CfnFirewallPolicyPropsMixin

class aws_cdk.mixins_preview.aws_networkfirewall.mixins.CfnFirewallPolicyPropsMixin(props, *, strategy=None)

Bases: Mixin

Use the firewall policy to define the stateless and stateful network traffic filtering behavior for your firewall.

You can use one firewall policy for multiple firewalls.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewallpolicy.html
CloudformationResource:: AWS::NetworkFirewall::FirewallPolicy
Mixin:: true
ExampleMetadata:: fixture=_generated

Example:

from aws_cdk import CfnTag
# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview import mixins
from aws_cdk.mixins_preview.aws_networkfirewall import mixins as networkfirewall_mixins

cfn_firewall_policy_props_mixin = networkfirewall_mixins.CfnFirewallPolicyPropsMixin(networkfirewall_mixins.CfnFirewallPolicyMixinProps(
    description="description",
    firewall_policy=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.FirewallPolicyProperty(
        enable_tls_session_holding=False,
        policy_variables=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.PolicyVariablesProperty(
            rule_variables={
                "rule_variables_key": {
                    "definition": ["definition"]
                }
            }
        ),
        stateful_default_actions=["statefulDefaultActions"],
        stateful_engine_options=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.StatefulEngineOptionsProperty(
            flow_timeouts=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.FlowTimeoutsProperty(
                tcp_idle_timeout_seconds=123
            ),
            rule_order="ruleOrder",
            stream_exception_policy="streamExceptionPolicy"
        ),
        stateful_rule_group_references=[networkfirewall_mixins.CfnFirewallPolicyPropsMixin.StatefulRuleGroupReferenceProperty(
            deep_threat_inspection=False,
            override=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.StatefulRuleGroupOverrideProperty(
                action="action"
            ),
            priority=123,
            resource_arn="resourceArn"
        )],
        stateless_custom_actions=[networkfirewall_mixins.CfnFirewallPolicyPropsMixin.CustomActionProperty(
            action_definition=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.ActionDefinitionProperty(
                publish_metric_action=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.PublishMetricActionProperty(
                    dimensions=[networkfirewall_mixins.CfnFirewallPolicyPropsMixin.DimensionProperty(
                        value="value"
                    )]
                )
            ),
            action_name="actionName"
        )],
        stateless_default_actions=["statelessDefaultActions"],
        stateless_fragment_default_actions=["statelessFragmentDefaultActions"],
        stateless_rule_group_references=[networkfirewall_mixins.CfnFirewallPolicyPropsMixin.StatelessRuleGroupReferenceProperty(
            priority=123,
            resource_arn="resourceArn"
        )],
        tls_inspection_configuration_arn="tlsInspectionConfigurationArn"
    ),
    firewall_policy_name="firewallPolicyName",
    tags=[CfnTag(
        key="key",
        value="value"
    )]
),
    strategy=mixins.PropertyMergeStrategy.OVERRIDE
)

Create a mixin to apply properties to AWS::NetworkFirewall::FirewallPolicy.

Parameters:

props (Union[CfnFirewallPolicyMixinProps, Dict[str, Any]]) – L1 properties to apply.
strategy (Optional[PropertyMergeStrategy]) – (experimental) Strategy for merging nested properties. Default: - PropertyMergeStrategy.MERGE

Methods

apply_to(construct)

Apply the mixin properties to the construct.

Parameters:: construct (IConstruct)
Return type:: IConstruct

supports(construct)

Check if this mixin supports the given construct.

Parameters:: construct (IConstruct)
Return type:: bool

Attributes

CFN_PROPERTY_KEYS = ['description', 'firewallPolicy', 'firewallPolicyName', 'tags']

Static Methods

classmethod is_mixin(x)

(experimental) Checks if x is a Mixin.

Parameters:: x (Any) – Any object.
Return type:: bool
Returns:: true if x is an object created from a class which extends Mixin.
Stability:: experimental

ActionDefinitionProperty

class CfnFirewallPolicyPropsMixin.ActionDefinitionProperty(*, publish_metric_action=None)

Bases: object

A custom action to use in stateless rule actions settings.

Parameters:: publish_metric_action (Union[IResolvable, PublishMetricActionProperty, Dict[str, Any], None]) – Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published. You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-actiondefinition.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_networkfirewall import mixins as networkfirewall_mixins

action_definition_property = networkfirewall_mixins.CfnFirewallPolicyPropsMixin.ActionDefinitionProperty(
    publish_metric_action=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.PublishMetricActionProperty(
        dimensions=[networkfirewall_mixins.CfnFirewallPolicyPropsMixin.DimensionProperty(
            value="value"
        )]
    )
)

Attributes

publish_metric_action

Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet.

This setting defines a CloudWatch dimension value to be published.

You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-actiondefinition.html#cfn-networkfirewall-firewallpolicy-actiondefinition-publishmetricaction

CustomActionProperty

class CfnFirewallPolicyPropsMixin.CustomActionProperty(*, action_definition=None, action_name=None)

Bases: object

An optional, non-standard action to use for stateless packet handling.

You can define this in addition to the standard action that you must specify.

You define and name the custom actions that you want to be able to use, and then you reference them by name in your actions settings.

You can use custom actions in the following places:

In an StatelessRulesAndCustomActions . The custom actions are available for use by name inside the StatelessRulesAndCustomActions where you define them. You can use them for your stateless rule actions to specify what to do with a packet that matches the rule’s match attributes.
In an firewall policy specification, in StatelessCustomActions . The custom actions are available for use inside the policy where you define them. You can use them for the policy’s default stateless actions settings to specify what to do with packets that don’t match any of the policy’s stateless rules.

Parameters:

action_definition (Union[IResolvable, ActionDefinitionProperty, Dict[str, Any], None]) – The custom action associated with the action name.
action_name (Optional[str]) – The descriptive name of the custom action. You can’t change the name of a custom action after you create it.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-customaction.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_networkfirewall import mixins as networkfirewall_mixins

custom_action_property = networkfirewall_mixins.CfnFirewallPolicyPropsMixin.CustomActionProperty(
    action_definition=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.ActionDefinitionProperty(
        publish_metric_action=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.PublishMetricActionProperty(
            dimensions=[networkfirewall_mixins.CfnFirewallPolicyPropsMixin.DimensionProperty(
                value="value"
            )]
        )
    ),
    action_name="actionName"
)

Attributes

action_definition

The custom action associated with the action name.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-customaction.html#cfn-networkfirewall-firewallpolicy-customaction-actiondefinition

action_name

The descriptive name of the custom action.

You can’t change the name of a custom action after you create it.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-customaction.html#cfn-networkfirewall-firewallpolicy-customaction-actionname

DimensionProperty

class CfnFirewallPolicyPropsMixin.DimensionProperty(*, value=None)

Bases: object

The value to use in an Amazon CloudWatch custom metric dimension.

This is used in the PublishMetrics custom action. A CloudWatch custom metric dimension is a name/value pair that’s part of the identity of a metric.

AWS Network Firewall sets the dimension name to CustomAction and you provide the dimension value.

For more information about CloudWatch custom metric dimensions, see Publishing Custom Metrics in the Amazon CloudWatch User Guide .

Parameters:: value (Optional[str]) – The value to use in the custom metric dimension.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-dimension.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_networkfirewall import mixins as networkfirewall_mixins

dimension_property = networkfirewall_mixins.CfnFirewallPolicyPropsMixin.DimensionProperty(
    value="value"
)

Attributes

value

The value to use in the custom metric dimension.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-dimension.html#cfn-networkfirewall-firewallpolicy-dimension-value

FirewallPolicyProperty

class CfnFirewallPolicyPropsMixin.FirewallPolicyProperty(*, enable_tls_session_holding=None, policy_variables=None, stateful_default_actions=None, stateful_engine_options=None, stateful_rule_group_references=None, stateless_custom_actions=None, stateless_default_actions=None, stateless_fragment_default_actions=None, stateless_rule_group_references=None, tls_inspection_configuration_arn=None)

Bases: object

The traffic filtering behavior of a firewall policy, defined in a collection of stateless and stateful rule groups and other settings.

Parameters:

enable_tls_session_holding (Union[bool, IResolvable, None]) – When true, prevents TCP and TLS packets from reaching destination servers until TLS Inspection has evaluated Server Name Indication (SNI) rules. Requires an associated TLS Inspection configuration.
policy_variables (Union[IResolvable, PolicyVariablesProperty, Dict[str, Any], None]) – Contains variables that you can use to override default Suricata settings in your firewall policy.
stateful_default_actions (Optional[Sequence[str]]) – The default actions to take on a packet that doesn’t match any stateful rules. The stateful default action is optional, and is only valid when using the strict rule order. Valid values of the stateful default action: - aws:drop_strict - aws:drop_established - aws:alert_strict - aws:alert_established For more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .
stateful_engine_options (Union[IResolvable, StatefulEngineOptionsProperty, Dict[str, Any], None]) – Additional options governing how Network Firewall handles stateful rules. The stateful rule groups that you use in your policy must have stateful rule options settings that are compatible with these settings.
stateful_rule_group_references (Union[IResolvable, Sequence[Union[IResolvable, StatefulRuleGroupReferenceProperty, Dict[str, Any]]], None]) – References to the stateful rule groups that are used in the policy. These define the inspection criteria in stateful rules.
stateless_custom_actions (Union[IResolvable, Sequence[Union[IResolvable, CustomActionProperty, Dict[str, Any]]], None]) – The custom action definitions that are available for use in the firewall policy’s StatelessDefaultActions setting. You name each custom action that you define, and then you can use it by name in your default actions specifications.
stateless_default_actions (Optional[Sequence[str]]) – The actions to take on a packet if it doesn’t match any of the stateless rules in the policy. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe . You must specify one of the standard actions: aws:pass , aws:drop , or aws:forward_to_sfe . In addition, you can specify custom actions that are compatible with your standard section choice. For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”] . For information about compatibility, see the custom action descriptions.
stateless_fragment_default_actions (Optional[Sequence[str]]) – The actions to take on a fragmented packet if it doesn’t match any of the stateless rules in the policy. If you want non-matching fragmented packets to be forwarded for stateful inspection, specify aws:forward_to_sfe . You must specify one of the standard actions: aws:pass , aws:drop , or aws:forward_to_sfe . In addition, you can specify custom actions that are compatible with your standard section choice. For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”] . For information about compatibility, see the custom action descriptions.
stateless_rule_group_references (Union[IResolvable, Sequence[Union[IResolvable, StatelessRuleGroupReferenceProperty, Dict[str, Any]]], None]) – References to the stateless rule groups that are used in the policy. These define the matching criteria in stateless rules.
tls_inspection_configuration_arn (Optional[str]) – The Amazon Resource Name (ARN) of the TLS inspection configuration.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_networkfirewall import mixins as networkfirewall_mixins

firewall_policy_property = networkfirewall_mixins.CfnFirewallPolicyPropsMixin.FirewallPolicyProperty(
    enable_tls_session_holding=False,
    policy_variables=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.PolicyVariablesProperty(
        rule_variables={
            "rule_variables_key": {
                "definition": ["definition"]
            }
        }
    ),
    stateful_default_actions=["statefulDefaultActions"],
    stateful_engine_options=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.StatefulEngineOptionsProperty(
        flow_timeouts=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.FlowTimeoutsProperty(
            tcp_idle_timeout_seconds=123
        ),
        rule_order="ruleOrder",
        stream_exception_policy="streamExceptionPolicy"
    ),
    stateful_rule_group_references=[networkfirewall_mixins.CfnFirewallPolicyPropsMixin.StatefulRuleGroupReferenceProperty(
        deep_threat_inspection=False,
        override=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.StatefulRuleGroupOverrideProperty(
            action="action"
        ),
        priority=123,
        resource_arn="resourceArn"
    )],
    stateless_custom_actions=[networkfirewall_mixins.CfnFirewallPolicyPropsMixin.CustomActionProperty(
        action_definition=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.ActionDefinitionProperty(
            publish_metric_action=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.PublishMetricActionProperty(
                dimensions=[networkfirewall_mixins.CfnFirewallPolicyPropsMixin.DimensionProperty(
                    value="value"
                )]
            )
        ),
        action_name="actionName"
    )],
    stateless_default_actions=["statelessDefaultActions"],
    stateless_fragment_default_actions=["statelessFragmentDefaultActions"],
    stateless_rule_group_references=[networkfirewall_mixins.CfnFirewallPolicyPropsMixin.StatelessRuleGroupReferenceProperty(
        priority=123,
        resource_arn="resourceArn"
    )],
    tls_inspection_configuration_arn="tlsInspectionConfigurationArn"
)

Attributes

enable_tls_session_holding

When true, prevents TCP and TLS packets from reaching destination servers until TLS Inspection has evaluated Server Name Indication (SNI) rules.

Requires an associated TLS Inspection configuration.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-enabletlssessionholding

policy_variables

Contains variables that you can use to override default Suricata settings in your firewall policy.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-policyvariables

stateful_default_actions

The default actions to take on a packet that doesn’t match any stateful rules.

The stateful default action is optional, and is only valid when using the strict rule order.

Valid values of the stateful default action:

aws:drop_strict
aws:drop_established
aws:alert_strict
aws:alert_established

For more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statefuldefaultactions

stateful_engine_options

Additional options governing how Network Firewall handles stateful rules.

The stateful rule groups that you use in your policy must have stateful rule options settings that are compatible with these settings.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statefulengineoptions

stateful_rule_group_references

References to the stateful rule groups that are used in the policy.

These define the inspection criteria in stateful rules.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statefulrulegroupreferences

stateless_custom_actions

The custom action definitions that are available for use in the firewall policy’s StatelessDefaultActions setting.

You name each custom action that you define, and then you can use it by name in your default actions specifications.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statelesscustomactions

stateless_default_actions

The actions to take on a packet if it doesn’t match any of the stateless rules in the policy.

If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe .

You must specify one of the standard actions: aws:pass , aws:drop , or aws:forward_to_sfe . In addition, you can specify custom actions that are compatible with your standard section choice.

For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”] . For information about compatibility, see the custom action descriptions.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statelessdefaultactions

stateless_fragment_default_actions

The actions to take on a fragmented packet if it doesn’t match any of the stateless rules in the policy.

If you want non-matching fragmented packets to be forwarded for stateful inspection, specify aws:forward_to_sfe .

You must specify one of the standard actions: aws:pass , aws:drop , or aws:forward_to_sfe . In addition, you can specify custom actions that are compatible with your standard section choice.

For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”] . For information about compatibility, see the custom action descriptions.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statelessfragmentdefaultactions

stateless_rule_group_references

References to the stateless rule groups that are used in the policy.

These define the matching criteria in stateless rules.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-statelessrulegroupreferences

tls_inspection_configuration_arn

The Amazon Resource Name (ARN) of the TLS inspection configuration.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-firewallpolicy.html#cfn-networkfirewall-firewallpolicy-firewallpolicy-tlsinspectionconfigurationarn

FlowTimeoutsProperty

class CfnFirewallPolicyPropsMixin.FlowTimeoutsProperty(*, tcp_idle_timeout_seconds=None)

Bases: object

Describes the amount of time that can pass without any traffic sent through the firewall before the firewall determines that the connection is idle and Network Firewall removes the flow entry from its flow table.

Existing connections and flows are not impacted when you update this value. Only new connections after you update this value are impacted.

Parameters:: tcp_idle_timeout_seconds (Union[int, float, None]) – The number of seconds that can pass without any TCP traffic sent through the firewall before the firewall determines that the connection is idle. After the idle timeout passes, data packets are dropped, however, the next TCP SYN packet is considered a new flow and is processed by the firewall. Clients or targets can use TCP keepalive packets to reset the idle timeout. You can define the TcpIdleTimeoutSeconds value to be between 60 and 6000 seconds. If no value is provided, it defaults to 350 seconds.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-flowtimeouts.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_networkfirewall import mixins as networkfirewall_mixins

flow_timeouts_property = networkfirewall_mixins.CfnFirewallPolicyPropsMixin.FlowTimeoutsProperty(
    tcp_idle_timeout_seconds=123
)

Attributes

tcp_idle_timeout_seconds

The number of seconds that can pass without any TCP traffic sent through the firewall before the firewall determines that the connection is idle.

After the idle timeout passes, data packets are dropped, however, the next TCP SYN packet is considered a new flow and is processed by the firewall. Clients or targets can use TCP keepalive packets to reset the idle timeout.

You can define the TcpIdleTimeoutSeconds value to be between 60 and 6000 seconds. If no value is provided, it defaults to 350 seconds.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-flowtimeouts.html#cfn-networkfirewall-firewallpolicy-flowtimeouts-tcpidletimeoutseconds

IPSetProperty

class CfnFirewallPolicyPropsMixin.IPSetProperty(*, definition=None)

Bases: object

A list of IP addresses and address ranges, in CIDR notation.

This is part of a rule variable.

Parameters:: definition (Optional[Sequence[str]]) – The list of IP addresses and address ranges, in CIDR notation.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-ipset.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_networkfirewall import mixins as networkfirewall_mixins

i_pSet_property = {
    "definition": ["definition"]
}

Attributes

definition

The list of IP addresses and address ranges, in CIDR notation.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-ipset.html#cfn-networkfirewall-firewallpolicy-ipset-definition

PolicyVariablesProperty

class CfnFirewallPolicyPropsMixin.PolicyVariablesProperty(*, rule_variables=None)

Bases: object

Contains variables that you can use to override default Suricata settings in your firewall policy.

Parameters:: rule_variables (Union[IResolvable, Mapping[str, Union[IResolvable, IPSetProperty, Dict[str, Any]]], None]) – The IPv4 or IPv6 addresses in CIDR notation to use for the Suricata HOME_NET variable. If your firewall uses an inspection VPC, you might want to override the HOME_NET variable with the CIDRs of your home networks. If you don’t override HOME_NET with your own CIDRs, Network Firewall by default uses the CIDR of your inspection VPC.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-policyvariables.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_networkfirewall import mixins as networkfirewall_mixins

policy_variables_property = networkfirewall_mixins.CfnFirewallPolicyPropsMixin.PolicyVariablesProperty(
    rule_variables={
        "rule_variables_key": {
            "definition": ["definition"]
        }
    }
)

Attributes

rule_variables

The IPv4 or IPv6 addresses in CIDR notation to use for the Suricata HOME_NET variable.

If your firewall uses an inspection VPC, you might want to override the HOME_NET variable with the CIDRs of your home networks. If you don’t override HOME_NET with your own CIDRs, Network Firewall by default uses the CIDR of your inspection VPC.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-policyvariables.html#cfn-networkfirewall-firewallpolicy-policyvariables-rulevariables

PublishMetricActionProperty

class CfnFirewallPolicyPropsMixin.PublishMetricActionProperty(*, dimensions=None)

Bases: object

Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet.

This setting defines a CloudWatch dimension value to be published.

Parameters:: dimensions (Union[IResolvable, Sequence[Union[IResolvable, DimensionProperty, Dict[str, Any]]], None])
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-publishmetricaction.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_networkfirewall import mixins as networkfirewall_mixins

publish_metric_action_property = networkfirewall_mixins.CfnFirewallPolicyPropsMixin.PublishMetricActionProperty(
    dimensions=[networkfirewall_mixins.CfnFirewallPolicyPropsMixin.DimensionProperty(
        value="value"
    )]
)

Attributes

dimensions

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-publishmetricaction.html#cfn-networkfirewall-firewallpolicy-publishmetricaction-dimensions

Type:: see

StatefulEngineOptionsProperty

class CfnFirewallPolicyPropsMixin.StatefulEngineOptionsProperty(*, flow_timeouts=None, rule_order=None, stream_exception_policy=None)

Bases: object

Configuration settings for the handling of the stateful rule groups in a firewall policy.

Parameters:

flow_timeouts (Union[IResolvable, FlowTimeoutsProperty, Dict[str, Any], None]) – Configures the amount of time that can pass without any traffic sent through the firewall before the firewall determines that the connection is idle.
rule_order (Optional[str]) – Indicates how to manage the order of stateful rule evaluation for the policy. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .
stream_exception_policy (Optional[str]) – Configures how Network Firewall processes traffic when a network connection breaks midstream. Network connections can break due to disruptions in external networks or within the firewall itself. - DROP - Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior. - CONTINUE - Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule to drop http traffic, Network Firewall won’t match the traffic for this rule because the service won’t have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using a flow:stateless rule would still match, as would the aws:drop_strict default action. - REJECT - Network Firewall fails closed and drops all subsequent traffic going to the firewall. Network Firewall also sends a TCP reject packet back to your client so that the client can immediately establish a new session. Network Firewall will have context about the new session and will apply rules to the subsequent traffic.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulengineoptions.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_networkfirewall import mixins as networkfirewall_mixins

stateful_engine_options_property = networkfirewall_mixins.CfnFirewallPolicyPropsMixin.StatefulEngineOptionsProperty(
    flow_timeouts=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.FlowTimeoutsProperty(
        tcp_idle_timeout_seconds=123
    ),
    rule_order="ruleOrder",
    stream_exception_policy="streamExceptionPolicy"
)

Attributes

flow_timeouts

Configures the amount of time that can pass without any traffic sent through the firewall before the firewall determines that the connection is idle.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulengineoptions.html#cfn-networkfirewall-firewallpolicy-statefulengineoptions-flowtimeouts

rule_order

Indicates how to manage the order of stateful rule evaluation for the policy.

DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulengineoptions.html#cfn-networkfirewall-firewallpolicy-statefulengineoptions-ruleorder

stream_exception_policy

Configures how Network Firewall processes traffic when a network connection breaks midstream.

Network connections can break due to disruptions in external networks or within the firewall itself.

DROP - Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior.
CONTINUE - Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule to drop http traffic, Network Firewall won’t match the traffic for this rule because the service won’t have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using a flow:stateless rule would still match, as would the aws:drop_strict default action.
REJECT - Network Firewall fails closed and drops all subsequent traffic going to the firewall. Network Firewall also sends a TCP reject packet back to your client so that the client can immediately establish a new session. Network Firewall will have context about the new session and will apply rules to the subsequent traffic.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulengineoptions.html#cfn-networkfirewall-firewallpolicy-statefulengineoptions-streamexceptionpolicy

StatefulRuleGroupOverrideProperty

class CfnFirewallPolicyPropsMixin.StatefulRuleGroupOverrideProperty(*, action=None)

Bases: object

The setting that allows the policy owner to change the behavior of the rule group within a policy.

Parameters:: action (Optional[str]) – The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulrulegroupoverride.html
ExampleMetadata:: fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_networkfirewall import mixins as networkfirewall_mixins

stateful_rule_group_override_property = networkfirewall_mixins.CfnFirewallPolicyPropsMixin.StatefulRuleGroupOverrideProperty(
    action="action"
)

Attributes

action

The action that changes the rule group from DROP to ALERT .

This only applies to managed rule groups.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulrulegroupoverride.html#cfn-networkfirewall-firewallpolicy-statefulrulegroupoverride-action

StatefulRuleGroupReferenceProperty

class CfnFirewallPolicyPropsMixin.StatefulRuleGroupReferenceProperty(*, deep_threat_inspection=None, override=None, priority=None, resource_arn=None)

Bases: object

Identifier for a single stateful rule group, used in a firewall policy to refer to a rule group.

Parameters:

deep_threat_inspection (Union[bool, IResolvable, None]) – AWS Network Firewall plans to augment the active threat defense managed rule group with an additional deep threat inspection capability. When this capability is released, AWS will analyze service logs of network traffic processed by these rule groups to identify threat indicators across customers. AWS will use these threat indicators to improve the active threat defense managed rule groups and protect the security of AWS customers and services. .. epigraph:: Customers can opt-out of deep threat inspection at any time through the AWS Network Firewall console or API. When customers opt out, AWS Network Firewall will not use the network traffic processed by those customers’ active threat defense rule groups for rule group improvement.
override (Union[IResolvable, StatefulRuleGroupOverrideProperty, Dict[str, Any], None]) – The action that allows the policy owner to override the behavior of the rule group within a policy.
priority (Union[int, float, None]) – An integer setting that indicates the order in which to run the stateful rule groups in a single firewall policy. This setting only applies to firewall policies that specify the STRICT_ORDER rule order in the stateful engine options settings. Network Firewall evalutes each stateful rule group against a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy. You can change the priority settings of your rule groups at any time. To make it easier to insert rule groups later, number them so there’s a wide range in between, for example use 100, 200, and so on.
resource_arn (Optional[str]) – The Amazon Resource Name (ARN) of the stateful rule group.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulrulegroupreference.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_networkfirewall import mixins as networkfirewall_mixins

stateful_rule_group_reference_property = networkfirewall_mixins.CfnFirewallPolicyPropsMixin.StatefulRuleGroupReferenceProperty(
    deep_threat_inspection=False,
    override=networkfirewall_mixins.CfnFirewallPolicyPropsMixin.StatefulRuleGroupOverrideProperty(
        action="action"
    ),
    priority=123,
    resource_arn="resourceArn"
)

Attributes

deep_threat_inspection

AWS Network Firewall plans to augment the active threat defense managed rule group with an additional deep threat inspection capability.

When this capability is released, AWS will analyze service logs of network traffic processed by these rule groups to identify threat indicators across customers. AWS will use these threat indicators to improve the active threat defense managed rule groups and protect the security of AWS customers and services. .. epigraph:

Customers can opt-out of deep threat inspection at any time through the AWS Network Firewall console or API. When customers opt out, AWS Network Firewall will not use the network traffic processed by those customers' active threat defense rule groups for rule group improvement.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulrulegroupreference.html#cfn-networkfirewall-firewallpolicy-statefulrulegroupreference-deepthreatinspection

override

The action that allows the policy owner to override the behavior of the rule group within a policy.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulrulegroupreference.html#cfn-networkfirewall-firewallpolicy-statefulrulegroupreference-override

priority

An integer setting that indicates the order in which to run the stateful rule groups in a single firewall policy.

This setting only applies to firewall policies that specify the STRICT_ORDER rule order in the stateful engine options settings.

Network Firewall evalutes each stateful rule group against a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy.

You can change the priority settings of your rule groups at any time. To make it easier to insert rule groups later, number them so there’s a wide range in between, for example use 100, 200, and so on.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulrulegroupreference.html#cfn-networkfirewall-firewallpolicy-statefulrulegroupreference-priority

resource_arn

The Amazon Resource Name (ARN) of the stateful rule group.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statefulrulegroupreference.html#cfn-networkfirewall-firewallpolicy-statefulrulegroupreference-resourcearn

StatelessRuleGroupReferenceProperty

class CfnFirewallPolicyPropsMixin.StatelessRuleGroupReferenceProperty(*, priority=None, resource_arn=None)

Bases: object

Identifier for a single stateless rule group, used in a firewall policy to refer to the rule group.

Parameters:

priority (Union[int, float, None]) – An integer setting that indicates the order in which to run the stateless rule groups in a single firewall policy. Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy.
resource_arn (Optional[str]) – The Amazon Resource Name (ARN) of the stateless rule group.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statelessrulegroupreference.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk.mixins_preview.aws_networkfirewall import mixins as networkfirewall_mixins

stateless_rule_group_reference_property = networkfirewall_mixins.CfnFirewallPolicyPropsMixin.StatelessRuleGroupReferenceProperty(
    priority=123,
    resource_arn="resourceArn"
)

Attributes

priority

An integer setting that indicates the order in which to run the stateless rule groups in a single firewall policy.

Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statelessrulegroupreference.html#cfn-networkfirewall-firewallpolicy-statelessrulegroupreference-priority

resource_arn

The Amazon Resource Name (ARN) of the stateless rule group.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-firewallpolicy-statelessrulegroupreference.html#cfn-networkfirewall-firewallpolicy-statelessrulegroupreference-resourcearn