Class Route53ResolvedIPValidation

java.lang.Object
software.amazon.awssdk.services.networkfirewall.model.Route53ResolvedIPValidation
All Implemented Interfaces:
Serializable, SdkPojo, ToCopyableBuilder<Route53ResolvedIPValidation.Builder,Route53ResolvedIPValidation>
@Generated("software.amazon.awssdk:codegen") public final class Route53ResolvedIPValidation extends Object implements SdkPojo, Serializable, ToCopyableBuilder<Route53ResolvedIPValidation.Builder,Route53ResolvedIPValidation>

The policy-level configuration for resolved IP validation. When you set this on a firewall policy, you require that the destination IP address of a connection is one that the Amazon Route 53 Resolver returned in a DNS response for a domain. The Route 53 Resolver must have returned the response in a VPC that's associated with the Route 53 Resolver DNS Firewall rule group identified by DNSFirewallRuleGroupId. At the policy level, this verifies that the destination IP address was resolved for some domain. To match specific domains, also configure stateful rule groups that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain rule keyword.

See Also:

  • Method Details

    • action

      public final Route53ResolvedIPValidationAction action()

      The action that Network Firewall takes for a connection whose destination IP address fails resolved IP validation. A destination IP address fails validation when the Route 53 Resolver didn't return it in a DNS response in an associated VPC. Valid values are the following:

      • ALERT – Tags the matching connection in the firewall's flow logs without blocking it, when you enable logging. Use this to observe the effect of resolved IP validation before you enforce it.

      • DROP – Silently blocks the connection without sending any response to the client.

      • REJECT – Blocks the connection and sends a TCP reset (RST) to the client. Because a TCP reset applies only to TCP connections, Network Firewall drops non-TCP traffic instead of resetting it.

      If the service returns an enum value that is not available in the current SDK version, action will return Route53ResolvedIPValidationAction.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from actionAsString().

      Returns:
      The action that Network Firewall takes for a connection whose destination IP address fails resolved IP validation. A destination IP address fails validation when the Route 53 Resolver didn't return it in a DNS response in an associated VPC. Valid values are the following:

      • ALERT – Tags the matching connection in the firewall's flow logs without blocking it, when you enable logging. Use this to observe the effect of resolved IP validation before you enforce it.

      • DROP – Silently blocks the connection without sending any response to the client.

      • REJECT – Blocks the connection and sends a TCP reset (RST) to the client. Because a TCP reset applies only to TCP connections, Network Firewall drops non-TCP traffic instead of resetting it.

      See Also:

    • actionAsString

      public final String actionAsString()

      The action that Network Firewall takes for a connection whose destination IP address fails resolved IP validation. A destination IP address fails validation when the Route 53 Resolver didn't return it in a DNS response in an associated VPC. Valid values are the following:

      • ALERT – Tags the matching connection in the firewall's flow logs without blocking it, when you enable logging. Use this to observe the effect of resolved IP validation before you enforce it.

      • DROP – Silently blocks the connection without sending any response to the client.

      • REJECT – Blocks the connection and sends a TCP reset (RST) to the client. Because a TCP reset applies only to TCP connections, Network Firewall drops non-TCP traffic instead of resetting it.

      If the service returns an enum value that is not available in the current SDK version, action will return Route53ResolvedIPValidationAction.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from actionAsString().

      Returns:
      The action that Network Firewall takes for a connection whose destination IP address fails resolved IP validation. A destination IP address fails validation when the Route 53 Resolver didn't return it in a DNS response in an associated VPC. Valid values are the following:

      • ALERT – Tags the matching connection in the firewall's flow logs without blocking it, when you enable logging. Use this to observe the effect of resolved IP validation before you enforce it.

      • DROP – Silently blocks the connection without sending any response to the client.

      • REJECT – Blocks the connection and sends a TCP reset (RST) to the client. Because a TCP reset applies only to TCP connections, Network Firewall drops non-TCP traffic instead of resetting it.

      See Also:

    • dnsFirewallRuleGroupId

      public final String dnsFirewallRuleGroupId()

      The ID of the Route 53 Resolver DNS Firewall rule group that determines which VPCs' DNS resolutions count for resolved IP validation. A destination IP address counts as resolved for a domain only when the Route 53 Resolver returned it in a DNS response within a VPC that's associated with this rule group. Associate the rule group with the VPCs that send traffic to the firewall. The ID must match the pattern ^rslvr-frg-[0-9a-f]+$. It must also exist and be accessible from your account. Network Firewall validates this when you create or update the policy.

      Changing this value swaps the managed rule group association. Network Firewall processes the swap asynchronously. Each policy can have only one managed Route 53 Resolver DNS Firewall association. While a swap is in progress, Network Firewall rejects further changes to this setting. Wait until the swap completes, then retry.

      Returns:
      The ID of the Route 53 Resolver DNS Firewall rule group that determines which VPCs' DNS resolutions count for resolved IP validation. A destination IP address counts as resolved for a domain only when the Route 53 Resolver returned it in a DNS response within a VPC that's associated with this rule group. Associate the rule group with the VPCs that send traffic to the firewall. The ID must match the pattern ^rslvr-frg-[0-9a-f]+$. It must also exist and be accessible from your account. Network Firewall validates this when you create or update the policy.

      Changing this value swaps the managed rule group association. Network Firewall processes the swap asynchronously. Each policy can have only one managed Route 53 Resolver DNS Firewall association. While a swap is in progress, Network Firewall rejects further changes to this setting. Wait until the swap completes, then retry.

    • dnsExpiryExceptionPolicy

      public final DNSExpiryExceptionPolicy dnsExpiryExceptionPolicy()

      The action that Network Firewall takes when the DNS resolution recorded for a destination IP address has expired from the resolved IP cache. This applies when Network Firewall still sees traffic to that IP address after the expiry. Network Firewall keeps a resolution for longer than the DNS record's time to live (TTL). Valid values are the following:

      • CONTINUE – Treats the expired resolution as still valid and doesn't block the connection because of expiry.

      • DROP – Silently blocks traffic to the IP address after its resolution has expired, without sending any response to the client.

      • REJECT – Blocks traffic to the IP address after its resolution has expired and sends a TCP reset (RST) to the client. Network Firewall drops non-TCP traffic instead of resetting it.

      If the service returns an enum value that is not available in the current SDK version, dnsExpiryExceptionPolicy will return DNSExpiryExceptionPolicy.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from dnsExpiryExceptionPolicyAsString().

      Returns:
      The action that Network Firewall takes when the DNS resolution recorded for a destination IP address has expired from the resolved IP cache. This applies when Network Firewall still sees traffic to that IP address after the expiry. Network Firewall keeps a resolution for longer than the DNS record's time to live (TTL). Valid values are the following:

      • CONTINUE – Treats the expired resolution as still valid and doesn't block the connection because of expiry.

      • DROP – Silently blocks traffic to the IP address after its resolution has expired, without sending any response to the client.

      • REJECT – Blocks traffic to the IP address after its resolution has expired and sends a TCP reset (RST) to the client. Network Firewall drops non-TCP traffic instead of resetting it.

      See Also:

    • dnsExpiryExceptionPolicyAsString

      public final String dnsExpiryExceptionPolicyAsString()

      The action that Network Firewall takes when the DNS resolution recorded for a destination IP address has expired from the resolved IP cache. This applies when Network Firewall still sees traffic to that IP address after the expiry. Network Firewall keeps a resolution for longer than the DNS record's time to live (TTL). Valid values are the following:

      • CONTINUE – Treats the expired resolution as still valid and doesn't block the connection because of expiry.

      • DROP – Silently blocks traffic to the IP address after its resolution has expired, without sending any response to the client.

      • REJECT – Blocks traffic to the IP address after its resolution has expired and sends a TCP reset (RST) to the client. Network Firewall drops non-TCP traffic instead of resetting it.

      If the service returns an enum value that is not available in the current SDK version, dnsExpiryExceptionPolicy will return DNSExpiryExceptionPolicy.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from dnsExpiryExceptionPolicyAsString().

      Returns:
      The action that Network Firewall takes when the DNS resolution recorded for a destination IP address has expired from the resolved IP cache. This applies when Network Firewall still sees traffic to that IP address after the expiry. Network Firewall keeps a resolution for longer than the DNS record's time to live (TTL). Valid values are the following:

      • CONTINUE – Treats the expired resolution as still valid and doesn't block the connection because of expiry.

      • DROP – Silently blocks traffic to the IP address after its resolution has expired, without sending any response to the client.

      • REJECT – Blocks traffic to the IP address after its resolution has expired and sends a TCP reset (RST) to the client. Network Firewall drops non-TCP traffic instead of resetting it.

      See Also:

    • hasBypassDestinationValidationIPRanges

      public final boolean hasBypassDestinationValidationIPRanges()
      For responses, this returns true if the service returned a value for the BypassDestinationValidationIPRanges property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

    • bypassDestinationValidationIPRanges

      public final List<Address> bypassDestinationValidationIPRanges()

      The destination IP address ranges that are exempt from the policy-level resolved IP check. Network Firewall doesn't apply the Action in this configuration to a connection whose destination falls in these ranges, even if the Route 53 Resolver didn't return that IP address in an associated VPC. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries.

      This exemption applies only to the policy-level check. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate connections to these destinations and match them independently of this list.

      Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

      This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasBypassDestinationValidationIPRanges() method.

      Returns:
      The destination IP address ranges that are exempt from the policy-level resolved IP check. Network Firewall doesn't apply the Action in this configuration to a connection whose destination falls in these ranges, even if the Route 53 Resolver didn't return that IP address in an associated VPC. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries.

      This exemption applies only to the policy-level check. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate connections to these destinations and match them independently of this list.

    • hasSourceIPRanges

      public final boolean hasSourceIPRanges()
      For responses, this returns true if the service returned a value for the SourceIPRanges property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

    • sourceIPRanges

      public final List<Address> sourceIPRanges()

      The client source IP address ranges whose connections are subject to resolved IP validation. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries. If you omit this field, resolved IP validation applies to the CIDR ranges of the firewall's VPC and of any additional VPCs attached to the firewall. Specifying an empty list is not the same as omitting the field: an empty list means that Network Firewall doesn't validate any source addresses.

      This scope applies to the policy-level check only. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate their destinations regardless of SourceIPRanges.

      Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

      This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasSourceIPRanges() method.

      Returns:
      The client source IP address ranges whose connections are subject to resolved IP validation. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries. If you omit this field, resolved IP validation applies to the CIDR ranges of the firewall's VPC and of any additional VPCs attached to the firewall. Specifying an empty list is not the same as omitting the field: an empty list means that Network Firewall doesn't validate any source addresses.

      This scope applies to the policy-level check only. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate their destinations regardless of SourceIPRanges.

    • toBuilder

      public Route53ResolvedIPValidation.Builder toBuilder()
      Description copied from interface: ToCopyableBuilder
      Take this object and create a builder that contains all of the current property values of this object.
      Specified by:
      toBuilder in interface ToCopyableBuilder<Route53ResolvedIPValidation.Builder,Route53ResolvedIPValidation>
      Returns:
      a builder for type T

    • builder

      public static Route53ResolvedIPValidation.Builder builder()

    • serializableBuilderClass

      public static Class<? extends Route53ResolvedIPValidation.Builder> serializableBuilderClass()

    • hashCode

      public final int hashCode()
      Overrides:
      hashCode in class Object

    • equals

      public final boolean equals(Object obj)
      Overrides:
      equals in class Object

    • equalsBySdkFields

      public final boolean equalsBySdkFields(Object obj)
      Description copied from interface: SdkPojo
      Indicates whether some other object is "equal to" this one by SDK fields. An SDK field is a modeled, non-inherited field in an SdkPojo class, and is generated based on a service model.

      If an SdkPojo class does not have any inherited fields, equalsBySdkFields and equals are essentially the same.

      Specified by:
      equalsBySdkFields in interface SdkPojo
      Parameters:
      obj - the object to be compared with
      Returns:
      true if the other object equals to this object by sdk fields, false otherwise.

    • toString

      public final String toString()
      Returns a string representation of this object. This is useful for testing and debugging. Sensitive data will be redacted from this string using a placeholder value.
      Overrides:
      toString in class Object

    • getValueForField

      public final <T> Optional<T> getValueForField(String fieldName, Class<T> clazz)

    • sdkFields

      public final List<SdkField<?>> sdkFields()
      Specified by:
      sdkFields in interface SdkPojo
      Returns:
      List of SdkField in this POJO. May be empty list but should never be null.

    • sdkFieldNameToField

      public final Map<String,SdkField<?>> sdkFieldNameToField()
      Specified by:
      sdkFieldNameToField in interface SdkPojo
      Returns:
      The mapping between the field name and its corresponding field.