CfnFirewallPolicy

class aws_cdk.aws_networkfirewall.CfnFirewallPolicy(scope, id, *, firewall_policy, firewall_policy_name, description=None, tags=None)

Bases: CfnResource

Use the FirewallPolicy to define the stateless and stateful network traffic filtering behavior for your Firewall .

You can use one firewall policy for multiple firewalls.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewallpolicy.html
CloudformationResource:: AWS::NetworkFirewall::FirewallPolicy
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_networkfirewall as networkfirewall

cfn_firewall_policy = networkfirewall.CfnFirewallPolicy(self, "MyCfnFirewallPolicy",
    firewall_policy=networkfirewall.CfnFirewallPolicy.FirewallPolicyProperty(
        stateless_default_actions=["statelessDefaultActions"],
        stateless_fragment_default_actions=["statelessFragmentDefaultActions"],

        # the properties below are optional
        policy_variables=networkfirewall.CfnFirewallPolicy.PolicyVariablesProperty(
            rule_variables={
                "rule_variables_key": {
                    "definition": ["definition"]
                }
            }
        ),
        stateful_default_actions=["statefulDefaultActions"],
        stateful_engine_options=networkfirewall.CfnFirewallPolicy.StatefulEngineOptionsProperty(
            rule_order="ruleOrder",
            stream_exception_policy="streamExceptionPolicy"
        ),
        stateful_rule_group_references=[networkfirewall.CfnFirewallPolicy.StatefulRuleGroupReferenceProperty(
            resource_arn="resourceArn",

            # the properties below are optional
            override=networkfirewall.CfnFirewallPolicy.StatefulRuleGroupOverrideProperty(
                action="action"
            ),
            priority=123
        )],
        stateless_custom_actions=[networkfirewall.CfnFirewallPolicy.CustomActionProperty(
            action_definition=networkfirewall.CfnFirewallPolicy.ActionDefinitionProperty(
                publish_metric_action=networkfirewall.CfnFirewallPolicy.PublishMetricActionProperty(
                    dimensions=[networkfirewall.CfnFirewallPolicy.DimensionProperty(
                        value="value"
                    )]
                )
            ),
            action_name="actionName"
        )],
        stateless_rule_group_references=[networkfirewall.CfnFirewallPolicy.StatelessRuleGroupReferenceProperty(
            priority=123,
            resource_arn="resourceArn"
        )],
        tls_inspection_configuration_arn="tlsInspectionConfigurationArn"
    ),
    firewall_policy_name="firewallPolicyName",

    # the properties below are optional
    description="description",
    tags=[CfnTag(
        key="key",
        value="value"
    )]
)

Parameters:

scope (Construct) – Scope in which this resource is defined.
id (str) – Construct identifier for this resource (unique in its scope).
firewall_policy (Union[IResolvable, FirewallPolicyProperty, Dict[str, Any]]) – The traffic filtering behavior of a firewall policy, defined in a collection of stateless and stateful rule groups and other settings.
firewall_policy_name (str) – The descriptive name of the firewall policy. You can’t change the name of a firewall policy after you create it.
description (Optional[str]) – A description of the firewall policy.
tags (Optional[Sequence[Union[CfnTag, Dict[str, Any]]]]) – An array of key-value pairs to apply to this resource. For more information, see Tag .

Methods

add_deletion_override(path)

Syntactic sugar for addOverride(path, undefined).

Parameters:: path (str) – The path of the value to delete.
Return type:: None

add_dependency(target)

Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.

This can be used for resources across stacks (or nested stack) boundaries and the dependency will automatically be transferred to the relevant scope.

Parameters:

target (CfnResource) –

Return type:

None

add_depends_on(target)

(deprecated) Indicates that this resource depends on another resource and cannot be provisioned unless the other resource has been successfully provisioned.

Parameters:

target (CfnResource) –

Deprecated:

use addDependency

Stability:

deprecated

Return type:

None

add_metadata(key, value)

Add a value to the CloudFormation Resource Metadata.

Parameters:

key (str) –
value (Any) –

See:

Return type:

None

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html

Note that this is a different set of metadata from CDK node metadata; this metadata ends up in the stack template under the resource, whereas CDK node metadata ends up in the Cloud Assembly.

add_override(path, value)

Adds an override to the synthesized CloudFormation resource.

To add a property override, either use addPropertyOverride or prefix path with “Properties.” (i.e. Properties.TopicName).

If the override is nested, separate each nested level using a dot (.) in the path parameter. If there is an array as part of the nesting, specify the index in the path.

To include a literal . in the property name, prefix with a \. In most programming languages you will need to write this as "\\." because the \ itself will need to be escaped.

For example:

cfn_resource.add_override("Properties.GlobalSecondaryIndexes.0.Projection.NonKeyAttributes", ["myattribute"])
cfn_resource.add_override("Properties.GlobalSecondaryIndexes.1.ProjectionType", "INCLUDE")

would add the overrides Example:

"Properties": {
  "GlobalSecondaryIndexes": [
    {
      "Projection": {
        "NonKeyAttributes": [ "myattribute" ]
        ...
      }
      ...
    },
    {
      "ProjectionType": "INCLUDE"
      ...
    },
  ]
  ...
}

The value argument to addOverride will not be processed or translated in any way. Pass raw JSON values in here with the correct capitalization for CloudFormation. If you pass CDK classes or structs, they will be rendered with lowercased key names, and CloudFormation will reject the template.

Parameters:

path (str) –
- The path of the property, you can use dot notation to override values in complex types. Any intermediate keys will be created as needed.
value (Any) –
- The value. Could be primitive or complex.

Return type:

None

add_property_deletion_override(property_path)

Adds an override that deletes the value of a property from the resource definition.

Parameters:: property_path (str) – The path to the property.
Return type:: None

add_property_override(property_path, value)

Adds an override to a resource property.

Syntactic sugar for addOverride("Properties.<...>", value).

Parameters:

property_path (str) – The path of the property.
value (Any) – The value.

Return type:

None

apply_removal_policy(policy=None, *, apply_to_update_replace_policy=None, default=None)

Sets the deletion policy of the resource based on the removal policy specified.

The Removal Policy controls what happens to this resource when it stops being managed by CloudFormation, either because you’ve removed it from the CDK application or because you’ve made a change that requires the resource to be replaced.

The resource can be deleted (RemovalPolicy.DESTROY), or left in your AWS account for data recovery and cleanup later (RemovalPolicy.RETAIN). In some cases, a snapshot can be taken of the resource prior to deletion (RemovalPolicy.SNAPSHOT). A list of resources that support this policy can be found in the following link:

Parameters:

policy (Optional[RemovalPolicy]) –
apply_to_update_replace_policy (Optional[bool]) – Apply the same deletion policy to the resource’s “UpdateReplacePolicy”. Default: true
default (Optional[RemovalPolicy]) – The default policy to apply in case the removal policy is not defined. Default: - Default value is resource specific. To determine the default value for a resource, please consult that specific resource’s documentation.

See:

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html#aws-attribute-deletionpolicy-options

Return type:

None

get_att(attribute_name, type_hint=None)

Returns a token for an runtime attribute of this resource.

Ideally, use generated attribute accessors (e.g. resource.arn), but this can be used for future compatibility in case there is no generated attribute.

Parameters:

attribute_name (str) – The name of the attribute.
type_hint (Optional[ResolutionTypeHint]) –

Return type:

Reference

get_metadata(key)

Retrieve a value value from the CloudFormation Resource Metadata.

Parameters:

key (str) –

See:

Return type:

Any

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/metadata-section-structure.html

Note that this is a different set of metadata from CDK node metadata; this metadata ends up in the stack template under the resource, whereas CDK node metadata ends up in the Cloud Assembly.

inspect(inspector)

Examines the CloudFormation resource and discloses attributes.

Parameters:: inspector (TreeInspector) – tree inspector to collect and process attributes.
Return type:: None

obtain_dependencies()

Retrieves an array of resources this resource depends on.

This assembles dependencies on resources across stacks (including nested stacks) automatically.

Return type:: List[Union[Stack, CfnResource]]

obtain_resource_dependencies()

Get a shallow copy of dependencies between this resource and other resources in the same stack.

Return type:: List[CfnResource]

override_logical_id(new_logical_id)

Overrides the auto-generated logical ID with a specific ID.

Parameters:: new_logical_id (str) – The new logical ID to use for this stack element.
Return type:: None

remove_dependency(target)

Indicates that this resource no longer depends on another resource.

This can be used for resources across stacks (including nested stacks) and the dependency will automatically be removed from the relevant scope.

Parameters:

target (CfnResource) –

Return type:

None

replace_dependency(target, new_target)

Replaces one dependency with another.

Parameters:

target (CfnResource) – The dependency to replace.
new_target (CfnResource) – The new dependency to add.

Return type:

None

to_string()

Returns a string representation of this construct.

Return type:: str
Returns:: a string representation of this resource

Attributes

CFN_RESOURCE_TYPE_NAME = 'AWS::NetworkFirewall::FirewallPolicy'

attr_firewall_policy_arn

The Amazon Resource Name (ARN) of the FirewallPolicy .

CloudformationAttribute:: FirewallPolicyArn

attr_firewall_policy_id

The unique ID of the FirewallPolicy resource.

CloudformationAttribute:: FirewallPolicyId

cfn_options: Options for this resource, such as condition, update policy etc.

cfn_resource_type: AWS resource type.

creation_stack

return:

the stack trace of the point where this Resource was created from, sourced from the +metadata+ entry typed +aws:cdk:logicalId+, and with the bottom-most node +internal+ entries filtered.

description: A description of the firewall policy.

firewall_policy: The traffic filtering behavior of a firewall policy, defined in a collection of stateless and stateful rule groups and other settings.

firewall_policy_name: The descriptive name of the firewall policy.

logical_id

The logical ID for this CloudFormation stack element.

The logical ID of the element is calculated from the path of the resource node in the construct tree.

To override this value, use overrideLogicalId(newLogicalId).

Returns:

the logical ID as a stringified token. This value will only get resolved during synthesis.

node: The tree node.

ref

Return a string that will be resolved to a CloudFormation { Ref } for this element.

If, by any chance, the intrinsic reference of a resource is not a string, you could coerce it to an IResolvable through Lazy.any({ produce: resource.ref }).

stack

The stack in which this element is defined.

CfnElements must be defined within a stack scope (directly or indirectly).

tags: Tag Manager which manages the tags for this resource.

tags_raw: An array of key-value pairs to apply to this resource.

Static Methods

classmethod is_cfn_element(x)

Returns true if a construct is a stack element (i.e. part of the synthesized cloudformation template).

Uses duck-typing instead of instanceof to allow stack elements from different versions of this library to be included in the same stack.

Parameters:

x (Any) –

Return type:

bool

Returns:

The construct as a stack element or undefined if it is not a stack element.

classmethod is_cfn_resource(x)

Check whether the given object is a CfnResource.

Parameters:

x (Any) –

Return type:

bool

classmethod is_construct(x)

Checks if x is a construct.

Use this method instead of instanceof to properly detect Construct instances, even when the construct library is symlinked.

Explanation: in JavaScript, multiple copies of the constructs library on disk are seen as independent, completely different libraries. As a consequence, the class Construct in each copy of the constructs library is seen as a different class, and an instance of one class will not test as instanceof the other class. npm install will not create installations like this, but users may manually symlink construct libraries together or use a monorepo tool: in those cases, multiple copies of the constructs library can be accidentally installed, and instanceof will behave unpredictably. It is safest to avoid using instanceof, and using this type-testing method instead.

Parameters:: x (Any) – Any object.
Return type:: bool
Returns:: true if x is an object created from a class which extends Construct.

ActionDefinitionProperty

class CfnFirewallPolicy.ActionDefinitionProperty(*, publish_metric_action=None)

Bases: object

A custom action to use in stateless rule actions settings.

Parameters:: publish_metric_action (Union[IResolvable, PublishMetricActionProperty, Dict[str, Any], None]) – Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published. You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-actiondefinition.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_networkfirewall as networkfirewall

action_definition_property = networkfirewall.CfnFirewallPolicy.ActionDefinitionProperty(
    publish_metric_action=networkfirewall.CfnFirewallPolicy.PublishMetricActionProperty(
        dimensions=[networkfirewall.CfnFirewallPolicy.DimensionProperty(
            value="value"
        )]
    )
)

Attributes

publish_metric_action

Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet.

This setting defines a CloudWatch dimension value to be published.

You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-actiondefinition.html#cfn-networkfirewall-firewallpolicy-actiondefinition-publishmetricaction

CustomActionProperty

class CfnFirewallPolicy.CustomActionProperty(*, action_definition, action_name)

Bases: object

An optional, non-standard action to use for stateless packet handling.

You can define this in addition to the standard action that you must specify.

You define and name the custom actions that you want to be able to use, and then you reference them by name in your actions settings.

You can use custom actions in the following places:

In an RuleGroup.StatelessRulesAndCustomActions . The custom actions are available for use by name inside the StatelessRulesAndCustomActions where you define them. You can use them for your stateless rule actions to specify what to do with a packet that matches the rule’s match attributes.
In an FirewallPolicy specification, in StatelessCustomActions . The custom actions are available for use inside the policy where you define them. You can use them for the policy’s default stateless actions settings to specify what to do with packets that don’t match any of the policy’s stateless rules.

Parameters:

action_definition (Union[IResolvable, ActionDefinitionProperty, Dict[str, Any]]) – The custom action associated with the action name.
action_name (str) – The descriptive name of the custom action. You can’t change the name of a custom action after you create it.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-customaction.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_networkfirewall as networkfirewall

custom_action_property = networkfirewall.CfnFirewallPolicy.CustomActionProperty(
    action_definition=networkfirewall.CfnFirewallPolicy.ActionDefinitionProperty(
        publish_metric_action=networkfirewall.CfnFirewallPolicy.PublishMetricActionProperty(
            dimensions=[networkfirewall.CfnFirewallPolicy.DimensionProperty(
                value="value"
            )]
        )
    ),
    action_name="actionName"
)

Attributes

action_definition

The custom action associated with the action name.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-customaction.html#cfn-networkfirewall-firewallpolicy-customaction-actiondefinition

action_name

The descriptive name of the custom action.

You can’t change the name of a custom action after you create it.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-customaction.html#cfn-networkfirewall-firewallpolicy-customaction-actionname

DimensionProperty

class CfnFirewallPolicy.DimensionProperty(*, value)

Bases: object

The value to use in an Amazon CloudWatch custom metric dimension.

This is used in the PublishMetrics custom action. A CloudWatch custom metric dimension is a name/value pair that’s part of the identity of a metric.

AWS Network Firewall sets the dimension name to CustomAction and you provide the dimension value.

For more information about CloudWatch custom metric dimensions, see Publishing Custom Metrics in the Amazon CloudWatch User Guide .

Parameters:: value (str) – The value to use in the custom metric dimension.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-dimension.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_networkfirewall as networkfirewall

dimension_property = networkfirewall.CfnFirewallPolicy.DimensionProperty(
    value="value"
)

Attributes

value

The value to use in the custom metric dimension.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-dimension.html#cfn-networkfirewall-firewallpolicy-dimension-value

FirewallPolicyProperty

class CfnFirewallPolicy.FirewallPolicyProperty(*, stateless_default_actions, stateless_fragment_default_actions, policy_variables=None, stateful_default_actions=None, stateful_engine_options=None, stateful_rule_group_references=None, stateless_custom_actions=None, stateless_rule_group_references=None, tls_inspection_configuration_arn=None)

Bases: object

The traffic filtering behavior of a firewall policy, defined in a collection of stateless and stateful rule groups and other settings.

Parameters:

stateless_default_actions (Sequence[str]) – The actions to take on a packet if it doesn’t match any of the stateless rules in the policy. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe . You must specify one of the standard actions: aws:pass , aws:drop , or aws:forward_to_sfe . In addition, you can specify custom actions that are compatible with your standard section choice. For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”] . For information about compatibility, see the custom action descriptions.
stateless_fragment_default_actions (Sequence[str]) – The actions to take on a fragmented packet if it doesn’t match any of the stateless rules in the policy. If you want non-matching fragmented packets to be forwarded for stateful inspection, specify aws:forward_to_sfe . You must specify one of the standard actions: aws:pass , aws:drop , or aws:forward_to_sfe . In addition, you can specify custom actions that are compatible with your standard section choice. For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”] . For information about compatibility, see the custom action descriptions.
policy_variables (Union[IResolvable, PolicyVariablesProperty, Dict[str, Any], None]) – Contains variables that you can use to override default Suricata settings in your firewall policy.
stateful_default_actions (Optional[Sequence[str]]) – The default actions to take on a packet that doesn’t match any stateful rules. The stateful default action is optional, and is only valid when using the strict rule order. Valid values of the stateful default action: - aws:drop_strict - aws:drop_established - aws:alert_strict - aws:alert_established For more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .
stateful_engine_options (Union[IResolvable, StatefulEngineOptionsProperty, Dict[str, Any], None]) – Additional options governing how Network Firewall handles stateful rules. The stateful rule groups that you use in your policy must have stateful rule options settings that are compatible with these settings.
stateful_rule_group_references (Union[IResolvable, Sequence[Union[IResolvable, StatefulRuleGroupReferenceProperty, Dict[str, Any]]], None]) – References to the stateful rule groups that are used in the policy. These define the inspection criteria in stateful rules.
stateless_custom_actions (Union[IResolvable, Sequence[Union[IResolvable, CustomActionProperty, Dict[str, Any]]], None]) – The custom action definitions that are available for use in the firewall policy’s StatelessDefaultActions setting. You name each custom action that you define, and then you can use it by name in your default actions specifications.
stateless_rule_group_references (Union[IResolvable, Sequence[Union[IResolvable, StatelessRuleGroupReferenceProperty, Dict[str, Any]]], None]) – References to the stateless rule groups that are used in the policy. These define the matching criteria in stateless rules.
tls_inspection_configuration_arn (Optional[str]) – The Amazon Resource Name (ARN) of the TLS inspection configuration.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_networkfirewall as networkfirewall

firewall_policy_property = networkfirewall.CfnFirewallPolicy.FirewallPolicyProperty(
    stateless_default_actions=["statelessDefaultActions"],
    stateless_fragment_default_actions=["statelessFragmentDefaultActions"],

    # the properties below are optional
    policy_variables=networkfirewall.CfnFirewallPolicy.PolicyVariablesProperty(
        rule_variables={
            "rule_variables_key": {
                "definition": ["definition"]
            }
        }
    ),
    stateful_default_actions=["statefulDefaultActions"],
    stateful_engine_options=networkfirewall.CfnFirewallPolicy.StatefulEngineOptionsProperty(
        rule_order="ruleOrder",
        stream_exception_policy="streamExceptionPolicy"
    ),
    stateful_rule_group_references=[networkfirewall.CfnFirewallPolicy.StatefulRuleGroupReferenceProperty(
        resource_arn="resourceArn",

        # the properties below are optional
        override=networkfirewall.CfnFirewallPolicy.StatefulRuleGroupOverrideProperty(
            action="action"
        ),
        priority=123
    )],
    stateless_custom_actions=[networkfirewall.CfnFirewallPolicy.CustomActionProperty(
        action_definition=networkfirewall.CfnFirewallPolicy.ActionDefinitionProperty(
            publish_metric_action=networkfirewall.CfnFirewallPolicy.PublishMetricActionProperty(
                dimensions=[networkfirewall.CfnFirewallPolicy.DimensionProperty(
                    value="value"
                )]
            )
        ),
        action_name="actionName"
    )],
    stateless_rule_group_references=[networkfirewall.CfnFirewallPolicy.StatelessRuleGroupReferenceProperty(
        priority=123,
        resource_arn="resourceArn"
    )],
    tls_inspection_configuration_arn="tlsInspectionConfigurationArn"
)

Attributes

policy_variables

Contains variables that you can use to override default Suricata settings in your firewall policy.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-policyvariables

stateful_default_actions

The default actions to take on a packet that doesn’t match any stateful rules.

The stateful default action is optional, and is only valid when using the strict rule order.

Valid values of the stateful default action:

aws:drop_strict
aws:drop_established
aws:alert_strict
aws:alert_established

For more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statefuldefaultactions

stateful_engine_options

Additional options governing how Network Firewall handles stateful rules.

The stateful rule groups that you use in your policy must have stateful rule options settings that are compatible with these settings.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statefulengineoptions

stateful_rule_group_references

References to the stateful rule groups that are used in the policy.

These define the inspection criteria in stateful rules.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statefulrulegroupreferences

stateless_custom_actions

The custom action definitions that are available for use in the firewall policy’s StatelessDefaultActions setting.

You name each custom action that you define, and then you can use it by name in your default actions specifications.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statelesscustomactions

stateless_default_actions

The actions to take on a packet if it doesn’t match any of the stateless rules in the policy.

If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe .

You must specify one of the standard actions: aws:pass , aws:drop , or aws:forward_to_sfe . In addition, you can specify custom actions that are compatible with your standard section choice.

For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”] . For information about compatibility, see the custom action descriptions.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statelessdefaultactions

stateless_fragment_default_actions

The actions to take on a fragmented packet if it doesn’t match any of the stateless rules in the policy.

If you want non-matching fragmented packets to be forwarded for stateful inspection, specify aws:forward_to_sfe .

You must specify one of the standard actions: aws:pass , aws:drop , or aws:forward_to_sfe . In addition, you can specify custom actions that are compatible with your standard section choice.

For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”] . For information about compatibility, see the custom action descriptions.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statelessfragmentdefaultactions

stateless_rule_group_references

References to the stateless rule groups that are used in the policy.

These define the matching criteria in stateless rules.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statelessrulegroupreferences

tls_inspection_configuration_arn

The Amazon Resource Name (ARN) of the TLS inspection configuration.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-tlsinspectionconfigurationarn

IPSetProperty

class CfnFirewallPolicy.IPSetProperty(*, definition=None)

Bases: object

A list of IP addresses and address ranges, in CIDR notation.

This is part of a RuleVariables .

Parameters:: definition (Optional[Sequence[str]]) – The list of IP addresses and address ranges, in CIDR notation.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-ipset.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_networkfirewall as networkfirewall

i_pSet_property = {
    "definition": ["definition"]
}

Attributes

definition

The list of IP addresses and address ranges, in CIDR notation.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-ipset.html#cfn-networkfirewall-firewallpolicy-ipset-definition

PolicyVariablesProperty

class CfnFirewallPolicy.PolicyVariablesProperty(*, rule_variables=None)

Bases: object

Contains variables that you can use to override default Suricata settings in your firewall policy.

Parameters:: rule_variables (Union[IResolvable, Mapping[str, Union[IResolvable, IPSetProperty, Dict[str, Any]]], None]) – The IPv4 or IPv6 addresses in CIDR notation to use for the Suricata HOME_NET variable. If your firewall uses an inspection VPC, you might want to override the HOME_NET variable with the CIDRs of your home networks. If you don’t override HOME_NET with your own CIDRs, Network Firewall by default uses the CIDR of your inspection VPC.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-policyvariables.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_networkfirewall as networkfirewall

policy_variables_property = networkfirewall.CfnFirewallPolicy.PolicyVariablesProperty(
    rule_variables={
        "rule_variables_key": {
            "definition": ["definition"]
        }
    }
)

Attributes

rule_variables

The IPv4 or IPv6 addresses in CIDR notation to use for the Suricata HOME_NET variable.

If your firewall uses an inspection VPC, you might want to override the HOME_NET variable with the CIDRs of your home networks. If you don’t override HOME_NET with your own CIDRs, Network Firewall by default uses the CIDR of your inspection VPC.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-policyvariables.html#cfn-networkfirewall-firewallpolicy-policyvariables-rulevariables

PublishMetricActionProperty

class CfnFirewallPolicy.PublishMetricActionProperty(*, dimensions)

Bases: object

Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet.

This setting defines a CloudWatch dimension value to be published.

Parameters:: dimensions (Union[IResolvable, Sequence[Union[IResolvable, DimensionProperty, Dict[str, Any]]]]) –
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-publishmetricaction.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_networkfirewall as networkfirewall

publish_metric_action_property = networkfirewall.CfnFirewallPolicy.PublishMetricActionProperty(
    dimensions=[networkfirewall.CfnFirewallPolicy.DimensionProperty(
        value="value"
    )]
)

Attributes

dimensions

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-publishmetricaction.html#cfn-networkfirewall-firewallpolicy-publishmetricaction-dimensions

Type:: see

StatefulEngineOptionsProperty

class CfnFirewallPolicy.StatefulEngineOptionsProperty(*, rule_order=None, stream_exception_policy=None)

Bases: object

Configuration settings for the handling of the stateful rule groups in a firewall policy.

Parameters:

rule_order (Optional[str]) – Indicates how to manage the order of stateful rule evaluation for the policy. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .
stream_exception_policy (Optional[str]) – Configures how Network Firewall processes traffic when a network connection breaks midstream. Network connections can break due to disruptions in external networks or within the firewall itself. - DROP - Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior. - CONTINUE - Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule to drop http traffic, Network Firewall won’t match the traffic for this rule because the service won’t have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using a flow:stateless rule would still match, as would the aws:drop_strict default action. - REJECT - Network Firewall fails closed and drops all subsequent traffic going to the firewall. Network Firewall also sends a TCP reject packet back to your client so that the client can immediately establish a new session. Network Firewall will have context about the new session and will apply rules to the subsequent traffic.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulengineoptions.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_networkfirewall as networkfirewall

stateful_engine_options_property = networkfirewall.CfnFirewallPolicy.StatefulEngineOptionsProperty(
    rule_order="ruleOrder",
    stream_exception_policy="streamExceptionPolicy"
)

Attributes

rule_order

Indicates how to manage the order of stateful rule evaluation for the policy.

DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulengineoptions.html#cfn-networkfirewall-firewallpolicy-statefulengineoptions-ruleorder

stream_exception_policy

Configures how Network Firewall processes traffic when a network connection breaks midstream.

Network connections can break due to disruptions in external networks or within the firewall itself.

DROP - Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior.
CONTINUE - Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule to drop http traffic, Network Firewall won’t match the traffic for this rule because the service won’t have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using a flow:stateless rule would still match, as would the aws:drop_strict default action.
REJECT - Network Firewall fails closed and drops all subsequent traffic going to the firewall. Network Firewall also sends a TCP reject packet back to your client so that the client can immediately establish a new session. Network Firewall will have context about the new session and will apply rules to the subsequent traffic.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulengineoptions.html#cfn-networkfirewall-firewallpolicy-statefulengineoptions-streamexceptionpolicy

StatefulRuleGroupOverrideProperty

class CfnFirewallPolicy.StatefulRuleGroupOverrideProperty(*, action=None)

Bases: object

The setting that allows the policy owner to change the behavior of the rule group within a policy.

Parameters:: action (Optional[str]) – The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulrulegroupoverride.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_networkfirewall as networkfirewall

stateful_rule_group_override_property = networkfirewall.CfnFirewallPolicy.StatefulRuleGroupOverrideProperty(
    action="action"
)

Attributes

action

The action that changes the rule group from DROP to ALERT .

This only applies to managed rule groups.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulrulegroupoverride.html#cfn-networkfirewall-firewallpolicy-statefulrulegroupoverride-action

StatefulRuleGroupReferenceProperty

class CfnFirewallPolicy.StatefulRuleGroupReferenceProperty(*, resource_arn, override=None, priority=None)

Bases: object

Identifier for a single stateful rule group, used in a firewall policy to refer to a rule group.

Parameters:

resource_arn (str) – The Amazon Resource Name (ARN) of the stateful rule group.
override (Union[IResolvable, StatefulRuleGroupOverrideProperty, Dict[str, Any], None]) – The action that allows the policy owner to override the behavior of the rule group within a policy.
priority (Union[int, float, None]) – An integer setting that indicates the order in which to run the stateful rule groups in a single FirewallPolicy . This setting only applies to firewall policies that specify the STRICT_ORDER rule order in the stateful engine options settings. Network Firewall evalutes each stateful rule group against a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy. You can change the priority settings of your rule groups at any time. To make it easier to insert rule groups later, number them so there’s a wide range in between, for example use 100, 200, and so on.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulrulegroupreference.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_networkfirewall as networkfirewall

stateful_rule_group_reference_property = networkfirewall.CfnFirewallPolicy.StatefulRuleGroupReferenceProperty(
    resource_arn="resourceArn",

    # the properties below are optional
    override=networkfirewall.CfnFirewallPolicy.StatefulRuleGroupOverrideProperty(
        action="action"
    ),
    priority=123
)

Attributes

override

The action that allows the policy owner to override the behavior of the rule group within a policy.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulrulegroupreference.html#cfn-networkfirewall-firewallpolicy-statefulrulegroupreference-override

priority

An integer setting that indicates the order in which to run the stateful rule groups in a single FirewallPolicy .

This setting only applies to firewall policies that specify the STRICT_ORDER rule order in the stateful engine options settings.

Network Firewall evalutes each stateful rule group against a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy.

You can change the priority settings of your rule groups at any time. To make it easier to insert rule groups later, number them so there’s a wide range in between, for example use 100, 200, and so on.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulrulegroupreference.html#cfn-networkfirewall-firewallpolicy-statefulrulegroupreference-priority

resource_arn

The Amazon Resource Name (ARN) of the stateful rule group.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulrulegroupreference.html#cfn-networkfirewall-firewallpolicy-statefulrulegroupreference-resourcearn

StatelessRuleGroupReferenceProperty

class CfnFirewallPolicy.StatelessRuleGroupReferenceProperty(*, priority, resource_arn)

Bases: object

Identifier for a single stateless rule group, used in a firewall policy to refer to the rule group.

Parameters:

priority (Union[int, float]) – An integer setting that indicates the order in which to run the stateless rule groups in a single FirewallPolicy . Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy.
resource_arn (str) – The Amazon Resource Name (ARN) of the stateless rule group.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statelessrulegroupreference.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_networkfirewall as networkfirewall

stateless_rule_group_reference_property = networkfirewall.CfnFirewallPolicy.StatelessRuleGroupReferenceProperty(
    priority=123,
    resource_arn="resourceArn"
)

Attributes

priority

An integer setting that indicates the order in which to run the stateless rule groups in a single FirewallPolicy .

Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statelessrulegroupreference.html#cfn-networkfirewall-firewallpolicy-statelessrulegroupreference-priority

resource_arn

The Amazon Resource Name (ARN) of the stateless rule group.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statelessrulegroupreference.html#cfn-networkfirewall-firewallpolicy-statelessrulegroupreference-resourcearn