[ aws . network-firewall ]
create-firewall-policy-v2¶
Description¶
Creates a Next Generation policy according to the specifications.
A Next Generation policy defines the behavior of a firewall in a collection of firewall engine and IPS engine rule groups and other settings. You can use one firewall policy for multiple firewalls. For more information, see Next Generation policies in the Network Firewall Developer Guide .
See also: AWS API Documentation
Synopsis¶
create-firewall-policy-v2
--firewall-policy-v2-name <value>
--firewall-policy-v2 <value>
[--description <value>]
[--tags <value>]
[--dry-run | --no-dry-run]
[--encryption-configuration <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]
[--cli-error-format <value>]
[--help]
Options¶
--firewall-policy-v2-name (string) [required]
The descriptive name of the Next Generation policy. You can’t change the name of a firewall policy after you create it.
Constraints:
- min:
1- max:
128- pattern:
^[a-zA-Z0-9-]+$
--firewall-policy-v2 (structure) [required]
The rule groups and other settings that define the Next Generation policy.
FirewallRuleGroupEntries -> (list)
The firewall section of the policy—the rule groups that the firewall engine evaluates. Each entry references an existing firewall engine rule group or embeds a rule group directly in the policy, and each entry has a unique priority that sets its evaluation order within the section.
(structure)
A single entry in the firewall section of a Next Generation policy. An entry either references an existing firewall engine rule group by ARN or embeds a rule group directly in the policy, and it carries the priority that sets the rule group’s evaluation order within the firewall section.
Priority -> (integer)
The priority of the rule group entry within the firewall section. Network Firewall evaluates the firewall section’s entries in order of increasing priority value. Each entry in the firewall section must have a unique priority.
Constraints:
- min:
1- max:
65535ResourceArn -> (string)
The Amazon Resource Name (ARN) of an existing firewall engine rule group to reference in this entry. Provide either
ResourceArnto reference an existing rule group orInlineRuleGroupto embed a rule group in the policy.Constraints:
- min:
1- max:
256- pattern:
^arn:aws.*InlineRuleGroup -> (structure)
A firewall engine rule group defined directly in the policy, instead of referenced by ARN. Provide either
InlineRuleGroupto embed a rule group orResourceArnto reference an existing rule group. An embedded rule group can’t use a domain list rules source; to filter on a domain list, reference a standalone rule group by ARN instead.RulesSource -> (structure) [required]
The stateful inspection criteria for the firewall engine rule group.
RulesString -> (string)
Firewall engine rules, provided as a single Suricata-compatible rule string in firewall mode. Use this to provide rules that you’ve already written in the Suricata firewall-mode format. For the rule format, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide .
Constraints:
- min:
0- max:
2000000FirewallRules -> (list)
An array of individual firewall engine rules, provided as structured rules rather than as a rule string.
(structure)
A single structured firewall engine rule, for use in a firewall engine rule group or as an embedded rule in a Next Generation policy. A firewall rule accepts, drops, or rejects traffic at a connection-state hook. For more information about authoring firewall engine rules, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide .
Action -> (string) [required]
The action that the firewall engine takes on traffic that matches the rule. The firewall engine supports the following actions:
ACCEPT- Allow the traffic.DROP- Block the traffic and discontinue inspection.REJECT- Block the traffic and send a TCP reset packet back to the client.REJECT_DST- Block the traffic and send a TCP reset packet to the destination.REJECT_BOTH- Block the traffic and send a TCP reset packet to both the client and the destination.You combine the action with an action scope, for example
accept:flow. To send accepted traffic straight to its destination and skip the IPS engine, pair an accept action with theBypassIPSEnabledsetting. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide .Possible values:
ACCEPTDROPREJECTREJECT_DSTREJECT_BOTHActionScope -> (string) [required]
The scope that controls how much of the matched traffic the action applies to. The valid scopes depend on the action:
ACCEPTsupports all four scopes, andDROP,REJECT,REJECT_DST, andREJECT_BOTHsupport onlyPACKETandFLOW.
PACKET- The current packet only.HOOK- The current hook only. The firewall engine evaluates the connection again at the next hook.TX- The current transaction. The firewall engine continues to evaluate later transactions on the connection.FLOW- The entire connection. For an accept action, the connection skips the firewall engine’s remaining hooks and advances to the IPS engine.In a Suricata-compatible rule string, you write the scope in lowercase, for example
accept:flow.Possible values:
FLOWTXHOOKPACKETHook -> (string) [required]
The connection-state hook at which the firewall engine evaluates the rule. The hook encodes both the protocol and the connection state, for example a TCP hook or a TLS
client_hellohook. For the hooks that the firewall engine supports and how they map to the connection lifecycle, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide and the Suricata firewall mode documentation .Possible values:
TCP_ALLTCP_FLOW_STARTTCP_PRE_FLOWTCP_PRE_STREAMSCTP_ALLSCTP_FLOW_STARTSCTP_PRE_FLOWSCTP_PRE_STREAMIPV6_ALLIPV6_FLOW_STARTIPV6_PRE_FLOWIPV6_PRE_STREAMICMPV6_ALLICMPV6_FLOW_STARTICMPV6_PRE_FLOWICMPV6_PRE_STREAMUDP_ALLUDP_FLOW_STARTUDP_PRE_FLOWUDP_PRE_STREAMICMP_ALLICMP_FLOW_STARTICMP_PRE_FLOWICMP_PRE_STREAMICMPV4_ALLICMPV4_FLOW_STARTICMPV4_PRE_FLOWICMPV4_PRE_STREAMIP_ALLIP_FLOW_STARTIP_PRE_FLOWIP_PRE_STREAMIPV4_ALLIPV4_FLOW_STARTIPV4_PRE_FLOWIPV4_PRE_STREAMTLS_CLIENT_STARTEDTLS_CLIENT_HELLOTLS_CLIENT_CERTTLS_CLIENT_DATATLS_CLIENT_FINISHEDTLS_SERVER_STARTEDTLS_SERVER_HELLOTLS_SERVER_CERTTLS_SERVER_DATATLS_SERVER_FINISHEDHTTP1_REQUEST_STARTEDHTTP1_REQUEST_LINEHTTP1_REQUEST_HEADERSHTTP1_REQUEST_BODYHTTP1_REQUEST_TRAILERHTTP1_REQUEST_COMPLETEHTTP1_RESPONSE_STARTEDHTTP1_RESPONSE_LINEHTTP1_RESPONSE_HEADERSHTTP1_RESPONSE_BODYHTTP1_RESPONSE_TRAILERHTTP1_RESPONSE_COMPLETEHTTP2_STREAM_REQUEST_STARTEDHTTP2_STREAM_REQUEST_HEADERSHTTP2_STREAM_REQUEST_DATAHTTP2_STREAM_REQUEST_CLOSEDHTTP2_STREAM_REQUEST_COMPLETEHTTP2_STREAM_RESPONSE_STARTEDHTTP2_STREAM_RESPONSE_HEADERSHTTP2_STREAM_RESPONSE_DATAHTTP2_STREAM_RESPONSE_CLOSEDHTTP2_STREAM_RESPONSE_COMPLETEHTTP2_GLOBAL_REQUEST_STARTEDHTTP2_GLOBAL_REQUEST_COMPLETEHTTP2_GLOBAL_RESPONSE_STARTEDHTTP2_GLOBAL_RESPONSE_COMPLETEDOH2_STREAM_REQUEST_STARTEDDOH2_STREAM_REQUEST_HEADERSDOH2_STREAM_REQUEST_DATADOH2_STREAM_REQUEST_CLOSEDDOH2_STREAM_REQUEST_COMPLETEDOH2_STREAM_RESPONSE_STARTEDDOH2_STREAM_RESPONSE_HEADERSDOH2_STREAM_RESPONSE_DATADOH2_STREAM_RESPONSE_CLOSEDDOH2_STREAM_RESPONSE_COMPLETEDOH2_GLOBAL_REQUEST_STARTEDDOH2_GLOBAL_REQUEST_COMPLETEDOH2_GLOBAL_RESPONSE_STARTEDDOH2_GLOBAL_RESPONSE_COMPLETEDNS_REQUEST_STARTEDDNS_REQUEST_COMPLETEDNS_RESPONSE_STARTEDDNS_RESPONSE_COMPLETESMTP_REQUEST_STARTEDSMTP_REQUEST_DATASMTP_REQUEST_COMPLETESMTP_RESPONSE_STARTEDSMTP_RESPONSE_DATASMTP_RESPONSE_COMPLETEFTP_REQUEST_STARTEDFTP_REQUEST_COMPLETEFTP_RESPONSE_STARTEDFTP_RESPONSE_COMPLETEFTP_DATA_REQUEST_STARTEDFTP_DATA_REQUEST_COMPLETEFTP_DATA_RESPONSE_STARTEDFTP_DATA_RESPONSE_COMPLETESMB_REQUEST_STARTEDSMB_REQUEST_COMPLETESMB_RESPONSE_STARTEDSMB_RESPONSE_COMPLETEDCERPC_REQUEST_STARTEDDCERPC_REQUEST_COMPLETEDCERPC_RESPONSE_STARTEDDCERPC_RESPONSE_COMPLETENFS_REQUEST_STARTEDNFS_REQUEST_COMPLETENFS_RESPONSE_STARTEDNFS_RESPONSE_COMPLETEKRB5_REQUEST_STARTEDKRB5_REQUEST_COMPLETEKRB5_RESPONSE_STARTEDKRB5_RESPONSE_COMPLETEIKE_REQUEST_STARTEDIKE_REQUEST_COMPLETEIKE_RESPONSE_STARTEDIKE_RESPONSE_COMPLETETFTP_REQUEST_STARTEDTFTP_REQUEST_COMPLETETFTP_RESPONSE_STARTEDTFTP_RESPONSE_COMPLETEDHCP_REQUEST_STARTEDDHCP_REQUEST_COMPLETEDHCP_RESPONSE_STARTEDDHCP_RESPONSE_COMPLETEQUIC_REQUEST_STARTEDQUIC_REQUEST_COMPLETEQUIC_RESPONSE_STARTEDQUIC_RESPONSE_COMPLETERDP_REQUEST_STARTEDRDP_REQUEST_COMPLETERDP_RESPONSE_STARTEDRDP_RESPONSE_COMPLETERFB_REQUEST_STARTEDRFB_REQUEST_COMPLETERFB_RESPONSE_STARTEDRFB_RESPONSE_COMPLETEMQTT_REQUEST_STARTEDMQTT_REQUEST_COMPLETEMQTT_RESPONSE_STARTEDMQTT_RESPONSE_COMPLETEPGSQL_REQUEST_STARTEDPGSQL_REQUEST_COMPLETEPGSQL_RESPONSE_STARTEDPGSQL_RESPONSE_COMPLETESNMP_REQUEST_STARTEDSNMP_REQUEST_COMPLETESNMP_RESPONSE_STARTEDSNMP_RESPONSE_COMPLETENTP_REQUEST_STARTEDNTP_REQUEST_COMPLETENTP_RESPONSE_STARTEDNTP_RESPONSE_COMPLETETELNET_REQUEST_STARTEDTELNET_REQUEST_COMPLETETELNET_RESPONSE_STARTEDTELNET_RESPONSE_COMPLETEWEBSOCKET_REQUEST_STARTEDWEBSOCKET_REQUEST_COMPLETEWEBSOCKET_RESPONSE_STARTEDWEBSOCKET_RESPONSE_COMPLETELDAP_REQUEST_STARTEDLDAP_REQUEST_COMPLETELDAP_RESPONSE_STARTEDLDAP_RESPONSE_COMPLETEPOP3_REQUEST_STARTEDPOP3_REQUEST_COMPLETEPOP3_RESPONSE_STARTEDPOP3_RESPONSE_COMPLETEMDNS_REQUEST_STARTEDMDNS_REQUEST_COMPLETEMDNS_RESPONSE_STARTEDMDNS_RESPONSE_COMPLETEBITTORRENT_DHT_REQUEST_STARTEDBITTORRENT_DHT_REQUEST_COMPLETEBITTORRENT_DHT_RESPONSE_STARTEDBITTORRENT_DHT_RESPONSE_COMPLETEDNP3_REQUEST_STARTEDDNP3_REQUEST_COMPLETEDNP3_RESPONSE_STARTEDDNP3_RESPONSE_COMPLETESSH_REQUEST_IN_PROGRESSSSH_REQUEST_BANNER_WAIT_EOLSSH_REQUEST_BANNER_DONESSH_REQUEST_FINISHEDSSH_RESPONSE_IN_PROGRESSSSH_RESPONSE_BANNER_WAIT_EOLSSH_RESPONSE_BANNER_DONESSH_RESPONSE_FINISHEDProtocol -> (string) [required]
The protocol of the rule’s hook. The protocol is derived from the hook and must match the hook’s protocol prefix. Network Firewall rejects a rule whose protocol doesn’t match its hook.
Possible values:
IPTCPUDPICMPHTTPFTPTLSSMBDNSDCERPCSSHSMTPMSNKRB5IKEV2TFTPNTPDHCPHTTP2QUICICMPV4ICMPV6SCTPIPV4IPV6DOH2FTP_DATANFSRDPRFBMQTTPGSQLSNMPTELNETWEBSOCKETLDAPPOP3MDNSBITTORRENT_DHTDNP3SourceIPs -> (string)
The source IP addresses and address ranges to inspect for, in CIDR notation. A firewall rule always compiles to a forward-direction rule, so you express inbound compared to outbound traffic through the source and destination addresses.
Constraints:
- min:
1- max:
1024- pattern:
^.*$DestIPs -> (string)
The destination IP addresses and address ranges to inspect for, in CIDR notation. A firewall rule always compiles to a forward-direction rule, so you express inbound compared to outbound traffic through the source and destination addresses.
Constraints:
- min:
1- max:
1024- pattern:
^.*$SourcePorts -> (string)
The source ports to inspect for.
Constraints:
- min:
1- max:
1024- pattern:
^.*$DestPorts -> (string)
The destination ports to inspect for.
Constraints:
- min:
1- max:
1024- pattern:
^.*$RuleOptions -> (list)
Additional options for the rule. These are the Suricata
RuleOptionssettings, such as the signature ID (sid) and match keywords.(structure)
Additional settings for a stateful rule. This is part of the StatefulRule configuration.
Keyword -> (string) [required]
The keyword for the Suricata compatible rule option. You must include a
sid(signature ID), and can optionally include other keywords. For information about Suricata compatible keywords, see Rule options in the Suricata documentation.Constraints:
- min:
1- max:
128- pattern:
.*Settings -> (list)
The settings of the Suricata compatible rule option. Rule options have zero or more setting values, and the number of possible and required settings depends on the
Keyword. For more information about the settings for specific options, see Rule options .(string)
Constraints:
- min:
1- max:
8192- pattern:
.*AcceptPriorHooks -> (boolean)
Whether Network Firewall automatically accepts the earlier application-layer hooks that a connection must pass to reach this rule’s hook. Because the firewall engine is drop by default, accepting prior hooks lets you author a single rule for the hook you care about, instead of also authoring a rule for each earlier hook. This setting accepts the earlier application-layer hooks only; it doesn’t accept the TCP layer. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide .AlertEnabled -> (boolean)
Specifies whether the rule also generates an alert log for the traffic that it matches. Turning on alerting adds a secondary alert action to the rule, so that Network Firewall logs the match in addition to taking the rule’s primary action.BypassIPSEnabled -> (boolean)
Specifies whether an accepted connection bypasses the IPS engine. By default, traffic that the firewall engine accepts advances to the IPS engine for threat inspection. When you turn on this setting for an accept rule, the accepted traffic goes straight to its destination without IPS inspection. You can set the bypass only on accept rules, and it uses the same scope as the rule’s accept action; only theflowandpacketscopes support a bypass. For more information, see Rule groups for a firewall using a Next Generation policy in the Network Firewall Developer Guide .RuleMetadata -> (structure)
Optional metadata for the rule: whether the rule is enabled and a description. Metadata doesn’t change how the rule matches or acts on traffic.
RuleEnabled -> (boolean)
Specifies whether the rule is active. The default isTRUE. When you set this toFALSE, Network Firewall keeps the rule in the rule group but doesn’t evaluate it against traffic and doesn’t count it toward the rule group’s consumed capacity.RuleDescription -> (string)
A description of the rule, up to 512 characters. The description can span multiple lines. A description line can’t itself look like a firewall rule; to disable a rule, set
RuleEnabledtoFALSEinstead.Constraints:
- max:
512- pattern:
[\s\S]*RulesSourceList -> (structure)
Stateful inspection criteria for a domain list, specified as the list of domain names that Network Firewall generates firewall engine rules from.
Targets -> (list) [required]
The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:
- Explicit names. For example,
abc.example.commatches only the domainabc.example.com.- Names that use a domain wildcard, which you indicate with an initial ‘
.‘. For example,``.example.com`` matchesexample.comand matches all subdomains ofexample.com, such asabc.example.comandwww.example.com.(string)
TargetTypes -> (list) [required]
The types of matching to perform against the domains in
Targets. You can specify any combination of the following:
AWS_ROUTE_53_RESOLVED_DOMAIN– Match the domain against the domain that the Amazon Route 53 Resolver resolved the connection’s destination IP address for.HTTP_HOST– Match the domain against theHostheader of HTTP traffic.TLS_SNI– Match the domain against the Server Name Indication (SNI) of HTTPS traffic.AWS_ROUTE_53_RESOLVED_DOMAINmatches on how the destination IP address was resolved, rather than on the domain that the client asserts in its TLS SNI or HTTPHostheader. This target type takes effect when you configure resolved IP validation on the firewall policy. For more information, see Route53ResolvedIPValidation .Whether you include
AWS_ROUTE_53_RESOLVED_DOMAINchanges what the generated rules match, together withGeneratedRulesType:
- Combining
AWS_ROUTE_53_RESOLVED_DOMAINwithTLS_SNIorHTTP_HOSTin anALLOWLISTrequires both conditions to match. The SNI orHostheader must match the domain, and the Route 53 Resolver must have resolved the destination IP address for that domain. Network Firewall allows traffic only in that case. Traffic that matches one condition, such as a spoofedHostheader sent to an unresolved IP address, is not allowed.- In a
DENYLIST, or whenAWS_ROUTE_53_RESOLVED_DOMAINis the only target type, Network Firewall evaluates each condition independently: a match on either the domain (SNI orHost) or the resolved destination IP address triggers the rule.- When you don’t include
AWS_ROUTE_53_RESOLVED_DOMAIN, the generated rules match only on the SNI orHostheader, without checking how the destination IP address was resolved.An
ALLOWLISTwhose only target type isAWS_ROUTE_53_RESOLVED_DOMAINis additive: it allows matching traffic but doesn’t generate a default rule that drops non-matching traffic. Only theTLS_SNIandHTTP_HOSTtarget types generate that default drop. To allow only the resolved domains and drop all other traffic, include a protocol target type as well.(string)
Possible values:
TLS_SNIHTTP_HOSTAWS_ROUTE_53_RESOLVED_DOMAINGeneratedRulesType -> (string) [required]
Whether you want to apply allow, reject, alert, or drop behavior to the domains in your target list.
Note
When logging is enabled and you choose Alert, traffic that matches the domain specifications generates an alert in the firewall’s logs. Then, traffic either passes, is rejected, or drops based on other rules in the firewall policy.Possible values:
ALLOWLISTDENYLISTREJECTLISTALERTLISTRuleVariables -> (structure)
Settings that are available for use in the rules in the firewall engine rule group, such as IP set and port variables that the rules reference.
IPSets -> (map)
A list of IP addresses and address ranges, in CIDR notation.
key -> (string)
Constraints:
- min:
1- max:
32- pattern:
^[A-Za-z][A-Za-z0-9_]*$value -> (structure)
A list of IP addresses and address ranges, in CIDR notation. This is part of a RuleVariables .
Definition -> (list) [required]
The list of IP addresses and address ranges, in CIDR notation.
(string)
Constraints:
- min:
1- pattern:
^.*$PortSets -> (map)
A list of port ranges.
key -> (string)
Constraints:
- min:
1- max:
32- pattern:
^[A-Za-z][A-Za-z0-9_]*$value -> (structure)
A set of port ranges for use in the rules in a rule group.
Definition -> (list)
The set of port ranges.
(string)
Constraints:
- min:
1- pattern:
^.*$ReferenceSets -> (structure)
The list of a rule group’s reference sets. Firewall engine rule groups don’t support IP set references (reference sets); this setting applies to IPS engine rule groups. To use CIDR ranges in firewall engine rules, use rule variables instead.
IPSetReferences -> (map)
The list of IP set references.
key -> (string)
Constraints:
- min:
1- max:
32- pattern:
^[A-Za-z][A-Za-z0-9_]*$value -> (structure)
Configures one or more IP set references for a Suricata-compatible rule group. This is used in CreateRuleGroup or UpdateRuleGroup . An IP set reference is a rule variable that references resources that you create and manage in another Amazon Web Services service, such as an Amazon VPC prefix list. Network Firewall IP set references enable you to dynamically update the contents of your rules. When you create, update, or delete the resource you are referencing in your rule, Network Firewall automatically updates the rule’s content with the changes. For more information about IP set references in Network Firewall, see Using IP set references in the Network Firewall Developer Guide .
Network Firewall currently supports Amazon VPC prefix lists and resource groups in IP set references.
ReferenceArn -> (string)
The Amazon Resource Name (ARN) of the resource that you are referencing in your rule group.
Constraints:
- min:
1- max:
256- pattern:
^arn:aws.*IpsRuleGroupEntries -> (list)
The IPS section of the policy—the rule groups that the IPS engine evaluates. Each entry references an existing IPS engine rule group or embeds a rule group directly in the policy. IPS section entries don’t use a priority.
(structure)
A single entry in the IPS section of a Next Generation policy. An entry either references an existing IPS engine rule group by ARN or embeds a rule group directly in the policy. IPS section entries don’t use a priority.
ResourceArn -> (string)
The Amazon Resource Name (ARN) of an existing IPS engine rule group to reference in this entry. Provide either
ResourceArnto reference an existing rule group orInlineRuleGroupto embed a rule group in the policy.Constraints:
- min:
1- max:
256- pattern:
^arn:aws.*InlineRuleGroup -> (structure)
An IPS engine rule group defined directly in the policy, instead of referenced by ARN. Provide either
InlineRuleGroupto embed a rule group orResourceArnto reference an existing rule group.RulesSource -> (structure) [required]
The stateful inspection criteria for the IPS engine rule group.
RulesString -> (string)
IPS engine rules, provided as a single Suricata-compatible rule string. For the rule format, see Rules Format on the Suricata website.
Constraints:
- min:
0- max:
2000000RuleVariables -> (structure)
Settings that are available for use in the rules in the IPS engine rule group.
IPSets -> (map)
A list of IP addresses and address ranges, in CIDR notation.
key -> (string)
Constraints:
- min:
1- max:
32- pattern:
^[A-Za-z][A-Za-z0-9_]*$value -> (structure)
A list of IP addresses and address ranges, in CIDR notation. This is part of a RuleVariables .
Definition -> (list) [required]
The list of IP addresses and address ranges, in CIDR notation.
(string)
Constraints:
- min:
1- pattern:
^.*$PortSets -> (map)
A list of port ranges.
key -> (string)
Constraints:
- min:
1- max:
32- pattern:
^[A-Za-z][A-Za-z0-9_]*$value -> (structure)
A set of port ranges for use in the rules in a rule group.
Definition -> (list)
The set of port ranges.
(string)
Constraints:
- min:
1- pattern:
^.*$ReferenceSets -> (structure)
The list of a rule group’s reference sets.
IPSetReferences -> (map)
The list of IP set references.
key -> (string)
Constraints:
- min:
1- max:
32- pattern:
^[A-Za-z][A-Za-z0-9_]*$value -> (structure)
Configures one or more IP set references for a Suricata-compatible rule group. This is used in CreateRuleGroup or UpdateRuleGroup . An IP set reference is a rule variable that references resources that you create and manage in another Amazon Web Services service, such as an Amazon VPC prefix list. Network Firewall IP set references enable you to dynamically update the contents of your rules. When you create, update, or delete the resource you are referencing in your rule, Network Firewall automatically updates the rule’s content with the changes. For more information about IP set references in Network Firewall, see Using IP set references in the Network Firewall Developer Guide .
Network Firewall currently supports Amazon VPC prefix lists and resource groups in IP set references.
ReferenceArn -> (string)
The Amazon Resource Name (ARN) of the resource that you are referencing in your rule group.
Constraints:
- min:
1- max:
256- pattern:
^arn:aws.*Override -> (structure)
The setting that allows the policy owner to change the behavior of the IPS engine rule group within this policy, such as changing a managed rule group’s action from
DROPtoALERT.Action -> (string)
The action that changes the rule group from
DROPtoALERT. This only applies to managed rule groups.Possible values:
DROP_TO_ALERTPolicyMode -> (string)
Indicates whether the policy’s engines enforce their verdicts or only report them. In
ENFORCEmode, the firewall engine and IPS engine apply their verdicts to traffic. InMONITORmode, the engines evaluate traffic and generate logs and metrics, but don’t block traffic, so you can observe how a policy would behave before you enforce it. For more information, see Next Generation policies in the Network Firewall Developer Guide .Possible values:
ENFORCEMONITORFirewallDefaultAction -> (string)
The action that the firewall engine takes on traffic that doesn’t match any firewall engine rule at a hook. The firewall engine is drop by default. You can set the default action to one of the following:
DROP- Block the traffic.ACCEPT- Allow the traffic.REJECT- Block the traffic and send a TCP reset packet back to the client.ALERT- Allow the traffic and generate an alert log for the traffic that reaches the default action at every hook. This is distinct from setting the policy mode toMONITOR.For more information, see Next Generation policies in the Network Firewall Developer Guide .
Possible values:
DROPACCEPTREJECTALERTStatefulEngineOptions -> (structure)
Additional options governing how the engines handle stateful traffic, such as the stream exception policy and flow timeouts.
StreamExceptionPolicy -> (string)
How Network Firewall handles traffic on a network connection that breaks midstream. A Next Generation policy supports
DROPandREJECT. For more information, see Stream exception policy options in your firewall policy in the Network Firewall Developer Guide .Possible values:
DROPREJECTFlowTimeouts -> (structure)
The amount of time that can pass without any traffic sent through the firewall before the firewall determines that the connection is idle.
TcpIdleTimeoutSeconds -> (integer)
The number of seconds that can pass without any TCP traffic sent through the firewall before the firewall determines that the connection is idle. After the idle timeout passes, data packets are dropped, however, the next TCP SYN packet is considered a new flow and is processed by the firewall. Clients or targets can use TCP keepalive packets to reset the idle timeout.
You can define the
TcpIdleTimeoutSecondsvalue to be between 60 and 6000 seconds. If no value is provided, it defaults to 350 seconds.TLSInspectionConfigurationArn -> (string)
The Amazon Resource Name (ARN) of the TLS inspection configuration to use to decrypt traffic for inspection. Next Generation policies support session holding only. For more information, see Inspecting SSL/TLS traffic with TLS inspection configurations in the Network Firewall Developer Guide .
Constraints:
- min:
1- max:
256- pattern:
^arn:aws.*PolicyVariables -> (structure)
Contains variables that you can use to override default Suricata settings in your Next Generation policy.
RuleVariables -> (map)
The IPv4 or IPv6 addresses in CIDR notation to use for the Suricata
HOME_NETvariable. If your firewall uses an inspection VPC, you might want to override theHOME_NETvariable with the CIDRs of your home networks. If you don’t overrideHOME_NETwith your own CIDRs, Network Firewall by default uses the CIDR of your inspection VPC.key -> (string)
Constraints:
- min:
1- max:
32- pattern:
^[A-Za-z][A-Za-z0-9_]*$value -> (structure)
A list of IP addresses and address ranges, in CIDR notation. This is part of a RuleVariables .
Definition -> (list) [required]
The list of IP addresses and address ranges, in CIDR notation.
(string)
Constraints:
- min:
1- pattern:
^.*$Route53ResolvedIPValidation -> (structure)
The settings that enable resolved IP validation for the Next Generation policy. Resolved IP validation verifies that a connection’s destination IP address is one that the Amazon Route 53 Resolver returned in a DNS response for a domain. A VPC that’s associated with the Route 53 Resolver DNS Firewall rule group that you specify must send the response. This checks how the destination IP address was obtained, instead of relying only on the domain that the client asserts in its TLS Server Name Indication (SNI) or HTTP
Hostheader. For more information, see Route53ResolvedIPValidation .Action -> (string) [required]
The action that Network Firewall takes for a connection whose destination IP address fails resolved IP validation. A destination IP address fails validation when the Route 53 Resolver didn’t return it in a DNS response in an associated VPC. Valid values are the following:
ALERT– Tags the matching connection in the firewall’s flow logs without blocking it, when you enable logging. Use this to observe the effect of resolved IP validation before you enforce it.DROP– Silently blocks the connection without sending any response to the client.REJECT– Blocks the connection and sends a TCP reset (RST) to the client. Because a TCP reset applies only to TCP connections, Network Firewall drops non-TCP traffic instead of resetting it.Possible values:
REJECTDROPALERTDNSFirewallRuleGroupId -> (string) [required]
The ID of the Route 53 Resolver DNS Firewall rule group that determines which VPCs’ DNS resolutions count for resolved IP validation. A destination IP address counts as resolved for a domain only when the Route 53 Resolver returned it in a DNS response within a VPC that’s associated with this rule group. Associate the rule group with the VPCs that send traffic to the firewall. The ID must match the pattern
^rslvr-frg-[0-9a-f]+$. It must also exist and be accessible from your account. Network Firewall validates this when you create or update the policy.Changing this value swaps the managed rule group association. Network Firewall processes the swap asynchronously. Each policy can have only one managed Route 53 Resolver DNS Firewall association. While a swap is in progress, Network Firewall rejects further changes to this setting. Wait until the swap completes, then retry. The change may also require a restart of the stateful engine. When this occurs, existing connections will be treated according to your stream exception policy configuration.
Constraints:
- min:
1- max:
256- pattern:
^rslvr-frg-[0-9a-f]+$DNSExpiryExceptionPolicy -> (string) [required]
The action that Network Firewall takes when the DNS resolution recorded for a destination IP address has expired from the resolved IP cache. This applies when Network Firewall still sees traffic to that IP address after the expiry. Network Firewall keeps a resolution for longer than the DNS record’s time to live (TTL). Valid values are the following:
CONTINUE– Treats the expired resolution as still valid and doesn’t block the connection because of expiry.DROP– Silently blocks traffic to the IP address after its resolution has expired, without sending any response to the client.REJECT– Blocks traffic to the IP address after its resolution has expired and sends a TCP reset (RST) to the client. Network Firewall drops non-TCP traffic instead of resetting it.Possible values:
REJECTDROPCONTINUEBypassDestinationValidationIPRanges -> (list)
The destination IP address ranges that are exempt from the policy-level resolved IP check. Network Firewall doesn’t apply the
Actionin this configuration to a connection whose destination falls in these ranges, even if the Route 53 Resolver didn’t return that IP address in an associated VPC. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries.This exemption applies only to the policy-level check. Stateful rules that use the
AWS_ROUTE_53_RESOLVED_DOMAINtarget type or theaws_route_53_resolved_domainkeyword still evaluate connections to these destinations and match them independently of this list.Constraints:
- min:
0- max:
100(structure)
A single IP address specification. This is used in the MatchAttributes source and destination specifications.
AddressDefinition -> (string) [required]
Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.
Examples:
- To configure Network Firewall to inspect for the IP address 192.0.2.44, specify
192.0.2.44/32.- To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify
192.0.2.0/24.- To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify
1111:0000:0000:0000:0000:0000:0000:0111/128.- To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify
1111:0000:0000:0000:0000:0000:0000:0000/64.For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .
Constraints:
- min:
1- max:
255- pattern:
^([a-fA-F\d:\.]+($|/\d{1,3}))$SourceIPRanges -> (list)
The client source IP address ranges whose connections are subject to resolved IP validation. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries. If you omit this field, resolved IP validation applies to the CIDR ranges of the firewall’s VPC and of any additional VPCs attached to the firewall. Specifying an empty list is not the same as omitting the field: an empty list means that Network Firewall doesn’t validate any source addresses.
This scope applies to the policy-level check only. Stateful rules that use the
AWS_ROUTE_53_RESOLVED_DOMAINtarget type or theaws_route_53_resolved_domainkeyword still evaluate their destinations regardless ofSourceIPRanges.Constraints:
- min:
0- max:
100(structure)
A single IP address specification. This is used in the MatchAttributes source and destination specifications.
AddressDefinition -> (string) [required]
Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.
Examples:
- To configure Network Firewall to inspect for the IP address 192.0.2.44, specify
192.0.2.44/32.- To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify
192.0.2.0/24.- To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify
1111:0000:0000:0000:0000:0000:0000:0111/128.- To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify
1111:0000:0000:0000:0000:0000:0000:0000/64.For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .
Constraints:
- min:
1- max:
255- pattern:
^([a-fA-F\d:\.]+($|/\d{1,3}))$
JSON Syntax:
{
"FirewallRuleGroupEntries": [
{
"Priority": integer,
"ResourceArn": "string",
"InlineRuleGroup": {
"RulesSource": {
"RulesString": "string",
"FirewallRules": [
{
"Action": "ACCEPT"|"DROP"|"REJECT"|"REJECT_DST"|"REJECT_BOTH",
"ActionScope": "FLOW"|"TX"|"HOOK"|"PACKET",
"Hook": "TCP_ALL"|"TCP_FLOW_START"|"TCP_PRE_FLOW"|"TCP_PRE_STREAM"|"SCTP_ALL"|"SCTP_FLOW_START"|"SCTP_PRE_FLOW"|"SCTP_PRE_STREAM"|"IPV6_ALL"|"IPV6_FLOW_START"|"IPV6_PRE_FLOW"|"IPV6_PRE_STREAM"|"ICMPV6_ALL"|"ICMPV6_FLOW_START"|"ICMPV6_PRE_FLOW"|"ICMPV6_PRE_STREAM"|"UDP_ALL"|"UDP_FLOW_START"|"UDP_PRE_FLOW"|"UDP_PRE_STREAM"|"ICMP_ALL"|"ICMP_FLOW_START"|"ICMP_PRE_FLOW"|"ICMP_PRE_STREAM"|"ICMPV4_ALL"|"ICMPV4_FLOW_START"|"ICMPV4_PRE_FLOW"|"ICMPV4_PRE_STREAM"|"IP_ALL"|"IP_FLOW_START"|"IP_PRE_FLOW"|"IP_PRE_STREAM"|"IPV4_ALL"|"IPV4_FLOW_START"|"IPV4_PRE_FLOW"|"IPV4_PRE_STREAM"|"TLS_CLIENT_STARTED"|"TLS_CLIENT_HELLO"|"TLS_CLIENT_CERT"|"TLS_CLIENT_DATA"|"TLS_CLIENT_FINISHED"|"TLS_SERVER_STARTED"|"TLS_SERVER_HELLO"|"TLS_SERVER_CERT"|"TLS_SERVER_DATA"|"TLS_SERVER_FINISHED"|"HTTP1_REQUEST_STARTED"|"HTTP1_REQUEST_LINE"|"HTTP1_REQUEST_HEADERS"|"HTTP1_REQUEST_BODY"|"HTTP1_REQUEST_TRAILER"|"HTTP1_REQUEST_COMPLETE"|"HTTP1_RESPONSE_STARTED"|"HTTP1_RESPONSE_LINE"|"HTTP1_RESPONSE_HEADERS"|"HTTP1_RESPONSE_BODY"|"HTTP1_RESPONSE_TRAILER"|"HTTP1_RESPONSE_COMPLETE"|"HTTP2_STREAM_REQUEST_STARTED"|"HTTP2_STREAM_REQUEST_HEADERS"|"HTTP2_STREAM_REQUEST_DATA"|"HTTP2_STREAM_REQUEST_CLOSED"|"HTTP2_STREAM_REQUEST_COMPLETE"|"HTTP2_STREAM_RESPONSE_STARTED"|"HTTP2_STREAM_RESPONSE_HEADERS"|"HTTP2_STREAM_RESPONSE_DATA"|"HTTP2_STREAM_RESPONSE_CLOSED"|"HTTP2_STREAM_RESPONSE_COMPLETE"|"HTTP2_GLOBAL_REQUEST_STARTED"|"HTTP2_GLOBAL_REQUEST_COMPLETE"|"HTTP2_GLOBAL_RESPONSE_STARTED"|"HTTP2_GLOBAL_RESPONSE_COMPLETE"|"DOH2_STREAM_REQUEST_STARTED"|"DOH2_STREAM_REQUEST_HEADERS"|"DOH2_STREAM_REQUEST_DATA"|"DOH2_STREAM_REQUEST_CLOSED"|"DOH2_STREAM_REQUEST_COMPLETE"|"DOH2_STREAM_RESPONSE_STARTED"|"DOH2_STREAM_RESPONSE_HEADERS"|"DOH2_STREAM_RESPONSE_DATA"|"DOH2_STREAM_RESPONSE_CLOSED"|"DOH2_STREAM_RESPONSE_COMPLETE"|"DOH2_GLOBAL_REQUEST_STARTED"|"DOH2_GLOBAL_REQUEST_COMPLETE"|"DOH2_GLOBAL_RESPONSE_STARTED"|"DOH2_GLOBAL_RESPONSE_COMPLETE"|"DNS_REQUEST_STARTED"|"DNS_REQUEST_COMPLETE"|"DNS_RESPONSE_STARTED"|"DNS_RESPONSE_COMPLETE"|"SMTP_REQUEST_STARTED"|"SMTP_REQUEST_DATA"|"SMTP_REQUEST_COMPLETE"|"SMTP_RESPONSE_STARTED"|"SMTP_RESPONSE_DATA"|"SMTP_RESPONSE_COMPLETE"|"FTP_REQUEST_STARTED"|"FTP_REQUEST_COMPLETE"|"FTP_RESPONSE_STARTED"|"FTP_RESPONSE_COMPLETE"|"FTP_DATA_REQUEST_STARTED"|"FTP_DATA_REQUEST_COMPLETE"|"FTP_DATA_RESPONSE_STARTED"|"FTP_DATA_RESPONSE_COMPLETE"|"SMB_REQUEST_STARTED"|"SMB_REQUEST_COMPLETE"|"SMB_RESPONSE_STARTED"|"SMB_RESPONSE_COMPLETE"|"DCERPC_REQUEST_STARTED"|"DCERPC_REQUEST_COMPLETE"|"DCERPC_RESPONSE_STARTED"|"DCERPC_RESPONSE_COMPLETE"|"NFS_REQUEST_STARTED"|"NFS_REQUEST_COMPLETE"|"NFS_RESPONSE_STARTED"|"NFS_RESPONSE_COMPLETE"|"KRB5_REQUEST_STARTED"|"KRB5_REQUEST_COMPLETE"|"KRB5_RESPONSE_STARTED"|"KRB5_RESPONSE_COMPLETE"|"IKE_REQUEST_STARTED"|"IKE_REQUEST_COMPLETE"|"IKE_RESPONSE_STARTED"|"IKE_RESPONSE_COMPLETE"|"TFTP_REQUEST_STARTED"|"TFTP_REQUEST_COMPLETE"|"TFTP_RESPONSE_STARTED"|"TFTP_RESPONSE_COMPLETE"|"DHCP_REQUEST_STARTED"|"DHCP_REQUEST_COMPLETE"|"DHCP_RESPONSE_STARTED"|"DHCP_RESPONSE_COMPLETE"|"QUIC_REQUEST_STARTED"|"QUIC_REQUEST_COMPLETE"|"QUIC_RESPONSE_STARTED"|"QUIC_RESPONSE_COMPLETE"|"RDP_REQUEST_STARTED"|"RDP_REQUEST_COMPLETE"|"RDP_RESPONSE_STARTED"|"RDP_RESPONSE_COMPLETE"|"RFB_REQUEST_STARTED"|"RFB_REQUEST_COMPLETE"|"RFB_RESPONSE_STARTED"|"RFB_RESPONSE_COMPLETE"|"MQTT_REQUEST_STARTED"|"MQTT_REQUEST_COMPLETE"|"MQTT_RESPONSE_STARTED"|"MQTT_RESPONSE_COMPLETE"|"PGSQL_REQUEST_STARTED"|"PGSQL_REQUEST_COMPLETE"|"PGSQL_RESPONSE_STARTED"|"PGSQL_RESPONSE_COMPLETE"|"SNMP_REQUEST_STARTED"|"SNMP_REQUEST_COMPLETE"|"SNMP_RESPONSE_STARTED"|"SNMP_RESPONSE_COMPLETE"|"NTP_REQUEST_STARTED"|"NTP_REQUEST_COMPLETE"|"NTP_RESPONSE_STARTED"|"NTP_RESPONSE_COMPLETE"|"TELNET_REQUEST_STARTED"|"TELNET_REQUEST_COMPLETE"|"TELNET_RESPONSE_STARTED"|"TELNET_RESPONSE_COMPLETE"|"WEBSOCKET_REQUEST_STARTED"|"WEBSOCKET_REQUEST_COMPLETE"|"WEBSOCKET_RESPONSE_STARTED"|"WEBSOCKET_RESPONSE_COMPLETE"|"LDAP_REQUEST_STARTED"|"LDAP_REQUEST_COMPLETE"|"LDAP_RESPONSE_STARTED"|"LDAP_RESPONSE_COMPLETE"|"POP3_REQUEST_STARTED"|"POP3_REQUEST_COMPLETE"|"POP3_RESPONSE_STARTED"|"POP3_RESPONSE_COMPLETE"|"MDNS_REQUEST_STARTED"|"MDNS_REQUEST_COMPLETE"|"MDNS_RESPONSE_STARTED"|"MDNS_RESPONSE_COMPLETE"|"BITTORRENT_DHT_REQUEST_STARTED"|"BITTORRENT_DHT_REQUEST_COMPLETE"|"BITTORRENT_DHT_RESPONSE_STARTED"|"BITTORRENT_DHT_RESPONSE_COMPLETE"|"DNP3_REQUEST_STARTED"|"DNP3_REQUEST_COMPLETE"|"DNP3_RESPONSE_STARTED"|"DNP3_RESPONSE_COMPLETE"|"SSH_REQUEST_IN_PROGRESS"|"SSH_REQUEST_BANNER_WAIT_EOL"|"SSH_REQUEST_BANNER_DONE"|"SSH_REQUEST_FINISHED"|"SSH_RESPONSE_IN_PROGRESS"|"SSH_RESPONSE_BANNER_WAIT_EOL"|"SSH_RESPONSE_BANNER_DONE"|"SSH_RESPONSE_FINISHED",
"Protocol": "IP"|"TCP"|"UDP"|"ICMP"|"HTTP"|"FTP"|"TLS"|"SMB"|"DNS"|"DCERPC"|"SSH"|"SMTP"|"MSN"|"KRB5"|"IKEV2"|"TFTP"|"NTP"|"DHCP"|"HTTP2"|"QUIC"|"ICMPV4"|"ICMPV6"|"SCTP"|"IPV4"|"IPV6"|"DOH2"|"FTP_DATA"|"NFS"|"RDP"|"RFB"|"MQTT"|"PGSQL"|"SNMP"|"TELNET"|"WEBSOCKET"|"LDAP"|"POP3"|"MDNS"|"BITTORRENT_DHT"|"DNP3",
"SourceIPs": "string",
"DestIPs": "string",
"SourcePorts": "string",
"DestPorts": "string",
"RuleOptions": [
{
"Keyword": "string",
"Settings": ["string", ...]
}
...
],
"AcceptPriorHooks": true|false,
"AlertEnabled": true|false,
"BypassIPSEnabled": true|false,
"RuleMetadata": {
"RuleEnabled": true|false,
"RuleDescription": "string"
}
}
...
],
"RulesSourceList": {
"Targets": ["string", ...],
"TargetTypes": ["TLS_SNI"|"HTTP_HOST"|"AWS_ROUTE_53_RESOLVED_DOMAIN", ...],
"GeneratedRulesType": "ALLOWLIST"|"DENYLIST"|"REJECTLIST"|"ALERTLIST"
}
},
"RuleVariables": {
"IPSets": {"string": {
"Definition": ["string", ...]
}
...},
"PortSets": {"string": {
"Definition": ["string", ...]
}
...}
},
"ReferenceSets": {
"IPSetReferences": {"string": {
"ReferenceArn": "string"
}
...}
}
}
}
...
],
"IpsRuleGroupEntries": [
{
"ResourceArn": "string",
"InlineRuleGroup": {
"RulesSource": {
"RulesString": "string"
},
"RuleVariables": {
"IPSets": {"string": {
"Definition": ["string", ...]
}
...},
"PortSets": {"string": {
"Definition": ["string", ...]
}
...}
},
"ReferenceSets": {
"IPSetReferences": {"string": {
"ReferenceArn": "string"
}
...}
}
},
"Override": {
"Action": "DROP_TO_ALERT"
}
}
...
],
"PolicyMode": "ENFORCE"|"MONITOR",
"FirewallDefaultAction": "DROP"|"ACCEPT"|"REJECT"|"ALERT",
"StatefulEngineOptions": {
"StreamExceptionPolicy": "DROP"|"REJECT",
"FlowTimeouts": {
"TcpIdleTimeoutSeconds": integer
}
},
"TLSInspectionConfigurationArn": "string",
"PolicyVariables": {
"RuleVariables": {"string": {
"Definition": ["string", ...]
}
...}
},
"Route53ResolvedIPValidation": {
"Action": "REJECT"|"DROP"|"ALERT",
"DNSFirewallRuleGroupId": "string",
"DNSExpiryExceptionPolicy": "REJECT"|"DROP"|"CONTINUE",
"BypassDestinationValidationIPRanges": [
{
"AddressDefinition": "string"
}
...
],
"SourceIPRanges": [
{
"AddressDefinition": "string"
}
...
]
}
}
--description (string)
A description of the firewall policy.
Constraints:
- max:
512- pattern:
^.*$
--tags (list)
The key:value pairs to associate with the resource.
Constraints:
- min:
1- max:
200(structure)
A key:value pair associated with an Amazon Web Services resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as “environment”) and the tag value represents a specific value within that category (such as “test,” “development,” or “production”). You can add up to 50 tags to each Amazon Web Services resource.
Key -> (string) [required]
The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as “customer.” Tag keys are case-sensitive.
Constraints:
- min:
1- max:
128- pattern:
^.*$Value -> (string) [required]
The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as “companyA” or “companyB.” Tag values are case-sensitive.
Constraints:
- min:
0- max:
256- pattern:
^.*$
Shorthand Syntax:
Key=string,Value=string ...
JSON Syntax:
[
{
"Key": "string",
"Value": "string"
}
...
]
--dry-run | --no-dry-run (boolean)
Indicates whether you want Network Firewall to just check the validity of the request, rather than run the request.
If set to
TRUE, Network Firewall checks whether the request can run successfully, but doesn’t actually make the requested changes. The call returns the value that the request would return if you ran it with dry run set toFALSE, but doesn’t make additions or changes to your resources. This option allows you to make sure that you have the required permissions to run the request and that your request parameters are valid.If set to
FALSE, Network Firewall makes the requested changes to your resources.
--encryption-configuration (structure)
A complex type that contains settings for encryption of your firewall policy resources.
KeyId -> (string)
The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you’re using a key that’s managed by another account. If you’re using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide .
Constraints:
- min:
1- max:
2048- pattern:
.*\S.*Type -> (string) [required]
The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.
Possible values:
CUSTOMER_KMSAWS_OWNED_KMS_KEY
Shorthand Syntax:
KeyId=string,Type=string
JSON Syntax:
{
"KeyId": "string",
"Type": "CUSTOMER_KMS"|"AWS_OWNED_KMS_KEY"
}
--cli-input-json | --cli-input-yaml (string)
Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.
--generate-cli-skeleton (string)
Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.
Global Options¶
--debug (boolean)
Turn on debug logging.
--endpoint-url (string)
Override command’s default URL with the given URL.
--no-verify-ssl (boolean)
By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.
--no-paginate (boolean)
Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.
--output (string)
The formatting style for command output.
- json
- text
- table
- yaml
- yaml-stream
- off
--query (string)
A JMESPath query to use in filtering the response data.
--profile (string)
Use a specific profile from your credential file.
--region (string)
The region to use. Overrides config/env settings.
--version (string)
Display the version of this tool.
--color (string)
Turn on/off color output.
- on
- off
- auto
--no-sign-request (boolean)
Do not sign requests. Credentials will not be loaded if this argument is provided.
--ca-bundle (string)
The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.
--cli-read-timeout (int)
The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.
--cli-connect-timeout (int)
The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.
--cli-binary-format (string)
The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob fileb:// will always be treated as binary and use the file contents directly regardless of the cli-binary-format setting. When using file:// the file contents will need to properly formatted for the configured cli-binary-format.
- base64
- raw-in-base64-out
--no-cli-pager (boolean)
Disable cli pager for output.
--cli-auto-prompt (boolean)
Automatically prompt for CLI input parameters.
--no-cli-auto-prompt (boolean)
Disable automatically prompt for CLI input parameters.
--cli-error-format (string)
The formatting style for error output. By default, errors are displayed in enhanced format.
- legacy
- json
- yaml
- text
- table
- enhanced
--help (boolean)
Display help for the command/subcommand.
Output¶
UpdateToken -> (string)
A token used for optimistic locking. Network Firewall returns a token to your requests that access the firewall policy. The token marks the state of the policy resource at the time of the request.
To make changes to the policy, you provide the token in your request. Network Firewall uses the token to ensure that the policy hasn’t changed since you last retrieved it. If it has changed, the operation fails with an
InvalidTokenException. If this happens, retrieve the firewall policy again to get a current copy of it with current token. Reapply your changes as needed, then try the operation again using the new token.Constraints:
- min:
1- max:
1024- pattern:
^([0-9a-f]{8})-([0-9a-f]{4}-){3}([0-9a-f]{12})$
FirewallPolicyV2Response -> (structure)
The high-level properties of the Next Generation policy. This, along with the FirewallPolicyV2 , define the policy. You can retrieve all objects for a Next Generation policy by calling DescribeFirewallPolicyV2 .
FirewallPolicyV2Name -> (string) [required]
The descriptive name of the Next Generation policy. You can’t change the name of a firewall policy after you create it.
Constraints:
- min:
1- max:
128- pattern:
^[a-zA-Z0-9-]+$FirewallPolicyV2Arn -> (string) [required]
The Amazon Resource Name (ARN) of the Next Generation policy.
Constraints:
- min:
1- max:
256- pattern:
^arn:aws.*FirewallPolicyV2Id -> (string) [required]
The unique identifier of the Next Generation policy. Network Firewall assigns this identifier when you create the policy.
Constraints:
- min:
36- max:
36- pattern:
^([0-9a-f]{8})-([0-9a-f]{4}-){3}([0-9a-f]{12})$Description -> (string)
A description of the Next Generation policy.
Constraints:
- max:
512- pattern:
^.*$FirewallPolicyV2Status -> (string)
The current status of the Next Generation policy. A policy must be in the
ACTIVEstate before you can use it in a firewall.Possible values:
ACTIVEDELETINGERRORUPDATINGStatusMessage -> (string)
Additional information about the current status of the Next Generation policy.
Constraints:
- min:
1- max:
8192Tags -> (list)
The key-value tag pairs that are associated with the Next Generation policy.
Constraints:
- min:
1- max:
200(structure)
A key:value pair associated with an Amazon Web Services resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as “environment”) and the tag value represents a specific value within that category (such as “test,” “development,” or “production”). You can add up to 50 tags to each Amazon Web Services resource.
Key -> (string) [required]
The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as “customer.” Tag keys are case-sensitive.
Constraints:
- min:
1- max:
128- pattern:
^.*$Value -> (string) [required]
The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as “companyA” or “companyB.” Tag values are case-sensitive.
Constraints:
- min:
0- max:
256- pattern:
^.*$ConsumedFirewallRuleCapacity -> (integer)
The number of firewall engine rule capacity units that the policy’s firewall section currently consumes.ConsumedIpsRuleCapacity -> (integer)
The number of IPS engine rule capacity units that the policy’s IPS section currently consumes.ConsumedIpsDomainCapacity -> (integer)
The number of IPS domain list capacity units that the policy’s IPS section currently consumes.NumberOfAssociations -> (integer)
The number of firewalls that are associated with the Next Generation policy.EncryptionConfiguration -> (structure)
A complex type that contains the Amazon Web Services KMS encryption configuration settings for your Next Generation policy.
KeyId -> (string)
The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you’re using a key that’s managed by another account. If you’re using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide .
Constraints:
- min:
1- max:
2048- pattern:
.*\S.*Type -> (string) [required]
The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.
Possible values:
CUSTOMER_KMSAWS_OWNED_KMS_KEYErrors -> (list)
Any configuration errors that apply to the Next Generation policy. Network Firewall detects these errors asynchronously, after you create or update the policy, so an error can appear after the request that caused it has already succeeded. Each entry describes the problem and how to resolve it, and Network Firewall clears it automatically after you resolve the problem.
Constraints:
- min:
0- max:
10(structure)
A configuration error that Network Firewall detected for a firewall policy.
Code -> (string) [required]
The error code identifies the type of error. Valid values are the following:
DNS_FIREWALL_RULE_GROUP_UNAVAILABLE– The Amazon Route 53 Resolver DNS Firewall rule group that resolved IP validation references is unavailable, for example, because it was deleted or is no longer accessible from your account. Update the rule group ID or remove the resolved IP validation configuration.ROUTE53_RESOLVED_IP_VALIDATION_MISSING– An associated stateful rule group uses theaws_route_53_resolved_domainkeyword, but the policy doesn’t have resolved IP validation configured. The affected rules are inactive until you add resolved IP validation to the policy or remove the keyword rules.Possible values:
DNS_FIREWALL_RULE_GROUP_UNAVAILABLEROUTE53_RESOLVED_IP_VALIDATION_MISSINGMessage -> (string) [required]
A description of the error and how to resolve it.
Constraints:
- min:
1- max:
256- pattern:
^[a-zA-Z0-9- ]+$ResourceId -> (string)
The ID of the resource that the error relates to, when applicable. For example, for
DNS_FIREWALL_RULE_GROUP_UNAVAILABLEthis is the Amazon Route 53 Resolver DNS Firewall rule group ID.Constraints:
- min:
1- max:
2048- pattern:
^[a-zA-Z0-9:/_.-]+$LastModifiedTime -> (timestamp)
The last time that the Next Generation policy was changed.