Class: AWSCDK::Route53Resolver::CfnFirewallRuleGroup::FirewallRuleProperty

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
route53_resolver/cfn_firewall_rule_group.rb

Overview

A single firewall rule in a rule group.

See Also:

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(action:, priority:, block_override_dns_type: nil, block_override_domain: nil, block_override_ttl: nil, block_response: nil, confidence_threshold: nil, dns_threat_protection: nil, firewall_domain_list_id: nil, firewall_domain_redirection_action: nil, firewall_rule_type: nil, firewall_threat_protection_id: nil, qtype: nil) ⇒ FirewallRuleProperty

Returns a new instance of FirewallRuleProperty.

Parameters:

  • action (String) —

    The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list, or a threat in a DNS Firewall Advvanced rule: - ALLOW - Permit the request to go through.

  • priority (Numeric) —

    The priority of the rule in the rule group.

  • block_override_dns_type (String, nil) (defaults to: nil) —

    The DNS record's type.

  • block_override_domain (String, nil) (defaults to: nil) —

    The custom DNS record to send back in response to the query.

  • block_override_ttl (Numeric, nil) (defaults to: nil) —

    The recommended amount of time, in seconds, for the DNS resolver or web browser to cache the provided override record.

  • block_response (String, nil) (defaults to: nil) —

    The way that you want DNS Firewall to block the request. Used for the rule action setting BLOCK .

  • confidence_threshold (String, nil) (defaults to: nil) —

    The confidence threshold for DNS Firewall Advanced.

  • dns_threat_protection (String, nil) (defaults to: nil) —

    The type of the DNS Firewall Advanced rule. Valid values are:.

  • firewall_domain_list_id (String, nil) (defaults to: nil) —

    The ID of the domain list that's used in the rule.

  • firewall_domain_redirection_action (String, nil) (defaults to: nil) —

    How you want the the rule to evaluate DNS redirection in the DNS redirection chain, such as CNAME, or DNAME.

  • firewall_rule_type (AWSCDK::IResolvable, AWSCDK::Route53Resolver::CfnFirewallRuleGroup::FirewallRuleTypeProperty, nil) (defaults to: nil) —

    Firewall rule type union.

  • firewall_threat_protection_id (String, nil) (defaults to: nil) —

    ID of the DNS Firewall Advanced rule.

  • qtype (String, nil) (defaults to: nil) —

    The DNS query type you want the rule to evaluate. Allowed values are;



701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 701

def initialize(action:, priority:, block_override_dns_type: nil, block_override_domain: nil, block_override_ttl: nil, block_response: nil, confidence_threshold: nil, dns_threat_protection: nil, firewall_domain_list_id: nil, firewall_domain_redirection_action: nil, firewall_rule_type: nil, firewall_threat_protection_id: nil, qtype: nil)
  @action = action
  Jsii::Type.check_type(@action, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "action")
  @priority = priority
  Jsii::Type.check_type(@priority, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJudW1iZXIifQ==")), "priority")
  @block_override_dns_type = block_override_dns_type
  Jsii::Type.check_type(@block_override_dns_type, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "blockOverrideDnsType") unless @block_override_dns_type.nil?
  @block_override_domain = block_override_domain
  Jsii::Type.check_type(@block_override_domain, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "blockOverrideDomain") unless @block_override_domain.nil?
  @block_override_ttl = block_override_ttl
  Jsii::Type.check_type(@block_override_ttl, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJudW1iZXIifQ==")), "blockOverrideTtl") unless @block_override_ttl.nil?
  @block_response = block_response
  Jsii::Type.check_type(@block_response, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "blockResponse") unless @block_response.nil?
  @confidence_threshold = confidence_threshold
  Jsii::Type.check_type(@confidence_threshold, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "confidenceThreshold") unless @confidence_threshold.nil?
  @dns_threat_protection = dns_threat_protection
  Jsii::Type.check_type(@dns_threat_protection, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "dnsThreatProtection") unless @dns_threat_protection.nil?
  @firewall_domain_list_id = firewall_domain_list_id
  Jsii::Type.check_type(@firewall_domain_list_id, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "firewallDomainListId") unless @firewall_domain_list_id.nil?
  @firewall_domain_redirection_action = firewall_domain_redirection_action
  Jsii::Type.check_type(@firewall_domain_redirection_action, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "firewallDomainRedirectionAction") unless @firewall_domain_redirection_action.nil?
  @firewall_rule_type = firewall_rule_type.is_a?(Hash) ? ::AWSCDK::Route53Resolver::CfnFirewallRuleGroup::FirewallRuleTypeProperty.new(**firewall_rule_type.transform_keys(&:to_sym)) : firewall_rule_type
  Jsii::Type.check_type(@firewall_rule_type, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImZxbiI6ImF3cy1jZGstbGliLmF3c19yb3V0ZTUzcmVzb2x2ZXIuQ2ZuRmlyZXdhbGxSdWxlR3JvdXAuRmlyZXdhbGxSdWxlVHlwZVByb3BlcnR5In1dfX0=")), "firewallRuleType") unless @firewall_rule_type.nil?
  @firewall_threat_protection_id = firewall_threat_protection_id
  Jsii::Type.check_type(@firewall_threat_protection_id, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "firewallThreatProtectionId") unless @firewall_threat_protection_id.nil?
  @qtype = qtype
  Jsii::Type.check_type(@qtype, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "qtype") unless @qtype.nil?
end

Instance Attribute Details

#action ⇒ String (readonly)

The action that DNS Firewall should take on a DNS query when it matches one of the domains in the rule's domain list, or a threat in a DNS Firewall Advvanced rule: - ALLOW - Permit the request to go through.

Not available for DNS Firewall Advanced rules.

  • ALERT - Permit the request to go through but send an alert to the logs.
  • BLOCK - Disallow the request. If this is specified,then BlockResponse must also be specified.

if BlockResponse is OVERRIDE , then all of the following OVERRIDE attributes must be specified:

  • BlockOverrideDnsType
  • BlockOverrideDomain
  • BlockOverrideTtl

Returns:

  • (String)

See Also:



745
746
747
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 745

def action
  @action
end

#block_override_dns_type ⇒ String? (readonly)

The DNS record's type.

This determines the format of the record value that you provided in BlockOverrideDomain . Used for the rule action BLOCK with a BlockResponse setting of OVERRIDE .

Returns:

  • (String, nil)

See Also:



759
760
761
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 759

def block_override_dns_type
  @block_override_dns_type
end

#block_override_domain ⇒ String? (readonly)

The custom DNS record to send back in response to the query.

Used for the rule action BLOCK with a BlockResponse setting of OVERRIDE .

Returns:

  • (String, nil)

See Also:



766
767
768
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 766

def block_override_domain
  @block_override_domain
end

#block_override_ttl ⇒ Numeric? (readonly)

The recommended amount of time, in seconds, for the DNS resolver or web browser to cache the provided override record.

Used for the rule action BLOCK with a BlockResponse setting of OVERRIDE .

Returns:

  • (Numeric, nil)

See Also:



773
774
775
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 773

def block_override_ttl
  @block_override_ttl
end

#block_response ⇒ String? (readonly)

The way that you want DNS Firewall to block the request. Used for the rule action setting BLOCK .

  • NODATA - Respond indicating that the query was successful, but no response is available for it.
  • NXDOMAIN - Respond indicating that the domain name that's in the query doesn't exist.
  • OVERRIDE - Provide a custom override in the response. This option requires custom handling details in the rule's BlockOverride* settings.

Returns:

  • (String, nil)

See Also:



782
783
784
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 782

def block_response
  @block_response
end

#confidence_threshold ⇒ String? (readonly)

The confidence threshold for DNS Firewall Advanced.

You must provide this value when you create a DNS Firewall Advanced rule. The confidence level values mean:

  • LOW : Provides the highest detection rate for threats, but also increases false positives.
  • MEDIUM : Provides a balance between detecting threats and false positives.
  • HIGH : Detects only the most well corroborated threats with a low rate of false positives.

Returns:

  • (String, nil)

See Also:



793
794
795
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 793

def confidence_threshold
  @confidence_threshold
end

#dns_threat_protection ⇒ String? (readonly)

The type of the DNS Firewall Advanced rule. Valid values are:.

  • DGA : Domain generation algorithms detection. DGAs are used by attackers to generate a large number of domains to to launch malware attacks.
  • DNS_TUNNELING : DNS tunneling detection. DNS tunneling is used by attackers to exfiltrate data from the client by using the DNS tunnel without making a network connection to the client.

Returns:

  • (String, nil)

See Also:



801
802
803
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 801

def dns_threat_protection
  @dns_threat_protection
end

#firewall_domain_list_id ⇒ String? (readonly)

The ID of the domain list that's used in the rule.

Returns:

  • (String, nil)

See Also:



806
807
808
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 806

def firewall_domain_list_id
  @firewall_domain_list_id
end

#firewall_domain_redirection_action ⇒ String? (readonly)

How you want the the rule to evaluate DNS redirection in the DNS redirection chain, such as CNAME, or DNAME.

Inspect_Redirection_Domain (Default) inspects all domains in the redirection chain. The individual domains in the redirection chain must be added to the domain list.

Trust_Redirection_Domain inspects only the first domain in the redirection chain. You don't need to add the subsequent domains in the domain in the redirection list to the domain list.

Returns:

  • (String, nil)

See Also:



815
816
817
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 815

def firewall_domain_redirection_action
  @firewall_domain_redirection_action
end

#firewall_rule_type ⇒ AWSCDK::IResolvable, ... (readonly)

Firewall rule type union.

Exactly one member must be set. Mutually exclusive with FirewallDomainListId and DnsThreatProtection/ConfidenceThreshold.

Returns:

See Also:



822
823
824
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 822

def firewall_rule_type
  @firewall_rule_type
end

#firewall_threat_protection_id ⇒ String? (readonly)

ID of the DNS Firewall Advanced rule.

Returns:

  • (String, nil)

See Also:



827
828
829
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 827

def firewall_threat_protection_id
  @firewall_threat_protection_id
end

#priority ⇒ Numeric (readonly)

The priority of the rule in the rule group.

This value must be unique within the rule group. DNS Firewall processes the rules in a rule group by order of priority, starting from the lowest setting.

Returns:

  • (Numeric)

See Also:



752
753
754
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 752

def priority
  @priority
end

#qtype ⇒ String? (readonly)

The DNS query type you want the rule to evaluate. Allowed values are;

  • A: Returns an IPv4 address.
  • AAAA: Returns an Ipv6 address.
  • CAA: Restricts CAs that can create SSL/TLS certifications for the domain.
  • CNAME: Returns another domain name.
  • DS: Record that identifies the DNSSEC signing key of a delegated zone.
  • MX: Specifies mail servers.
  • NAPTR: Regular-expression-based rewriting of domain names.
  • NS: Authoritative name servers.
  • PTR: Maps an IP address to a domain name.
  • SOA: Start of authority record for the zone.
  • SPF: Lists the servers authorized to send emails from a domain.
  • SRV: Application specific values that identify servers.
  • TXT: Verifies email senders and application-specific values.
  • A query type you define by using the DNS type ID, for example 28 for AAAA. The values must be defined as TYPE NUMBER , where the NUMBER can be 1-65334, for example, TYPE28. For more information, see List of DNS record types .

Returns:

  • (String, nil)

See Also:



847
848
849
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 847

def qtype
  @qtype
end

Class Method Details

.jsii_properties ⇒ Object 



849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 849

def self.jsii_properties
  {
    :action => "action",
    :priority => "priority",
    :block_override_dns_type => "blockOverrideDnsType",
    :block_override_domain => "blockOverrideDomain",
    :block_override_ttl => "blockOverrideTtl",
    :block_response => "blockResponse",
    :confidence_threshold => "confidenceThreshold",
    :dns_threat_protection => "dnsThreatProtection",
    :firewall_domain_list_id => "firewallDomainListId",
    :firewall_domain_redirection_action => "firewallDomainRedirectionAction",
    :firewall_rule_type => "firewallRuleType",
    :firewall_threat_protection_id => "firewallThreatProtectionId",
    :qtype => "qtype",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
 
# File 'route53_resolver/cfn_firewall_rule_group.rb', line 867

def to_jsii
  result = {}
  result.merge!({
    "action" => @action,
    "priority" => @priority,
    "blockOverrideDnsType" => @block_override_dns_type,
    "blockOverrideDomain" => @block_override_domain,
    "blockOverrideTtl" => @block_override_ttl,
    "blockResponse" => @block_response,
    "confidenceThreshold" => @confidence_threshold,
    "dnsThreatProtection" => @dns_threat_protection,
    "firewallDomainListId" => @firewall_domain_list_id,
    "firewallDomainRedirectionAction" => @firewall_domain_redirection_action,
    "firewallRuleType" => @firewall_rule_type,
    "firewallThreatProtectionId" => @firewall_threat_protection_id,
    "qtype" => @qtype,
  })
  result.compact
end