Interface RulesSourceList.Builder

All Superinterfaces:
Buildable, CopyableBuilder<RulesSourceList.Builder,RulesSourceList>, SdkBuilder<RulesSourceList.Builder,RulesSourceList>, SdkPojo
Enclosing class:
RulesSourceList
@Mutable @NotThreadSafe public static interface RulesSourceList.Builder extends SdkPojo, CopyableBuilder<RulesSourceList.Builder,RulesSourceList>

  • Method Details

    • targets

      RulesSourceList.Builder targets(Collection<String> targets)

      The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

      • Explicit names. For example, abc.example.com matches only the domain abc.example.com.

      • Names that use a domain wildcard, which you indicate with an initial '.'. For example, .example.com matches example.com and matches all subdomains of example.com, such as abc.example.com and www.example.com.

      Parameters:
      targets - The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

      • Explicit names. For example, abc.example.com matches only the domain abc.example.com.

      • Names that use a domain wildcard, which you indicate with an initial '.'. For example, .example.com matches example.com and matches all subdomains of example.com, such as abc.example.com and www.example.com.

      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • targets

      RulesSourceList.Builder targets(String... targets)

      The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

      • Explicit names. For example, abc.example.com matches only the domain abc.example.com.

      • Names that use a domain wildcard, which you indicate with an initial '.'. For example, .example.com matches example.com and matches all subdomains of example.com, such as abc.example.com and www.example.com.

      Parameters:
      targets - The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

      • Explicit names. For example, abc.example.com matches only the domain abc.example.com.

      • Names that use a domain wildcard, which you indicate with an initial '.'. For example, .example.com matches example.com and matches all subdomains of example.com, such as abc.example.com and www.example.com.

      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • targetTypesWithStrings

      RulesSourceList.Builder targetTypesWithStrings(Collection<String> targetTypes)

      The types of matching to perform against the domains in Targets. You can specify any combination of the following:

      • AWS_ROUTE_53_RESOLVED_DOMAIN – Match the domain against the domain that the Amazon Route 53 Resolver resolved the connection's destination IP address for.

      • HTTP_HOST – Match the domain against the Host header of HTTP traffic.

      • TLS_SNI – Match the domain against the Server Name Indication (SNI) of HTTPS traffic.

      AWS_ROUTE_53_RESOLVED_DOMAIN matches on how the destination IP address was resolved, rather than on the domain that the client asserts in its TLS SNI or HTTP Host header. This target type takes effect when you configure resolved IP validation on the firewall policy. For more information, see Route53ResolvedIPValidation.

      Whether you include AWS_ROUTE_53_RESOLVED_DOMAIN changes what the generated rules match, together with GeneratedRulesType:

      • Combining AWS_ROUTE_53_RESOLVED_DOMAIN with TLS_SNI or HTTP_HOST in an ALLOWLIST requires both conditions to match. The SNI or Host header must match the domain, and the Route 53 Resolver must have resolved the destination IP address for that domain. Network Firewall allows traffic only in that case. Traffic that matches one condition, such as a spoofed Host header sent to an unresolved IP address, is not allowed.

      • In a DENYLIST, or when AWS_ROUTE_53_RESOLVED_DOMAIN is the only target type, Network Firewall evaluates each condition independently: a match on either the domain (SNI or Host) or the resolved destination IP address triggers the rule.

      • When you don't include AWS_ROUTE_53_RESOLVED_DOMAIN, the generated rules match only on the SNI or Host header, without checking how the destination IP address was resolved.

      An ALLOWLIST whose only target type is AWS_ROUTE_53_RESOLVED_DOMAIN is additive: it allows matching traffic but doesn't generate a default rule that drops non-matching traffic. Only the TLS_SNI and HTTP_HOST target types generate that default drop. To allow only the resolved domains and drop all other traffic, include a protocol target type as well.

      Parameters:
      targetTypes - The types of matching to perform against the domains in Targets. You can specify any combination of the following:

      • AWS_ROUTE_53_RESOLVED_DOMAIN – Match the domain against the domain that the Amazon Route 53 Resolver resolved the connection's destination IP address for.

      • HTTP_HOST – Match the domain against the Host header of HTTP traffic.

      • TLS_SNI – Match the domain against the Server Name Indication (SNI) of HTTPS traffic.

      AWS_ROUTE_53_RESOLVED_DOMAIN matches on how the destination IP address was resolved, rather than on the domain that the client asserts in its TLS SNI or HTTP Host header. This target type takes effect when you configure resolved IP validation on the firewall policy. For more information, see Route53ResolvedIPValidation.

      Whether you include AWS_ROUTE_53_RESOLVED_DOMAIN changes what the generated rules match, together with GeneratedRulesType:

      • Combining AWS_ROUTE_53_RESOLVED_DOMAIN with TLS_SNI or HTTP_HOST in an ALLOWLIST requires both conditions to match. The SNI or Host header must match the domain, and the Route 53 Resolver must have resolved the destination IP address for that domain. Network Firewall allows traffic only in that case. Traffic that matches one condition, such as a spoofed Host header sent to an unresolved IP address, is not allowed.

      • In a DENYLIST, or when AWS_ROUTE_53_RESOLVED_DOMAIN is the only target type, Network Firewall evaluates each condition independently: a match on either the domain (SNI or Host) or the resolved destination IP address triggers the rule.

      • When you don't include AWS_ROUTE_53_RESOLVED_DOMAIN, the generated rules match only on the SNI or Host header, without checking how the destination IP address was resolved.

      An ALLOWLIST whose only target type is AWS_ROUTE_53_RESOLVED_DOMAIN is additive: it allows matching traffic but doesn't generate a default rule that drops non-matching traffic. Only the TLS_SNI and HTTP_HOST target types generate that default drop. To allow only the resolved domains and drop all other traffic, include a protocol target type as well.

      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • targetTypesWithStrings

      RulesSourceList.Builder targetTypesWithStrings(String... targetTypes)

      The types of matching to perform against the domains in Targets. You can specify any combination of the following:

      • AWS_ROUTE_53_RESOLVED_DOMAIN – Match the domain against the domain that the Amazon Route 53 Resolver resolved the connection's destination IP address for.

      • HTTP_HOST – Match the domain against the Host header of HTTP traffic.

      • TLS_SNI – Match the domain against the Server Name Indication (SNI) of HTTPS traffic.

      AWS_ROUTE_53_RESOLVED_DOMAIN matches on how the destination IP address was resolved, rather than on the domain that the client asserts in its TLS SNI or HTTP Host header. This target type takes effect when you configure resolved IP validation on the firewall policy. For more information, see Route53ResolvedIPValidation.

      Whether you include AWS_ROUTE_53_RESOLVED_DOMAIN changes what the generated rules match, together with GeneratedRulesType:

      • Combining AWS_ROUTE_53_RESOLVED_DOMAIN with TLS_SNI or HTTP_HOST in an ALLOWLIST requires both conditions to match. The SNI or Host header must match the domain, and the Route 53 Resolver must have resolved the destination IP address for that domain. Network Firewall allows traffic only in that case. Traffic that matches one condition, such as a spoofed Host header sent to an unresolved IP address, is not allowed.

      • In a DENYLIST, or when AWS_ROUTE_53_RESOLVED_DOMAIN is the only target type, Network Firewall evaluates each condition independently: a match on either the domain (SNI or Host) or the resolved destination IP address triggers the rule.

      • When you don't include AWS_ROUTE_53_RESOLVED_DOMAIN, the generated rules match only on the SNI or Host header, without checking how the destination IP address was resolved.

      An ALLOWLIST whose only target type is AWS_ROUTE_53_RESOLVED_DOMAIN is additive: it allows matching traffic but doesn't generate a default rule that drops non-matching traffic. Only the TLS_SNI and HTTP_HOST target types generate that default drop. To allow only the resolved domains and drop all other traffic, include a protocol target type as well.

      Parameters:
      targetTypes - The types of matching to perform against the domains in Targets. You can specify any combination of the following:

      • AWS_ROUTE_53_RESOLVED_DOMAIN – Match the domain against the domain that the Amazon Route 53 Resolver resolved the connection's destination IP address for.

      • HTTP_HOST – Match the domain against the Host header of HTTP traffic.

      • TLS_SNI – Match the domain against the Server Name Indication (SNI) of HTTPS traffic.

      AWS_ROUTE_53_RESOLVED_DOMAIN matches on how the destination IP address was resolved, rather than on the domain that the client asserts in its TLS SNI or HTTP Host header. This target type takes effect when you configure resolved IP validation on the firewall policy. For more information, see Route53ResolvedIPValidation.

      Whether you include AWS_ROUTE_53_RESOLVED_DOMAIN changes what the generated rules match, together with GeneratedRulesType:

      • Combining AWS_ROUTE_53_RESOLVED_DOMAIN with TLS_SNI or HTTP_HOST in an ALLOWLIST requires both conditions to match. The SNI or Host header must match the domain, and the Route 53 Resolver must have resolved the destination IP address for that domain. Network Firewall allows traffic only in that case. Traffic that matches one condition, such as a spoofed Host header sent to an unresolved IP address, is not allowed.

      • In a DENYLIST, or when AWS_ROUTE_53_RESOLVED_DOMAIN is the only target type, Network Firewall evaluates each condition independently: a match on either the domain (SNI or Host) or the resolved destination IP address triggers the rule.

      • When you don't include AWS_ROUTE_53_RESOLVED_DOMAIN, the generated rules match only on the SNI or Host header, without checking how the destination IP address was resolved.

      An ALLOWLIST whose only target type is AWS_ROUTE_53_RESOLVED_DOMAIN is additive: it allows matching traffic but doesn't generate a default rule that drops non-matching traffic. Only the TLS_SNI and HTTP_HOST target types generate that default drop. To allow only the resolved domains and drop all other traffic, include a protocol target type as well.

      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • targetTypes

      RulesSourceList.Builder targetTypes(Collection<TargetType> targetTypes)

      The types of matching to perform against the domains in Targets. You can specify any combination of the following:

      • AWS_ROUTE_53_RESOLVED_DOMAIN – Match the domain against the domain that the Amazon Route 53 Resolver resolved the connection's destination IP address for.

      • HTTP_HOST – Match the domain against the Host header of HTTP traffic.

      • TLS_SNI – Match the domain against the Server Name Indication (SNI) of HTTPS traffic.

      AWS_ROUTE_53_RESOLVED_DOMAIN matches on how the destination IP address was resolved, rather than on the domain that the client asserts in its TLS SNI or HTTP Host header. This target type takes effect when you configure resolved IP validation on the firewall policy. For more information, see Route53ResolvedIPValidation.

      Whether you include AWS_ROUTE_53_RESOLVED_DOMAIN changes what the generated rules match, together with GeneratedRulesType:

      • Combining AWS_ROUTE_53_RESOLVED_DOMAIN with TLS_SNI or HTTP_HOST in an ALLOWLIST requires both conditions to match. The SNI or Host header must match the domain, and the Route 53 Resolver must have resolved the destination IP address for that domain. Network Firewall allows traffic only in that case. Traffic that matches one condition, such as a spoofed Host header sent to an unresolved IP address, is not allowed.

      • In a DENYLIST, or when AWS_ROUTE_53_RESOLVED_DOMAIN is the only target type, Network Firewall evaluates each condition independently: a match on either the domain (SNI or Host) or the resolved destination IP address triggers the rule.

      • When you don't include AWS_ROUTE_53_RESOLVED_DOMAIN, the generated rules match only on the SNI or Host header, without checking how the destination IP address was resolved.

      An ALLOWLIST whose only target type is AWS_ROUTE_53_RESOLVED_DOMAIN is additive: it allows matching traffic but doesn't generate a default rule that drops non-matching traffic. Only the TLS_SNI and HTTP_HOST target types generate that default drop. To allow only the resolved domains and drop all other traffic, include a protocol target type as well.

      Parameters:
      targetTypes - The types of matching to perform against the domains in Targets. You can specify any combination of the following:

      • AWS_ROUTE_53_RESOLVED_DOMAIN – Match the domain against the domain that the Amazon Route 53 Resolver resolved the connection's destination IP address for.

      • HTTP_HOST – Match the domain against the Host header of HTTP traffic.

      • TLS_SNI – Match the domain against the Server Name Indication (SNI) of HTTPS traffic.

      AWS_ROUTE_53_RESOLVED_DOMAIN matches on how the destination IP address was resolved, rather than on the domain that the client asserts in its TLS SNI or HTTP Host header. This target type takes effect when you configure resolved IP validation on the firewall policy. For more information, see Route53ResolvedIPValidation.

      Whether you include AWS_ROUTE_53_RESOLVED_DOMAIN changes what the generated rules match, together with GeneratedRulesType:

      • Combining AWS_ROUTE_53_RESOLVED_DOMAIN with TLS_SNI or HTTP_HOST in an ALLOWLIST requires both conditions to match. The SNI or Host header must match the domain, and the Route 53 Resolver must have resolved the destination IP address for that domain. Network Firewall allows traffic only in that case. Traffic that matches one condition, such as a spoofed Host header sent to an unresolved IP address, is not allowed.

      • In a DENYLIST, or when AWS_ROUTE_53_RESOLVED_DOMAIN is the only target type, Network Firewall evaluates each condition independently: a match on either the domain (SNI or Host) or the resolved destination IP address triggers the rule.

      • When you don't include AWS_ROUTE_53_RESOLVED_DOMAIN, the generated rules match only on the SNI or Host header, without checking how the destination IP address was resolved.

      An ALLOWLIST whose only target type is AWS_ROUTE_53_RESOLVED_DOMAIN is additive: it allows matching traffic but doesn't generate a default rule that drops non-matching traffic. Only the TLS_SNI and HTTP_HOST target types generate that default drop. To allow only the resolved domains and drop all other traffic, include a protocol target type as well.

      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • targetTypes

      RulesSourceList.Builder targetTypes(TargetType... targetTypes)

      The types of matching to perform against the domains in Targets. You can specify any combination of the following:

      • AWS_ROUTE_53_RESOLVED_DOMAIN – Match the domain against the domain that the Amazon Route 53 Resolver resolved the connection's destination IP address for.

      • HTTP_HOST – Match the domain against the Host header of HTTP traffic.

      • TLS_SNI – Match the domain against the Server Name Indication (SNI) of HTTPS traffic.

      AWS_ROUTE_53_RESOLVED_DOMAIN matches on how the destination IP address was resolved, rather than on the domain that the client asserts in its TLS SNI or HTTP Host header. This target type takes effect when you configure resolved IP validation on the firewall policy. For more information, see Route53ResolvedIPValidation.

      Whether you include AWS_ROUTE_53_RESOLVED_DOMAIN changes what the generated rules match, together with GeneratedRulesType:

      • Combining AWS_ROUTE_53_RESOLVED_DOMAIN with TLS_SNI or HTTP_HOST in an ALLOWLIST requires both conditions to match. The SNI or Host header must match the domain, and the Route 53 Resolver must have resolved the destination IP address for that domain. Network Firewall allows traffic only in that case. Traffic that matches one condition, such as a spoofed Host header sent to an unresolved IP address, is not allowed.

      • In a DENYLIST, or when AWS_ROUTE_53_RESOLVED_DOMAIN is the only target type, Network Firewall evaluates each condition independently: a match on either the domain (SNI or Host) or the resolved destination IP address triggers the rule.

      • When you don't include AWS_ROUTE_53_RESOLVED_DOMAIN, the generated rules match only on the SNI or Host header, without checking how the destination IP address was resolved.

      An ALLOWLIST whose only target type is AWS_ROUTE_53_RESOLVED_DOMAIN is additive: it allows matching traffic but doesn't generate a default rule that drops non-matching traffic. Only the TLS_SNI and HTTP_HOST target types generate that default drop. To allow only the resolved domains and drop all other traffic, include a protocol target type as well.

      Parameters:
      targetTypes - The types of matching to perform against the domains in Targets. You can specify any combination of the following:

      • AWS_ROUTE_53_RESOLVED_DOMAIN – Match the domain against the domain that the Amazon Route 53 Resolver resolved the connection's destination IP address for.

      • HTTP_HOST – Match the domain against the Host header of HTTP traffic.

      • TLS_SNI – Match the domain against the Server Name Indication (SNI) of HTTPS traffic.

      AWS_ROUTE_53_RESOLVED_DOMAIN matches on how the destination IP address was resolved, rather than on the domain that the client asserts in its TLS SNI or HTTP Host header. This target type takes effect when you configure resolved IP validation on the firewall policy. For more information, see Route53ResolvedIPValidation.

      Whether you include AWS_ROUTE_53_RESOLVED_DOMAIN changes what the generated rules match, together with GeneratedRulesType:

      • Combining AWS_ROUTE_53_RESOLVED_DOMAIN with TLS_SNI or HTTP_HOST in an ALLOWLIST requires both conditions to match. The SNI or Host header must match the domain, and the Route 53 Resolver must have resolved the destination IP address for that domain. Network Firewall allows traffic only in that case. Traffic that matches one condition, such as a spoofed Host header sent to an unresolved IP address, is not allowed.

      • In a DENYLIST, or when AWS_ROUTE_53_RESOLVED_DOMAIN is the only target type, Network Firewall evaluates each condition independently: a match on either the domain (SNI or Host) or the resolved destination IP address triggers the rule.

      • When you don't include AWS_ROUTE_53_RESOLVED_DOMAIN, the generated rules match only on the SNI or Host header, without checking how the destination IP address was resolved.

      An ALLOWLIST whose only target type is AWS_ROUTE_53_RESOLVED_DOMAIN is additive: it allows matching traffic but doesn't generate a default rule that drops non-matching traffic. Only the TLS_SNI and HTTP_HOST target types generate that default drop. To allow only the resolved domains and drop all other traffic, include a protocol target type as well.

      Returns:
      Returns a reference to this object so that method calls can be chained together.

    • generatedRulesType

      RulesSourceList.Builder generatedRulesType(String generatedRulesType)

      Whether you want to apply allow, reject, alert, or drop behavior to the domains in your target list.

      When logging is enabled and you choose Alert, traffic that matches the domain specifications generates an alert in the firewall's logs. Then, traffic either passes, is rejected, or drops based on other rules in the firewall policy.

      Parameters:
      generatedRulesType - Whether you want to apply allow, reject, alert, or drop behavior to the domains in your target list.

      When logging is enabled and you choose Alert, traffic that matches the domain specifications generates an alert in the firewall's logs. Then, traffic either passes, is rejected, or drops based on other rules in the firewall policy.

      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also:

    • generatedRulesType

      RulesSourceList.Builder generatedRulesType(GeneratedRulesType generatedRulesType)

      Whether you want to apply allow, reject, alert, or drop behavior to the domains in your target list.

      When logging is enabled and you choose Alert, traffic that matches the domain specifications generates an alert in the firewall's logs. Then, traffic either passes, is rejected, or drops based on other rules in the firewall policy.

      Parameters:
      generatedRulesType - Whether you want to apply allow, reject, alert, or drop behavior to the domains in your target list.

      When logging is enabled and you choose Alert, traffic that matches the domain specifications generates an alert in the firewall's logs. Then, traffic either passes, is rejected, or drops based on other rules in the firewall policy.

      Returns:
      Returns a reference to this object so that method calls can be chained together.
      See Also: