Package software.amazon.awssdk.services.networkfirewall.model

Class FirewallPolicy

java.lang.Object
software.amazon.awssdk.services.networkfirewall.model.FirewallPolicy
All Implemented Interfaces:
Serializable, SdkPojo, ToCopyableBuilder<FirewallPolicy.Builder,FirewallPolicy>
@Generated("software.amazon.awssdk:codegen") public final class FirewallPolicy extends Object implements SdkPojo, Serializable, ToCopyableBuilder<FirewallPolicy.Builder,FirewallPolicy>

The firewall policy defines the behavior of a firewall using a collection of stateless and stateful rule groups and other settings. You can use one firewall policy for multiple firewalls.

This, along with FirewallPolicyResponse, define the policy. You can retrieve all objects for a firewall policy by calling DescribeFirewallPolicy.

See Also:

  • Method Details

    • hasStatelessRuleGroupReferences

      public final boolean hasStatelessRuleGroupReferences()
      For responses, this returns true if the service returned a value for the StatelessRuleGroupReferences property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

    • statelessRuleGroupReferences

      public final List<StatelessRuleGroupReference> statelessRuleGroupReferences()

      References to the stateless rule groups that are used in the policy. These define the matching criteria in stateless rules.

      Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

      This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasStatelessRuleGroupReferences() method.

      Returns:
      References to the stateless rule groups that are used in the policy. These define the matching criteria in stateless rules.

    • hasStatelessDefaultActions

      public final boolean hasStatelessDefaultActions()
      For responses, this returns true if the service returned a value for the StatelessDefaultActions property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

    • statelessDefaultActions

      public final List<String> statelessDefaultActions()

      The actions to take on a packet if it doesn't match any of the stateless rules in the policy. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.

      You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice.

      For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.

      Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

      This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasStatelessDefaultActions() method.

      Returns:
      The actions to take on a packet if it doesn't match any of the stateless rules in the policy. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.

      You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice.

      For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.

    • hasStatelessFragmentDefaultActions

      public final boolean hasStatelessFragmentDefaultActions()
      For responses, this returns true if the service returned a value for the StatelessFragmentDefaultActions property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

    • statelessFragmentDefaultActions

      public final List<String> statelessFragmentDefaultActions()

      The actions to take on a fragmented UDP packet if it doesn't match any of the stateless rules in the policy. Network Firewall only manages UDP packet fragments and silently drops packet fragments for other protocols. If you want non-matching fragmented UDP packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.

      You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice.

      For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.

      Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

      This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasStatelessFragmentDefaultActions() method.

      Returns:
      The actions to take on a fragmented UDP packet if it doesn't match any of the stateless rules in the policy. Network Firewall only manages UDP packet fragments and silently drops packet fragments for other protocols. If you want non-matching fragmented UDP packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.

      You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice.

      For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.

    • hasStatelessCustomActions

      public final boolean hasStatelessCustomActions()
      For responses, this returns true if the service returned a value for the StatelessCustomActions property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

    • statelessCustomActions

      public final List<CustomAction> statelessCustomActions()

      The custom action definitions that are available for use in the firewall policy's StatelessDefaultActions setting. You name each custom action that you define, and then you can use it by name in your default actions specifications.

      Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

      This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasStatelessCustomActions() method.

      Returns:
      The custom action definitions that are available for use in the firewall policy's StatelessDefaultActions setting. You name each custom action that you define, and then you can use it by name in your default actions specifications.

    • hasStatefulRuleGroupReferences

      public final boolean hasStatefulRuleGroupReferences()
      For responses, this returns true if the service returned a value for the StatefulRuleGroupReferences property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

    • statefulRuleGroupReferences

      public final List<StatefulRuleGroupReference> statefulRuleGroupReferences()

      References to the stateful rule groups that are used in the policy. These define the inspection criteria in stateful rules.

      Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

      This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasStatefulRuleGroupReferences() method.

      Returns:
      References to the stateful rule groups that are used in the policy. These define the inspection criteria in stateful rules.

    • hasStatefulDefaultActions

      public final boolean hasStatefulDefaultActions()
      For responses, this returns true if the service returned a value for the StatefulDefaultActions property. This DOES NOT check that the value is non-empty (for which, you should check the isEmpty() method on the property). This is useful because the SDK will never return a null collection or map, but you may need to differentiate between the service returning nothing (or null) and the service returning an empty collection or map. For requests, this returns true if a value for the property was specified in the request builder, and false if a value was not specified.

    • statefulDefaultActions

      public final List<String> statefulDefaultActions()

      The default actions to take on a packet that doesn't match any stateful rules. The stateful default action is optional, and is only valid when using the strict rule order.

      Valid values of the stateful default action:

      • aws:drop_strict

      • aws:drop_established

      • aws:alert_strict

      • aws:alert_established

      For more information, see Strict evaluation order in the Network Firewall Developer Guide.

      Attempts to modify the collection returned by this method will result in an UnsupportedOperationException.

      This method will never return null. If you would like to know whether the service returned this field (so that you can differentiate between null and empty), you can use the hasStatefulDefaultActions() method.

      Returns:
      The default actions to take on a packet that doesn't match any stateful rules. The stateful default action is optional, and is only valid when using the strict rule order.

      Valid values of the stateful default action:

      • aws:drop_strict

      • aws:drop_established

      • aws:alert_strict

      • aws:alert_established

      For more information, see Strict evaluation order in the Network Firewall Developer Guide.

    • statefulEngineOptions

      public final StatefulEngineOptions statefulEngineOptions()

      Additional options governing how Network Firewall handles stateful rules. The stateful rule groups that you use in your policy must have stateful rule options settings that are compatible with these settings.

      Returns:
      Additional options governing how Network Firewall handles stateful rules. The stateful rule groups that you use in your policy must have stateful rule options settings that are compatible with these settings.

    • tlsInspectionConfigurationArn

      public final String tlsInspectionConfigurationArn()

      The Amazon Resource Name (ARN) of the TLS inspection configuration.

      Returns:
      The Amazon Resource Name (ARN) of the TLS inspection configuration.

    • policyVariables

      public final PolicyVariables policyVariables()

      Contains variables that you can use to override default Suricata settings in your firewall policy.

      Returns:
      Contains variables that you can use to override default Suricata settings in your firewall policy.

    • toBuilder

      public FirewallPolicy.Builder toBuilder()
      Description copied from interface: ToCopyableBuilder
      Take this object and create a builder that contains all of the current property values of this object.
      Specified by:
      toBuilder in interface ToCopyableBuilder<FirewallPolicy.Builder,FirewallPolicy>
      Returns:
      a builder for type T

    • builder

      public static FirewallPolicy.Builder builder()

    • serializableBuilderClass

      public static Class<? extends FirewallPolicy.Builder> serializableBuilderClass()

    • hashCode

      public final int hashCode()
      Overrides:
      hashCode in class Object

    • equals

      public final boolean equals(Object obj)
      Overrides:
      equals in class Object

    • equalsBySdkFields

      public final boolean equalsBySdkFields(Object obj)
      Description copied from interface: SdkPojo
      Indicates whether some other object is "equal to" this one by SDK fields. An SDK field is a modeled, non-inherited field in an SdkPojo class, and is generated based on a service model.

      If an SdkPojo class does not have any inherited fields, equalsBySdkFields and equals are essentially the same.

      Specified by:
      equalsBySdkFields in interface SdkPojo
      Parameters:
      obj - the object to be compared with
      Returns:
      true if the other object equals to this object by sdk fields, false otherwise.

    • toString

      public final String toString()
      Returns a string representation of this object. This is useful for testing and debugging. Sensitive data will be redacted from this string using a placeholder value.
      Overrides:
      toString in class Object

    • getValueForField

      public final <T> Optional<T> getValueForField(String fieldName, Class<T> clazz)

    • sdkFields

      public final List<SdkField<?>> sdkFields()
      Specified by:
      sdkFields in interface SdkPojo
      Returns:
      List of SdkField in this POJO. May be empty list but should never be null.