Class: AWSCDK::FMS::CfnPolicy::NetworkAclEntryProperty

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
fms/cfn_policy.rb

Overview

Describes a rule in a network ACL.

Each network ACL has a set of numbered ingress rules and a separate set of numbered egress rules. When determining whether a packet should be allowed in or out of a subnet associated with the network ACL, AWS processes the entries in the network ACL according to the rule numbers, in ascending order.

When you manage an individual network ACL, you explicitly specify the rule numbers. When you specify the network ACL rules in a Firewall Manager policy, you provide the rules to run first, in the order that you want them to run, and the rules to run last, in the order that you want them to run. Firewall Manager assigns the rule numbers for you when you save the network ACL policy specification.

See Also:

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(egress:, protocol:, rule_action:, cidr_block: nil, icmp_type_code: nil, ipv6_cidr_block: nil, port_range: nil) ⇒ NetworkAclEntryProperty

Returns a new instance of NetworkAclEntryProperty.

Parameters:

  • egress (Boolean, AWSCDK::IResolvable) —

    Indicates whether the rule is an egress, or outbound, rule (applied to traffic leaving the subnet).

  • protocol (String) —

    The protocol number.

  • rule_action (String) —

    Indicates whether to allow or deny the traffic that matches the rule.

  • cidr_block (String, nil) (defaults to: nil) —

    The IPv4 network range to allow or deny, in CIDR notation.

  • icmp_type_code (AWSCDK::IResolvable, AWSCDK::FMS::CfnPolicy::IcmpTypeCodeProperty, nil) (defaults to: nil) —

    ICMP protocol: The ICMP type and code.

  • ipv6_cidr_block (String, nil) (defaults to: nil) —

    The IPv6 network range to allow or deny, in CIDR notation.

  • port_range (AWSCDK::IResolvable, AWSCDK::FMS::CfnPolicy::PortRangeProperty, nil) (defaults to: nil) —

    TCP or UDP protocols: The range of ports the rule applies to.



874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
 
# File 'fms/cfn_policy.rb', line 874

def initialize(egress:, protocol:, rule_action:, cidr_block: nil, icmp_type_code: nil, ipv6_cidr_block: nil, port_range: nil)
  @egress = egress
  Jsii::Type.check_type(@egress, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3sicHJpbWl0aXZlIjoiYm9vbGVhbiJ9LHsiZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifV19fQ==")), "egress")
  @protocol = protocol
  Jsii::Type.check_type(@protocol, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "protocol")
  @rule_action = rule_action
  Jsii::Type.check_type(@rule_action, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "ruleAction")
  @cidr_block = cidr_block
  Jsii::Type.check_type(@cidr_block, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "cidrBlock") unless @cidr_block.nil?
  @icmp_type_code = icmp_type_code.is_a?(Hash) ? ::AWSCDK::FMS::CfnPolicy::IcmpTypeCodeProperty.new(**icmp_type_code.transform_keys(&:to_sym)) : icmp_type_code
  Jsii::Type.check_type(@icmp_type_code, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImZxbiI6ImF3cy1jZGstbGliLmF3c19mbXMuQ2ZuUG9saWN5LkljbXBUeXBlQ29kZVByb3BlcnR5In1dfX0=")), "icmpTypeCode") unless @icmp_type_code.nil?
  @ipv6_cidr_block = ipv6_cidr_block
  Jsii::Type.check_type(@ipv6_cidr_block, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "ipv6CidrBlock") unless @ipv6_cidr_block.nil?
  @port_range = port_range.is_a?(Hash) ? ::AWSCDK::FMS::CfnPolicy::PortRangeProperty.new(**port_range.transform_keys(&:to_sym)) : port_range
  Jsii::Type.check_type(@port_range, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImZxbiI6ImF3cy1jZGstbGliLmF3c19mbXMuQ2ZuUG9saWN5LlBvcnRSYW5nZVByb3BlcnR5In1dfX0=")), "portRange") unless @port_range.nil?
end

Instance Attribute Details

#cidr_block ⇒ String? (readonly)

The IPv4 network range to allow or deny, in CIDR notation.

Returns:

  • (String, nil)

See Also:



914
915
916
 
# File 'fms/cfn_policy.rb', line 914

def cidr_block
  @cidr_block
end

#egress ⇒ Boolean, AWSCDK::IResolvable (readonly)

Indicates whether the rule is an egress, or outbound, rule (applied to traffic leaving the subnet).

If it's not an egress rule, then it's an ingress, or inbound, rule.

Returns:

See Also:



897
898
899
 
# File 'fms/cfn_policy.rb', line 897

def egress
  @egress
end

#icmp_type_code ⇒ AWSCDK::IResolvable, ... (readonly)

ICMP protocol: The ICMP type and code.

Returns:

See Also:



919
920
921
 
# File 'fms/cfn_policy.rb', line 919

def icmp_type_code
  @icmp_type_code
end

#ipv6_cidr_block ⇒ String? (readonly)

The IPv6 network range to allow or deny, in CIDR notation.

Returns:

  • (String, nil)

See Also:



924
925
926
 
# File 'fms/cfn_policy.rb', line 924

def ipv6_cidr_block
  @ipv6_cidr_block
end

#port_range ⇒ AWSCDK::IResolvable, ... (readonly)

TCP or UDP protocols: The range of ports the rule applies to.

Returns:

See Also:



929
930
931
 
# File 'fms/cfn_policy.rb', line 929

def port_range
  @port_range
end

#protocol ⇒ String (readonly)

The protocol number.

A value of "-1" means all protocols.

Returns:

  • (String)

See Also:



904
905
906
 
# File 'fms/cfn_policy.rb', line 904

def protocol
  @protocol
end

#rule_action ⇒ String (readonly)

Indicates whether to allow or deny the traffic that matches the rule.

Returns:

  • (String)

See Also:



909
910
911
 
# File 'fms/cfn_policy.rb', line 909

def rule_action
  @rule_action
end

Class Method Details

.jsii_properties ⇒ Object 



931
932
933
934
935
936
937
938
939
940
941
 
# File 'fms/cfn_policy.rb', line 931

def self.jsii_properties
  {
    :egress => "egress",
    :protocol => "protocol",
    :rule_action => "ruleAction",
    :cidr_block => "cidrBlock",
    :icmp_type_code => "icmpTypeCode",
    :ipv6_cidr_block => "ipv6CidrBlock",
    :port_range => "portRange",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



943
944
945
946
947
948
949
950
951
952
953
954
955
 
# File 'fms/cfn_policy.rb', line 943

def to_jsii
  result = {}
  result.merge!({
    "egress" => @egress,
    "protocol" => @protocol,
    "ruleAction" => @rule_action,
    "cidrBlock" => @cidr_block,
    "icmpTypeCode" => @icmp_type_code,
    "ipv6CidrBlock" => @ipv6_cidr_block,
    "portRange" => @port_range,
  })
  result.compact
end