View a markdown version of this page

ContainerAttribute - Amazon Network Firewall
ContentsSee Also
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

ContainerAttribute

A key-value filter pair used in container association monitoring configurations to narrow which containers are tracked. The key must match exactly. The value can be an exact value or a wildcard pattern.

Contents

Key

The attribute key to filter on. For Amazon EKS, specify namespace to filter by namespace, or specify a Kubernetes label key. For Amazon ECS, specify a container instance attribute name. Keys don't support wildcards.

Valid characters are letters, numbers, spaces, hyphens (-), underscores (_), periods (.), forward slashes (/), and colons (:).

Type: String

Length Constraints: Minimum length of 1. Maximum length of 256.

Pattern: \S+

Required: Yes

Value

The attribute value to match. You can specify an exact value, such as payments-api, or a wildcard pattern, such as payments-*.

Valid characters are letters, numbers, spaces, hyphens (-), underscores (_), periods (.), forward slashes (/), colons (:), asterisks (*), and backslashes (\).

Network Firewall evaluates the value using the following rules:

  • An asterisk (*) matches zero or more characters. For example, payments-* matches payments-, payments-api, and payments-api-v2, and *-prod matches web-prod.

  • The pattern must match the entire value. For example, payments-* doesn't match my-payments-api. To match a value that contains payments anywhere, use *payments*.

  • Matching is case sensitive. For example, Payments-* doesn't match payments-api.

  • To match a literal asterisk, escape it with a backslash (\*). To match a literal backslash, use \\. A backslash followed by any other character matches a literal backslash followed by that character.

  • A wildcard pattern matches only containers that have the attribute. For example, a filter with key app and value * matches every container that has an app label, but doesn't match a container without an app label.

  • A value that doesn't contain * or \ matches only that exact value.

A value can contain at most 10 unescaped asterisks. Escaped asterisks (\*) don't count toward this limit. A value can't end with a single unescaped backslash.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 256.

Pattern: \S+

Required: Yes

See Also

For more information about using this API in one of the language-specific Amazon SDKs, see the following: