Class: AWSCDK::NetworkFirewall::CfnTLSInspectionConfiguration::CheckCertificateRevocationStatusProperty

Inherits:

Jsii::Struct

• Object
• Jsii::Struct
• AWSCDK::NetworkFirewall::CfnTLSInspectionConfiguration::CheckCertificateRevocationStatusProperty

Defined in:

network_firewall/cfn_tls_inspection_configuration.rb

Overview

When enabled, Network Firewall checks if the server certificate presented by the server in the SSL/TLS connection has a revoked or unkown status.

If the certificate has an unknown or revoked status, you must specify the actions that Network Firewall takes on outbound traffic. To check the certificate revocation status, you must also specify a CertificateAuthorityArn in ServerCertificateConfiguration .

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-tlsinspectionconfiguration-checkcertificaterevocationstatus.html

Instance Attribute Summary

• #revoked_status_action ⇒ String^? readonly

  Configures how Network Firewall processes traffic when it determines that the certificate presented by the server in the SSL/TLS connection has a revoked status.

• #unknown_status_action ⇒ String^? readonly

  Configures how Network Firewall processes traffic when it determines that the certificate presented by the server in the SSL/TLS connection has an unknown status, or a status that cannot be determined for any other reason, including when the service is unable to connect to the OCSP and CRL endpoints for the certificate.

Class Method Summary

• .jsii_properties ⇒ Object

Instance Method Summary

• #initialize(revoked_status_action: nil, unknown_status_action: nil) ⇒ CheckCertificateRevocationStatusProperty constructor

  A new instance of CheckCertificateRevocationStatusProperty.

• #to_jsii ⇒ Object

Constructor Details

#initialize(revoked_status_action: nil, unknown_status_action: nil) ⇒ CheckCertificateRevocationStatusProperty

Returns a new instance of CheckCertificateRevocationStatusProperty.

Parameters:

• revoked_status_action (String, nil) (defaults to: nil) —

  Configures how Network Firewall processes traffic when it determines that the certificate presented by the server in the SSL/TLS connection has a revoked status.

• unknown_status_action (String, nil) (defaults to: nil) —

  Configures how Network Firewall processes traffic when it determines that the certificate presented by the server in the SSL/TLS connection has an unknown status, or a status that cannot be determined for any other reason, including when the service is unable to connect to the OCSP and CRL endpoints for the certificate.

# File 'network_firewall/cfn_tls_inspection_configuration.rb', line 620

def initialize(revoked_status_action: nil, unknown_status_action: nil)
  @revoked_status_action = revoked_status_action
  Jsii::Type.check_type(@revoked_status_action, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "revokedStatusAction") unless @revoked_status_action.nil?
  @unknown_status_action = unknown_status_action
  Jsii::Type.check_type(@unknown_status_action, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "unknownStatusAction") unless @unknown_status_action.nil?
end

Instance Attribute Details

#revoked_status_action ⇒ String^? (readonly)

Configures how Network Firewall processes traffic when it determines that the certificate presented by the server in the SSL/TLS connection has a revoked status.

• PASS - Allow the connection to continue, and pass subsequent packets to the stateful engine for inspection.
• DROP - Network Firewall closes the connection and drops subsequent packets for that connection.
• REJECT - Network Firewall sends a TCP reject packet back to your client. The service closes the connection and drops subsequent packets for that connection. REJECT is available only for TCP traffic.

Returns:

• (String, nil)

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-tlsinspectionconfiguration-checkcertificaterevocationstatus.html#cfn-networkfirewall-tlsinspectionconfiguration-checkcertificaterevocationstatus-revokedstatusaction

# File 'network_firewall/cfn_tls_inspection_configuration.rb', line 635

def revoked_status_action
  @revoked_status_action
end

#unknown_status_action ⇒ String^? (readonly)

Configures how Network Firewall processes traffic when it determines that the certificate presented by the server in the SSL/TLS connection has an unknown status, or a status that cannot be determined for any other reason, including when the service is unable to connect to the OCSP and CRL endpoints for the certificate.

• PASS - Allow the connection to continue, and pass subsequent packets to the stateful engine for inspection.
• DROP - Network Firewall closes the connection and drops subsequent packets for that connection.
• REJECT - Network Firewall sends a TCP reject packet back to your client. The service closes the connection and drops subsequent packets for that connection. REJECT is available only for TCP traffic.

Returns:

• (String, nil)

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-tlsinspectionconfiguration-checkcertificaterevocationstatus.html#cfn-networkfirewall-tlsinspectionconfiguration-checkcertificaterevocationstatus-unknownstatusaction

# File 'network_firewall/cfn_tls_inspection_configuration.rb', line 644

def unknown_status_action
  @unknown_status_action
end

Class Method Details

.jsii_properties ⇒ Object

# File 'network_firewall/cfn_tls_inspection_configuration.rb', line 646

def self.jsii_properties
  {
    :revoked_status_action => "revokedStatusAction",
    :unknown_status_action => "unknownStatusAction",
  }
end

Instance Method Details

#to_jsii ⇒ Object

# File 'network_firewall/cfn_tls_inspection_configuration.rb', line 653

def to_jsii
  result = {}
  result.merge!({
    "revokedStatusAction" => @revoked_status_action,
    "unknownStatusAction" => @unknown_status_action,
  })
  result.compact
end