AWS Native v0.109.0, Jun 26 24

AWS Native is in preview. AWS Classic is fully supported.

AWS Native v0.109.0 published on Wednesday, Jun 26, 2024 by Pulumi

pulumi/pulumi-aws-native

aws-native.networkfirewall.getRuleGroup

Explore with Pulumi AI

AWS Native is in preview. AWS Classic is fully supported.

AWS Native v0.109.0 published on Wednesday, Jun 26, 2024 by Pulumi

pulumi/pulumi-aws-native

Using getRuleGroup

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getRuleGroup(args: GetRuleGroupArgs, opts?: InvokeOptions): Promise<GetRuleGroupResult>
function getRuleGroupOutput(args: GetRuleGroupOutputArgs, opts?: InvokeOptions): Output<GetRuleGroupResult>

def get_rule_group(rule_group_arn: Optional[str] = None,
                   opts: Optional[InvokeOptions] = None) -> GetRuleGroupResult
def get_rule_group_output(rule_group_arn: Optional[pulumi.Input[str]] = None,
                   opts: Optional[InvokeOptions] = None) -> Output[GetRuleGroupResult]

func LookupRuleGroup(ctx *Context, args *LookupRuleGroupArgs, opts ...InvokeOption) (*LookupRuleGroupResult, error)
func LookupRuleGroupOutput(ctx *Context, args *LookupRuleGroupOutputArgs, opts ...InvokeOption) LookupRuleGroupResultOutput

> Note: This function is named LookupRuleGroup in the Go SDK.

public static class GetRuleGroup 
{
    public static Task<GetRuleGroupResult> InvokeAsync(GetRuleGroupArgs args, InvokeOptions? opts = null)
    public static Output<GetRuleGroupResult> Invoke(GetRuleGroupInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetRuleGroupResult> getRuleGroup(GetRuleGroupArgs args, InvokeOptions options)
// Output-based functions aren't available in Java yet

fn::invoke:
  function: aws-native:networkfirewall:getRuleGroup
  arguments:
    # arguments dictionary

The following arguments are supported:

RuleGroupArn string: The Amazon Resource Name (ARN) of the RuleGroup .

RuleGroupArn string: The Amazon Resource Name (ARN) of the RuleGroup .

ruleGroupArn String: The Amazon Resource Name (ARN) of the RuleGroup .

ruleGroupArn string: The Amazon Resource Name (ARN) of the RuleGroup .

rule_group_arn str: The Amazon Resource Name (ARN) of the RuleGroup .

ruleGroupArn String: The Amazon Resource Name (ARN) of the RuleGroup .

getRuleGroup Result

The following output properties are available:

Description string

A description of the rule group.

RuleGroupArn string

The Amazon Resource Name (ARN) of the RuleGroup .

RuleGroupId string

The unique ID of the RuleGroup resource.

RuleGroupValue Pulumi.AwsNative.NetworkFirewall.Outputs.RuleGroup

An object that defines the rule group rules.

Tags List<Pulumi.AwsNative.Outputs.Tag>

An array of key-value pairs to apply to this resource.

For more information, see Tag .

Description string

A description of the rule group.

RuleGroup RuleGroupType

An object that defines the rule group rules.

RuleGroupArn string

The Amazon Resource Name (ARN) of the RuleGroup .

RuleGroupId string

The unique ID of the RuleGroup resource.

Tags Tag

An array of key-value pairs to apply to this resource.

For more information, see Tag .

description String

A description of the rule group.

ruleGroup RuleGroup

An object that defines the rule group rules.

ruleGroupArn String

The Amazon Resource Name (ARN) of the RuleGroup .

ruleGroupId String

The unique ID of the RuleGroup resource.

tags List<Tag>

An array of key-value pairs to apply to this resource.

For more information, see Tag .

description string

A description of the rule group.

ruleGroup RuleGroup

An object that defines the rule group rules.

ruleGroupArn string

The Amazon Resource Name (ARN) of the RuleGroup .

ruleGroupId string

The unique ID of the RuleGroup resource.

tags Tag[]

An array of key-value pairs to apply to this resource.

For more information, see Tag .

description str

A description of the rule group.

rule_group RuleGroup

An object that defines the rule group rules.

rule_group_arn str

The Amazon Resource Name (ARN) of the RuleGroup .

rule_group_id str

The unique ID of the RuleGroup resource.

tags Sequence[root_Tag]

An array of key-value pairs to apply to this resource.

For more information, see Tag .

description String

A description of the rule group.

ruleGroup Property Map

An object that defines the rule group rules.

ruleGroupArn String

The Amazon Resource Name (ARN) of the RuleGroup .

ruleGroupId String

The unique ID of the RuleGroup resource.

tags List<Property Map>

An array of key-value pairs to apply to this resource.

For more information, see Tag .

Supporting Types

RuleGroup

RulesSource Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupRulesSource: The stateful rules or stateless rules for the rule group.
ReferenceSets Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupReferenceSets: The reference sets for the stateful rule group.
RuleVariables Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupRuleVariables: Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
StatefulRuleOptions Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupStatefulRuleOptions: Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these settings. Some limitations apply; for more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .

RulesSource RuleGroupRulesSource: The stateful rules or stateless rules for the rule group.
ReferenceSets RuleGroupReferenceSets: The reference sets for the stateful rule group.
RuleVariables RuleGroupRuleVariables: Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
StatefulRuleOptions RuleGroupStatefulRuleOptions: Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these settings. Some limitations apply; for more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .

rulesSource RuleGroupRulesSource: The stateful rules or stateless rules for the rule group.
referenceSets RuleGroupReferenceSets: The reference sets for the stateful rule group.
ruleVariables RuleGroupRuleVariables: Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
statefulRuleOptions RuleGroupStatefulRuleOptions: Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these settings. Some limitations apply; for more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .

rulesSource RuleGroupRulesSource: The stateful rules or stateless rules for the rule group.
referenceSets RuleGroupReferenceSets: The reference sets for the stateful rule group.
ruleVariables RuleGroupRuleVariables: Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
statefulRuleOptions RuleGroupStatefulRuleOptions: Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these settings. Some limitations apply; for more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .

rules_source RuleGroupRulesSource: The stateful rules or stateless rules for the rule group.
reference_sets RuleGroupReferenceSets: The reference sets for the stateful rule group.
rule_variables RuleGroupRuleVariables: Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
stateful_rule_options RuleGroupStatefulRuleOptions: Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these settings. Some limitations apply; for more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .

rulesSource Property Map: The stateful rules or stateless rules for the rule group.
referenceSets Property Map: The reference sets for the stateful rule group.
ruleVariables Property Map: Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
statefulRuleOptions Property Map: Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these settings. Some limitations apply; for more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .

RuleGroupActionDefinition

PublishMetricAction Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupPublishMetricAction

Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.

You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.

PublishMetricAction RuleGroupPublishMetricAction

Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.

publishMetricAction RuleGroupPublishMetricAction

Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.

publishMetricAction RuleGroupPublishMetricAction

Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.

publish_metric_action RuleGroupPublishMetricAction

Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.

publishMetricAction Property Map

Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.

RuleGroupAddress

AddressDefinition string

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

AddressDefinition string

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

addressDefinition String

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

addressDefinition string

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

address_definition str

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

addressDefinition String

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

RuleGroupCustomAction

ActionDefinition Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupActionDefinition: The custom action associated with the action name.
ActionName string: The descriptive name of the custom action. You can't change the name of a custom action after you create it.

ActionDefinition RuleGroupActionDefinition: The custom action associated with the action name.
ActionName string: The descriptive name of the custom action. You can't change the name of a custom action after you create it.

actionDefinition RuleGroupActionDefinition: The custom action associated with the action name.
actionName String: The descriptive name of the custom action. You can't change the name of a custom action after you create it.

actionDefinition RuleGroupActionDefinition: The custom action associated with the action name.
actionName string: The descriptive name of the custom action. You can't change the name of a custom action after you create it.

action_definition RuleGroupActionDefinition: The custom action associated with the action name.
action_name str: The descriptive name of the custom action. You can't change the name of a custom action after you create it.

actionDefinition Property Map: The custom action associated with the action name.
actionName String: The descriptive name of the custom action. You can't change the name of a custom action after you create it.

RuleGroupDimension

Value string: The value to use in the custom metric dimension.

Value string: The value to use in the custom metric dimension.

value String: The value to use in the custom metric dimension.

value string: The value to use in the custom metric dimension.

value str: The value to use in the custom metric dimension.

value String: The value to use in the custom metric dimension.

RuleGroupGeneratedRulesType

RuleGroupHeader

Destination string

The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

DestinationPort string

The destination port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .

Direction Pulumi.AwsNative.NetworkFirewall.RuleGroupHeaderDirection

The direction of traffic flow to inspect. If set to ANY , the inspection matches bidirectional traffic, both from the source to the destination and from the destination to the source. If set to FORWARD , the inspection only matches traffic going from the source to the destination.

Protocol Pulumi.AwsNative.NetworkFirewall.RuleGroupHeaderProtocol

The protocol to inspect for. To specify all, you can use IP , because all traffic on AWS and on the internet is IP.

Source string

The source IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

SourcePort string

The source port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .

Destination string

The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

DestinationPort string

The destination port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .

Direction RuleGroupHeaderDirection

Protocol RuleGroupHeaderProtocol

The protocol to inspect for. To specify all, you can use IP , because all traffic on AWS and on the internet is IP.

Source string

The source IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

SourcePort string

The source port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .

destination String

The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

destinationPort String

The destination port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .

direction RuleGroupHeaderDirection

protocol RuleGroupHeaderProtocol

The protocol to inspect for. To specify all, you can use IP , because all traffic on AWS and on the internet is IP.

source String

The source IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

sourcePort String

The source port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .

destination string

The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

destinationPort string

The destination port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .

direction RuleGroupHeaderDirection

protocol RuleGroupHeaderProtocol

The protocol to inspect for. To specify all, you can use IP , because all traffic on AWS and on the internet is IP.

source string

The source IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

sourcePort string

The source port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .

destination str

The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

destination_port str

The destination port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .

direction RuleGroupHeaderDirection

protocol RuleGroupHeaderProtocol

The protocol to inspect for. To specify all, you can use IP , because all traffic on AWS and on the internet is IP.

source str

The source IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

source_port str

The source port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .

destination String

The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

destinationPort String

The destination port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .

direction "FORWARD" | "ANY"

protocol "IP" | "TCP" | "UDP" | "ICMP" | "HTTP" | "FTP" | "TLS" | "SMB" | "DNS" | "DCERPC" | "SSH" | "SMTP" | "IMAP" | "MSN" | "KRB5" | "IKEV2" | "TFTP" | "NTP" | "DHCP"

The protocol to inspect for. To specify all, you can use IP , because all traffic on AWS and on the internet is IP.

source String

The source IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

sourcePort String

The source port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .

RuleGroupHeaderDirection

RuleGroupHeaderProtocol

RuleGroupIpSet

Definition List<string>

Definition []string

definition List<String>

definition string[]

definition Sequence[str]

definition List<String>

RuleGroupIpSetReference

ReferenceArn string

ReferenceArn string

referenceArn String

referenceArn string

reference_arn str

referenceArn String

RuleGroupMatchAttributes

DestinationPorts List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupPortRange>

The destination ports to inspect for. If not specified, this matches with any destination port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

Destinations List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupAddress>

The destination IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address.

Protocols List<int>

The protocols to inspect for, specified using each protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.

SourcePorts List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupPortRange>

The source ports to inspect for. If not specified, this matches with any source port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

Sources List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupAddress>

The source IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address.

TcpFlags List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupTcpFlagField>

The TCP flags and masks to inspect for. If not specified, this matches with any settings. This setting is only used for protocol 6 (TCP).

DestinationPorts []RuleGroupPortRange

The destination ports to inspect for. If not specified, this matches with any destination port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

Destinations []RuleGroupAddress

The destination IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address.

Protocols []int

The protocols to inspect for, specified using each protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.

SourcePorts []RuleGroupPortRange

The source ports to inspect for. If not specified, this matches with any source port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

Sources []RuleGroupAddress

The source IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address.

TcpFlags []RuleGroupTcpFlagField

The TCP flags and masks to inspect for. If not specified, this matches with any settings. This setting is only used for protocol 6 (TCP).

destinationPorts List<RuleGroupPortRange>

The destination ports to inspect for. If not specified, this matches with any destination port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

destinations List<RuleGroupAddress>

The destination IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address.

protocols List<Integer>

The protocols to inspect for, specified using each protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.

sourcePorts List<RuleGroupPortRange>

The source ports to inspect for. If not specified, this matches with any source port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

sources List<RuleGroupAddress>

The source IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address.

tcpFlags List<RuleGroupTcpFlagField>

The TCP flags and masks to inspect for. If not specified, this matches with any settings. This setting is only used for protocol 6 (TCP).

destinationPorts RuleGroupPortRange[]

The destination ports to inspect for. If not specified, this matches with any destination port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

destinations RuleGroupAddress[]

The destination IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address.

protocols number[]

The protocols to inspect for, specified using each protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.

sourcePorts RuleGroupPortRange[]

The source ports to inspect for. If not specified, this matches with any source port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

sources RuleGroupAddress[]

The source IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address.

tcpFlags RuleGroupTcpFlagField[]

The TCP flags and masks to inspect for. If not specified, this matches with any settings. This setting is only used for protocol 6 (TCP).

destination_ports Sequence[RuleGroupPortRange]

The destination ports to inspect for. If not specified, this matches with any destination port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

destinations Sequence[RuleGroupAddress]

The destination IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address.

protocols Sequence[int]

The protocols to inspect for, specified using each protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.

source_ports Sequence[RuleGroupPortRange]

The source ports to inspect for. If not specified, this matches with any source port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

sources Sequence[RuleGroupAddress]

The source IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address.

tcp_flags Sequence[RuleGroupTcpFlagField]

The TCP flags and masks to inspect for. If not specified, this matches with any settings. This setting is only used for protocol 6 (TCP).

destinationPorts List<Property Map>

The destination ports to inspect for. If not specified, this matches with any destination port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

destinations List<Property Map>

The destination IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address.

protocols List<Number>

The protocols to inspect for, specified using each protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.

sourcePorts List<Property Map>

The source ports to inspect for. If not specified, this matches with any source port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

sources List<Property Map>

The source IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address.

tcpFlags List<Property Map>

The TCP flags and masks to inspect for. If not specified, this matches with any settings. This setting is only used for protocol 6 (TCP).

RuleGroupPortRange

FromPort int: The lower limit of the port range. This must be less than or equal to the ToPort specification.
ToPort int: The upper limit of the port range. This must be greater than or equal to the FromPort specification.

FromPort int: The lower limit of the port range. This must be less than or equal to the ToPort specification.
ToPort int: The upper limit of the port range. This must be greater than or equal to the FromPort specification.

fromPort Integer: The lower limit of the port range. This must be less than or equal to the ToPort specification.
toPort Integer: The upper limit of the port range. This must be greater than or equal to the FromPort specification.

fromPort number: The lower limit of the port range. This must be less than or equal to the ToPort specification.
toPort number: The upper limit of the port range. This must be greater than or equal to the FromPort specification.

from_port int: The lower limit of the port range. This must be less than or equal to the ToPort specification.
to_port int: The upper limit of the port range. This must be greater than or equal to the FromPort specification.

fromPort Number: The lower limit of the port range. This must be less than or equal to the ToPort specification.
toPort Number: The upper limit of the port range. This must be greater than or equal to the FromPort specification.

RuleGroupPortSet

Definition List<string>

Definition []string

definition List<String>

definition string[]

definition Sequence[str]

definition List<String>

RuleGroupPublishMetricAction

Dimensions List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupDimension>

Dimensions []RuleGroupDimension

dimensions List<RuleGroupDimension>

dimensions RuleGroupDimension[]

dimensions Sequence[RuleGroupDimension]

dimensions List<Property Map>

RuleGroupReferenceSets

IpSetReferences Dictionary<string, Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupIpSetReference>: The IP set references to use in the stateful rule group.

IpSetReferences map[string]RuleGroupIpSetReference: The IP set references to use in the stateful rule group.

ipSetReferences Map<String,RuleGroupIpSetReference>: The IP set references to use in the stateful rule group.

ipSetReferences {[key: string]: RuleGroupIpSetReference}: The IP set references to use in the stateful rule group.

ip_set_references Mapping[str, RuleGroupIpSetReference]: The IP set references to use in the stateful rule group.

ipSetReferences Map<Property Map>: The IP set references to use in the stateful rule group.

RuleGroupRuleDefinition

Actions List<string>

The actions to take on a packet that matches one of the stateless rule definition's match attributes. You must specify a standard action and you can add custom actions.

Network Firewall only forwards a packet for stateful rule inspection if you specify aws:forward_to_sfe for a rule that the packet matches, or if the packet doesn't match any stateless rule and you specify aws:forward_to_sfe for the StatelessDefaultActions setting for the FirewallPolicy .

For every rule, you must specify exactly one of the following standard actions.

aws:pass - Discontinues all inspection of the packet and permits it to go to its intended destination.
aws:drop - Discontinues all inspection of the packet and blocks it from going to its intended destination.
aws:forward_to_sfe - Discontinues stateless inspection of the packet and forwards it to the stateful rule engine for inspection.

Additionally, you can specify a custom action. To do this, you define a custom action by name and type, then provide the name you've assigned to the action in this Actions setting.

To provide more than one action in this setting, separate the settings with a comma. For example, if you have a publish metrics custom action that you've named MyMetricsAction , then you could specify the standard action aws:pass combined with the custom action using ["aws:pass", "MyMetricsAction"] .

MatchAttributes Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupMatchAttributes

Criteria for Network Firewall to use to inspect an individual packet in stateless rule inspection. Each match attributes set can include one or more items such as IP address, CIDR range, port number, protocol, and TCP flags.

Actions []string

The actions to take on a packet that matches one of the stateless rule definition's match attributes. You must specify a standard action and you can add custom actions.

Network Firewall only forwards a packet for stateful rule inspection if you specify aws:forward_to_sfe for a rule that the packet matches, or if the packet doesn't match any stateless rule and you specify aws:forward_to_sfe for the StatelessDefaultActions setting for the FirewallPolicy .

For every rule, you must specify exactly one of the following standard actions.

aws:pass - Discontinues all inspection of the packet and permits it to go to its intended destination.
aws:drop - Discontinues all inspection of the packet and blocks it from going to its intended destination.
aws:forward_to_sfe - Discontinues stateless inspection of the packet and forwards it to the stateful rule engine for inspection.

Additionally, you can specify a custom action. To do this, you define a custom action by name and type, then provide the name you've assigned to the action in this Actions setting.

MatchAttributes RuleGroupMatchAttributes

actions List<String>

The actions to take on a packet that matches one of the stateless rule definition's match attributes. You must specify a standard action and you can add custom actions.

Network Firewall only forwards a packet for stateful rule inspection if you specify aws:forward_to_sfe for a rule that the packet matches, or if the packet doesn't match any stateless rule and you specify aws:forward_to_sfe for the StatelessDefaultActions setting for the FirewallPolicy .

For every rule, you must specify exactly one of the following standard actions.

aws:pass - Discontinues all inspection of the packet and permits it to go to its intended destination.
aws:drop - Discontinues all inspection of the packet and blocks it from going to its intended destination.
aws:forward_to_sfe - Discontinues stateless inspection of the packet and forwards it to the stateful rule engine for inspection.

Additionally, you can specify a custom action. To do this, you define a custom action by name and type, then provide the name you've assigned to the action in this Actions setting.

matchAttributes RuleGroupMatchAttributes

actions string[]

The actions to take on a packet that matches one of the stateless rule definition's match attributes. You must specify a standard action and you can add custom actions.

Network Firewall only forwards a packet for stateful rule inspection if you specify aws:forward_to_sfe for a rule that the packet matches, or if the packet doesn't match any stateless rule and you specify aws:forward_to_sfe for the StatelessDefaultActions setting for the FirewallPolicy .

For every rule, you must specify exactly one of the following standard actions.

aws:pass - Discontinues all inspection of the packet and permits it to go to its intended destination.
aws:drop - Discontinues all inspection of the packet and blocks it from going to its intended destination.
aws:forward_to_sfe - Discontinues stateless inspection of the packet and forwards it to the stateful rule engine for inspection.

Additionally, you can specify a custom action. To do this, you define a custom action by name and type, then provide the name you've assigned to the action in this Actions setting.

matchAttributes RuleGroupMatchAttributes

actions Sequence[str]

The actions to take on a packet that matches one of the stateless rule definition's match attributes. You must specify a standard action and you can add custom actions.

Network Firewall only forwards a packet for stateful rule inspection if you specify aws:forward_to_sfe for a rule that the packet matches, or if the packet doesn't match any stateless rule and you specify aws:forward_to_sfe for the StatelessDefaultActions setting for the FirewallPolicy .

For every rule, you must specify exactly one of the following standard actions.

aws:pass - Discontinues all inspection of the packet and permits it to go to its intended destination.
aws:drop - Discontinues all inspection of the packet and blocks it from going to its intended destination.
aws:forward_to_sfe - Discontinues stateless inspection of the packet and forwards it to the stateful rule engine for inspection.

Additionally, you can specify a custom action. To do this, you define a custom action by name and type, then provide the name you've assigned to the action in this Actions setting.

match_attributes RuleGroupMatchAttributes

actions List<String>

The actions to take on a packet that matches one of the stateless rule definition's match attributes. You must specify a standard action and you can add custom actions.

Network Firewall only forwards a packet for stateful rule inspection if you specify aws:forward_to_sfe for a rule that the packet matches, or if the packet doesn't match any stateless rule and you specify aws:forward_to_sfe for the StatelessDefaultActions setting for the FirewallPolicy .

For every rule, you must specify exactly one of the following standard actions.

aws:pass - Discontinues all inspection of the packet and permits it to go to its intended destination.
aws:drop - Discontinues all inspection of the packet and blocks it from going to its intended destination.
aws:forward_to_sfe - Discontinues stateless inspection of the packet and forwards it to the stateful rule engine for inspection.

Additionally, you can specify a custom action. To do this, you define a custom action by name and type, then provide the name you've assigned to the action in this Actions setting.

matchAttributes Property Map

RuleGroupRuleOption

Keyword string: The Suricata rule option keywords. For Network Firewall , the keyword signature ID (sid) is required in the format sid:112233 . The sid must be unique within the rule group. For information about Suricata rule option keywords, see Rule options .
Settings List<string>: The Suricata rule option settings. Settings have zero or more values, and the number of possible settings and required settings depends on the keyword. The format for Settings is number . For information about Suricata rule option settings, see Rule options .

Keyword string: The Suricata rule option keywords. For Network Firewall , the keyword signature ID (sid) is required in the format sid:112233 . The sid must be unique within the rule group. For information about Suricata rule option keywords, see Rule options .
Settings []string: The Suricata rule option settings. Settings have zero or more values, and the number of possible settings and required settings depends on the keyword. The format for Settings is number . For information about Suricata rule option settings, see Rule options .

keyword String: The Suricata rule option keywords. For Network Firewall , the keyword signature ID (sid) is required in the format sid:112233 . The sid must be unique within the rule group. For information about Suricata rule option keywords, see Rule options .
settings List<String>: The Suricata rule option settings. Settings have zero or more values, and the number of possible settings and required settings depends on the keyword. The format for Settings is number . For information about Suricata rule option settings, see Rule options .

keyword string: The Suricata rule option keywords. For Network Firewall , the keyword signature ID (sid) is required in the format sid:112233 . The sid must be unique within the rule group. For information about Suricata rule option keywords, see Rule options .
settings string[]: The Suricata rule option settings. Settings have zero or more values, and the number of possible settings and required settings depends on the keyword. The format for Settings is number . For information about Suricata rule option settings, see Rule options .

keyword str: The Suricata rule option keywords. For Network Firewall , the keyword signature ID (sid) is required in the format sid:112233 . The sid must be unique within the rule group. For information about Suricata rule option keywords, see Rule options .
settings Sequence[str]: The Suricata rule option settings. Settings have zero or more values, and the number of possible settings and required settings depends on the keyword. The format for Settings is number . For information about Suricata rule option settings, see Rule options .

keyword String: The Suricata rule option keywords. For Network Firewall , the keyword signature ID (sid) is required in the format sid:112233 . The sid must be unique within the rule group. For information about Suricata rule option keywords, see Rule options .
settings List<String>: The Suricata rule option settings. Settings have zero or more values, and the number of possible settings and required settings depends on the keyword. The format for Settings is number . For information about Suricata rule option settings, see Rule options .

RuleGroupRuleOrder

RuleGroupRuleVariables

IpSets Dictionary<string, Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupIpSet>: A list of IP addresses and address ranges, in CIDR notation.
PortSets Dictionary<string, Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupPortSet>: A list of port ranges.

IpSets map[string]RuleGroupIpSet: A list of IP addresses and address ranges, in CIDR notation.
PortSets map[string]RuleGroupPortSet: A list of port ranges.

ipSets Map<String,RuleGroupIpSet>: A list of IP addresses and address ranges, in CIDR notation.
portSets Map<String,RuleGroupPortSet>: A list of port ranges.

ipSets {[key: string]: RuleGroupIpSet}: A list of IP addresses and address ranges, in CIDR notation.
portSets {[key: string]: RuleGroupPortSet}: A list of port ranges.

ip_sets Mapping[str, RuleGroupIpSet]: A list of IP addresses and address ranges, in CIDR notation.
port_sets Mapping[str, RuleGroupPortSet]: A list of port ranges.

ipSets Map<Property Map>: A list of IP addresses and address ranges, in CIDR notation.
portSets Map<Property Map>: A list of port ranges.

RuleGroupRulesSource

RulesSourceList Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupRulesSourceList

Stateful inspection criteria for a domain list rule group.

RulesString string

Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.

These rules contain the inspection criteria and the action to take for traffic that matches the criteria, so this type of rule group doesn't have a separate action setting.

You can't use the priority keyword if the RuleOrder option in StatefulRuleOptions is set to STRICT_ORDER .

StatefulRules List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupStatefulRule>

An array of individual stateful rules inspection criteria to be used together in a stateful rule group. Use this option to specify simple Suricata rules with protocol, source and destination, ports, direction, and rule options. For information about the Suricata Rules format, see Rules Format .

StatelessRulesAndCustomActions Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupStatelessRulesAndCustomActions

Stateless inspection criteria to be used in a stateless rule group.

RulesSourceList RuleGroupRulesSourceList

Stateful inspection criteria for a domain list rule group.

RulesString string

Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.

These rules contain the inspection criteria and the action to take for traffic that matches the criteria, so this type of rule group doesn't have a separate action setting.

You can't use the priority keyword if the RuleOrder option in StatefulRuleOptions is set to STRICT_ORDER .

StatefulRules []RuleGroupStatefulRule

StatelessRulesAndCustomActions RuleGroupStatelessRulesAndCustomActions

Stateless inspection criteria to be used in a stateless rule group.

rulesSourceList RuleGroupRulesSourceList

Stateful inspection criteria for a domain list rule group.

rulesString String

Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.

These rules contain the inspection criteria and the action to take for traffic that matches the criteria, so this type of rule group doesn't have a separate action setting.

You can't use the priority keyword if the RuleOrder option in StatefulRuleOptions is set to STRICT_ORDER .

statefulRules List<RuleGroupStatefulRule>

statelessRulesAndCustomActions RuleGroupStatelessRulesAndCustomActions

Stateless inspection criteria to be used in a stateless rule group.

rulesSourceList RuleGroupRulesSourceList

Stateful inspection criteria for a domain list rule group.

rulesString string

Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.

These rules contain the inspection criteria and the action to take for traffic that matches the criteria, so this type of rule group doesn't have a separate action setting.

You can't use the priority keyword if the RuleOrder option in StatefulRuleOptions is set to STRICT_ORDER .

statefulRules RuleGroupStatefulRule[]

statelessRulesAndCustomActions RuleGroupStatelessRulesAndCustomActions

Stateless inspection criteria to be used in a stateless rule group.

rules_source_list RuleGroupRulesSourceList

Stateful inspection criteria for a domain list rule group.

rules_string str

Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.

These rules contain the inspection criteria and the action to take for traffic that matches the criteria, so this type of rule group doesn't have a separate action setting.

You can't use the priority keyword if the RuleOrder option in StatefulRuleOptions is set to STRICT_ORDER .

stateful_rules Sequence[RuleGroupStatefulRule]

stateless_rules_and_custom_actions RuleGroupStatelessRulesAndCustomActions

Stateless inspection criteria to be used in a stateless rule group.

rulesSourceList Property Map

Stateful inspection criteria for a domain list rule group.

rulesString String

Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.

These rules contain the inspection criteria and the action to take for traffic that matches the criteria, so this type of rule group doesn't have a separate action setting.

You can't use the priority keyword if the RuleOrder option in StatefulRuleOptions is set to STRICT_ORDER .

statefulRules List<Property Map>

statelessRulesAndCustomActions Property Map

Stateless inspection criteria to be used in a stateless rule group.

RuleGroupRulesSourceList

GeneratedRulesType Pulumi.AwsNative.NetworkFirewall.RuleGroupGeneratedRulesType

Whether you want to allow or deny access to the domains in your target list.

TargetTypes List<Pulumi.AwsNative.NetworkFirewall.RuleGroupTargetType>

The types of targets to inspect for. Valid values are TLS_SNI and HTTP_HOST .

Targets List<string>

The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

Explicit names. For example, abc.example.com matches only the domain abc.example.com .
Names that use a domain wildcard, which you indicate with an initial ' . '. For example, .example.com matches example.com and matches all subdomains of example.com , such as abc.example.com and www.example.com .

GeneratedRulesType RuleGroupGeneratedRulesType

Whether you want to allow or deny access to the domains in your target list.

TargetTypes []RuleGroupTargetType

The types of targets to inspect for. Valid values are TLS_SNI and HTTP_HOST .

Targets []string

The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

Explicit names. For example, abc.example.com matches only the domain abc.example.com .
Names that use a domain wildcard, which you indicate with an initial ' . '. For example, .example.com matches example.com and matches all subdomains of example.com , such as abc.example.com and www.example.com .

generatedRulesType RuleGroupGeneratedRulesType

Whether you want to allow or deny access to the domains in your target list.

targetTypes List<RuleGroupTargetType>

The types of targets to inspect for. Valid values are TLS_SNI and HTTP_HOST .

targets List<String>

The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

Explicit names. For example, abc.example.com matches only the domain abc.example.com .
Names that use a domain wildcard, which you indicate with an initial ' . '. For example, .example.com matches example.com and matches all subdomains of example.com , such as abc.example.com and www.example.com .

generatedRulesType RuleGroupGeneratedRulesType

Whether you want to allow or deny access to the domains in your target list.

targetTypes RuleGroupTargetType[]

The types of targets to inspect for. Valid values are TLS_SNI and HTTP_HOST .

targets string[]

The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

Explicit names. For example, abc.example.com matches only the domain abc.example.com .
Names that use a domain wildcard, which you indicate with an initial ' . '. For example, .example.com matches example.com and matches all subdomains of example.com , such as abc.example.com and www.example.com .

generated_rules_type RuleGroupGeneratedRulesType

Whether you want to allow or deny access to the domains in your target list.

target_types Sequence[RuleGroupTargetType]

The types of targets to inspect for. Valid values are TLS_SNI and HTTP_HOST .

targets Sequence[str]

The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

Explicit names. For example, abc.example.com matches only the domain abc.example.com .
Names that use a domain wildcard, which you indicate with an initial ' . '. For example, .example.com matches example.com and matches all subdomains of example.com , such as abc.example.com and www.example.com .

generatedRulesType "ALLOWLIST" | "DENYLIST"

Whether you want to allow or deny access to the domains in your target list.

targetTypes List<"TLS_SNI" | "HTTP_HOST">

The types of targets to inspect for. Valid values are TLS_SNI and HTTP_HOST .

targets List<String>

The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

Explicit names. For example, abc.example.com matches only the domain abc.example.com .
Names that use a domain wildcard, which you indicate with an initial ' . '. For example, .example.com matches example.com and matches all subdomains of example.com , such as abc.example.com and www.example.com .

RuleGroupStatefulRule

Action Pulumi.AwsNative.NetworkFirewall.RuleGroupStatefulRuleAction

Defines what Network Firewall should do with the packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow.

The actions for a stateful rule are defined as follows:

PASS - Permits the packets to go to the intended destination.
DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .
REJECT - Drops traffic that matches the conditions of the stateful rule and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. REJECT is available only for TCP traffic.
ALERT - Permits the packets to go to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .

You can use this action to test a rule that you intend to use to drop traffic. You can enable the rule with ALERT action, verify in the logs that the rule is filtering as you want, then change the action to DROP .

REJECT - Drops TCP traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. Also sends an alert log mesage if alert logging is configured in the Firewall LoggingConfiguration .

REJECT isn't currently available for use with IMAP and FTP protocols.

Header Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupHeader

The stateful inspection criteria for this rule, used to inspect traffic flows.

RuleOptions List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupRuleOption>

Additional settings for a stateful rule, provided as keywords and settings.

Action RuleGroupStatefulRuleAction

The actions for a stateful rule are defined as follows:

PASS - Permits the packets to go to the intended destination.
DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .
REJECT - Drops traffic that matches the conditions of the stateful rule and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. REJECT is available only for TCP traffic.
ALERT - Permits the packets to go to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .

REJECT - Drops TCP traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. Also sends an alert log mesage if alert logging is configured in the Firewall LoggingConfiguration .

REJECT isn't currently available for use with IMAP and FTP protocols.

Header RuleGroupHeader

The stateful inspection criteria for this rule, used to inspect traffic flows.

RuleOptions []RuleGroupRuleOption

Additional settings for a stateful rule, provided as keywords and settings.

action RuleGroupStatefulRuleAction

The actions for a stateful rule are defined as follows:

PASS - Permits the packets to go to the intended destination.
DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .
REJECT - Drops traffic that matches the conditions of the stateful rule and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. REJECT is available only for TCP traffic.
ALERT - Permits the packets to go to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .

REJECT - Drops TCP traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. Also sends an alert log mesage if alert logging is configured in the Firewall LoggingConfiguration .

REJECT isn't currently available for use with IMAP and FTP protocols.

header RuleGroupHeader

The stateful inspection criteria for this rule, used to inspect traffic flows.

ruleOptions List<RuleGroupRuleOption>

Additional settings for a stateful rule, provided as keywords and settings.

action RuleGroupStatefulRuleAction

The actions for a stateful rule are defined as follows:

PASS - Permits the packets to go to the intended destination.
DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .
REJECT - Drops traffic that matches the conditions of the stateful rule and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. REJECT is available only for TCP traffic.
ALERT - Permits the packets to go to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .

REJECT - Drops TCP traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. Also sends an alert log mesage if alert logging is configured in the Firewall LoggingConfiguration .

REJECT isn't currently available for use with IMAP and FTP protocols.

header RuleGroupHeader

The stateful inspection criteria for this rule, used to inspect traffic flows.

ruleOptions RuleGroupRuleOption[]

Additional settings for a stateful rule, provided as keywords and settings.

action RuleGroupStatefulRuleAction

The actions for a stateful rule are defined as follows:

PASS - Permits the packets to go to the intended destination.
DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .
REJECT - Drops traffic that matches the conditions of the stateful rule and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. REJECT is available only for TCP traffic.
ALERT - Permits the packets to go to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .

REJECT - Drops TCP traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. Also sends an alert log mesage if alert logging is configured in the Firewall LoggingConfiguration .

REJECT isn't currently available for use with IMAP and FTP protocols.

header RuleGroupHeader

The stateful inspection criteria for this rule, used to inspect traffic flows.

rule_options Sequence[RuleGroupRuleOption]

Additional settings for a stateful rule, provided as keywords and settings.

action "PASS" | "DROP" | "ALERT" | "REJECT"

The actions for a stateful rule are defined as follows:

PASS - Permits the packets to go to the intended destination.
DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .
REJECT - Drops traffic that matches the conditions of the stateful rule and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. REJECT is available only for TCP traffic.
ALERT - Permits the packets to go to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .

REJECT - Drops TCP traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. Also sends an alert log mesage if alert logging is configured in the Firewall LoggingConfiguration .

REJECT isn't currently available for use with IMAP and FTP protocols.

header Property Map

The stateful inspection criteria for this rule, used to inspect traffic flows.

ruleOptions List<Property Map>

Additional settings for a stateful rule, provided as keywords and settings.

RuleGroupStatefulRuleAction

RuleGroupStatefulRuleOptions

RuleOrder Pulumi.AwsNative.NetworkFirewall.RuleGroupRuleOrder: Indicates how to manage the order of the rule evaluation for the rule group. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .

RuleOrder RuleGroupRuleOrder: Indicates how to manage the order of the rule evaluation for the rule group. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .

ruleOrder RuleGroupRuleOrder: Indicates how to manage the order of the rule evaluation for the rule group. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .

ruleOrder RuleGroupRuleOrder: Indicates how to manage the order of the rule evaluation for the rule group. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .

rule_order RuleGroupRuleOrder: Indicates how to manage the order of the rule evaluation for the rule group. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .

ruleOrder "DEFAULT_ACTION_ORDER" | "STRICT_ORDER": Indicates how to manage the order of the rule evaluation for the rule group. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .

RuleGroupStatelessRule

Priority int

Indicates the order in which to run this rule relative to all of the rules that are defined for a stateless rule group. Network Firewall evaluates the rules in a rule group starting with the lowest priority setting. You must ensure that the priority settings are unique for the rule group.

Each stateless rule group uses exactly one StatelessRulesAndCustomActions object, and each StatelessRulesAndCustomActions contains exactly one StatelessRules object. To ensure unique priority settings for your rule groups, set unique priorities for the stateless rules that you define inside any single StatelessRules object.

You can change the priority settings of your rules at any time. To make it easier to insert rules later, number them so there's a wide range in between, for example use 100, 200, and so on.

RuleDefinition Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupRuleDefinition

Defines the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria.

Priority int

You can change the priority settings of your rules at any time. To make it easier to insert rules later, number them so there's a wide range in between, for example use 100, 200, and so on.

RuleDefinition RuleGroupRuleDefinition

Defines the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria.

priority Integer

You can change the priority settings of your rules at any time. To make it easier to insert rules later, number them so there's a wide range in between, for example use 100, 200, and so on.

ruleDefinition RuleGroupRuleDefinition

Defines the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria.

priority number

You can change the priority settings of your rules at any time. To make it easier to insert rules later, number them so there's a wide range in between, for example use 100, 200, and so on.

ruleDefinition RuleGroupRuleDefinition

Defines the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria.

priority int

You can change the priority settings of your rules at any time. To make it easier to insert rules later, number them so there's a wide range in between, for example use 100, 200, and so on.

rule_definition RuleGroupRuleDefinition

Defines the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria.

priority Number

You can change the priority settings of your rules at any time. To make it easier to insert rules later, number them so there's a wide range in between, for example use 100, 200, and so on.

ruleDefinition Property Map

Defines the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria.

RuleGroupStatelessRulesAndCustomActions

StatelessRules List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupStatelessRule>: Defines the set of stateless rules for use in a stateless rule group.
CustomActions List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupCustomAction>: Defines an array of individual custom action definitions that are available for use by the stateless rules in this StatelessRulesAndCustomActions specification. You name each custom action that you define, and then you can use it by name in your stateless rule RuleGroup.RuleDefinition Actions specification.

StatelessRules []RuleGroupStatelessRule: Defines the set of stateless rules for use in a stateless rule group.
CustomActions []RuleGroupCustomAction: Defines an array of individual custom action definitions that are available for use by the stateless rules in this StatelessRulesAndCustomActions specification. You name each custom action that you define, and then you can use it by name in your stateless rule RuleGroup.RuleDefinition Actions specification.

statelessRules List<RuleGroupStatelessRule>: Defines the set of stateless rules for use in a stateless rule group.
customActions List<RuleGroupCustomAction>: Defines an array of individual custom action definitions that are available for use by the stateless rules in this StatelessRulesAndCustomActions specification. You name each custom action that you define, and then you can use it by name in your stateless rule RuleGroup.RuleDefinition Actions specification.

statelessRules RuleGroupStatelessRule[]: Defines the set of stateless rules for use in a stateless rule group.
customActions RuleGroupCustomAction[]: Defines an array of individual custom action definitions that are available for use by the stateless rules in this StatelessRulesAndCustomActions specification. You name each custom action that you define, and then you can use it by name in your stateless rule RuleGroup.RuleDefinition Actions specification.

stateless_rules Sequence[RuleGroupStatelessRule]: Defines the set of stateless rules for use in a stateless rule group.
custom_actions Sequence[RuleGroupCustomAction]: Defines an array of individual custom action definitions that are available for use by the stateless rules in this StatelessRulesAndCustomActions specification. You name each custom action that you define, and then you can use it by name in your stateless rule RuleGroup.RuleDefinition Actions specification.

statelessRules List<Property Map>: Defines the set of stateless rules for use in a stateless rule group.
customActions List<Property Map>: Defines an array of individual custom action definitions that are available for use by the stateless rules in this StatelessRulesAndCustomActions specification. You name each custom action that you define, and then you can use it by name in your stateless rule RuleGroup.RuleDefinition Actions specification.

RuleGroupTargetType

RuleGroupTcpFlag

RuleGroupTcpFlagField

Flags List<Pulumi.AwsNative.NetworkFirewall.RuleGroupTcpFlag>

Used in conjunction with the Masks setting to define the flags that must be set and flags that must not be set in order for the packet to match. This setting can only specify values that are also specified in the Masks setting.

For the flags that are specified in the masks setting, the following must be true for the packet to match:

The ones that are set in this flags setting must be set in the packet.
The ones that are not set in this flags setting must also not be set in the packet.

Masks List<Pulumi.AwsNative.NetworkFirewall.RuleGroupTcpFlag>

The set of flags to consider in the inspection. To inspect all flags in the valid values list, leave this with no setting.

Flags []RuleGroupTcpFlag

For the flags that are specified in the masks setting, the following must be true for the packet to match:

The ones that are set in this flags setting must be set in the packet.
The ones that are not set in this flags setting must also not be set in the packet.

Masks []RuleGroupTcpFlag

The set of flags to consider in the inspection. To inspect all flags in the valid values list, leave this with no setting.

flags List<RuleGroupTcpFlag>

For the flags that are specified in the masks setting, the following must be true for the packet to match:

The ones that are set in this flags setting must be set in the packet.
The ones that are not set in this flags setting must also not be set in the packet.

masks List<RuleGroupTcpFlag>

The set of flags to consider in the inspection. To inspect all flags in the valid values list, leave this with no setting.

flags RuleGroupTcpFlag[]

For the flags that are specified in the masks setting, the following must be true for the packet to match:

The ones that are set in this flags setting must be set in the packet.
The ones that are not set in this flags setting must also not be set in the packet.

masks RuleGroupTcpFlag[]

The set of flags to consider in the inspection. To inspect all flags in the valid values list, leave this with no setting.

flags Sequence[RuleGroupTcpFlag]

For the flags that are specified in the masks setting, the following must be true for the packet to match:

The ones that are set in this flags setting must be set in the packet.
The ones that are not set in this flags setting must also not be set in the packet.

masks Sequence[RuleGroupTcpFlag]

The set of flags to consider in the inspection. To inspect all flags in the valid values list, leave this with no setting.

flags List<"FIN" | "SYN" | "RST" | "PSH" | "ACK" | "URG" | "ECE" | "CWR">

For the flags that are specified in the masks setting, the following must be true for the packet to match:

The ones that are set in this flags setting must be set in the packet.
The ones that are not set in this flags setting must also not be set in the packet.

masks List<"FIN" | "SYN" | "RST" | "PSH" | "ACK" | "URG" | "ECE" | "CWR">

The set of flags to consider in the inspection. To inspect all flags in the valid values list, leave this with no setting.

Package Details

Repository: AWS Native pulumi/pulumi-aws-native
License: Apache-2.0

AWS Native is in preview. AWS Classic is fully supported.

AWS Native v0.109.0 published on Wednesday, Jun 26, 2024 by Pulumi

pulumi/pulumi-aws-native

aws-native.networkfirewall.getRuleGroup

On this page

On this page

Using getRuleGroup

getRuleGroup Result

Supporting Types

RuleGroup

RuleGroupActionDefinition

RuleGroupAddress

RuleGroupCustomAction

RuleGroupDimension

RuleGroupGeneratedRulesType

RuleGroupHeader

RuleGroupHeaderDirection

RuleGroupHeaderProtocol

RuleGroupIpSet

RuleGroupIpSetReference

RuleGroupMatchAttributes

RuleGroupPortRange

RuleGroupPortSet

RuleGroupPublishMetricAction

RuleGroupReferenceSets

RuleGroupRuleDefinition

RuleGroupRuleOption

RuleGroupRuleOrder

RuleGroupRuleVariables

RuleGroupRulesSource

RuleGroupRulesSourceList

RuleGroupStatefulRule

RuleGroupStatefulRuleAction

RuleGroupStatefulRuleOptions

RuleGroupStatelessRule

RuleGroupStatelessRulesAndCustomActions

RuleGroupTargetType

RuleGroupTcpFlag

RuleGroupTcpFlagField

Tag

Package Details

On this page

On this page