: List of Attributes Monitored on the AWS VPC
Focus
Focus

List of Attributes Monitored on the AWS VPC

Table of Contents
End-of-Life (EoL)

List of Attributes Monitored on the AWS VPC

As you provision or modify virtual machines in your AWS VPCs, you have two ways of monitoring these instances and retrieving the tags for use as match criteria in dynamic address groups.
  • AWS Resource Information—On a next-gen firewall, you can monitor up to a total of 32 tags—14 pre-defined and 15 user-defined key-value pairs (tags).
  • AWS Plugin on Panorama—The Panorama plugin for AWS allows you to connect Panorama to your AWS VPC on the public cloud and retrieve the IP address-to-tag mapping for your virtual machines. Panorama then registers the VM information to the managed Palo Alto Networks® firewall(s) that you have configured for notification. With the plugin, Panorama can retrieve a total of 32 tags for each virtual machine, 15 predefined tags and up to 17 user-defined tags.
    The maximum length of the tag-value (name and value included) must be 116 characters or less. If a tag is longer than 116 characters, Panorama does not retrieve the tag and register it on the firewalls.
Attributes Monitored on the AWS-VPC
VM Information Source on the FirewallAWS Plugin on Panorama
AMI ID
ImageId.<ImageId string>
YesYes
Architecture
Architecture.<Architecture string>
YesNo
Availability Zone
AvailabilityZone.<string>
YesYes
Guest OS
GuestOS.<guest OS name>
YesNo
IAM Instance Profile
Iam-instance-profile.<instanceProfileArn>
NoYes
Instance ID
InstanceId.<InstanceId string>
YesNo
Instance State
InstanceState.<instance state>
YesNo
Instance Type
InstanceType.<instance type>
YesNo
Key Name
KeyName.<KeyName string>
YesYes
Owner ID
The value for this attribute is fetched from the ENI.
Account-number.<OwnerId>
NoYes
Placement
Tenancy, Group Name
Placement.Tenancy.<string>
Placement.GroupName.<string>
YesYes
Private DNS Name
PrivateDnsName.<Private DNS Name>
YesNo
Public DNS Name
PublicDnsName.<Public DNS Name>
YesYes
Subnet ID
SubnetID.<subnetID string>
YesYes
Security Group ID
Sg-id.<sg-xxxx>
NoYes
Security Group Name
Sg-name.<SecurityGroupName>
NoYes
VPC ID
VpcId.<VpcId string>
YesYes
Tag (key, value)
aws-tag.<key>.<value>
Yes;
Up to a maximum of 18 user defined tags are supported. The user-defined tags are sorted alphabetically, and the first 18 tags are available for use on the firewalls.
Yes;
Up to a maximum of 21 user defined tags are supported. The user-defined tags are sorted alphabetically, and the first 21 tags are available for use on Panorama and the firewalls.
Load Balancer Name
Lb-name.<LoadBalancerName>
NoYes
Endpoint ID
Endpoint-id.<EndpointID>
NoYes