# CfnRuleGroupProps

Properties for defining a `CfnRuleGroup`.

Extends: CfnRuleGroupProps
Used as props by: CfnRuleGroup

- Source: Generated code
- Type last changed: v2.211.0 · 13 Aug 2025

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import { aws_networkfirewall as networkfirewall } from 'aws-cdk-lib';
const cfnRuleGroupProps: networkfirewall.CfnRuleGroupProps = {
  capacity: 123,
  ruleGroupName: 'ruleGroupName',
  type: 'type',

  // the properties below are optional
  description: 'description',
  ruleGroup: {
    rulesSource: {
      rulesSourceList: {
        generatedRulesType: 'generatedRulesType',
        targets: ['targets'],
        targetTypes: ['targetTypes'],
      },
      rulesString: 'rulesString',
      statefulRules: [{
        action: 'action',
        header: {
          destination: 'destination',
          destinationPort: 'destinationPort',
          direction: 'direction',
          protocol: 'protocol',
          source: 'source',
          sourcePort: 'sourcePort',
        },
        ruleOptions: [{
          keyword: 'keyword',

          // the properties below are optional
          settings: ['settings'],
        }],
      }],
      statelessRulesAndCustomActions: {
        statelessRules: [{
          priority: 123,
          ruleDefinition: {
            actions: ['actions'],
            matchAttributes: {
              destinationPorts: [{
                fromPort: 123,
                toPort: 123,
              }],
              destinations: [{
                addressDefinition: 'addressDefinition',
              }],
              protocols: [123],
              sourcePorts: [{
                fromPort: 123,
                toPort: 123,
              }],
              sources: [{
                addressDefinition: 'addressDefinition',
              }],
              tcpFlags: [{
                flags: ['flags'],

                // the properties below are optional
                masks: ['masks'],
              }],
            },
          },
        }],

        // the properties below are optional
        customActions: [{
          actionDefinition: {
            publishMetricAction: {
              dimensions: [{
                value: 'value',
              }],
            },
          },
          actionName: 'actionName',
        }],
      },
    },

    // the properties below are optional
    referenceSets: {
      ipSetReferences: {
        ipSetReferencesKey: {
          referenceArn: 'referenceArn',
        },
      },
    },
    ruleVariables: {
      ipSets: {
        ipSetsKey: {
          definition: ['definition'],
        },
      },
      portSets: {
        portSetsKey: {
          definition: ['definition'],
        },
      },
    },
    statefulRuleOptions: {
      ruleOrder: 'ruleOrder',
    },
  },
  summaryConfiguration: {
    ruleOptions: ['ruleOptions'],
  },
  tags: [{
    key: 'key',
    value: 'value',
  }],
};
```

## Properties

- `capacity`: number (required) — The maximum operating resources that this rule group can use.

  You can't change a rule group's capacity setting after you create the rule group. When you update a rule group, you are limited to this capacity. When you reference a rule group from a firewall policy, Network Firewall reserves this capacity for the rule group.

- `description`: string — A description of the rule group.

- `ruleGroup`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnRuleGroup.RuleGroupProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_networkfirewall.CfnRuleGroup.RuleGroupProperty.html) — An object that defines the rule group rules.

- `ruleGroupName`: string (required) — The descriptive name of the rule group.

  You can't change the name of a rule group after you create it.

- `summaryConfiguration`: [IResolvable](/cdk/api/v2/docs/aws-cdk-lib.IResolvable.html) | [CfnRuleGroup.SummaryConfigurationProperty](/cdk/api/v2/docs/aws-cdk-lib.aws_networkfirewall.CfnRuleGroup.SummaryConfigurationProperty.html) — A complex type containing the currently selected rule option fields that will be displayed for rule summarization returned by `DescribeRuleGroupSummary` .

  - The `RuleOptions` specified in `SummaryConfiguration`
  - Rule metadata organization preferences

- `tags`: [CfnTag](/cdk/api/v2/docs/aws-cdk-lib.CfnTag.html)[] — An array of key-value pairs to apply to this resource.

  For more information, see [Tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) .

- `type`: string (required) — Indicates whether the rule group is stateless or stateful.

  If the rule group is stateless, it contains
  stateless rules. If it is stateful, it contains stateful rules.