Interface FirewallPolicyV2.Builder

All Superinterfaces:
Buildable, CopyableBuilder<FirewallPolicyV2.Builder,FirewallPolicyV2>, SdkBuilder<FirewallPolicyV2.Builder,FirewallPolicyV2>, SdkPojo
Enclosing class:
FirewallPolicyV2
@Mutable @NotThreadSafe public static interface FirewallPolicyV2.Builder extends SdkPojo, CopyableBuilder<FirewallPolicyV2.Builder,FirewallPolicyV2>

  • Method Details

    • firewallRuleGroupEntries

      FirewallPolicyV2.Builder firewallRuleGroupEntries(Collection<FirewallRuleGroupEntry> firewallRuleGroupEntries)

      The firewall section of the policy—the rule groups that the firewall engine evaluates. Each entry references an existing firewall engine rule group or embeds a rule group directly in the policy, and each entry has a unique priority that sets its evaluation order within the section.

      Parameters:
      firewallRuleGroupEntries - The firewall section of the policy—the rule groups that the firewall engine evaluates. Each entry references an existing firewall engine rule group or embeds a rule group directly in the policy, and each entry has a unique priority that sets its evaluation order within the section.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • firewallRuleGroupEntries

      FirewallPolicyV2.Builder firewallRuleGroupEntries(FirewallRuleGroupEntry... firewallRuleGroupEntries)

      The firewall section of the policy—the rule groups that the firewall engine evaluates. Each entry references an existing firewall engine rule group or embeds a rule group directly in the policy, and each entry has a unique priority that sets its evaluation order within the section.

      Parameters:
      firewallRuleGroupEntries - The firewall section of the policy—the rule groups that the firewall engine evaluates. Each entry references an existing firewall engine rule group or embeds a rule group directly in the policy, and each entry has a unique priority that sets its evaluation order within the section.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • firewallRuleGroupEntries

      FirewallPolicyV2.Builder firewallRuleGroupEntries(Consumer<FirewallRuleGroupEntry.Builder>... firewallRuleGroupEntries)

      The firewall section of the policy—the rule groups that the firewall engine evaluates. Each entry references an existing firewall engine rule group or embeds a rule group directly in the policy, and each entry has a unique priority that sets its evaluation order within the section.

      This is a convenience method that creates an instance of the FirewallRuleGroupEntry.Builder avoiding the need to create one manually via FirewallRuleGroupEntry.builder().

      When the Consumer completes, SdkBuilder.build() is called immediately and its result is passed to firewallRuleGroupEntries(List<FirewallRuleGroupEntry>).

      Parameters:
      firewallRuleGroupEntries - a consumer that will call methods on FirewallRuleGroupEntry.Builder
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • ipsRuleGroupEntries

      FirewallPolicyV2.Builder ipsRuleGroupEntries(Collection<IpsRuleGroupEntry> ipsRuleGroupEntries)

      The IPS section of the policy—the rule groups that the IPS engine evaluates. Each entry references an existing IPS engine rule group or embeds a rule group directly in the policy. IPS section entries don't use a priority.

      Parameters:
      ipsRuleGroupEntries - The IPS section of the policy—the rule groups that the IPS engine evaluates. Each entry references an existing IPS engine rule group or embeds a rule group directly in the policy. IPS section entries don't use a priority.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • ipsRuleGroupEntries

      FirewallPolicyV2.Builder ipsRuleGroupEntries(IpsRuleGroupEntry... ipsRuleGroupEntries)

      The IPS section of the policy—the rule groups that the IPS engine evaluates. Each entry references an existing IPS engine rule group or embeds a rule group directly in the policy. IPS section entries don't use a priority.

      Parameters:
      ipsRuleGroupEntries - The IPS section of the policy—the rule groups that the IPS engine evaluates. Each entry references an existing IPS engine rule group or embeds a rule group directly in the policy. IPS section entries don't use a priority.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • ipsRuleGroupEntries

      FirewallPolicyV2.Builder ipsRuleGroupEntries(Consumer<IpsRuleGroupEntry.Builder>... ipsRuleGroupEntries)

      The IPS section of the policy—the rule groups that the IPS engine evaluates. Each entry references an existing IPS engine rule group or embeds a rule group directly in the policy. IPS section entries don't use a priority.

      This is a convenience method that creates an instance of the IpsRuleGroupEntry.Builder avoiding the need to create one manually via IpsRuleGroupEntry.builder().

      When the Consumer completes, SdkBuilder.build() is called immediately and its result is passed to ipsRuleGroupEntries(List<IpsRuleGroupEntry>).

      Parameters:
      ipsRuleGroupEntries - a consumer that will call methods on IpsRuleGroupEntry.Builder
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • policyMode

      FirewallPolicyV2.Builder policyMode(String policyMode)

      Indicates whether the policy's engines enforce their verdicts or only report them. In ENFORCE mode, the firewall engine and IPS engine apply their verdicts to traffic. In MONITOR mode, the engines evaluate traffic and generate logs and metrics, but don't block traffic, so you can observe how a policy would behave before you enforce it. For more information, see Next Generation policies in the Network Firewall Developer Guide.

      Parameters:
      policyMode - Indicates whether the policy's engines enforce their verdicts or only report them. In ENFORCE mode, the firewall engine and IPS engine apply their verdicts to traffic. In MONITOR mode, the engines evaluate traffic and generate logs and metrics, but don't block traffic, so you can observe how a policy would behave before you enforce it. For more information, see Next Generation policies in the Network Firewall Developer Guide.
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • policyMode

      FirewallPolicyV2.Builder policyMode(PolicyMode policyMode)

      Indicates whether the policy's engines enforce their verdicts or only report them. In ENFORCE mode, the firewall engine and IPS engine apply their verdicts to traffic. In MONITOR mode, the engines evaluate traffic and generate logs and metrics, but don't block traffic, so you can observe how a policy would behave before you enforce it. For more information, see Next Generation policies in the Network Firewall Developer Guide.

      Parameters:
      policyMode - Indicates whether the policy's engines enforce their verdicts or only report them. In ENFORCE mode, the firewall engine and IPS engine apply their verdicts to traffic. In MONITOR mode, the engines evaluate traffic and generate logs and metrics, but don't block traffic, so you can observe how a policy would behave before you enforce it. For more information, see Next Generation policies in the Network Firewall Developer Guide.
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • firewallDefaultAction

      FirewallPolicyV2.Builder firewallDefaultAction(String firewallDefaultAction)

      The action that the firewall engine takes on traffic that doesn't match any firewall engine rule at a hook. The firewall engine is drop by default. You can set the default action to one of the following:

      • DROP - Block the traffic.

      • ACCEPT - Allow the traffic.

      • REJECT - Block the traffic and send a TCP reset packet back to the client.

      • ALERT - Allow the traffic and generate an alert log for the traffic that reaches the default action at every hook. This is distinct from setting the policy mode to MONITOR.

      For more information, see Next Generation policies in the Network Firewall Developer Guide.

      Parameters:
      firewallDefaultAction - The action that the firewall engine takes on traffic that doesn't match any firewall engine rule at a hook. The firewall engine is drop by default. You can set the default action to one of the following:

      • DROP - Block the traffic.

      • ACCEPT - Allow the traffic.

      • REJECT - Block the traffic and send a TCP reset packet back to the client.

      • ALERT - Allow the traffic and generate an alert log for the traffic that reaches the default action at every hook. This is distinct from setting the policy mode to MONITOR.

      For more information, see Next Generation policies in the Network Firewall Developer Guide.

      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • firewallDefaultAction

      FirewallPolicyV2.Builder firewallDefaultAction(PolicyDefaultAction firewallDefaultAction)

      The action that the firewall engine takes on traffic that doesn't match any firewall engine rule at a hook. The firewall engine is drop by default. You can set the default action to one of the following:

      • DROP - Block the traffic.

      • ACCEPT - Allow the traffic.

      • REJECT - Block the traffic and send a TCP reset packet back to the client.

      • ALERT - Allow the traffic and generate an alert log for the traffic that reaches the default action at every hook. This is distinct from setting the policy mode to MONITOR.

      For more information, see Next Generation policies in the Network Firewall Developer Guide.

      Parameters:
      firewallDefaultAction - The action that the firewall engine takes on traffic that doesn't match any firewall engine rule at a hook. The firewall engine is drop by default. You can set the default action to one of the following:

      • DROP - Block the traffic.

      • ACCEPT - Allow the traffic.

      • REJECT - Block the traffic and send a TCP reset packet back to the client.

      • ALERT - Allow the traffic and generate an alert log for the traffic that reaches the default action at every hook. This is distinct from setting the policy mode to MONITOR.

      For more information, see Next Generation policies in the Network Firewall Developer Guide.

      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • statefulEngineOptions

      FirewallPolicyV2.Builder statefulEngineOptions(StatefulEngineOptionsV2 statefulEngineOptions)

      Additional options governing how the engines handle stateful traffic, such as the stream exception policy and flow timeouts.

      Parameters:
      statefulEngineOptions - Additional options governing how the engines handle stateful traffic, such as the stream exception policy and flow timeouts.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • statefulEngineOptions

      default FirewallPolicyV2.Builder statefulEngineOptions(Consumer<StatefulEngineOptionsV2.Builder> statefulEngineOptions)

      Additional options governing how the engines handle stateful traffic, such as the stream exception policy and flow timeouts.

      This is a convenience method that creates an instance of the StatefulEngineOptionsV2.Builder avoiding the need to create one manually via StatefulEngineOptionsV2.builder().

      When the Consumer completes, SdkBuilder.build() is called immediately and its result is passed to statefulEngineOptions(StatefulEngineOptionsV2).

      Parameters:
      statefulEngineOptions - a consumer that will call methods on StatefulEngineOptionsV2.Builder
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • tlsInspectionConfigurationArn

      FirewallPolicyV2.Builder tlsInspectionConfigurationArn(String tlsInspectionConfigurationArn)

      The Amazon Resource Name (ARN) of the TLS inspection configuration to use to decrypt traffic for inspection. Next Generation policies support session holding only. For more information, see Inspecting SSL/TLS traffic with TLS inspection configurations in the Network Firewall Developer Guide.

      Parameters:
      tlsInspectionConfigurationArn - The Amazon Resource Name (ARN) of the TLS inspection configuration to use to decrypt traffic for inspection. Next Generation policies support session holding only. For more information, see Inspecting SSL/TLS traffic with TLS inspection configurations in the Network Firewall Developer Guide.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • policyVariables

      FirewallPolicyV2.Builder policyVariables(PolicyVariables policyVariables)

      Contains variables that you can use to override default Suricata settings in your Next Generation policy.

      Parameters:
      policyVariables - Contains variables that you can use to override default Suricata settings in your Next Generation policy.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • policyVariables

      default FirewallPolicyV2.Builder policyVariables(Consumer<PolicyVariables.Builder> policyVariables)

      Contains variables that you can use to override default Suricata settings in your Next Generation policy.

      This is a convenience method that creates an instance of the PolicyVariables.Builder avoiding the need to create one manually via PolicyVariables.builder().

      When the Consumer completes, SdkBuilder.build() is called immediately and its result is passed to policyVariables(PolicyVariables).

      Parameters:
      policyVariables - a consumer that will call methods on PolicyVariables.Builder
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • route53ResolvedIPValidation

      FirewallPolicyV2.Builder route53ResolvedIPValidation(Route53ResolvedIPValidation route53ResolvedIPValidation)

      The settings that enable resolved IP validation for the Next Generation policy. Resolved IP validation verifies that a connection's destination IP address is one that the Amazon Route 53 Resolver returned in a DNS response for a domain. A VPC that's associated with the Route 53 Resolver DNS Firewall rule group that you specify must send the response. This checks how the destination IP address was obtained, instead of relying only on the domain that the client asserts in its TLS Server Name Indication (SNI) or HTTP Host header. For more information, see Route53ResolvedIPValidation.

      Parameters:
      route53ResolvedIPValidation - The settings that enable resolved IP validation for the Next Generation policy. Resolved IP validation verifies that a connection's destination IP address is one that the Amazon Route 53 Resolver returned in a DNS response for a domain. A VPC that's associated with the Route 53 Resolver DNS Firewall rule group that you specify must send the response. This checks how the destination IP address was obtained, instead of relying only on the domain that the client asserts in its TLS Server Name Indication (SNI) or HTTP Host header. For more information, see Route53ResolvedIPValidation.
      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • route53ResolvedIPValidation

      default FirewallPolicyV2.Builder route53ResolvedIPValidation(Consumer<Route53ResolvedIPValidation.Builder> route53ResolvedIPValidation)

      The settings that enable resolved IP validation for the Next Generation policy. Resolved IP validation verifies that a connection's destination IP address is one that the Amazon Route 53 Resolver returned in a DNS response for a domain. A VPC that's associated with the Route 53 Resolver DNS Firewall rule group that you specify must send the response. This checks how the destination IP address was obtained, instead of relying only on the domain that the client asserts in its TLS Server Name Indication (SNI) or HTTP Host header. For more information, see Route53ResolvedIPValidation.

      This is a convenience method that creates an instance of the Route53ResolvedIPValidation.Builder avoiding the need to create one manually via Route53ResolvedIPValidation.builder().

      When the Consumer completes, SdkBuilder.build() is called immediately and its result is passed to route53ResolvedIPValidation(Route53ResolvedIPValidation).

      Parameters:
      route53ResolvedIPValidation - a consumer that will call methods on Route53ResolvedIPValidation.Builder
      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also: