Class: AWSCDK::NetworkFirewall::CfnFirewallPolicy::StatefulEngineOptionsProperty

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
network_firewall/cfn_firewall_policy.rb

Overview

Configuration settings for the handling of the stateful rule groups in a firewall policy.

See Also:

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(flow_timeouts: nil, rule_order: nil, stream_exception_policy: nil) ⇒ StatefulEngineOptionsProperty

Returns a new instance of StatefulEngineOptionsProperty.

Parameters:

  • flow_timeouts (AWSCDK::IResolvable, AWSCDK::NetworkFirewall::CfnFirewallPolicy::FlowTimeoutsProperty, nil) (defaults to: nil) —

    Configures the amount of time that can pass without any traffic sent through the firewall before the firewall determines that the connection is idle.

  • rule_order (String, nil) (defaults to: nil) —

    Indicates how to manage the order of stateful rule evaluation for the policy.

  • stream_exception_policy (String, nil) (defaults to: nil) —

    Configures how Network Firewall processes traffic when a network connection breaks midstream.



997
998
999
1000
1001
1002
1003
1004
 
# File 'network_firewall/cfn_firewall_policy.rb', line 997

def initialize(flow_timeouts: nil, rule_order: nil, stream_exception_policy: nil)
  @flow_timeouts = flow_timeouts.is_a?(Hash) ? ::AWSCDK::NetworkFirewall::CfnFirewallPolicy::FlowTimeoutsProperty.new(**flow_timeouts.transform_keys(&:to_sym)) : flow_timeouts
  Jsii::Type.check_type(@flow_timeouts, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImZxbiI6ImF3cy1jZGstbGliLmF3c19uZXR3b3JrZmlyZXdhbGwuQ2ZuRmlyZXdhbGxQb2xpY3kuRmxvd1RpbWVvdXRzUHJvcGVydHkifV19fQ==")), "flowTimeouts") unless @flow_timeouts.nil?
  @rule_order = rule_order
  Jsii::Type.check_type(@rule_order, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "ruleOrder") unless @rule_order.nil?
  @stream_exception_policy = stream_exception_policy
  Jsii::Type.check_type(@stream_exception_policy, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "streamExceptionPolicy") unless @stream_exception_policy.nil?
end

Instance Attribute Details

#flow_timeouts ⇒ AWSCDK::IResolvable, ... (readonly)

Configures the amount of time that can pass without any traffic sent through the firewall before the firewall determines that the connection is idle.

Returns:

See Also:



1010
1011
1012
 
# File 'network_firewall/cfn_firewall_policy.rb', line 1010

def flow_timeouts
  @flow_timeouts
end

#rule_order ⇒ String? (readonly)

Indicates how to manage the order of stateful rule evaluation for the policy.

DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .

Returns:

  • (String, nil)

See Also:



1017
1018
1019
 
# File 'network_firewall/cfn_firewall_policy.rb', line 1017

def rule_order
  @rule_order
end

#stream_exception_policy ⇒ String? (readonly)

Configures how Network Firewall processes traffic when a network connection breaks midstream.

Network connections can break due to disruptions in external networks or within the firewall itself.

  • DROP - Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior.
  • CONTINUE - Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule to drop http traffic, Network Firewall won't match the traffic for this rule because the service won't have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using a flow:stateless rule would still match, as would the aws:drop_strict default action.
  • REJECT - Network Firewall fails closed and drops all subsequent traffic going to the firewall. Network Firewall also sends a TCP reject packet back to your client so that the client can immediately establish a new session. Network Firewall will have context about the new session and will apply rules to the subsequent traffic.

Returns:

  • (String, nil)

See Also:



1028
1029
1030
 
# File 'network_firewall/cfn_firewall_policy.rb', line 1028

def stream_exception_policy
  @stream_exception_policy
end

Class Method Details

.jsii_properties ⇒ Object 



1030
1031
1032
1033
1034
1035
1036
 
# File 'network_firewall/cfn_firewall_policy.rb', line 1030

def self.jsii_properties
  {
    :flow_timeouts => "flowTimeouts",
    :rule_order => "ruleOrder",
    :stream_exception_policy => "streamExceptionPolicy",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



1038
1039
1040
1041
1042
1043
1044
1045
1046
 
# File 'network_firewall/cfn_firewall_policy.rb', line 1038

def to_jsii
  result = {}
  result.merge!({
    "flowTimeouts" => @flow_timeouts,
    "ruleOrder" => @rule_order,
    "streamExceptionPolicy" => @stream_exception_policy,
  })
  result.compact
end