Class StatefulEngineOptions
- All Implemented Interfaces:
Serializable
,SdkPojo
,ToCopyableBuilder<StatefulEngineOptions.Builder,
StatefulEngineOptions>
Configuration settings for the handling of the stateful rule groups in a firewall policy.
- See Also:
-
Nested Class Summary
-
Method Summary
Modifier and TypeMethodDescriptionbuilder()
final boolean
final boolean
equalsBySdkFields
(Object obj) Indicates whether some other object is "equal to" this one by SDK fields.final <T> Optional
<T> getValueForField
(String fieldName, Class<T> clazz) final int
hashCode()
final RuleOrder
Indicates how to manage the order of stateful rule evaluation for the policy.final String
Indicates how to manage the order of stateful rule evaluation for the policy.static Class
<? extends StatefulEngineOptions.Builder> final StreamExceptionPolicy
Configures how Network Firewall processes traffic when a network connection breaks midstream.final String
Configures how Network Firewall processes traffic when a network connection breaks midstream.Take this object and create a builder that contains all of the current property values of this object.final String
toString()
Returns a string representation of this object.Methods inherited from interface software.amazon.awssdk.utils.builder.ToCopyableBuilder
copy
-
Method Details
-
ruleOrder
Indicates how to manage the order of stateful rule evaluation for the policy.
STRICT_ORDER
is the default and recommended option. WithSTRICT_ORDER
, provide your rules in the order that you want them to be evaluated. You can then choose one or more default actions for packets that don't match any rules. ChooseSTRICT_ORDER
to have the stateful rules engine determine the evaluation order of your rules. The default action for this rule order isPASS
, followed byDROP
,REJECT
, andALERT
actions. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on your settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide.If the service returns an enum value that is not available in the current SDK version,
ruleOrder
will returnRuleOrder.UNKNOWN_TO_SDK_VERSION
. The raw value returned by the service is available fromruleOrderAsString()
.- Returns:
- Indicates how to manage the order of stateful rule evaluation for the policy.
STRICT_ORDER
is the default and recommended option. WithSTRICT_ORDER
, provide your rules in the order that you want them to be evaluated. You can then choose one or more default actions for packets that don't match any rules. ChooseSTRICT_ORDER
to have the stateful rules engine determine the evaluation order of your rules. The default action for this rule order isPASS
, followed byDROP
,REJECT
, andALERT
actions. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on your settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide. - See Also:
-
ruleOrderAsString
Indicates how to manage the order of stateful rule evaluation for the policy.
STRICT_ORDER
is the default and recommended option. WithSTRICT_ORDER
, provide your rules in the order that you want them to be evaluated. You can then choose one or more default actions for packets that don't match any rules. ChooseSTRICT_ORDER
to have the stateful rules engine determine the evaluation order of your rules. The default action for this rule order isPASS
, followed byDROP
,REJECT
, andALERT
actions. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on your settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide.If the service returns an enum value that is not available in the current SDK version,
ruleOrder
will returnRuleOrder.UNKNOWN_TO_SDK_VERSION
. The raw value returned by the service is available fromruleOrderAsString()
.- Returns:
- Indicates how to manage the order of stateful rule evaluation for the policy.
STRICT_ORDER
is the default and recommended option. WithSTRICT_ORDER
, provide your rules in the order that you want them to be evaluated. You can then choose one or more default actions for packets that don't match any rules. ChooseSTRICT_ORDER
to have the stateful rules engine determine the evaluation order of your rules. The default action for this rule order isPASS
, followed byDROP
,REJECT
, andALERT
actions. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on your settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide. - See Also:
-
streamExceptionPolicy
Configures how Network Firewall processes traffic when a network connection breaks midstream. Network connections can break due to disruptions in external networks or within the firewall itself.
-
DROP
- Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior. -
CONTINUE
- Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule todrop http
traffic, Network Firewall won't match the traffic for this rule because the service won't have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using aflow:stateless
rule would still match, as would theaws:drop_strict
default action. -
REJECT
- Network Firewall fails closed and drops all subsequent traffic going to the firewall. Network Firewall also sends a TCP reject packet back to your client so that the client can immediately establish a new session. Network Firewall will have context about the new session and will apply rules to the subsequent traffic.
If the service returns an enum value that is not available in the current SDK version,
streamExceptionPolicy
will returnStreamExceptionPolicy.UNKNOWN_TO_SDK_VERSION
. The raw value returned by the service is available fromstreamExceptionPolicyAsString()
.- Returns:
- Configures how Network Firewall processes traffic when a network connection breaks midstream. Network
connections can break due to disruptions in external networks or within the firewall itself.
-
DROP
- Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior. -
CONTINUE
- Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule todrop http
traffic, Network Firewall won't match the traffic for this rule because the service won't have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using aflow:stateless
rule would still match, as would theaws:drop_strict
default action. -
REJECT
- Network Firewall fails closed and drops all subsequent traffic going to the firewall. Network Firewall also sends a TCP reject packet back to your client so that the client can immediately establish a new session. Network Firewall will have context about the new session and will apply rules to the subsequent traffic.
-
- See Also:
-
-
streamExceptionPolicyAsString
Configures how Network Firewall processes traffic when a network connection breaks midstream. Network connections can break due to disruptions in external networks or within the firewall itself.
-
DROP
- Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior. -
CONTINUE
- Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule todrop http
traffic, Network Firewall won't match the traffic for this rule because the service won't have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using aflow:stateless
rule would still match, as would theaws:drop_strict
default action. -
REJECT
- Network Firewall fails closed and drops all subsequent traffic going to the firewall. Network Firewall also sends a TCP reject packet back to your client so that the client can immediately establish a new session. Network Firewall will have context about the new session and will apply rules to the subsequent traffic.
If the service returns an enum value that is not available in the current SDK version,
streamExceptionPolicy
will returnStreamExceptionPolicy.UNKNOWN_TO_SDK_VERSION
. The raw value returned by the service is available fromstreamExceptionPolicyAsString()
.- Returns:
- Configures how Network Firewall processes traffic when a network connection breaks midstream. Network
connections can break due to disruptions in external networks or within the firewall itself.
-
DROP
- Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior. -
CONTINUE
- Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule todrop http
traffic, Network Firewall won't match the traffic for this rule because the service won't have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using aflow:stateless
rule would still match, as would theaws:drop_strict
default action. -
REJECT
- Network Firewall fails closed and drops all subsequent traffic going to the firewall. Network Firewall also sends a TCP reject packet back to your client so that the client can immediately establish a new session. Network Firewall will have context about the new session and will apply rules to the subsequent traffic.
-
- See Also:
-
-
toBuilder
Description copied from interface:ToCopyableBuilder
Take this object and create a builder that contains all of the current property values of this object.- Specified by:
toBuilder
in interfaceToCopyableBuilder<StatefulEngineOptions.Builder,
StatefulEngineOptions> - Returns:
- a builder for type T
-
builder
-
serializableBuilderClass
-
hashCode
public final int hashCode() -
equals
-
equalsBySdkFields
Description copied from interface:SdkPojo
Indicates whether some other object is "equal to" this one by SDK fields. An SDK field is a modeled, non-inherited field in anSdkPojo
class, and is generated based on a service model.If an
SdkPojo
class does not have any inherited fields,equalsBySdkFields
andequals
are essentially the same.- Specified by:
equalsBySdkFields
in interfaceSdkPojo
- Parameters:
obj
- the object to be compared with- Returns:
- true if the other object equals to this object by sdk fields, false otherwise.
-
toString
Returns a string representation of this object. This is useful for testing and debugging. Sensitive data will be redacted from this string using a placeholder value. -
getValueForField
-
sdkFields
-