Package software.amazon.awssdk.services.networkfirewall.model

Class AnalysisResult

java.lang.Object
software.amazon.awssdk.services.networkfirewall.model.AnalysisResult
All Implemented Interfaces:
Serializable, SdkPojo, ToCopyableBuilder<AnalysisResult.Builder,AnalysisResult>
@Generated("software.amazon.awssdk:codegen") public final class AnalysisResult extends Object implements SdkPojo, Serializable, ToCopyableBuilder<AnalysisResult.Builder,AnalysisResult>

The analysis result for Network Firewall's stateless rule group analyzer. Every time you call CreateRuleGroup, UpdateRuleGroup, or DescribeRuleGroup on a stateless rule group, Network Firewall analyzes the stateless rule groups in your account and identifies the rules that might adversely effect your firewall's functionality. For example, if Network Firewall detects a rule that's routing traffic asymmetrically, which impacts the service's ability to properly process traffic, the service includes the rule in a list of analysis results.

See Also:

  • Method Details

    • hasIdentifiedRuleIds

      public final boolean hasIdentifiedRuleIds()
      For responses, this returns true if the service returned a value for the IdentifiedRuleIds property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

    • identifiedRuleIds

      public final List<String> identifiedRuleIds()

      The priority number of the stateless rules identified in the analysis.

      Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

      This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasIdentifiedRuleIds() method.

      Returns:
      The priority number of the stateless rules identified in the analysis.

    • identifiedType

      public final IdentifiedType identifiedType()

      The types of rule configurations that Network Firewall analyzes your rule groups for. Network Firewall analyzes stateless rule groups for the following types of rule configurations:

      • STATELESS_RULE_FORWARDING_ASYMMETRICALLY

        Cause: One or more stateless rules with the action pass or forward are forwarding traffic asymmetrically. Specifically, the rule's set of source IP addresses or their associated port numbers, don't match the set of destination IP addresses or their associated port numbers.

        To mitigate: Make sure that there's an existing return path. For example, if the rule allows traffic from source 10.1.0.0/24 to destination 20.1.0.0/24, you should allow return traffic from source 20.1.0.0/24 to destination 10.1.0.0/24.

      • STATELESS_RULE_CONTAINS_TCP_FLAGS

        Cause: At least one stateless rule with the action pass orforward contains TCP flags that are inconsistent in the forward and return directions.

        To mitigate: Prevent asymmetric routing issues caused by TCP flags by following these actions:

        • Remove unnecessary TCP flag inspections from the rules.

        • If you need to inspect TCP flags, check that the rules correctly account for changes in TCP flags throughout the TCP connection cycle, for example SYN and ACK flags used in a 3-way TCP handshake.

      If the service returns an enum value that is not available in the current SDK version, identifiedType will return IdentifiedType.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from identifiedTypeAsString().

      Returns:
      The types of rule configurations that Network Firewall analyzes your rule groups for. Network Firewall analyzes stateless rule groups for the following types of rule configurations:

      • STATELESS_RULE_FORWARDING_ASYMMETRICALLY

        Cause: One or more stateless rules with the action pass or forward are forwarding traffic asymmetrically. Specifically, the rule's set of source IP addresses or their associated port numbers, don't match the set of destination IP addresses or their associated port numbers.

        To mitigate: Make sure that there's an existing return path. For example, if the rule allows traffic from source 10.1.0.0/24 to destination 20.1.0.0/24, you should allow return traffic from source 20.1.0.0/24 to destination 10.1.0.0/24.

      • STATELESS_RULE_CONTAINS_TCP_FLAGS

        Cause: At least one stateless rule with the action pass orforward contains TCP flags that are inconsistent in the forward and return directions.

        To mitigate: Prevent asymmetric routing issues caused by TCP flags by following these actions:

        • Remove unnecessary TCP flag inspections from the rules.

        • If you need to inspect TCP flags, check that the rules correctly account for changes in TCP flags throughout the TCP connection cycle, for example SYN and ACK flags used in a 3-way TCP handshake.

      See Also:

    • identifiedTypeAsString

      public final String identifiedTypeAsString()

      The types of rule configurations that Network Firewall analyzes your rule groups for. Network Firewall analyzes stateless rule groups for the following types of rule configurations:

      • STATELESS_RULE_FORWARDING_ASYMMETRICALLY

        Cause: One or more stateless rules with the action pass or forward are forwarding traffic asymmetrically. Specifically, the rule's set of source IP addresses or their associated port numbers, don't match the set of destination IP addresses or their associated port numbers.

        To mitigate: Make sure that there's an existing return path. For example, if the rule allows traffic from source 10.1.0.0/24 to destination 20.1.0.0/24, you should allow return traffic from source 20.1.0.0/24 to destination 10.1.0.0/24.

      • STATELESS_RULE_CONTAINS_TCP_FLAGS

        Cause: At least one stateless rule with the action pass orforward contains TCP flags that are inconsistent in the forward and return directions.

        To mitigate: Prevent asymmetric routing issues caused by TCP flags by following these actions:

        • Remove unnecessary TCP flag inspections from the rules.

        • If you need to inspect TCP flags, check that the rules correctly account for changes in TCP flags throughout the TCP connection cycle, for example SYN and ACK flags used in a 3-way TCP handshake.

      If the service returns an enum value that is not available in the current SDK version, identifiedType will return IdentifiedType.UNKNOWN_TO_SDK_VERSION. The raw value returned by the service is available from identifiedTypeAsString().

      Returns:
      The types of rule configurations that Network Firewall analyzes your rule groups for. Network Firewall analyzes stateless rule groups for the following types of rule configurations:

      • STATELESS_RULE_FORWARDING_ASYMMETRICALLY

        Cause: One or more stateless rules with the action pass or forward are forwarding traffic asymmetrically. Specifically, the rule's set of source IP addresses or their associated port numbers, don't match the set of destination IP addresses or their associated port numbers.

        To mitigate: Make sure that there's an existing return path. For example, if the rule allows traffic from source 10.1.0.0/24 to destination 20.1.0.0/24, you should allow return traffic from source 20.1.0.0/24 to destination 10.1.0.0/24.

      • STATELESS_RULE_CONTAINS_TCP_FLAGS

        Cause: At least one stateless rule with the action pass orforward contains TCP flags that are inconsistent in the forward and return directions.

        To mitigate: Prevent asymmetric routing issues caused by TCP flags by following these actions:

        • Remove unnecessary TCP flag inspections from the rules.

        • If you need to inspect TCP flags, check that the rules correctly account for changes in TCP flags throughout the TCP connection cycle, for example SYN and ACK flags used in a 3-way TCP handshake.

      See Also:

    • analysisDetail

      public final String analysisDetail()

      Provides analysis details for the identified rule.

      Returns:
      Provides analysis details for the identified rule.

    • toBuilder

      public AnalysisResult.Builder toBuilder()
      Description copied from interface: ToCopyableBuilder
      Take this object and create a builder that contains all of the current property values of this object.
      Specified by:
      toBuilder in interface ToCopyableBuilder<AnalysisResult.Builder,AnalysisResult>
      Returns:
      a builder for type T

    • builder

      public static AnalysisResult.Builder builder()

    • serializableBuilderClass

      public static Class<? extends AnalysisResult.Builder> serializableBuilderClass()

    • hashCode

      public final int hashCode()
      Overrides:
      hashCode in class Object

    • equals

      public final boolean equals(Object obj)
      Overrides:
      equals in class Object

    • equalsBySdkFields

      public final boolean equalsBySdkFields(Object obj)
      Description copied from interface: SdkPojo
      Indicates whether some other object is "equal to" this one by SDK fields. An SDK field is a modeled, non-inherited field in an SdkPojo class, and is generated based on a service model.

      If an SdkPojo class does not have any inherited fields, equalsBySdkFields and equals are essentially the same.

      Specified by:
      equalsBySdkFields in interface SdkPojo
      Parameters:
      obj - the object to be compared with
      Returns:
      true if the other object equals to this object by sdk fields, false otherwise.

    • toString

      public final String toString()
      Returns a string representation of this object. This is useful for testing and debugging. Sensitive data will be redacted from this string using a placeholder value.
      Overrides:
      toString in class Object

    • getValueForField

      public final <T> Optional<T> getValueForField(String fieldName, Class<T> clazz)

    • sdkFields

      public final List<SdkField<?>> sdkFields()
      Specified by:
      sdkFields in interface SdkPojo
      Returns:
      List of SdkField in this POJO. May be empty list but should never be null.