RuleGroup

networkfirewall.services.k8s.aws/v1alpha1

Metadata#

The object that defines the rules in a rule group. This, along with RuleGroupResponse, define the rule group. You can retrieve all objects for a rule group by calling DescribeRuleGroup.

Network Firewall uses a rule group to inspect and control network traffic. You define stateless rule groups to inspect individual packets and you define stateful rule groups to inspect packets in the context of their traffic flow.

To use a rule group, you include it by reference in an Network Firewall firewall policy, then you use the policy in a firewall. You can reference a rule group from more than one firewall policy, and you can use a firewall policy in more than one firewall.

Spec#

analyzeRuleGroup: boolean
capacity: integer
description: string
dryRun: boolean
encryptionConfiguration: 
  keyID: string
  type_: string
ruleGroup: 
  referenceSets: 
    ipSetReferences: {}
  ruleVariables: 
    ipSets: {}
    portSets: {}
  rulesSource: 
    rulesSourceList: 
      generatedRulesType: string
      targetTypes:
      - string
      targets:
      - string
    rulesString: string
    statefulRules:
    - action: string
      header: 
        destination: string
        destinationPort: string
        direction: string
        protocol: string
        source: string
        sourcePort: string
      ruleOptions:
      - keyword: string
        settings:
        - string
    statelessRulesAndCustomActions: 
      customActions:
        actionDefinition: 
          publishMetricAction: 
            dimensions:
            - value: string
        actionName: string
      statelessRules:
      - priority: integer
        ruleDefinition: 
          actions:
          - string
          matchAttributes: 
            destinationPorts:
            - fromPort: integer
              toPort: integer
            destinations:
            - addressDefinition: string
            protocols:
            - integer
            sourcePorts:
            - fromPort: integer
              toPort: integer
            sources:
            - addressDefinition: string
            tcpFlags:
              flags:
              - string
              masks:
              - string
  statefulRuleOptions: 
    ruleOrder: string
ruleGroupName: string
rules: string
sourceMetadata: 
  sourceARN: string
  sourceUpdateToken: string
tags:
- key: string
  value: string
type_: string

You define and name the custom actions that you want to be able to use, and then you reference them by name in your actions settings.

You can use custom actions in the following places:

• In a rule group’s StatelessRulesAndCustomActions specification. The custom actions are available for use by name inside the StatelessRulesAndCustomActions where you define them. You can use them for your stateless rule actions to specify what to do with a packet that matches the rule’s match attributes.

• In a FirewallPolicy specification, in StatelessCustomActions. The custom actions are available for use inside the policy where you define them. You can use them for the policy’s default stateless actions settings to specify what to do with packets that don’t match any of the policy’s stateless rules. || ruleGroup.rulesSource.statelessRulesAndCustomActions.customActions.[].actionDefinition
  Optional | object
  A custom action to use in stateless rule actions settings. This is used in
  CustomAction. | | ruleGroup.rulesSource.statelessRulesAndCustomActions.customActions.[].actionDefinition.publishMetricAction
  Optional | object
  Stateless inspection criteria that publishes the specified metrics to Amazon
  CloudWatch for the matching packet. This setting defines a CloudWatch dimension
  value to be published. | | ruleGroup.rulesSource.statelessRulesAndCustomActions.customActions.[].actionDefinition.publishMetricAction.dimensions
  Optional | array
  | | ruleGroup.rulesSource.statelessRulesAndCustomActions.customActions.[].actionDefinition.publishMetricAction.dimensions.[]
  Required | object
  The value to use in an Amazon CloudWatch custom metric dimension. This is used in the PublishMetrics CustomAction. A CloudWatch custom metric dimension is a name/value pair that’s part of the identity of a metric.

Network Firewall sets the dimension name to CustomAction and you provide the dimension value.

For more information about CloudWatch custom metric dimensions, see Publishing Custom Metrics (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/publishingMetrics.html#usingDimensions) in the Amazon CloudWatch User Guide (https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html). || ruleGroup.rulesSource.statelessRulesAndCustomActions.customActions.[].actionDefinition.publishMetricAction.dimensions.[].value
Optional | string
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.customActions.[].actionName
Optional | string
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules
Optional | array
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[]
Required | object
A single stateless rule. This is used in StatelessRulesAndCustomActions. || ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].priority
Optional | integer
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition
Optional | object
The inspection criteria and action for a single stateless rule. Network Firewall
inspects each packet for the specified matching criteria. When a packet matches
the criteria, Network Firewall performs the rule’s actions on the packet. | | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.actions
Optional | array
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.actions.[]
Required | string
|| ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes
Optional | object
Criteria for Network Firewall to use to inspect an individual packet in stateless
rule inspection. Each match attributes set can include one or more items
such as IP address, CIDR range, port number, protocol, and TCP flags. | | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.destinationPorts
Optional | array
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.destinationPorts.[]
Required | object
A single port range specification. This is used for source and destination port ranges in the stateless rule MatchAttributes, SourcePorts, and DestinationPorts settings. || ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.destinationPorts.[].fromPort
Optional | integer
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.destinationPorts.[].toPort
Optional | integer
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.destinations
Optional | array
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.destinations.[]
Required | object
A single IP address specification. This is used in the MatchAttributes source and destination specifications. || ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.destinations.[].addressDefinition
Optional | string
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.protocols
Optional | array
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.protocols.[]
Required | integer
|| ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.sourcePorts
Optional | array
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.sourcePorts.[]
Required | object
A single port range specification. This is used for source and destination port ranges in the stateless rule MatchAttributes, SourcePorts, and DestinationPorts settings. || ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.sourcePorts.[].fromPort
Optional | integer
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.sourcePorts.[].toPort
Optional | integer
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.sources
Optional | array
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.sources.[]
Required | object
A single IP address specification. This is used in the MatchAttributes source and destination specifications. || ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.sources.[].addressDefinition
Optional | string
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.tcpFlags
Optional | array
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.tcpFlags.[]
Required | object
TCP flags and masks to inspect packets for, used in stateless rules MatchAttributes settings. || ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.tcpFlags.[].flags
Optional | array
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.tcpFlags.[].flags.[]
Required | string
|| ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.tcpFlags.[].masks
Optional | array
| | ruleGroup.rulesSource.statelessRulesAndCustomActions.statelessRules.[].ruleDefinition.matchAttributes.tcpFlags.[].masks.[]
Required | string
|| ruleGroup.statefulRuleOptions
Optional | object
Additional options governing how Network Firewall handles the rule group.
You can only use these for stateful rule groups. | | ruleGroup.statefulRuleOptions.ruleOrder
Optional | string
| | ruleGroupName
Required | string
The descriptive name of the rule group. You can’t change the name of a rule
group after you create it. | | rules
Optional | string
A string containing stateful rule group rules specifications in Suricata
flat format, with one rule per line. Use this to import your existing Suricata
compatible rule groups.

You must provide either this rules setting or a populated RuleGroup setting,
but not both.

You can provide your rule group specification in Suricata flat format through
this setting when you create or update your rule group. The call response
returns a RuleGroup object that Network Firewall has populated from your
string. | | sourceMetadata
Optional | object
A complex type that contains metadata about the rule group that your own
rule group is copied from. You can use the metadata to keep track of updates
made to the originating rule group. | | sourceMetadata.sourceARN
Optional | string
| | sourceMetadata.sourceUpdateToken
Optional | string
| | tags
Optional | array
The key:value pairs to associate with the resource. | | tags.[]
Required | object
A key:value pair associated with an Amazon Web Services resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as “environment”) and the tag value represents a specific value within that category (such as “test,” “development,” or “production”). You can add up to 50 tags to each Amazon Web Services resource. || tags.[].key
Optional | string
| | tags.[].value
Optional | string
| | **type_**
Required | **string**
Indicates whether the rule group is stateless or stateful. If the rule group
is stateless, it contains stateless rules. If it is stateful, it contains
stateful rules. |

Status#

ackResourceMetadata: 
  arn: string
  ownerAccountID: string
  region: string
conditions:
- lastTransitionTime: string
  message: string
  reason: string
  status: string
  type: string
ruleGroupResponse: 
  analysisResults:
  - analysisDetail: string
    identifiedRuleIDs:
    - string
    identifiedType: string
  capacity: integer
  consumedCapacity: integer
  description: string
  encryptionConfiguration: 
    keyID: string
    type_: string
  lastModifiedTime: string
  numberOfAssociations: integer
  ruleGroupARN: string
  ruleGroupID: string
  ruleGroupName: string
  ruleGroupStatus: string
  snsTopic: string
  sourceMetadata: 
    sourceARN: string
    sourceUpdateToken: string
  tags:
  - key: string
    value: string
  type_: string
updateToken: string