Class: AWSCDK::FMS::CfnPolicy::SecurityServicePolicyDataProperty

Inherits:

Jsii::Struct

Object
Jsii::Struct
AWSCDK::FMS::CfnPolicy::SecurityServicePolicyDataProperty

show all

Defined in:: fms/cfn_policy.rb

Overview

Details about the security service that is being used to protect the resources.

See Also:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fms-policy-securityservicepolicydata.html

Instance Attribute Summary collapse

#managed_service_data ⇒ String^? readonly
Details about the service that are specific to the service type, in JSON format.
#policy_option ⇒ AWSCDK::IResolvable, ... readonly
Contains the settings to configure a network ACL policy, a AWS Network Firewall firewall policy deployment model, or a third-party firewall policy.
#type ⇒ String readonly
The service that the policy is using to protect the resources.

Class Method Summary collapse

.jsii_properties ⇒ Object

Instance Method Summary collapse

#initialize(type:, managed_service_data: nil, policy_option: nil) ⇒ SecurityServicePolicyDataProperty constructor
A new instance of SecurityServicePolicyDataProperty.
#to_jsii ⇒ Object

Constructor Details

#initialize(type:, managed_service_data: nil, policy_option: nil) ⇒ `SecurityServicePolicyDataProperty`

Returns a new instance of SecurityServicePolicyDataProperty.

Parameters:

type (String) —
The service that the policy is using to protect the resources.
managed_service_data (String, nil) (defaults to: nil) —
Details about the service that are specific to the service type, in JSON format.
policy_option (AWSCDK::IResolvable, AWSCDK::FMS::CfnPolicy::PolicyOptionProperty, nil) (defaults to: nil) —
Contains the settings to configure a network ACL policy, a AWS Network Firewall firewall policy deployment model, or a third-party firewall policy.

# File 'fms/cfn_policy.rb', line 1273

def initialize(type:, managed_service_data: nil, policy_option: nil)
  @type = type
  Jsii::Type.check_type(@type, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "type")
  @managed_service_data = managed_service_data
  Jsii::Type.check_type(@managed_service_data, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "managedServiceData") unless @managed_service_data.nil?
  @policy_option = policy_option.is_a?(Hash) ? ::AWSCDK::FMS::CfnPolicy::PolicyOptionProperty.new(**policy_option.transform_keys(&:to_sym)) : policy_option
  Jsii::Type.check_type(@policy_option, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImZxbiI6ImF3cy1jZGstbGliLmF3c19mbXMuQ2ZuUG9saWN5LlBvbGljeU9wdGlvblByb3BlcnR5In1dfX0=")), "policyOption") unless @policy_option.nil?
end

Instance Attribute Details

#managed_service_data ⇒ `String`^? (readonly)

Details about the service that are specific to the service type, in JSON format.

Example: DNS_FIREWALL

"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"

Valid values for pre_process_rule_groups are between 1 and 99. Valid values for post_process_rule_groups are between 9901 and 10000.

Example: NETWORK_FIREWALL - Centralized deployment model

"{\"type\":\"NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}},\"firewallDeploymentModel\":{\"centralizedFirewallDeploymentModel\":{\"centralizedFirewallOrchestrationConfig\":{\"inspectionVpcIds\":[{\"resourceId\":\"vpc-1234\",\"accountId\":\"123456789011\"}],\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneId\":null,\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"allowedIPV4CidrList\":[]}}}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration

With automatic Availbility Zone configuration, Firewall Manager chooses which Availability Zones to create the endpoints in. To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":[\"10.0.0.0/28\",\"192.168.0.0/28\"],\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"]},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\": \"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

With custom Availability Zone configuration, you define which specific Availability Zones to create endpoints in by configuring firewall_creation_config . To configure the Availability Zones in firewall_creation_config , specify either the availability_zone_name or availability_zone_id parameter, not both parameters.

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall centralized deployment model

"{ \"type\":\"THIRD_PARTY_FIREWALL\", \"thirdPartyFirewall\":\"PALO_ALTO_NETWORKS_CLOUD_NGFW\", \"thirdPartyFirewallConfig\":{ \"thirdPartyFirewallPolicyList\":[\"global-1\"] },\"firewallDeploymentModel\":{\"centralizedFirewallDeploymentModel\":{\"centralizedFirewallOrchestrationConfig\":{\"inspectionVpcIds\":[{\"resourceId\":\"vpc-1234\",\"accountId\":\"123456789011\"}],\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneId\":null,\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"allowedIPV4CidrList\":[]}}}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to CENTRALIZED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall distributed deployment model

"{\"type\":\"THIRD_PARTY_FIREWALL\",\"thirdPartyFirewall\":\"PALO_ALTO_NETWORKS_CLOUD_NGFW\",\"thirdPartyFirewallConfig\":{\"thirdPartyFirewallPolicyList\":[\"global-1\"] },\"firewallDeploymentModel\":{ \"distributedFirewallDeploymentModel\":{ \"distributedFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{ \"availabilityZoneConfigList\":[ {\"availabilityZoneName\":\"${AvailabilityZone}\" } ] } }, \"allowedIPV4CidrList\":[ ] } } } }"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Specification for SHIELD_ADVANCED for Amazon CloudFront distributions

"{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED|IGNORED|DISABLED\", \"automaticResponseAction\":\"BLOCK|COUNT\"}, \"overrideCustomerWebaclClassic\":true|false}"

For example: "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"

The default value for automatic_response_status is IGNORED . The value for automatic_response_action is only required when automatic_response_status is set to ENABLED . The default value for override_customer_webacl_classic is false .

For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData configuration is an empty string.

Example: WAFV2

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesAmazonIpReputationList\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

In the logging_configuration , you can specify one log_destination_configs , you can optionally provide up to 20 redacted_fields , and the RedactedFieldType must be one of URI , QUERY_STRING , HEADER , or METHOD .

Example: AWS WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"

Example: WAFV2 - AWS Firewall Manager support for AWS WAF managed rule group versioning

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

To use a specific version of a AWS WAF managed rule group in your Firewall Manager policy, you must set version_enabled to true , and set version to the version you'd like to use. If you don't set version_enabled to true , or if you omit version_enabled , then Firewall Manager uses the default version of the AWS WAF managed rule group.

Example: SECURITY_GROUPS_COMMON

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

The security group action for content audit can be ALLOW or DENY . For ALLOW , all in-scope security group rules must be within the allowed range of the policy's security group rules. For DENY , all in-scope security group rules must not contain a value or a range that matches a rule value or range in the policy security group.

Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

Returns:

(String, nil)

See Also:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fms-policy-securityservicepolicydata.html#cfn-fms-policy-securityservicepolicydata-managedservicedata



1387
1388
1389

# File 'fms/cfn_policy.rb', line 1387

def managed_service_data
  @managed_service_data
end

#policy_option ⇒ `AWSCDK::IResolvable`, ... (readonly)

Contains the settings to configure a network ACL policy, a AWS Network Firewall firewall policy deployment model, or a third-party firewall policy.

Returns:

(AWSCDK::IResolvable, AWSCDK::FMS::CfnPolicy::PolicyOptionProperty, nil)

See Also:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fms-policy-securityservicepolicydata.html#cfn-fms-policy-securityservicepolicydata-policyoption



1392
1393
1394

# File 'fms/cfn_policy.rb', line 1392

def policy_option
  @policy_option
end

#type ⇒ `String` (readonly)

The service that the policy is using to protect the resources.

This specifies the type of policy that is created, either an AWS WAF policy, a Shield Advanced policy, or a security group policy. For security group policies, Firewall Manager supports one security group for each common policy and for each content audit policy. This is an adjustable limit that you can increase by contacting SUPlong .

Returns:

(String)

See Also:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-fms-policy-securityservicepolicydata.html#cfn-fms-policy-securityservicepolicydata-type



1288
1289
1290

# File 'fms/cfn_policy.rb', line 1288

def type
  @type
end

Class Method Details

.jsii_properties ⇒ `Object`

# File 'fms/cfn_policy.rb', line 1394

def self.jsii_properties
  {
    :type => "type",
    :managed_service_data => "managedServiceData",
    :policy_option => "policyOption",
  }
end

Instance Method Details

#to_jsii ⇒ `Object`

# File 'fms/cfn_policy.rb', line 1402

def to_jsii
  result = {}
  result.merge!({
    "type" => @type,
    "managedServiceData" => @managed_service_data,
    "policyOption" => @policy_option,
  })
  result.compact
end

Class: AWSCDK::FMS::CfnPolicy::SecurityServicePolicyDataProperty

Overview

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(type:, managed_service_data: nil, policy_option: nil) ⇒ SecurityServicePolicyDataProperty

Instance Attribute Details

#managed_service_data ⇒ String? (readonly)

#policy_option ⇒ AWSCDK::IResolvable, ... (readonly)

#type ⇒ String (readonly)

Class Method Details

.jsii_properties ⇒ Object

Instance Method Details

#to_jsii ⇒ Object

#initialize(type:, managed_service_data: nil, policy_option: nil) ⇒ `SecurityServicePolicyDataProperty`

#managed_service_data ⇒ `String`^? (readonly)

#policy_option ⇒ `AWSCDK::IResolvable`, ... (readonly)

#type ⇒ `String` (readonly)

.jsii_properties ⇒ `Object`

#to_jsii ⇒ `Object`