openapi: 3.2.0
info:
  contact: {}
  description: "There are two types of rulestacks:\n- **Local rulestack**-Consists of local rules and manages them. A local account administrator can associate local rulestacks to an NGFW in their AWS account.\n- **Global rulestack**-The AWS Firewall Manager administrator can author a Firewall Manager Service (FMS) policy and associate a global rulestack with it. AWS Firewall Manager manages the global rulestack across all these NGFWs in different AWS accounts of an AWS Organization.  \n\nA global rulestack configures pre-rules and post-rules on each NGFW. The AWS Firewall Manager administrator can author a FMS policy and associate a global rulestack with it. AWS Firewall Manager manages the global rulestack across all these NGFWs in different AWS accounts in the AWS Organization. A global rulestack configures pre-rules and post-rules on each NGFW.  \n\n>**Note:** For FMS policy, there is no Local Firewall administrator. The local rulestack administrator associates the local rulestacks to an NGFW. If the FMS service handshake is successful, any local firewall administrator call must be disabled, and the local rulestack administrator can associate the local rulestack to a NGFW.\n\n### Permission Policies\n\n| Action                        | Local Firewall Administrator  | Local Rulestack Administrator | Global Rulestack Administrator |\n| ----------------------------- | :---------------------------: | :---------------------------: | :----------------------------: | \n| Associate a Global Rulestack  | ☐                       | ☐                       | **☑**                    |                     \n| Associate a Local Rulestack   | **☑**                   | **☑**                   | ☐                        |  \n\n>**Note:** The maximum local and global rulestacks you can create per subscription is 10.  \n"
  title: Manage Association Rulestacks API
  version: 1.0.0
servers:
- url: https://api.us-east-1.aws.cloudngfw.paloaltonetworks.com
tags:
- name: AssociationRulestacks
paths:
  /v1/config/ngfirewalls/{ngfirewallname}/globalrulestack:
    put:
      description: 'Associate a global rulestack to an NGFW.

        '
      operationId: put-v1-config-ngfirewalls-ngfirewallname-globalrulestack
      parameters:
      - description: 'The name of the NGFW to which you want to associate the global rulestack.

          '
        in: path
        name: ngfirewallname
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssociateGlobalRuleStackRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AssociateGlobalRuleStackResponse'
          description: OK
      summary: Associate global rulestack
      tags:
      - AssociationRulestacks
  /v1/config/ngfirewalls/{ngfirewallname}/rulestack:
    put:
      description: 'Associate a local rulestack to an NGFW.

        '
      operationId: put-v1-config-ngfirewalls-ngfirewallname-rulestack
      parameters:
      - description: 'The name of the NGFW to which you want to associate the local rulestack.

          '
        in: path
        name: ngfirewallname
        required: true
        schema:
          type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/AssociateRuleStackRequest'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/AssociateRuleStackResponse'
          description: OK
      summary: Associate local rulestack
      tags:
      - AssociationRulestacks
components:
  schemas:
    AssociateGlobalRuleStackRequest:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
        RuleStackName:
          maxLength: 128
          minLength: 1
          pattern: ^[a-zA-Z0-9-]+$
          title: Rulestackname
          type: string
        UpdateToken:
          title: Updatetoken
          type: string
      required:
      - RuleStackName
      - AccountId
      title: AssociateGlobalRuleStackRequest
      type: object
    AssociateRuleStackRequest:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
        RuleStackName:
          maxLength: 128
          minLength: 1
          pattern: ^[a-zA-Z0-9-]+$
          title: Rulestackname
          type: string
        UpdateToken:
          title: Updatetoken
          type: string
      required:
      - RuleStackName
      - AccountId
      title: AssociateRuleStackRequest
      type: object
    AssociateRuleStackResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    AssociateGlobalRuleStackResponse.Result:
      additionalProperties: false
      properties:
        ErrorCode:
          default: 0
          title: Errorcode
          type: integer
        Reason:
          title: Reason
          type: string
      title: Result
      type: object
    AssociateRuleStackResponse:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
        FirewallName:
          title: Firewallname
          type: string
        ResponseStatus:
          $ref: '#/components/schemas/AssociateRuleStackResponse.Result'
        RuleStackName:
          title: Rulestackname
          type: string
        UpdateToken:
          title: Updatetoken
          type: string
      title: AssociateRuleStackResponse
      type: object
    AssociateGlobalRuleStackResponse:
      additionalProperties: false
      properties:
        AccountId:
          title: Accountid
          type: string
        FirewallName:
          title: Firewallname
          type: string
        ResponseStatus:
          $ref: '#/components/schemas/AssociateGlobalRuleStackResponse.Result'
        RuleStackName:
          title: Rulestackname
          type: string
        UpdateToken:
          title: Updatetoken
          type: string
      title: AssociateGlobalRuleStackResponse
      type: object