FirewallPolicyV2

The object that defines a Next Generation policy. This, along with the FirewallPolicyV2Response, define the policy.

A Next Generation policy defines how the firewall engine and IPS engine inspect and control your VPC network traffic. You define the policy as a firewall section and an IPS section, each a collection of rule groups, along with policy-wide settings such as the policy mode and default actions. For more information, see Next Generation policies in the AWS Network Firewall Developer Guide.

FirewallDefaultAction

The action that the firewall engine takes on traffic that doesn't match any firewall engine rule at a hook. The firewall engine is drop by default. You can set the default action to one of the following:

DROP - Block the traffic.
ACCEPT - Allow the traffic.
REJECT - Block the traffic and send a TCP reset packet back to the client.
ALERT - Allow the traffic and generate an alert log for the traffic that reaches the default action at every hook. This is distinct from setting the policy mode to MONITOR.

For more information, see Next Generation policies in the AWS Network Firewall Developer Guide.

Type: String

Valid Values: DROP | ACCEPT | REJECT | ALERT

Required: No

FirewallRuleGroupEntries

The firewall section of the policy—the rule groups that the firewall engine evaluates. Each entry references an existing firewall engine rule group or embeds a rule group directly in the policy, and each entry has a unique priority that sets its evaluation order within the section.

Type: Array of FirewallRuleGroupEntry objects

Required: No

IpsRuleGroupEntries

The IPS section of the policy—the rule groups that the IPS engine evaluates. Each entry references an existing IPS engine rule group or embeds a rule group directly in the policy. IPS section entries don't use a priority.

Type: Array of IpsRuleGroupEntry objects

Required: No

PolicyMode

Indicates whether the policy's engines enforce their verdicts or only report them. In ENFORCE mode, the firewall engine and IPS engine apply their verdicts to traffic. In MONITOR mode, the engines evaluate traffic and generate logs and metrics, but don't block traffic, so you can observe how a policy would behave before you enforce it. For more information, see Next Generation policies in the AWS Network Firewall Developer Guide.

Type: String

Valid Values: ENFORCE | MONITOR

Required: No

PolicyVariables

Contains variables that you can use to override default Suricata settings in your Next Generation policy.

Type: PolicyVariables object

Required: No

Route53ResolvedIPValidation

The settings that enable resolved IP validation for the Next Generation policy. Resolved IP validation verifies that a connection's destination IP address is one that the Amazon Route 53 Resolver returned in a DNS response for a domain. A VPC that's associated with the Route 53 Resolver DNS Firewall rule group that you specify must send the response. This checks how the destination IP address was obtained, instead of relying only on the domain that the client asserts in its TLS Server Name Indication (SNI) or HTTP Host header. For more information, see Route53ResolvedIPValidation.

Type: Route53ResolvedIPValidation object

Required: No

StatefulEngineOptions

Additional options governing how the engines handle stateful traffic, such as the stream exception policy and flow timeouts.

Type: StatefulEngineOptionsV2 object

Required: No

TLSInspectionConfigurationArn

The Amazon Resource Name (ARN) of the TLS inspection configuration to use to decrypt traffic for inspection. Next Generation policies support session holding only. For more information, see Inspecting SSL/TLS traffic with TLS inspection configurations in the AWS Network Firewall Developer Guide.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 256.

Pattern: ^arn:aws.*

Required: No

FirewallPolicyV2

Contents

See Also