, use the following syntax:

JSON

{
  "Type" : "AWS::Shield::ProactiveEngagement",
  "Properties" : {
      "EmergencyContactList" : [ EmergencyContact, ... ],
      "ProactiveEngagementStatus" : String
    }
}

YAML

Type: AWS::Shield::ProactiveEngagement
Properties:
  EmergencyContactList: 
    - EmergencyContact
  ProactiveEngagementStatus: String

Properties

EmergencyContactList

The list of email addresses and phone numbers that the Shield Response Team (SRT) can use to contact you for escalations to the SRT and to initiate proactive customer support, plus any relevant notes.

To enable proactive engagement, the contact list must include at least one phone number.

If you provide more than one contact, in the notes, indicate the circumstances under which each contact should be used. Include primary and secondary contact designations, and provide the hours of availability and time zones for each contact.

Example contact notes:

  • This is a hotline that's staffed 24x7x365. Please work with the responding analyst and they will get the appropriate person on the call.

  • Please contact the secondary phone number if the hotline doesn't respond within 5 minutes.

Required: Yes

Type: Array of EmergencyContact

Minimum: 1

Maximum: 10

Update requires: No interruption

ProactiveEngagementStatus

Specifies whether proactive engagement is enabled or disabled.

Valid values:

ENABLED - The Shield Response Team (SRT) will use email and phone to notify contacts about escalations to the SRT and to initiate proactive customer support.

DISABLED - The SRT will not proactively notify contacts about escalations or to initiate proactive customer support.

Required: Yes

Type: String

Allowed values: ENABLED | DISABLED

Update requires: No interruption

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the ID of the account that submitted the template.

For more information about using the Ref function, see Ref.

Fn::GetAtt

The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.

AccountId

The ID of the account that submitted the template.

Examples

Enable proactive engagement and define contacts

The following shows an example proactive engagement configuration with proactive engagement enabled and with two emergency contacts.

YAML

Resources:
  TestProactiveEngagement:
    DeletionPolicy: Delete
    Type: AWS::Shield::ProactiveEngagement
    Properties:
      ProactiveEngagementStatus: ENABLED
      EmergencyContactList:
        - EmailAddress: !Sub 'dev-on-duty@example.com'
          ContactNotes: !Sub 'Dev On Duty'
          PhoneNumber: '+10000000001'
        - EmailAddress: !Sub 'security@example.com'
          ContactNotes: !Sub 'Security Team'
          PhoneNumber: '+10000000002'

JSON

{
    "Resources": {
        "TestProactiveEngagement": {
            "DeletionPolicy": "Delete",
            "Type": "AWS::Shield::ProactiveEngagement",
            "Properties": {
                "ProactiveEngagementStatus": "ENABLED",
                "EmergencyContactList": [
                    {
                        "EmailAddress": {
                            "Fn::Sub": "dev-on-duty@example.com"
                        },
                        "ContactNotes": {
                            "Fn::Sub": "Dev On Duty"
                        },
                        "PhoneNumber": "+10000000001"
                    },
                    {
                        "EmailAddress": {
                            "Fn::Sub": "security@example.com"
                        },
                        "ContactNotes": {
                            "Fn::Sub": "Security Team"
                        },
                        "PhoneNumber": "+10000000002"
                    }
                ]
            }
        }
    }
}