software.amazon.awssdk.services.networkfirewall.model

Class FirewallPolicy

java.lang.Object

software.amazon.awssdk.services.networkfirewall.model.FirewallPolicy

All Implemented Interfaces:

Serializable, SdkPojo, ToCopyableBuilder<FirewallPolicy.Builder,FirewallPolicy>

@Generated(value="software.amazon.awssdk:codegen")
public final class FirewallPolicy
extends Object
implements SdkPojo, Serializable, ToCopyableBuilder<FirewallPolicy.Builder,FirewallPolicy>

The firewall policy defines the behavior of a firewall using a collection of stateless and stateful rule groups and other settings. You can use one firewall policy for multiple firewalls.

This, along with FirewallPolicyResponse, define the policy. You can retrieve all objects for a firewall policy by calling DescribeFirewallPolicy.

See Also:

Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static interface	FirewallPolicy.Builder

Method Summary

Modifier and Type	Method and Description
static FirewallPolicy.Builder	builder()
boolean	equals(Object obj)
boolean	equalsBySdkFields(Object obj)
<T> Optional<T>	getValueForField(String fieldName, Class<T> clazz)
int	hashCode()
boolean	hasStatefulDefaultActions() For responses, this returns true if the service returned a value for the StatefulDefaultActions property.
boolean	hasStatefulRuleGroupReferences() For responses, this returns true if the service returned a value for the StatefulRuleGroupReferences property.
boolean	hasStatelessCustomActions() For responses, this returns true if the service returned a value for the StatelessCustomActions property.
boolean	hasStatelessDefaultActions() For responses, this returns true if the service returned a value for the StatelessDefaultActions property.
boolean	hasStatelessFragmentDefaultActions() For responses, this returns true if the service returned a value for the StatelessFragmentDefaultActions property.
boolean	hasStatelessRuleGroupReferences() For responses, this returns true if the service returned a value for the StatelessRuleGroupReferences property.
PolicyVariables	policyVariables() Contains variables that you can use to override default Suricata settings in your firewall policy.
List<SdkField<?>>	sdkFields()
static Class<? extends FirewallPolicy.Builder>	serializableBuilderClass()
List<String>	statefulDefaultActions() The default actions to take on a packet that doesn't match any stateful rules.
StatefulEngineOptions	statefulEngineOptions() Additional options governing how Network Firewall handles stateful rules.
List<StatefulRuleGroupReference>	statefulRuleGroupReferences() References to the stateful rule groups that are used in the policy.
List<CustomAction>	statelessCustomActions() The custom action definitions that are available for use in the firewall policy's StatelessDefaultActions setting.
List<String>	statelessDefaultActions() The actions to take on a packet if it doesn't match any of the stateless rules in the policy.
List<String>	statelessFragmentDefaultActions() The actions to take on a fragmented UDP packet if it doesn't match any of the stateless rules in the policy.
List<StatelessRuleGroupReference>	statelessRuleGroupReferences() References to the stateless rule groups that are used in the policy.
String	tlsInspectionConfigurationArn() The Amazon Resource Name (ARN) of the TLS inspection configuration.
FirewallPolicy.Builder	toBuilder()
String	toString() Returns a string representation of this object.

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface software.amazon.awssdk.utils.builder.ToCopyableBuilder

copy

Method Detail

hasStatelessRuleGroupReferences

public final boolean hasStatelessRuleGroupReferences()

For responses, this returns true if the service returned a value for the StatelessRuleGroupReferences property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

statelessRuleGroupReferences

public final List<StatelessRuleGroupReference> statelessRuleGroupReferences()

References to the stateless rule groups that are used in the policy. These define the matching criteria in stateless rules.

Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasStatelessRuleGroupReferences() method.

Returns:

References to the stateless rule groups that are used in the policy. These define the matching criteria in stateless rules.

hasStatelessDefaultActions

public final boolean hasStatelessDefaultActions()

For responses, this returns true if the service returned a value for the StatelessDefaultActions property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

statelessDefaultActions

public final List<String> statelessDefaultActions()

The actions to take on a packet if it doesn't match any of the stateless rules in the policy. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.

You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice.

For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.

Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasStatelessDefaultActions() method.

Returns:

The actions to take on a packet if it doesn't match any of the stateless rules in the policy. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.

You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice.

For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.

hasStatelessFragmentDefaultActions

public final boolean hasStatelessFragmentDefaultActions()

For responses, this returns true if the service returned a value for the StatelessFragmentDefaultActions property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

statelessFragmentDefaultActions

public final List<String> statelessFragmentDefaultActions()

The actions to take on a fragmented UDP packet if it doesn't match any of the stateless rules in the policy. Network Firewall only manages UDP packet fragments and silently drops packet fragments for other protocols. If you want non-matching fragmented UDP packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.

You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice.

For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.

Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasStatelessFragmentDefaultActions() method.

Returns:

The actions to take on a fragmented UDP packet if it doesn't match any of the stateless rules in the policy. Network Firewall only manages UDP packet fragments and silently drops packet fragments for other protocols. If you want non-matching fragmented UDP packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.

You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice.

For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.

hasStatelessCustomActions

public final boolean hasStatelessCustomActions()

For responses, this returns true if the service returned a value for the StatelessCustomActions property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

statelessCustomActions

public final List<CustomAction> statelessCustomActions()

The custom action definitions that are available for use in the firewall policy's StatelessDefaultActions setting. You name each custom action that you define, and then you can use it by name in your default actions specifications.

Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasStatelessCustomActions() method.

Returns:

The custom action definitions that are available for use in the firewall policy's StatelessDefaultActions setting. You name each custom action that you define, and then you can use it by name in your default actions specifications.

hasStatefulRuleGroupReferences

public final boolean hasStatefulRuleGroupReferences()

For responses, this returns true if the service returned a value for the StatefulRuleGroupReferences property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

statefulRuleGroupReferences

public final List<StatefulRuleGroupReference> statefulRuleGroupReferences()

References to the stateful rule groups that are used in the policy. These define the inspection criteria in stateful rules.

Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasStatefulRuleGroupReferences() method.

Returns:

References to the stateful rule groups that are used in the policy. These define the inspection criteria in stateful rules.

hasStatefulDefaultActions

public final boolean hasStatefulDefaultActions()

For responses, this returns true if the service returned a value for the StatefulDefaultActions property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

statefulDefaultActions

public final List<String> statefulDefaultActions()

The default actions to take on a packet that doesn't match any stateful rules. The stateful default action is optional, and is only valid when using the strict rule order.

Valid values of the stateful default action:

• aws:drop_strict

• aws:drop_established

• aws:alert_strict

• aws:alert_established

For more information, see Strict evaluation order in the Network Firewall Developer Guide.

Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasStatefulDefaultActions() method.

Returns:

The default actions to take on a packet that doesn't match any stateful rules. The stateful default action is optional, and is only valid when using the strict rule order.

Valid values of the stateful default action:

• aws:drop_strict

• aws:drop_established

• aws:alert_strict

• aws:alert_established

For more information, see Strict evaluation order in the Network Firewall Developer Guide.

statefulEngineOptions

public final StatefulEngineOptions statefulEngineOptions()

Additional options governing how Network Firewall handles stateful rules. The stateful rule groups that you use in your policy must have stateful rule options settings that are compatible with these settings.

Returns:

Additional options governing how Network Firewall handles stateful rules. The stateful rule groups that you use in your policy must have stateful rule options settings that are compatible with these settings.

tlsInspectionConfigurationArn

public final String tlsInspectionConfigurationArn()

The Amazon Resource Name (ARN) of the TLS inspection configuration.

Returns:

The Amazon Resource Name (ARN) of the TLS inspection configuration.

policyVariables

public final PolicyVariables policyVariables()

Contains variables that you can use to override default Suricata settings in your firewall policy.

Returns:

Contains variables that you can use to override default Suricata settings in your firewall policy.

toBuilder

public FirewallPolicy.Builder toBuilder()

Specified by:

toBuilder in interface ToCopyableBuilder<FirewallPolicy.Builder,FirewallPolicy>

builder

public static FirewallPolicy.Builder builder()

serializableBuilderClass

public static Class<? extends FirewallPolicy.Builder> serializableBuilderClass()

hashCode

public final int hashCode()

Overrides:

hashCode in class Object

equals

public final boolean equals(Object obj)

Overrides:

equals in class Object

equalsBySdkFields

public final boolean equalsBySdkFields(Object obj)

Specified by:

equalsBySdkFields in interface SdkPojo

toString

public final String toString()

Returns a string representation of this object. This is useful for testing and debugging. Sensitive data will be redacted from this string using a placeholder value.

Overrides:

toString in class Object

getValueForField

public final <T> Optional<T> getValueForField(String fieldName,
                                              Class<T> clazz)

sdkFields

public final List<SdkField<?>> sdkFields()

Specified by:

sdkFields in interface SdkPojo