Class FirewallPolicyV2

java.lang.Object
software.amazon.awssdk.services.networkfirewall.model.FirewallPolicyV2
All Implemented Interfaces:
Serializable, SdkPojo, ToCopyableBuilder<FirewallPolicyV2.Builder,FirewallPolicyV2>
@Generated("software.amazon.awssdk:codegen") public final class FirewallPolicyV2 extends Object implements SdkPojo, Serializable, ToCopyableBuilder<FirewallPolicyV2.Builder,FirewallPolicyV2>

The object that defines a Next Generation policy. This, along with the FirewallPolicyV2Response, define the policy.

A Next Generation policy defines how the firewall engine and IPS engine inspect and control your VPC network traffic. You define the policy as a firewall section and an IPS section, each a collection of rule groups, along with policy-wide settings such as the policy mode and default actions. For more information, see Next Generation policies in the Network Firewall Developer Guide.

See Also:

  • Method Details

    • hasFirewallRuleGroupEntries

      public final boolean hasFirewallRuleGroupEntries()
      For responses, this returns true if the service returned a value for the FirewallRuleGroupEntries property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

    • firewallRuleGroupEntries

      public final List<FirewallRuleGroupEntry> firewallRuleGroupEntries()

      The firewall section of the policy—the rule groups that the firewall engine evaluates. Each entry references an existing firewall engine rule group or embeds a rule group directly in the policy, and each entry has a unique priority that sets its evaluation order within the section.

      Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

      This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasFirewallRuleGroupEntries() method.

      Returns:
      The firewall section of the policy—the rule groups that the firewall engine evaluates. Each entry references an existing firewall engine rule group or embeds a rule group directly in the policy, and each entry has a unique priority that sets its evaluation order within the section.

    • hasIpsRuleGroupEntries

      public final boolean hasIpsRuleGroupEntries()
      For responses, this returns true if the service returned a value for the IpsRuleGroupEntries property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

    • ipsRuleGroupEntries

      public final List<IpsRuleGroupEntry> ipsRuleGroupEntries()

      The IPS section of the policy—the rule groups that the IPS engine evaluates. Each entry references an existing IPS engine rule group or embeds a rule group directly in the policy. IPS section entries don't use a priority.

      Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

      This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasIpsRuleGroupEntries() method.

      Returns:
      The IPS section of the policy—the rule groups that the IPS engine evaluates. Each entry references an existing IPS engine rule group or embeds a rule group directly in the policy. IPS section entries don't use a priority.

    • policyMode

      public final PolicyMode policyMode()

      Indicates whether the policy's engines enforce their verdicts or only report them. In ENFORCE mode, the firewall engine and IPS engine apply their verdicts to traffic. In MONITOR mode, the engines evaluate traffic and generate logs and metrics, but don't block traffic, so you can observe how a policy would behave before you enforce it. For more information, see Next Generation policies in the Network Firewall Developer Guide.

      If the service returns an enum value that is not available in the current SDK version, policyMode will return PolicyMode.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from policyModeAsString().

      Returns:
      Indicates whether the policy's engines enforce their verdicts or only report them. In ENFORCE mode, the firewall engine and IPS engine apply their verdicts to traffic. In MONITOR mode, the engines evaluate traffic and generate logs and metrics, but don't block traffic, so you can observe how a policy would behave before you enforce it. For more information, see Next Generation policies in the Network Firewall Developer Guide.
      See Also:

    • policyModeAsString

      public final String policyModeAsString()

      Indicates whether the policy's engines enforce their verdicts or only report them. In ENFORCE mode, the firewall engine and IPS engine apply their verdicts to traffic. In MONITOR mode, the engines evaluate traffic and generate logs and metrics, but don't block traffic, so you can observe how a policy would behave before you enforce it. For more information, see Next Generation policies in the Network Firewall Developer Guide.

      If the service returns an enum value that is not available in the current SDK version, policyMode will return PolicyMode.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from policyModeAsString().

      Returns:
      Indicates whether the policy's engines enforce their verdicts or only report them. In ENFORCE mode, the firewall engine and IPS engine apply their verdicts to traffic. In MONITOR mode, the engines evaluate traffic and generate logs and metrics, but don't block traffic, so you can observe how a policy would behave before you enforce it. For more information, see Next Generation policies in the Network Firewall Developer Guide.
      See Also:

    • firewallDefaultAction

      public final PolicyDefaultAction firewallDefaultAction()

      The action that the firewall engine takes on traffic that doesn't match any firewall engine rule at a hook. The firewall engine is drop by default. You can set the default action to one of the following:

      • DROP - Block the traffic.

      • ACCEPT - Allow the traffic.

      • REJECT - Block the traffic and send a TCP reset packet back to the client.

      • ALERT - Allow the traffic and generate an alert log for the traffic that reaches the default action at every hook. This is distinct from setting the policy mode to MONITOR.

      For more information, see Next Generation policies in the Network Firewall Developer Guide.

      If the service returns an enum value that is not available in the current SDK version, firewallDefaultAction will return PolicyDefaultAction.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from firewallDefaultActionAsString().

      Returns:
      The action that the firewall engine takes on traffic that doesn't match any firewall engine rule at a hook. The firewall engine is drop by default. You can set the default action to one of the following:

      • DROP - Block the traffic.

      • ACCEPT - Allow the traffic.

      • REJECT - Block the traffic and send a TCP reset packet back to the client.

      • ALERT - Allow the traffic and generate an alert log for the traffic that reaches the default action at every hook. This is distinct from setting the policy mode to MONITOR.

      For more information, see Next Generation policies in the Network Firewall Developer Guide.

      See Also:

    • firewallDefaultActionAsString

      public final String firewallDefaultActionAsString()

      The action that the firewall engine takes on traffic that doesn't match any firewall engine rule at a hook. The firewall engine is drop by default. You can set the default action to one of the following:

      • DROP - Block the traffic.

      • ACCEPT - Allow the traffic.

      • REJECT - Block the traffic and send a TCP reset packet back to the client.

      • ALERT - Allow the traffic and generate an alert log for the traffic that reaches the default action at every hook. This is distinct from setting the policy mode to MONITOR.

      For more information, see Next Generation policies in the Network Firewall Developer Guide.

      If the service returns an enum value that is not available in the current SDK version, firewallDefaultAction will return PolicyDefaultAction.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from firewallDefaultActionAsString().

      Returns:
      The action that the firewall engine takes on traffic that doesn't match any firewall engine rule at a hook. The firewall engine is drop by default. You can set the default action to one of the following:

      • DROP - Block the traffic.

      • ACCEPT - Allow the traffic.

      • REJECT - Block the traffic and send a TCP reset packet back to the client.

      • ALERT - Allow the traffic and generate an alert log for the traffic that reaches the default action at every hook. This is distinct from setting the policy mode to MONITOR.

      For more information, see Next Generation policies in the Network Firewall Developer Guide.

      See Also:

    • statefulEngineOptions

      public final StatefulEngineOptionsV2 statefulEngineOptions()

      Additional options governing how the engines handle stateful traffic, such as the stream exception policy and flow timeouts.

      Returns:
      Additional options governing how the engines handle stateful traffic, such as the stream exception policy and flow timeouts.

    • tlsInspectionConfigurationArn

      public final String tlsInspectionConfigurationArn()

      The Amazon Resource Name (ARN) of the TLS inspection configuration to use to decrypt traffic for inspection. Next Generation policies support session holding only. For more information, see Inspecting SSL/TLS traffic with TLS inspection configurations in the Network Firewall Developer Guide.

      Returns:
      The Amazon Resource Name (ARN) of the TLS inspection configuration to use to decrypt traffic for inspection. Next Generation policies support session holding only. For more information, see Inspecting SSL/TLS traffic with TLS inspection configurations in the Network Firewall Developer Guide.

    • policyVariables

      public final PolicyVariables policyVariables()

      Contains variables that you can use to override default Suricata settings in your Next Generation policy.

      Returns:
      Contains variables that you can use to override default Suricata settings in your Next Generation policy.

    • route53ResolvedIPValidation

      public final Route53ResolvedIPValidation route53ResolvedIPValidation()

      The settings that enable resolved IP validation for the Next Generation policy. Resolved IP validation verifies that a connection's destination IP address is one that the Amazon Route 53 Resolver returned in a DNS response for a domain. A VPC that's associated with the Route 53 Resolver DNS Firewall rule group that you specify must send the response. This checks how the destination IP address was obtained, instead of relying only on the domain that the client asserts in its TLS Server Name Indication (SNI) or HTTP Host header. For more information, see Route53ResolvedIPValidation.

      Returns:
      The settings that enable resolved IP validation for the Next Generation policy. Resolved IP validation verifies that a connection's destination IP address is one that the Amazon Route 53 Resolver returned in a DNS response for a domain. A VPC that's associated with the Route 53 Resolver DNS Firewall rule group that you specify must send the response. This checks how the destination IP address was obtained, instead of relying only on the domain that the client asserts in its TLS Server Name Indication (SNI) or HTTP Host header. For more information, see Route53ResolvedIPValidation.

    • toBuilder

      public FirewallPolicyV2.Builder toBuilder()
      Description copied from interface: ToCopyableBuilder
      Take this object and create a builder that contains all of the current property values of this object.
      Specified by:
      toBuilder in interface ToCopyableBuilder<FirewallPolicyV2.Builder,FirewallPolicyV2>
      Returns:
      a builder for type T

    • builder

      public static FirewallPolicyV2.Builder builder()

    • serializableBuilderClass

      public static Class<? extends FirewallPolicyV2.Builder> serializableBuilderClass()

    • hashCode

      public final int hashCode()
      Overrides:
      hashCode in class Object

    • equals

      public final boolean equals(Object obj)
      Overrides:
      equals in class Object

    • equalsBySdkFields

      public final boolean equalsBySdkFields(Object obj)
      Description copied from interface: SdkPojo
      Indicates whether some other object is "equal to" this one by SDK fields. An SDK field is a modeled, non-inherited field in an SdkPojo class, and is generated based on a service model.

      If an SdkPojo class does not have any inherited fields, equalsBySdkFields and equals are essentially the same.

      Specified by:
      equalsBySdkFields in interface SdkPojo
      Parameters:
      obj - the object to be compared with
      Returns:
      true if the other object equals to this object by sdk fields, false otherwise.

    • toString

      public final String toString()
      Returns a string representation of this object. This is useful for testing and debugging. Sensitive data will be redacted from this string using a placeholder value.
      Overrides:
      toString in class Object

    • getValueForField

      public final <T> Optional<T> getValueForField(String fieldName, Class<T> clazz)

    • sdkFields

      public final List<SdkField<?>> sdkFields()
      Specified by:
      sdkFields in interface SdkPojo
      Returns:
      List of SdkField in this POJO. May be empty list but should never be null.

    • sdkFieldNameToField

      public final Map<String,SdkField<?>> sdkFieldNameToField()
      Specified by:
      sdkFieldNameToField in interface SdkPojo
      Returns:
      The mapping between the field name and its corresponding field.