Interface Route53ResolvedIPValidation.Builder

All Superinterfaces:
Buildable, CopyableBuilder<Route53ResolvedIPValidation.Builder,Route53ResolvedIPValidation>, SdkBuilder<Route53ResolvedIPValidation.Builder,Route53ResolvedIPValidation>, SdkPojo
Enclosing class:
Route53ResolvedIPValidation
@Mutable @NotThreadSafe public static interface Route53ResolvedIPValidation.Builder extends SdkPojo, CopyableBuilder<Route53ResolvedIPValidation.Builder,Route53ResolvedIPValidation>

  • Method Details

    • action

      Route53ResolvedIPValidation.Builder action(String action)

      The action that Network Firewall takes for a connection whose destination IP address fails resolved IP validation. A destination IP address fails validation when the Route 53 Resolver didn't return it in a DNS response in an associated VPC. Valid values are the following:

      • ALERT – Tags the matching connection in the firewall's flow logs without blocking it, when you enable logging. Use this to observe the effect of resolved IP validation before you enforce it.

      • DROP – Silently blocks the connection without sending any response to the client.

      • REJECT – Blocks the connection and sends a TCP reset (RST) to the client. Because a TCP reset applies only to TCP connections, Network Firewall drops non-TCP traffic instead of resetting it.

      Parameters:
      action - The action that Network Firewall takes for a connection whose destination IP address fails resolved IP validation. A destination IP address fails validation when the Route 53 Resolver didn't return it in a DNS response in an associated VPC. Valid values are the following:

      • ALERT – Tags the matching connection in the firewall's flow logs without blocking it, when you enable logging. Use this to observe the effect of resolved IP validation before you enforce it.

      • DROP – Silently blocks the connection without sending any response to the client.

      • REJECT – Blocks the connection and sends a TCP reset (RST) to the client. Because a TCP reset applies only to TCP connections, Network Firewall drops non-TCP traffic instead of resetting it.

      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • action

      Route53ResolvedIPValidation.Builder action(Route53ResolvedIPValidationAction action)

      The action that Network Firewall takes for a connection whose destination IP address fails resolved IP validation. A destination IP address fails validation when the Route 53 Resolver didn't return it in a DNS response in an associated VPC. Valid values are the following:

      • ALERT – Tags the matching connection in the firewall's flow logs without blocking it, when you enable logging. Use this to observe the effect of resolved IP validation before you enforce it.

      • DROP – Silently blocks the connection without sending any response to the client.

      • REJECT – Blocks the connection and sends a TCP reset (RST) to the client. Because a TCP reset applies only to TCP connections, Network Firewall drops non-TCP traffic instead of resetting it.

      Parameters:
      action - The action that Network Firewall takes for a connection whose destination IP address fails resolved IP validation. A destination IP address fails validation when the Route 53 Resolver didn't return it in a DNS response in an associated VPC. Valid values are the following:

      • ALERT – Tags the matching connection in the firewall's flow logs without blocking it, when you enable logging. Use this to observe the effect of resolved IP validation before you enforce it.

      • DROP – Silently blocks the connection without sending any response to the client.

      • REJECT – Blocks the connection and sends a TCP reset (RST) to the client. Because a TCP reset applies only to TCP connections, Network Firewall drops non-TCP traffic instead of resetting it.

      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • dnsFirewallRuleGroupId

      Route53ResolvedIPValidation.Builder dnsFirewallRuleGroupId(String dnsFirewallRuleGroupId)

      The ID of the Route 53 Resolver DNS Firewall rule group that determines which VPCs' DNS resolutions count for resolved IP validation. A destination IP address counts as resolved for a domain only when the Route 53 Resolver returned it in a DNS response within a VPC that's associated with this rule group. Associate the rule group with the VPCs that send traffic to the firewall. The ID must match the pattern ^rslvr-frg-[0-9a-f]+$. It must also exist and be accessible from your account. Network Firewall validates this when you create or update the policy.

      Changing this value swaps the managed rule group association. Network Firewall processes the swap asynchronously. Each policy can have only one managed Route 53 Resolver DNS Firewall association. While a swap is in progress, Network Firewall rejects further changes to this setting. Wait until the swap completes, then retry.

      Parameters:
      dnsFirewallRuleGroupId - The ID of the Route 53 Resolver DNS Firewall rule group that determines which VPCs' DNS resolutions count for resolved IP validation. A destination IP address counts as resolved for a domain only when the Route 53 Resolver returned it in a DNS response within a VPC that's associated with this rule group. Associate the rule group with the VPCs that send traffic to the firewall. The ID must match the pattern ^rslvr-frg-[0-9a-f]+$. It must also exist and be accessible from your account. Network Firewall validates this when you create or update the policy.

      Changing this value swaps the managed rule group association. Network Firewall processes the swap asynchronously. Each policy can have only one managed Route 53 Resolver DNS Firewall association. While a swap is in progress, Network Firewall rejects further changes to this setting. Wait until the swap completes, then retry.

      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • dnsExpiryExceptionPolicy

      Route53ResolvedIPValidation.Builder dnsExpiryExceptionPolicy(String dnsExpiryExceptionPolicy)

      The action that Network Firewall takes when the DNS resolution recorded for a destination IP address has expired from the resolved IP cache. This applies when Network Firewall still sees traffic to that IP address after the expiry. Network Firewall keeps a resolution for longer than the DNS record's time to live (TTL). Valid values are the following:

      • CONTINUE – Treats the expired resolution as still valid and doesn't block the connection because of expiry.

      • DROP – Silently blocks traffic to the IP address after its resolution has expired, without sending any response to the client.

      • REJECT – Blocks traffic to the IP address after its resolution has expired and sends a TCP reset (RST) to the client. Network Firewall drops non-TCP traffic instead of resetting it.

      Parameters:
      dnsExpiryExceptionPolicy - The action that Network Firewall takes when the DNS resolution recorded for a destination IP address has expired from the resolved IP cache. This applies when Network Firewall still sees traffic to that IP address after the expiry. Network Firewall keeps a resolution for longer than the DNS record's time to live (TTL). Valid values are the following:

      • CONTINUE – Treats the expired resolution as still valid and doesn't block the connection because of expiry.

      • DROP – Silently blocks traffic to the IP address after its resolution has expired, without sending any response to the client.

      • REJECT – Blocks traffic to the IP address after its resolution has expired and sends a TCP reset (RST) to the client. Network Firewall drops non-TCP traffic instead of resetting it.

      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • dnsExpiryExceptionPolicy

      Route53ResolvedIPValidation.Builder dnsExpiryExceptionPolicy(DNSExpiryExceptionPolicy dnsExpiryExceptionPolicy)

      The action that Network Firewall takes when the DNS resolution recorded for a destination IP address has expired from the resolved IP cache. This applies when Network Firewall still sees traffic to that IP address after the expiry. Network Firewall keeps a resolution for longer than the DNS record's time to live (TTL). Valid values are the following:

      • CONTINUE – Treats the expired resolution as still valid and doesn't block the connection because of expiry.

      • DROP – Silently blocks traffic to the IP address after its resolution has expired, without sending any response to the client.

      • REJECT – Blocks traffic to the IP address after its resolution has expired and sends a TCP reset (RST) to the client. Network Firewall drops non-TCP traffic instead of resetting it.

      Parameters:
      dnsExpiryExceptionPolicy - The action that Network Firewall takes when the DNS resolution recorded for a destination IP address has expired from the resolved IP cache. This applies when Network Firewall still sees traffic to that IP address after the expiry. Network Firewall keeps a resolution for longer than the DNS record's time to live (TTL). Valid values are the following:

      • CONTINUE – Treats the expired resolution as still valid and doesn't block the connection because of expiry.

      • DROP – Silently blocks traffic to the IP address after its resolution has expired, without sending any response to the client.

      • REJECT – Blocks traffic to the IP address after its resolution has expired and sends a TCP reset (RST) to the client. Network Firewall drops non-TCP traffic instead of resetting it.

      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • bypassDestinationValidationIPRanges

      Route53ResolvedIPValidation.Builder bypassDestinationValidationIPRanges(Collection<Address> bypassDestinationValidationIPRanges)

      The destination IP address ranges that are exempt from the policy-level resolved IP check. Network Firewall doesn't apply the Action in this configuration to a connection whose destination falls in these ranges, even if the Route 53 Resolver didn't return that IP address in an associated VPC. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries.

      This exemption applies only to the policy-level check. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate connections to these destinations and match them independently of this list.

      Parameters:
      bypassDestinationValidationIPRanges - The destination IP address ranges that are exempt from the policy-level resolved IP check. Network Firewall doesn't apply the Action in this configuration to a connection whose destination falls in these ranges, even if the Route 53 Resolver didn't return that IP address in an associated VPC. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries.

      This exemption applies only to the policy-level check. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate connections to these destinations and match them independently of this list.

      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • bypassDestinationValidationIPRanges

      Route53ResolvedIPValidation.Builder bypassDestinationValidationIPRanges(Address... bypassDestinationValidationIPRanges)

      The destination IP address ranges that are exempt from the policy-level resolved IP check. Network Firewall doesn't apply the Action in this configuration to a connection whose destination falls in these ranges, even if the Route 53 Resolver didn't return that IP address in an associated VPC. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries.

      This exemption applies only to the policy-level check. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate connections to these destinations and match them independently of this list.

      Parameters:
      bypassDestinationValidationIPRanges - The destination IP address ranges that are exempt from the policy-level resolved IP check. Network Firewall doesn't apply the Action in this configuration to a connection whose destination falls in these ranges, even if the Route 53 Resolver didn't return that IP address in an associated VPC. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries.

      This exemption applies only to the policy-level check. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate connections to these destinations and match them independently of this list.

      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • bypassDestinationValidationIPRanges

      Route53ResolvedIPValidation.Builder bypassDestinationValidationIPRanges(Consumer<Address.Builder>... bypassDestinationValidationIPRanges)

      The destination IP address ranges that are exempt from the policy-level resolved IP check. Network Firewall doesn't apply the Action in this configuration to a connection whose destination falls in these ranges, even if the Route 53 Resolver didn't return that IP address in an associated VPC. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries.

      This exemption applies only to the policy-level check. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate connections to these destinations and match them independently of this list.

      This is a convenience method that creates an instance of the Address.Builder avoiding the need to create one manually via Address.builder().

      When the Consumer completes, SdkBuilder.build() is called immediately and its result is passed to bypassDestinationValidationIPRanges(List<Address>).

      Parameters:
      bypassDestinationValidationIPRanges - a consumer that will call methods on Address.Builder
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • sourceIPRanges

      Route53ResolvedIPValidation.Builder sourceIPRanges(Collection<Address> sourceIPRanges)

      The client source IP address ranges whose connections are subject to resolved IP validation. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries. If you omit this field, resolved IP validation applies to the CIDR ranges of the firewall's VPC and of any additional VPCs attached to the firewall. Specifying an empty list is not the same as omitting the field: an empty list means that Network Firewall doesn't validate any source addresses.

      This scope applies to the policy-level check only. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate their destinations regardless of SourceIPRanges.

      Parameters:
      sourceIPRanges - The client source IP address ranges whose connections are subject to resolved IP validation. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries. If you omit this field, resolved IP validation applies to the CIDR ranges of the firewall's VPC and of any additional VPCs attached to the firewall. Specifying an empty list is not the same as omitting the field: an empty list means that Network Firewall doesn't validate any source addresses.

      This scope applies to the policy-level check only. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate their destinations regardless of SourceIPRanges.

      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • sourceIPRanges

      Route53ResolvedIPValidation.Builder sourceIPRanges(Address... sourceIPRanges)

      The client source IP address ranges whose connections are subject to resolved IP validation. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries. If you omit this field, resolved IP validation applies to the CIDR ranges of the firewall's VPC and of any additional VPCs attached to the firewall. Specifying an empty list is not the same as omitting the field: an empty list means that Network Firewall doesn't validate any source addresses.

      This scope applies to the policy-level check only. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate their destinations regardless of SourceIPRanges.

      Parameters:
      sourceIPRanges - The client source IP address ranges whose connections are subject to resolved IP validation. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries. If you omit this field, resolved IP validation applies to the CIDR ranges of the firewall's VPC and of any additional VPCs attached to the firewall. Specifying an empty list is not the same as omitting the field: an empty list means that Network Firewall doesn't validate any source addresses.

      This scope applies to the policy-level check only. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate their destinations regardless of SourceIPRanges.

      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • sourceIPRanges

      Route53ResolvedIPValidation.Builder sourceIPRanges(Consumer<Address.Builder>... sourceIPRanges)

      The client source IP address ranges whose connections are subject to resolved IP validation. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries. If you omit this field, resolved IP validation applies to the CIDR ranges of the firewall's VPC and of any additional VPCs attached to the firewall. Specifying an empty list is not the same as omitting the field: an empty list means that Network Firewall doesn't validate any source addresses.

      This scope applies to the policy-level check only. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate their destinations regardless of SourceIPRanges.

      This is a convenience method that creates an instance of the Address.Builder avoiding the need to create one manually via Address.builder().

      When the Consumer completes, SdkBuilder.build() is called immediately and its result is passed to sourceIPRanges(List<Address>).

      Parameters:
      sourceIPRanges - a consumer that will call methods on Address.Builder
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also: