FirewallPolicy

networkfirewall.services.k8s.aws/v1alpha1

Metadata#

The firewall policy defines the behavior of a firewall using a collection of stateless and stateful rule groups and other settings. You can use one firewall policy for multiple firewalls.

This, along with FirewallPolicyResponse, define the policy. You can retrieve all objects for a firewall policy by calling DescribeFirewallPolicy.

Spec#

description: string
encryptionConfiguration: 
  keyID: string
  type_: string
firewallPolicy: 
  policyVariables: 
    ruleVariables: {}
  statefulDefaultActions:
  - string
  statefulEngineOptions: 
    ruleOrder: string
    streamExceptionPolicy: string
  statefulRuleGroupReferences:
    override: 
      action: string
    priority: integer
    resourceARN: string
  statelessCustomActions:
    actionDefinition: 
      publishMetricAction: 
        dimensions:
        - value: string
    actionName: string
  statelessDefaultActions:
  - string
  statelessFragmentDefaultActions:
  - string
  statelessRuleGroupReferences:
  - priority: integer
    resourceARN: string
  tlsInspectionConfigurationARN: string
firewallPolicyName: string
tags:
- key: string
  value: string

You define and name the custom actions that you want to be able to use, and then you reference them by name in your actions settings.

You can use custom actions in the following places:

• In a rule group’s StatelessRulesAndCustomActions specification. The custom actions are available for use by name inside the StatelessRulesAndCustomActions where you define them. You can use them for your stateless rule actions to specify what to do with a packet that matches the rule’s match attributes.

• In a FirewallPolicy specification, in StatelessCustomActions. The custom actions are available for use inside the policy where you define them. You can use them for the policy’s default stateless actions settings to specify what to do with packets that don’t match any of the policy’s stateless rules. || firewallPolicy.statelessCustomActions.[].actionDefinition
  Optional | object
  A custom action to use in stateless rule actions settings. This is used in
  CustomAction. | | firewallPolicy.statelessCustomActions.[].actionDefinition.publishMetricAction
  Optional | object
  Stateless inspection criteria that publishes the specified metrics to Amazon
  CloudWatch for the matching packet. This setting defines a CloudWatch dimension
  value to be published. | | firewallPolicy.statelessCustomActions.[].actionDefinition.publishMetricAction.dimensions
  Optional | array
  | | firewallPolicy.statelessCustomActions.[].actionDefinition.publishMetricAction.dimensions.[]
  Required | object
  The value to use in an Amazon CloudWatch custom metric dimension. This is used in the PublishMetrics CustomAction. A CloudWatch custom metric dimension is a name/value pair that’s part of the identity of a metric.

Network Firewall sets the dimension name to CustomAction and you provide the dimension value.

For more information about CloudWatch custom metric dimensions, see Publishing Custom Metrics (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/publishingMetrics.html#usingDimensions) in the Amazon CloudWatch User Guide (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html). || firewallPolicy.statelessCustomActions.[].actionDefinition.publishMetricAction.dimensions.[].value
Optional | string
| | firewallPolicy.statelessCustomActions.[].actionName
Optional | string
| | firewallPolicy.statelessDefaultActions
Optional | array
| | firewallPolicy.statelessDefaultActions.[]
Required | string
|| firewallPolicy.statelessFragmentDefaultActions
Optional | array
| | firewallPolicy.statelessFragmentDefaultActions.[]
Required | string
|| firewallPolicy.statelessRuleGroupReferences
Optional | array
| | firewallPolicy.statelessRuleGroupReferences.[]
Required | object
Identifier for a single stateless rule group, used in a firewall policy to refer to the rule group. || firewallPolicy.statelessRuleGroupReferences.[].priority
Optional | integer
| | firewallPolicy.statelessRuleGroupReferences.[].resourceARN
Optional | string
| | firewallPolicy.tlsInspectionConfigurationARN
Optional | string
| | firewallPolicyName
Required | string
The descriptive name of the firewall policy. You can’t change the name of
a firewall policy after you create it. | | tags
Optional | array
The key:value pairs to associate with the resource. | | tags.[]
Required | object
A key:value pair associated with an Amazon Web Services resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as “environment”) and the tag value represents a specific value within that category (such as “test,” “development,” or “production”). You can add up to 50 tags to each Amazon Web Services resource. || tags.[].key
Optional | string
| | tags.[].value
Optional | string
|

Status#

ackResourceMetadata: 
  arn: string
  ownerAccountID: string
  region: string
conditions:
- lastTransitionTime: string
  message: string
  reason: string
  status: string
  type: string
firewallPolicyResponse: 
  consumedStatefulRuleCapacity: integer
  consumedStatelessRuleCapacity: integer
  description: string
  encryptionConfiguration: 
    keyID: string
    type_: string
  firewallPolicyARN: string
  firewallPolicyID: string
  firewallPolicyName: string
  firewallPolicyStatus: string
  lastModifiedTime: string
  numberOfAssociations: integer
  tags:
  - key: string
    value: string
updateToken: string