Docs Home Pulumi IaC Pulumi ESC Pulumi Cloud Packages Tutorials
  1. Packages
  2. AWS Native
  3. API Docs
  4. networkfirewall
  5. RuleGroup

We recommend new projects start with resources from the AWS provider.

AWS Native v0.126.0 published on Monday, Sep 30, 2024 by Pulumi
pulumi/pulumi-aws-native

aws-native.networkfirewall.RuleGroup

Explore with Pulumi AI

aws-native logo

We recommend new projects start with resources from the AWS provider.

AWS Native v0.126.0 published on Monday, Sep 30, 2024 by Pulumi
pulumi/pulumi-aws-native

    Resource type definition for AWS::NetworkFirewall::RuleGroup

    Create RuleGroup Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new RuleGroup(name: string, args: RuleGroupArgs, opts?: CustomResourceOptions);
    @overload
def RuleGroup(resource_name: str,
              args: RuleGroupInitArgs,
              opts: Optional[ResourceOptions] = None)

@overload
def RuleGroup(resource_name: str,
              opts: Optional[ResourceOptions] = None,
              capacity: Optional[int] = None,
              type: Optional[RuleGroupTypeEnum] = None,
              description: Optional[str] = None,
              rule_group: Optional[RuleGroupArgs] = None,
              rule_group_name: Optional[str] = None,
              tags: Optional[Sequence[_root_inputs.TagArgs]] = None)
    func NewRuleGroup(ctx *Context, name string, args RuleGroupArgs, opts ...ResourceOption) (*RuleGroup, error)
    public RuleGroup(string name, RuleGroupArgs args, CustomResourceOptions? opts = null)
    public RuleGroup(String name, RuleGroupArgs args)
public RuleGroup(String name, RuleGroupArgs args, CustomResourceOptions options)

    type: aws-native:networkfirewall:RuleGroup
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args RuleGroupArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args RuleGroupInitArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args RuleGroupArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args RuleGroupArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args RuleGroupArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    RuleGroup Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    The RuleGroup resource accepts the following input properties:

    Capacity int
    The maximum operating resources that this rule group can use. You can't change a rule group's capacity setting after you create the rule group. When you update a rule group, you are limited to this capacity. When you reference a rule group from a firewall policy, Network Firewall reserves this capacity for the rule group.
    Type Pulumi.AwsNative.NetworkFirewall.RuleGroupTypeEnum
    Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules.
    Description string
    A description of the rule group.
    RuleGroupName string
    The descriptive name of the rule group. You can't change the name of a rule group after you create it.
    RuleGroupValue Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroup
    An object that defines the rule group rules.
    Tags List<Pulumi.AwsNative.Inputs.Tag>

    An array of key-value pairs to apply to this resource.

    For more information, see Tag .

    Capacity int
    The maximum operating resources that this rule group can use. You can't change a rule group's capacity setting after you create the rule group. When you update a rule group, you are limited to this capacity. When you reference a rule group from a firewall policy, Network Firewall reserves this capacity for the rule group.
    Type RuleGroupTypeEnum
    Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules.
    Description string
    A description of the rule group.
    RuleGroup RuleGroupTypeArgs
    An object that defines the rule group rules.
    RuleGroupName string
    The descriptive name of the rule group. You can't change the name of a rule group after you create it.
    Tags TagArgs

    An array of key-value pairs to apply to this resource.

    For more information, see Tag .

    capacity Integer
    The maximum operating resources that this rule group can use. You can't change a rule group's capacity setting after you create the rule group. When you update a rule group, you are limited to this capacity. When you reference a rule group from a firewall policy, Network Firewall reserves this capacity for the rule group.
    type RuleGroupTypeEnum
    Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules.
    description String
    A description of the rule group.
    ruleGroup RuleGroup
    An object that defines the rule group rules.
    ruleGroupName String
    The descriptive name of the rule group. You can't change the name of a rule group after you create it.
    tags List<Tag>

    An array of key-value pairs to apply to this resource.

    For more information, see Tag .

    capacity number
    The maximum operating resources that this rule group can use. You can't change a rule group's capacity setting after you create the rule group. When you update a rule group, you are limited to this capacity. When you reference a rule group from a firewall policy, Network Firewall reserves this capacity for the rule group.
    type RuleGroupTypeEnum
    Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules.
    description string
    A description of the rule group.
    ruleGroup RuleGroup
    An object that defines the rule group rules.
    ruleGroupName string
    The descriptive name of the rule group. You can't change the name of a rule group after you create it.
    tags Tag[]

    An array of key-value pairs to apply to this resource.

    For more information, see Tag .

    capacity int
    The maximum operating resources that this rule group can use. You can't change a rule group's capacity setting after you create the rule group. When you update a rule group, you are limited to this capacity. When you reference a rule group from a firewall policy, Network Firewall reserves this capacity for the rule group.
    type RuleGroupTypeEnum
    Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules.
    description str
    A description of the rule group.
    rule_group RuleGroupArgs
    An object that defines the rule group rules.
    rule_group_name str
    The descriptive name of the rule group. You can't change the name of a rule group after you create it.
    tags Sequence[TagArgs]

    An array of key-value pairs to apply to this resource.

    For more information, see Tag .

    capacity Number
    The maximum operating resources that this rule group can use. You can't change a rule group's capacity setting after you create the rule group. When you update a rule group, you are limited to this capacity. When you reference a rule group from a firewall policy, Network Firewall reserves this capacity for the rule group.
    type "STATELESS" | "STATEFUL"
    Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules.
    description String
    A description of the rule group.
    ruleGroup Property Map
    An object that defines the rule group rules.
    ruleGroupName String
    The descriptive name of the rule group. You can't change the name of a rule group after you create it.
    tags List<Property Map>

    An array of key-value pairs to apply to this resource.

    For more information, see Tag .

    Outputs

    All input properties are implicitly available as output properties. Additionally, the RuleGroup resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    RuleGroupArn string
    The Amazon Resource Name (ARN) of the RuleGroup .
    RuleGroupId string
    The unique ID of the RuleGroup resource.
    Id string
    The provider-assigned unique ID for this managed resource.
    RuleGroupArn string
    The Amazon Resource Name (ARN) of the RuleGroup .
    RuleGroupId string
    The unique ID of the RuleGroup resource.
    id String
    The provider-assigned unique ID for this managed resource.
    ruleGroupArn String
    The Amazon Resource Name (ARN) of the RuleGroup .
    ruleGroupId String
    The unique ID of the RuleGroup resource.
    id string
    The provider-assigned unique ID for this managed resource.
    ruleGroupArn string
    The Amazon Resource Name (ARN) of the RuleGroup .
    ruleGroupId string
    The unique ID of the RuleGroup resource.
    id str
    The provider-assigned unique ID for this managed resource.
    rule_group_arn str
    The Amazon Resource Name (ARN) of the RuleGroup .
    rule_group_id str
    The unique ID of the RuleGroup resource.
    id String
    The provider-assigned unique ID for this managed resource.
    ruleGroupArn String
    The Amazon Resource Name (ARN) of the RuleGroup .
    ruleGroupId String
    The unique ID of the RuleGroup resource.

    Supporting Types

    RuleGroup, RuleGroupArgs

    RulesSource Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupRulesSource
    The stateful rules or stateless rules for the rule group.
    ReferenceSets Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupReferenceSets
    The reference sets for the stateful rule group.
    RuleVariables Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupRuleVariables
    Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
    StatefulRuleOptions Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupStatefulRuleOptions
    Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these settings. Some limitations apply; for more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .
    RulesSource RuleGroupRulesSource
    The stateful rules or stateless rules for the rule group.
    ReferenceSets RuleGroupReferenceSets
    The reference sets for the stateful rule group.
    RuleVariables RuleGroupRuleVariables
    Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
    StatefulRuleOptions RuleGroupStatefulRuleOptions
    Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these settings. Some limitations apply; for more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .
    rulesSource RuleGroupRulesSource
    The stateful rules or stateless rules for the rule group.
    referenceSets RuleGroupReferenceSets
    The reference sets for the stateful rule group.
    ruleVariables RuleGroupRuleVariables
    Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
    statefulRuleOptions RuleGroupStatefulRuleOptions
    Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these settings. Some limitations apply; for more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .
    rulesSource RuleGroupRulesSource
    The stateful rules or stateless rules for the rule group.
    referenceSets RuleGroupReferenceSets
    The reference sets for the stateful rule group.
    ruleVariables RuleGroupRuleVariables
    Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
    statefulRuleOptions RuleGroupStatefulRuleOptions
    Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these settings. Some limitations apply; for more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .
    rules_source RuleGroupRulesSource
    The stateful rules or stateless rules for the rule group.
    reference_sets RuleGroupReferenceSets
    The reference sets for the stateful rule group.
    rule_variables RuleGroupRuleVariables
    Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
    stateful_rule_options RuleGroupStatefulRuleOptions
    Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these settings. Some limitations apply; for more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .
    rulesSource Property Map
    The stateful rules or stateless rules for the rule group.
    referenceSets Property Map
    The reference sets for the stateful rule group.
    ruleVariables Property Map
    Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
    statefulRuleOptions Property Map
    Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these settings. Some limitations apply; for more information, see Strict evaluation order in the AWS Network Firewall Developer Guide .

    RuleGroupActionDefinition, RuleGroupActionDefinitionArgs

    PublishMetricAction Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupPublishMetricAction

    Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.

    You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.

    PublishMetricAction RuleGroupPublishMetricAction

    Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.

    You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.

    publishMetricAction RuleGroupPublishMetricAction

    Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.

    You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.

    publishMetricAction RuleGroupPublishMetricAction

    Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.

    You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.

    publish_metric_action RuleGroupPublishMetricAction

    Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.

    You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.

    publishMetricAction Property Map

    Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.

    You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.

    RuleGroupAddress, RuleGroupAddressArgs

    AddressDefinition string

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    AddressDefinition string

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    addressDefinition String

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    addressDefinition string

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    address_definition str

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    addressDefinition String

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    RuleGroupCustomAction, RuleGroupCustomActionArgs

    ActionDefinition Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupActionDefinition
    The custom action associated with the action name.
    ActionName string
    The descriptive name of the custom action. You can't change the name of a custom action after you create it.
    ActionDefinition RuleGroupActionDefinition
    The custom action associated with the action name.
    ActionName string
    The descriptive name of the custom action. You can't change the name of a custom action after you create it.
    actionDefinition RuleGroupActionDefinition
    The custom action associated with the action name.
    actionName String
    The descriptive name of the custom action. You can't change the name of a custom action after you create it.
    actionDefinition RuleGroupActionDefinition
    The custom action associated with the action name.
    actionName string
    The descriptive name of the custom action. You can't change the name of a custom action after you create it.
    action_definition RuleGroupActionDefinition
    The custom action associated with the action name.
    action_name str
    The descriptive name of the custom action. You can't change the name of a custom action after you create it.
    actionDefinition Property Map
    The custom action associated with the action name.
    actionName String
    The descriptive name of the custom action. You can't change the name of a custom action after you create it.

    RuleGroupDimension, RuleGroupDimensionArgs

    Value string
    The value to use in the custom metric dimension.
    Value string
    The value to use in the custom metric dimension.
    value String
    The value to use in the custom metric dimension.
    value string
    The value to use in the custom metric dimension.
    value str
    The value to use in the custom metric dimension.
    value String
    The value to use in the custom metric dimension.

    RuleGroupGeneratedRulesType, RuleGroupGeneratedRulesTypeArgs

    Allowlist
    ALLOWLIST
    Denylist
    DENYLIST
    RuleGroupGeneratedRulesTypeAllowlist
    ALLOWLIST
    RuleGroupGeneratedRulesTypeDenylist
    DENYLIST
    Allowlist
    ALLOWLIST
    Denylist
    DENYLIST
    Allowlist
    ALLOWLIST
    Denylist
    DENYLIST
    ALLOWLIST
    ALLOWLIST
    DENYLIST
    DENYLIST
    "ALLOWLIST"
    ALLOWLIST
    "DENYLIST"
    DENYLIST

    RuleGroupHeader, RuleGroupHeaderArgs

    Destination string

    The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    DestinationPort string
    The destination port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .
    Direction Pulumi.AwsNative.NetworkFirewall.RuleGroupHeaderDirection
    The direction of traffic flow to inspect. If set to ANY , the inspection matches bidirectional traffic, both from the source to the destination and from the destination to the source. If set to FORWARD , the inspection only matches traffic going from the source to the destination.
    Protocol Pulumi.AwsNative.NetworkFirewall.RuleGroupHeaderProtocol
    The protocol to inspect for. To specify all, you can use IP , because all traffic on AWS and on the internet is IP.
    Source string

    The source IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    SourcePort string
    The source port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .
    Destination string

    The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    DestinationPort string
    The destination port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .
    Direction RuleGroupHeaderDirection
    The direction of traffic flow to inspect. If set to ANY , the inspection matches bidirectional traffic, both from the source to the destination and from the destination to the source. If set to FORWARD , the inspection only matches traffic going from the source to the destination.
    Protocol RuleGroupHeaderProtocol
    The protocol to inspect for. To specify all, you can use IP , because all traffic on AWS and on the internet is IP.
    Source string

    The source IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    SourcePort string
    The source port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .
    destination String

    The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    destinationPort String
    The destination port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .
    direction RuleGroupHeaderDirection
    The direction of traffic flow to inspect. If set to ANY , the inspection matches bidirectional traffic, both from the source to the destination and from the destination to the source. If set to FORWARD , the inspection only matches traffic going from the source to the destination.
    protocol RuleGroupHeaderProtocol
    The protocol to inspect for. To specify all, you can use IP , because all traffic on AWS and on the internet is IP.
    source String

    The source IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    sourcePort String
    The source port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .
    destination string

    The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    destinationPort string
    The destination port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .
    direction RuleGroupHeaderDirection
    The direction of traffic flow to inspect. If set to ANY , the inspection matches bidirectional traffic, both from the source to the destination and from the destination to the source. If set to FORWARD , the inspection only matches traffic going from the source to the destination.
    protocol RuleGroupHeaderProtocol
    The protocol to inspect for. To specify all, you can use IP , because all traffic on AWS and on the internet is IP.
    source string

    The source IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    sourcePort string
    The source port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .
    destination str

    The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    destination_port str
    The destination port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .
    direction RuleGroupHeaderDirection
    The direction of traffic flow to inspect. If set to ANY , the inspection matches bidirectional traffic, both from the source to the destination and from the destination to the source. If set to FORWARD , the inspection only matches traffic going from the source to the destination.
    protocol RuleGroupHeaderProtocol
    The protocol to inspect for. To specify all, you can use IP , because all traffic on AWS and on the internet is IP.
    source str

    The source IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    source_port str
    The source port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .
    destination String

    The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    destinationPort String
    The destination port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .
    direction "FORWARD" | "ANY"
    The direction of traffic flow to inspect. If set to ANY , the inspection matches bidirectional traffic, both from the source to the destination and from the destination to the source. If set to FORWARD , the inspection only matches traffic going from the source to the destination.
    protocol "IP" | "TCP" | "UDP" | "ICMP" | "HTTP" | "FTP" | "TLS" | "SMB" | "DNS" | "DCERPC" | "SSH" | "SMTP" | "IMAP" | "MSN" | "KRB5" | "IKEV2" | "TFTP" | "NTP" | "DHCP"
    The protocol to inspect for. To specify all, you can use IP , because all traffic on AWS and on the internet is IP.
    source String

    The source IP address or address range to inspect for, in CIDR notation. To match with any address, specify ANY .

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    sourcePort String
    The source port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994 . To match with any port, specify ANY .

    RuleGroupHeaderDirection, RuleGroupHeaderDirectionArgs

    Forward
    FORWARD
    Any
    ANY
    RuleGroupHeaderDirectionForward
    FORWARD
    RuleGroupHeaderDirectionAny
    ANY
    Forward
    FORWARD
    Any
    ANY
    Forward
    FORWARD
    Any
    ANY
    FORWARD
    FORWARD
    ANY
    ANY
    "FORWARD"
    FORWARD
    "ANY"
    ANY

    RuleGroupHeaderProtocol, RuleGroupHeaderProtocolArgs

    Ip
    IP
    Tcp
    TCP
    Udp
    UDP
    Icmp
    ICMP
    Http
    HTTP
    Ftp
    FTP
    Tls
    TLS
    Smb
    SMB
    Dns
    DNS
    Dcerpc
    DCERPC
    Ssh
    SSH
    Smtp
    SMTP
    Imap
    IMAP
    Msn
    MSN
    Krb5
    KRB5
    Ikev2
    IKEV2
    Tftp
    TFTP
    Ntp
    NTP
    Dhcp
    DHCP
    RuleGroupHeaderProtocolIp
    IP
    RuleGroupHeaderProtocolTcp
    TCP
    RuleGroupHeaderProtocolUdp
    UDP
    RuleGroupHeaderProtocolIcmp
    ICMP
    RuleGroupHeaderProtocolHttp
    HTTP
    RuleGroupHeaderProtocolFtp
    FTP
    RuleGroupHeaderProtocolTls
    TLS
    RuleGroupHeaderProtocolSmb
    SMB
    RuleGroupHeaderProtocolDns
    DNS
    RuleGroupHeaderProtocolDcerpc
    DCERPC
    RuleGroupHeaderProtocolSsh
    SSH
    RuleGroupHeaderProtocolSmtp
    SMTP
    RuleGroupHeaderProtocolImap
    IMAP
    RuleGroupHeaderProtocolMsn
    MSN
    RuleGroupHeaderProtocolKrb5
    KRB5
    RuleGroupHeaderProtocolIkev2
    IKEV2
    RuleGroupHeaderProtocolTftp
    TFTP
    RuleGroupHeaderProtocolNtp
    NTP
    RuleGroupHeaderProtocolDhcp
    DHCP
    Ip
    IP
    Tcp
    TCP
    Udp
    UDP
    Icmp
    ICMP
    Http
    HTTP
    Ftp
    FTP
    Tls
    TLS
    Smb
    SMB
    Dns
    DNS
    Dcerpc
    DCERPC
    Ssh
    SSH
    Smtp
    SMTP
    Imap
    IMAP
    Msn
    MSN
    Krb5
    KRB5
    Ikev2
    IKEV2
    Tftp
    TFTP
    Ntp
    NTP
    Dhcp
    DHCP
    Ip
    IP
    Tcp
    TCP
    Udp
    UDP
    Icmp
    ICMP
    Http
    HTTP
    Ftp
    FTP
    Tls
    TLS
    Smb
    SMB
    Dns
    DNS
    Dcerpc
    DCERPC
    Ssh
    SSH
    Smtp
    SMTP
    Imap
    IMAP
    Msn
    MSN
    Krb5
    KRB5
    Ikev2
    IKEV2
    Tftp
    TFTP
    Ntp
    NTP
    Dhcp
    DHCP
    IP
    IP
    TCP
    TCP
    UDP
    UDP
    ICMP
    ICMP
    HTTP
    HTTP
    FTP
    FTP
    TLS
    TLS
    SMB
    SMB
    DNS
    DNS
    DCERPC
    DCERPC
    SSH
    SSH
    SMTP
    SMTP
    IMAP
    IMAP
    MSN
    MSN
    KRB5
    KRB5
    IKEV2
    IKEV2
    TFTP
    TFTP
    NTP
    NTP
    DHCP
    DHCP
    "IP"
    IP
    "TCP"
    TCP
    "UDP"
    UDP
    "ICMP"
    ICMP
    "HTTP"
    HTTP
    "FTP"
    FTP
    "TLS"
    TLS
    "SMB"
    SMB
    "DNS"
    DNS
    "DCERPC"
    DCERPC
    "SSH"
    SSH
    "SMTP"
    SMTP
    "IMAP"
    IMAP
    "MSN"
    MSN
    "KRB5"
    KRB5
    "IKEV2"
    IKEV2
    "TFTP"
    TFTP
    "NTP"
    NTP
    "DHCP"
    DHCP

    RuleGroupIpSet, RuleGroupIpSetArgs

    Definition List<string>
    Definition []string
    definition List<String>
    definition string[]
    definition Sequence[str]
    definition List<String>

    RuleGroupIpSetReference, RuleGroupIpSetReferenceArgs

    RuleGroupMatchAttributes, RuleGroupMatchAttributesArgs

    DestinationPorts List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupPortRange>

    The destination ports to inspect for. If not specified, this matches with any destination port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

    You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

    Destinations List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupAddress>
    The destination IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address.
    Protocols List<int>
    The protocols to inspect for, specified using each protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.
    SourcePorts List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupPortRange>

    The source ports to inspect for. If not specified, this matches with any source port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

    You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

    Sources List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupAddress>
    The source IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address.
    TcpFlags List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupTcpFlagField>
    The TCP flags and masks to inspect for. If not specified, this matches with any settings. This setting is only used for protocol 6 (TCP).
    DestinationPorts []RuleGroupPortRange

    The destination ports to inspect for. If not specified, this matches with any destination port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

    You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

    Destinations []RuleGroupAddress
    The destination IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address.
    Protocols []int
    The protocols to inspect for, specified using each protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.
    SourcePorts []RuleGroupPortRange

    The source ports to inspect for. If not specified, this matches with any source port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

    You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

    Sources []RuleGroupAddress
    The source IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address.
    TcpFlags []RuleGroupTcpFlagField
    The TCP flags and masks to inspect for. If not specified, this matches with any settings. This setting is only used for protocol 6 (TCP).
    destinationPorts List<RuleGroupPortRange>

    The destination ports to inspect for. If not specified, this matches with any destination port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

    You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

    destinations List<RuleGroupAddress>
    The destination IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address.
    protocols List<Integer>
    The protocols to inspect for, specified using each protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.
    sourcePorts List<RuleGroupPortRange>

    The source ports to inspect for. If not specified, this matches with any source port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

    You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

    sources List<RuleGroupAddress>
    The source IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address.
    tcpFlags List<RuleGroupTcpFlagField>
    The TCP flags and masks to inspect for. If not specified, this matches with any settings. This setting is only used for protocol 6 (TCP).
    destinationPorts RuleGroupPortRange[]

    The destination ports to inspect for. If not specified, this matches with any destination port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

    You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

    destinations RuleGroupAddress[]
    The destination IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address.
    protocols number[]
    The protocols to inspect for, specified using each protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.
    sourcePorts RuleGroupPortRange[]

    The source ports to inspect for. If not specified, this matches with any source port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

    You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

    sources RuleGroupAddress[]
    The source IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address.
    tcpFlags RuleGroupTcpFlagField[]
    The TCP flags and masks to inspect for. If not specified, this matches with any settings. This setting is only used for protocol 6 (TCP).
    destination_ports Sequence[RuleGroupPortRange]

    The destination ports to inspect for. If not specified, this matches with any destination port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

    You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

    destinations Sequence[RuleGroupAddress]
    The destination IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address.
    protocols Sequence[int]
    The protocols to inspect for, specified using each protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.
    source_ports Sequence[RuleGroupPortRange]

    The source ports to inspect for. If not specified, this matches with any source port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

    You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

    sources Sequence[RuleGroupAddress]
    The source IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address.
    tcp_flags Sequence[RuleGroupTcpFlagField]
    The TCP flags and masks to inspect for. If not specified, this matches with any settings. This setting is only used for protocol 6 (TCP).
    destinationPorts List<Property Map>

    The destination ports to inspect for. If not specified, this matches with any destination port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

    You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

    destinations List<Property Map>
    The destination IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address.
    protocols List<Number>
    The protocols to inspect for, specified using each protocol's assigned internet protocol number (IANA). If not specified, this matches with any protocol.
    sourcePorts List<Property Map>

    The source ports to inspect for. If not specified, this matches with any source port. This setting is only used for protocols 6 (TCP) and 17 (UDP).

    You can specify individual ports, for example 1994 and you can specify port ranges, for example 1990:1994 .

    sources List<Property Map>
    The source IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address.
    tcpFlags List<Property Map>
    The TCP flags and masks to inspect for. If not specified, this matches with any settings. This setting is only used for protocol 6 (TCP).

    RuleGroupPortRange, RuleGroupPortRangeArgs

    FromPort int
    The lower limit of the port range. This must be less than or equal to the ToPort specification.
    ToPort int
    The upper limit of the port range. This must be greater than or equal to the FromPort specification.
    FromPort int
    The lower limit of the port range. This must be less than or equal to the ToPort specification.
    ToPort int
    The upper limit of the port range. This must be greater than or equal to the FromPort specification.
    fromPort Integer
    The lower limit of the port range. This must be less than or equal to the ToPort specification.
    toPort Integer
    The upper limit of the port range. This must be greater than or equal to the FromPort specification.
    fromPort number
    The lower limit of the port range. This must be less than or equal to the ToPort specification.
    toPort number
    The upper limit of the port range. This must be greater than or equal to the FromPort specification.
    from_port int
    The lower limit of the port range. This must be less than or equal to the ToPort specification.
    to_port int
    The upper limit of the port range. This must be greater than or equal to the FromPort specification.
    fromPort Number
    The lower limit of the port range. This must be less than or equal to the ToPort specification.
    toPort Number
    The upper limit of the port range. This must be greater than or equal to the FromPort specification.

    RuleGroupPortSet, RuleGroupPortSetArgs

    Definition List<string>
    Definition []string
    definition List<String>
    definition string[]
    definition Sequence[str]
    definition List<String>

    RuleGroupPublishMetricAction, RuleGroupPublishMetricActionArgs

    RuleGroupReferenceSets, RuleGroupReferenceSetsArgs

    IpSetReferences Dictionary<string, Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupIpSetReference>
    The IP set references to use in the stateful rule group.
    IpSetReferences map[string]RuleGroupIpSetReference
    The IP set references to use in the stateful rule group.
    ipSetReferences Map<String,RuleGroupIpSetReference>
    The IP set references to use in the stateful rule group.
    ipSetReferences {[key: string]: RuleGroupIpSetReference}
    The IP set references to use in the stateful rule group.
    ip_set_references Mapping[str, RuleGroupIpSetReference]
    The IP set references to use in the stateful rule group.
    ipSetReferences Map<Property Map>
    The IP set references to use in the stateful rule group.

    RuleGroupRuleDefinition, RuleGroupRuleDefinitionArgs

    Actions List<string>

    The actions to take on a packet that matches one of the stateless rule definition's match attributes. You must specify a standard action and you can add custom actions.

    Network Firewall only forwards a packet for stateful rule inspection if you specify aws:forward_to_sfe for a rule that the packet matches, or if the packet doesn't match any stateless rule and you specify aws:forward_to_sfe for the StatelessDefaultActions setting for the FirewallPolicy .

    For every rule, you must specify exactly one of the following standard actions.

    • aws:pass - Discontinues all inspection of the packet and permits it to go to its intended destination.
    • aws:drop - Discontinues all inspection of the packet and blocks it from going to its intended destination.
    • aws:forward_to_sfe - Discontinues stateless inspection of the packet and forwards it to the stateful rule engine for inspection.

    Additionally, you can specify a custom action. To do this, you define a custom action by name and type, then provide the name you've assigned to the action in this Actions setting.

    To provide more than one action in this setting, separate the settings with a comma. For example, if you have a publish metrics custom action that you've named MyMetricsAction , then you could specify the standard action aws:pass combined with the custom action using ["aws:pass", "MyMetricsAction"] .

    MatchAttributes Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupMatchAttributes
    Criteria for Network Firewall to use to inspect an individual packet in stateless rule inspection. Each match attributes set can include one or more items such as IP address, CIDR range, port number, protocol, and TCP flags.
    Actions []string

    The actions to take on a packet that matches one of the stateless rule definition's match attributes. You must specify a standard action and you can add custom actions.

    Network Firewall only forwards a packet for stateful rule inspection if you specify aws:forward_to_sfe for a rule that the packet matches, or if the packet doesn't match any stateless rule and you specify aws:forward_to_sfe for the StatelessDefaultActions setting for the FirewallPolicy .

    For every rule, you must specify exactly one of the following standard actions.

    • aws:pass - Discontinues all inspection of the packet and permits it to go to its intended destination.
    • aws:drop - Discontinues all inspection of the packet and blocks it from going to its intended destination.
    • aws:forward_to_sfe - Discontinues stateless inspection of the packet and forwards it to the stateful rule engine for inspection.

    Additionally, you can specify a custom action. To do this, you define a custom action by name and type, then provide the name you've assigned to the action in this Actions setting.

    To provide more than one action in this setting, separate the settings with a comma. For example, if you have a publish metrics custom action that you've named MyMetricsAction , then you could specify the standard action aws:pass combined with the custom action using ["aws:pass", "MyMetricsAction"] .

    MatchAttributes RuleGroupMatchAttributes
    Criteria for Network Firewall to use to inspect an individual packet in stateless rule inspection. Each match attributes set can include one or more items such as IP address, CIDR range, port number, protocol, and TCP flags.
    actions List<String>

    The actions to take on a packet that matches one of the stateless rule definition's match attributes. You must specify a standard action and you can add custom actions.

    Network Firewall only forwards a packet for stateful rule inspection if you specify aws:forward_to_sfe for a rule that the packet matches, or if the packet doesn't match any stateless rule and you specify aws:forward_to_sfe for the StatelessDefaultActions setting for the FirewallPolicy .

    For every rule, you must specify exactly one of the following standard actions.

    • aws:pass - Discontinues all inspection of the packet and permits it to go to its intended destination.
    • aws:drop - Discontinues all inspection of the packet and blocks it from going to its intended destination.
    • aws:forward_to_sfe - Discontinues stateless inspection of the packet and forwards it to the stateful rule engine for inspection.

    Additionally, you can specify a custom action. To do this, you define a custom action by name and type, then provide the name you've assigned to the action in this Actions setting.

    To provide more than one action in this setting, separate the settings with a comma. For example, if you have a publish metrics custom action that you've named MyMetricsAction , then you could specify the standard action aws:pass combined with the custom action using ["aws:pass", "MyMetricsAction"] .

    matchAttributes RuleGroupMatchAttributes
    Criteria for Network Firewall to use to inspect an individual packet in stateless rule inspection. Each match attributes set can include one or more items such as IP address, CIDR range, port number, protocol, and TCP flags.
    actions string[]

    The actions to take on a packet that matches one of the stateless rule definition's match attributes. You must specify a standard action and you can add custom actions.

    Network Firewall only forwards a packet for stateful rule inspection if you specify aws:forward_to_sfe for a rule that the packet matches, or if the packet doesn't match any stateless rule and you specify aws:forward_to_sfe for the StatelessDefaultActions setting for the FirewallPolicy .

    For every rule, you must specify exactly one of the following standard actions.

    • aws:pass - Discontinues all inspection of the packet and permits it to go to its intended destination.
    • aws:drop - Discontinues all inspection of the packet and blocks it from going to its intended destination.
    • aws:forward_to_sfe - Discontinues stateless inspection of the packet and forwards it to the stateful rule engine for inspection.

    Additionally, you can specify a custom action. To do this, you define a custom action by name and type, then provide the name you've assigned to the action in this Actions setting.

    To provide more than one action in this setting, separate the settings with a comma. For example, if you have a publish metrics custom action that you've named MyMetricsAction , then you could specify the standard action aws:pass combined with the custom action using ["aws:pass", "MyMetricsAction"] .

    matchAttributes RuleGroupMatchAttributes
    Criteria for Network Firewall to use to inspect an individual packet in stateless rule inspection. Each match attributes set can include one or more items such as IP address, CIDR range, port number, protocol, and TCP flags.
    actions Sequence[str]

    The actions to take on a packet that matches one of the stateless rule definition's match attributes. You must specify a standard action and you can add custom actions.

    Network Firewall only forwards a packet for stateful rule inspection if you specify aws:forward_to_sfe for a rule that the packet matches, or if the packet doesn't match any stateless rule and you specify aws:forward_to_sfe for the StatelessDefaultActions setting for the FirewallPolicy .

    For every rule, you must specify exactly one of the following standard actions.

    • aws:pass - Discontinues all inspection of the packet and permits it to go to its intended destination.
    • aws:drop - Discontinues all inspection of the packet and blocks it from going to its intended destination.
    • aws:forward_to_sfe - Discontinues stateless inspection of the packet and forwards it to the stateful rule engine for inspection.

    Additionally, you can specify a custom action. To do this, you define a custom action by name and type, then provide the name you've assigned to the action in this Actions setting.

    To provide more than one action in this setting, separate the settings with a comma. For example, if you have a publish metrics custom action that you've named MyMetricsAction , then you could specify the standard action aws:pass combined with the custom action using ["aws:pass", "MyMetricsAction"] .

    match_attributes RuleGroupMatchAttributes
    Criteria for Network Firewall to use to inspect an individual packet in stateless rule inspection. Each match attributes set can include one or more items such as IP address, CIDR range, port number, protocol, and TCP flags.
    actions List<String>

    The actions to take on a packet that matches one of the stateless rule definition's match attributes. You must specify a standard action and you can add custom actions.

    Network Firewall only forwards a packet for stateful rule inspection if you specify aws:forward_to_sfe for a rule that the packet matches, or if the packet doesn't match any stateless rule and you specify aws:forward_to_sfe for the StatelessDefaultActions setting for the FirewallPolicy .

    For every rule, you must specify exactly one of the following standard actions.

    • aws:pass - Discontinues all inspection of the packet and permits it to go to its intended destination.
    • aws:drop - Discontinues all inspection of the packet and blocks it from going to its intended destination.
    • aws:forward_to_sfe - Discontinues stateless inspection of the packet and forwards it to the stateful rule engine for inspection.

    Additionally, you can specify a custom action. To do this, you define a custom action by name and type, then provide the name you've assigned to the action in this Actions setting.

    To provide more than one action in this setting, separate the settings with a comma. For example, if you have a publish metrics custom action that you've named MyMetricsAction , then you could specify the standard action aws:pass combined with the custom action using ["aws:pass", "MyMetricsAction"] .

    matchAttributes Property Map
    Criteria for Network Firewall to use to inspect an individual packet in stateless rule inspection. Each match attributes set can include one or more items such as IP address, CIDR range, port number, protocol, and TCP flags.

    RuleGroupRuleOption, RuleGroupRuleOptionArgs

    Keyword string
    The Suricata rule option keywords. For Network Firewall , the keyword signature ID (sid) is required in the format sid:112233 . The sid must be unique within the rule group. For information about Suricata rule option keywords, see Rule options .
    Settings List<string>
    The Suricata rule option settings. Settings have zero or more values, and the number of possible settings and required settings depends on the keyword. The format for Settings is number . For information about Suricata rule option settings, see Rule options .
    Keyword string
    The Suricata rule option keywords. For Network Firewall , the keyword signature ID (sid) is required in the format sid:112233 . The sid must be unique within the rule group. For information about Suricata rule option keywords, see Rule options .
    Settings []string
    The Suricata rule option settings. Settings have zero or more values, and the number of possible settings and required settings depends on the keyword. The format for Settings is number . For information about Suricata rule option settings, see Rule options .
    keyword String
    The Suricata rule option keywords. For Network Firewall , the keyword signature ID (sid) is required in the format sid:112233 . The sid must be unique within the rule group. For information about Suricata rule option keywords, see Rule options .
    settings List<String>
    The Suricata rule option settings. Settings have zero or more values, and the number of possible settings and required settings depends on the keyword. The format for Settings is number . For information about Suricata rule option settings, see Rule options .
    keyword string
    The Suricata rule option keywords. For Network Firewall , the keyword signature ID (sid) is required in the format sid:112233 . The sid must be unique within the rule group. For information about Suricata rule option keywords, see Rule options .
    settings string[]
    The Suricata rule option settings. Settings have zero or more values, and the number of possible settings and required settings depends on the keyword. The format for Settings is number . For information about Suricata rule option settings, see Rule options .
    keyword str
    The Suricata rule option keywords. For Network Firewall , the keyword signature ID (sid) is required in the format sid:112233 . The sid must be unique within the rule group. For information about Suricata rule option keywords, see Rule options .
    settings Sequence[str]
    The Suricata rule option settings. Settings have zero or more values, and the number of possible settings and required settings depends on the keyword. The format for Settings is number . For information about Suricata rule option settings, see Rule options .
    keyword String
    The Suricata rule option keywords. For Network Firewall , the keyword signature ID (sid) is required in the format sid:112233 . The sid must be unique within the rule group. For information about Suricata rule option keywords, see Rule options .
    settings List<String>
    The Suricata rule option settings. Settings have zero or more values, and the number of possible settings and required settings depends on the keyword. The format for Settings is number . For information about Suricata rule option settings, see Rule options .

    RuleGroupRuleOrder, RuleGroupRuleOrderArgs

    DefaultActionOrder
    DEFAULT_ACTION_ORDER
    StrictOrder
    STRICT_ORDER
    RuleGroupRuleOrderDefaultActionOrder
    DEFAULT_ACTION_ORDER
    RuleGroupRuleOrderStrictOrder
    STRICT_ORDER
    DefaultActionOrder
    DEFAULT_ACTION_ORDER
    StrictOrder
    STRICT_ORDER
    DefaultActionOrder
    DEFAULT_ACTION_ORDER
    StrictOrder
    STRICT_ORDER
    DEFAULT_ACTION_ORDER
    DEFAULT_ACTION_ORDER
    STRICT_ORDER
    STRICT_ORDER
    "DEFAULT_ACTION_ORDER"
    DEFAULT_ACTION_ORDER
    "STRICT_ORDER"
    STRICT_ORDER

    RuleGroupRuleVariables, RuleGroupRuleVariablesArgs

    IpSets Dictionary<string, Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupIpSet>
    A list of IP addresses and address ranges, in CIDR notation.
    PortSets Dictionary<string, Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupPortSet>
    A list of port ranges.
    IpSets map[string]RuleGroupIpSet
    A list of IP addresses and address ranges, in CIDR notation.
    PortSets map[string]RuleGroupPortSet
    A list of port ranges.
    ipSets Map<String,RuleGroupIpSet>
    A list of IP addresses and address ranges, in CIDR notation.
    portSets Map<String,RuleGroupPortSet>
    A list of port ranges.
    ipSets {[key: string]: RuleGroupIpSet}
    A list of IP addresses and address ranges, in CIDR notation.
    portSets {[key: string]: RuleGroupPortSet}
    A list of port ranges.
    ip_sets Mapping[str, RuleGroupIpSet]
    A list of IP addresses and address ranges, in CIDR notation.
    port_sets Mapping[str, RuleGroupPortSet]
    A list of port ranges.
    ipSets Map<Property Map>
    A list of IP addresses and address ranges, in CIDR notation.
    portSets Map<Property Map>
    A list of port ranges.

    RuleGroupRulesSource, RuleGroupRulesSourceArgs

    RulesSourceList Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupRulesSourceList
    Stateful inspection criteria for a domain list rule group.
    RulesString string

    Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.

    These rules contain the inspection criteria and the action to take for traffic that matches the criteria, so this type of rule group doesn't have a separate action setting.

    You can't use the priority keyword if the RuleOrder option in StatefulRuleOptions is set to STRICT_ORDER .

    StatefulRules List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupStatefulRule>
    An array of individual stateful rules inspection criteria to be used together in a stateful rule group. Use this option to specify simple Suricata rules with protocol, source and destination, ports, direction, and rule options. For information about the Suricata Rules format, see Rules Format .
    StatelessRulesAndCustomActions Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupStatelessRulesAndCustomActions
    Stateless inspection criteria to be used in a stateless rule group.
    RulesSourceList RuleGroupRulesSourceList
    Stateful inspection criteria for a domain list rule group.
    RulesString string

    Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.

    These rules contain the inspection criteria and the action to take for traffic that matches the criteria, so this type of rule group doesn't have a separate action setting.

    You can't use the priority keyword if the RuleOrder option in StatefulRuleOptions is set to STRICT_ORDER .

    StatefulRules []RuleGroupStatefulRule
    An array of individual stateful rules inspection criteria to be used together in a stateful rule group. Use this option to specify simple Suricata rules with protocol, source and destination, ports, direction, and rule options. For information about the Suricata Rules format, see Rules Format .
    StatelessRulesAndCustomActions RuleGroupStatelessRulesAndCustomActions
    Stateless inspection criteria to be used in a stateless rule group.
    rulesSourceList RuleGroupRulesSourceList
    Stateful inspection criteria for a domain list rule group.
    rulesString String

    Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.

    These rules contain the inspection criteria and the action to take for traffic that matches the criteria, so this type of rule group doesn't have a separate action setting.

    You can't use the priority keyword if the RuleOrder option in StatefulRuleOptions is set to STRICT_ORDER .

    statefulRules List<RuleGroupStatefulRule>
    An array of individual stateful rules inspection criteria to be used together in a stateful rule group. Use this option to specify simple Suricata rules with protocol, source and destination, ports, direction, and rule options. For information about the Suricata Rules format, see Rules Format .
    statelessRulesAndCustomActions RuleGroupStatelessRulesAndCustomActions
    Stateless inspection criteria to be used in a stateless rule group.
    rulesSourceList RuleGroupRulesSourceList
    Stateful inspection criteria for a domain list rule group.
    rulesString string

    Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.

    These rules contain the inspection criteria and the action to take for traffic that matches the criteria, so this type of rule group doesn't have a separate action setting.

    You can't use the priority keyword if the RuleOrder option in StatefulRuleOptions is set to STRICT_ORDER .

    statefulRules RuleGroupStatefulRule[]
    An array of individual stateful rules inspection criteria to be used together in a stateful rule group. Use this option to specify simple Suricata rules with protocol, source and destination, ports, direction, and rule options. For information about the Suricata Rules format, see Rules Format .
    statelessRulesAndCustomActions RuleGroupStatelessRulesAndCustomActions
    Stateless inspection criteria to be used in a stateless rule group.
    rules_source_list RuleGroupRulesSourceList
    Stateful inspection criteria for a domain list rule group.
    rules_string str

    Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.

    These rules contain the inspection criteria and the action to take for traffic that matches the criteria, so this type of rule group doesn't have a separate action setting.

    You can't use the priority keyword if the RuleOrder option in StatefulRuleOptions is set to STRICT_ORDER .

    stateful_rules Sequence[RuleGroupStatefulRule]
    An array of individual stateful rules inspection criteria to be used together in a stateful rule group. Use this option to specify simple Suricata rules with protocol, source and destination, ports, direction, and rule options. For information about the Suricata Rules format, see Rules Format .
    stateless_rules_and_custom_actions RuleGroupStatelessRulesAndCustomActions
    Stateless inspection criteria to be used in a stateless rule group.
    rulesSourceList Property Map
    Stateful inspection criteria for a domain list rule group.
    rulesString String

    Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.

    These rules contain the inspection criteria and the action to take for traffic that matches the criteria, so this type of rule group doesn't have a separate action setting.

    You can't use the priority keyword if the RuleOrder option in StatefulRuleOptions is set to STRICT_ORDER .

    statefulRules List<Property Map>
    An array of individual stateful rules inspection criteria to be used together in a stateful rule group. Use this option to specify simple Suricata rules with protocol, source and destination, ports, direction, and rule options. For information about the Suricata Rules format, see Rules Format .
    statelessRulesAndCustomActions Property Map
    Stateless inspection criteria to be used in a stateless rule group.

    RuleGroupRulesSourceList, RuleGroupRulesSourceListArgs

    GeneratedRulesType Pulumi.AwsNative.NetworkFirewall.RuleGroupGeneratedRulesType
    Whether you want to allow or deny access to the domains in your target list.
    TargetTypes List<Pulumi.AwsNative.NetworkFirewall.RuleGroupTargetType>
    The types of targets to inspect for. Valid values are TLS_SNI and HTTP_HOST .
    Targets List<string>
    The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

    • Explicit names. For example, abc.example.com matches only the domain abc.example.com .
    • Names that use a domain wildcard, which you indicate with an initial ' . '. For example, .example.com matches example.com and matches all subdomains of example.com , such as abc.example.com and www.example.com .
    GeneratedRulesType RuleGroupGeneratedRulesType
    Whether you want to allow or deny access to the domains in your target list.
    TargetTypes []RuleGroupTargetType
    The types of targets to inspect for. Valid values are TLS_SNI and HTTP_HOST .
    Targets []string
    The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

    • Explicit names. For example, abc.example.com matches only the domain abc.example.com .
    • Names that use a domain wildcard, which you indicate with an initial ' . '. For example, .example.com matches example.com and matches all subdomains of example.com , such as abc.example.com and www.example.com .
    generatedRulesType RuleGroupGeneratedRulesType
    Whether you want to allow or deny access to the domains in your target list.
    targetTypes List<RuleGroupTargetType>
    The types of targets to inspect for. Valid values are TLS_SNI and HTTP_HOST .
    targets List<String>
    The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

    • Explicit names. For example, abc.example.com matches only the domain abc.example.com .
    • Names that use a domain wildcard, which you indicate with an initial ' . '. For example, .example.com matches example.com and matches all subdomains of example.com , such as abc.example.com and www.example.com .
    generatedRulesType RuleGroupGeneratedRulesType
    Whether you want to allow or deny access to the domains in your target list.
    targetTypes RuleGroupTargetType[]
    The types of targets to inspect for. Valid values are TLS_SNI and HTTP_HOST .
    targets string[]
    The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

    • Explicit names. For example, abc.example.com matches only the domain abc.example.com .
    • Names that use a domain wildcard, which you indicate with an initial ' . '. For example, .example.com matches example.com and matches all subdomains of example.com , such as abc.example.com and www.example.com .
    generated_rules_type RuleGroupGeneratedRulesType
    Whether you want to allow or deny access to the domains in your target list.
    target_types Sequence[RuleGroupTargetType]
    The types of targets to inspect for. Valid values are TLS_SNI and HTTP_HOST .
    targets Sequence[str]
    The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

    • Explicit names. For example, abc.example.com matches only the domain abc.example.com .
    • Names that use a domain wildcard, which you indicate with an initial ' . '. For example, .example.com matches example.com and matches all subdomains of example.com , such as abc.example.com and www.example.com .
    generatedRulesType "ALLOWLIST" | "DENYLIST"
    Whether you want to allow or deny access to the domains in your target list.
    targetTypes List<"TLS_SNI" | "HTTP_HOST">
    The types of targets to inspect for. Valid values are TLS_SNI and HTTP_HOST .
    targets List<String>
    The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:

    • Explicit names. For example, abc.example.com matches only the domain abc.example.com .
    • Names that use a domain wildcard, which you indicate with an initial ' . '. For example, .example.com matches example.com and matches all subdomains of example.com , such as abc.example.com and www.example.com .

    RuleGroupStatefulRule, RuleGroupStatefulRuleArgs

    Action Pulumi.AwsNative.NetworkFirewall.RuleGroupStatefulRuleAction

    Defines what Network Firewall should do with the packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow.

    The actions for a stateful rule are defined as follows:

    • PASS - Permits the packets to go to the intended destination.
    • DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .
    • REJECT - Drops traffic that matches the conditions of the stateful rule and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. REJECT is available only for TCP traffic.
    • ALERT - Permits the packets to go to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .

    You can use this action to test a rule that you intend to use to drop traffic. You can enable the rule with ALERT action, verify in the logs that the rule is filtering as you want, then change the action to DROP .

    • REJECT - Drops TCP traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. Also sends an alert log mesage if alert logging is configured in the Firewall LoggingConfiguration .

    REJECT isn't currently available for use with IMAP and FTP protocols.

    Header Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupHeader
    The stateful inspection criteria for this rule, used to inspect traffic flows.
    RuleOptions List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupRuleOption>
    Additional settings for a stateful rule, provided as keywords and settings.
    Action RuleGroupStatefulRuleAction

    Defines what Network Firewall should do with the packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow.

    The actions for a stateful rule are defined as follows:

    • PASS - Permits the packets to go to the intended destination.
    • DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .
    • REJECT - Drops traffic that matches the conditions of the stateful rule and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. REJECT is available only for TCP traffic.
    • ALERT - Permits the packets to go to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .

    You can use this action to test a rule that you intend to use to drop traffic. You can enable the rule with ALERT action, verify in the logs that the rule is filtering as you want, then change the action to DROP .

    • REJECT - Drops TCP traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. Also sends an alert log mesage if alert logging is configured in the Firewall LoggingConfiguration .

    REJECT isn't currently available for use with IMAP and FTP protocols.

    Header RuleGroupHeader
    The stateful inspection criteria for this rule, used to inspect traffic flows.
    RuleOptions []RuleGroupRuleOption
    Additional settings for a stateful rule, provided as keywords and settings.
    action RuleGroupStatefulRuleAction

    Defines what Network Firewall should do with the packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow.

    The actions for a stateful rule are defined as follows:

    • PASS - Permits the packets to go to the intended destination.
    • DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .
    • REJECT - Drops traffic that matches the conditions of the stateful rule and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. REJECT is available only for TCP traffic.
    • ALERT - Permits the packets to go to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .

    You can use this action to test a rule that you intend to use to drop traffic. You can enable the rule with ALERT action, verify in the logs that the rule is filtering as you want, then change the action to DROP .

    • REJECT - Drops TCP traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. Also sends an alert log mesage if alert logging is configured in the Firewall LoggingConfiguration .

    REJECT isn't currently available for use with IMAP and FTP protocols.

    header RuleGroupHeader
    The stateful inspection criteria for this rule, used to inspect traffic flows.
    ruleOptions List<RuleGroupRuleOption>
    Additional settings for a stateful rule, provided as keywords and settings.
    action RuleGroupStatefulRuleAction

    Defines what Network Firewall should do with the packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow.

    The actions for a stateful rule are defined as follows:

    • PASS - Permits the packets to go to the intended destination.
    • DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .
    • REJECT - Drops traffic that matches the conditions of the stateful rule and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. REJECT is available only for TCP traffic.
    • ALERT - Permits the packets to go to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .

    You can use this action to test a rule that you intend to use to drop traffic. You can enable the rule with ALERT action, verify in the logs that the rule is filtering as you want, then change the action to DROP .

    • REJECT - Drops TCP traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. Also sends an alert log mesage if alert logging is configured in the Firewall LoggingConfiguration .

    REJECT isn't currently available for use with IMAP and FTP protocols.

    header RuleGroupHeader
    The stateful inspection criteria for this rule, used to inspect traffic flows.
    ruleOptions RuleGroupRuleOption[]
    Additional settings for a stateful rule, provided as keywords and settings.
    action RuleGroupStatefulRuleAction

    Defines what Network Firewall should do with the packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow.

    The actions for a stateful rule are defined as follows:

    • PASS - Permits the packets to go to the intended destination.
    • DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .
    • REJECT - Drops traffic that matches the conditions of the stateful rule and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. REJECT is available only for TCP traffic.
    • ALERT - Permits the packets to go to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .

    You can use this action to test a rule that you intend to use to drop traffic. You can enable the rule with ALERT action, verify in the logs that the rule is filtering as you want, then change the action to DROP .

    • REJECT - Drops TCP traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. Also sends an alert log mesage if alert logging is configured in the Firewall LoggingConfiguration .

    REJECT isn't currently available for use with IMAP and FTP protocols.

    header RuleGroupHeader
    The stateful inspection criteria for this rule, used to inspect traffic flows.
    rule_options Sequence[RuleGroupRuleOption]
    Additional settings for a stateful rule, provided as keywords and settings.
    action "PASS" | "DROP" | "ALERT" | "REJECT"

    Defines what Network Firewall should do with the packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow.

    The actions for a stateful rule are defined as follows:

    • PASS - Permits the packets to go to the intended destination.
    • DROP - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .
    • REJECT - Drops traffic that matches the conditions of the stateful rule and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. REJECT is available only for TCP traffic.
    • ALERT - Permits the packets to go to the intended destination and sends an alert log message, if alert logging is configured in the Firewall LoggingConfiguration .

    You can use this action to test a rule that you intend to use to drop traffic. You can enable the rule with ALERT action, verify in the logs that the rule is filtering as you want, then change the action to DROP .

    • REJECT - Drops TCP traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a RST bit contained in the TCP header flags. Also sends an alert log mesage if alert logging is configured in the Firewall LoggingConfiguration .

    REJECT isn't currently available for use with IMAP and FTP protocols.

    header Property Map
    The stateful inspection criteria for this rule, used to inspect traffic flows.
    ruleOptions List<Property Map>
    Additional settings for a stateful rule, provided as keywords and settings.

    RuleGroupStatefulRuleAction, RuleGroupStatefulRuleActionArgs

    Pass
    PASS
    Drop
    DROP
    Alert
    ALERT
    Reject
    REJECT
    RuleGroupStatefulRuleActionPass
    PASS
    RuleGroupStatefulRuleActionDrop
    DROP
    RuleGroupStatefulRuleActionAlert
    ALERT
    RuleGroupStatefulRuleActionReject
    REJECT
    Pass
    PASS
    Drop
    DROP
    Alert
    ALERT
    Reject
    REJECT
    Pass
    PASS
    Drop
    DROP
    Alert
    ALERT
    Reject
    REJECT
    PASS_
    PASS
    DROP
    DROP
    ALERT
    ALERT
    REJECT
    REJECT
    "PASS"
    PASS
    "DROP"
    DROP
    "ALERT"
    ALERT
    "REJECT"
    REJECT

    RuleGroupStatefulRuleOptions, RuleGroupStatefulRuleOptionsArgs

    RuleOrder Pulumi.AwsNative.NetworkFirewall.RuleGroupRuleOrder
    Indicates how to manage the order of the rule evaluation for the rule group. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .
    RuleOrder RuleGroupRuleOrder
    Indicates how to manage the order of the rule evaluation for the rule group. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .
    ruleOrder RuleGroupRuleOrder
    Indicates how to manage the order of the rule evaluation for the rule group. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .
    ruleOrder RuleGroupRuleOrder
    Indicates how to manage the order of the rule evaluation for the rule group. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .
    rule_order RuleGroupRuleOrder
    Indicates how to manage the order of the rule evaluation for the rule group. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .
    ruleOrder "DEFAULT_ACTION_ORDER" | "STRICT_ORDER"
    Indicates how to manage the order of the rule evaluation for the rule group. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see Evaluation order for stateful rules in the AWS Network Firewall Developer Guide .

    RuleGroupStatelessRule, RuleGroupStatelessRuleArgs

    Priority int

    Indicates the order in which to run this rule relative to all of the rules that are defined for a stateless rule group. Network Firewall evaluates the rules in a rule group starting with the lowest priority setting. You must ensure that the priority settings are unique for the rule group.

    Each stateless rule group uses exactly one StatelessRulesAndCustomActions object, and each StatelessRulesAndCustomActions contains exactly one StatelessRules object. To ensure unique priority settings for your rule groups, set unique priorities for the stateless rules that you define inside any single StatelessRules object.

    You can change the priority settings of your rules at any time. To make it easier to insert rules later, number them so there's a wide range in between, for example use 100, 200, and so on.

    RuleDefinition Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupRuleDefinition
    Defines the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria.
    Priority int

    Indicates the order in which to run this rule relative to all of the rules that are defined for a stateless rule group. Network Firewall evaluates the rules in a rule group starting with the lowest priority setting. You must ensure that the priority settings are unique for the rule group.

    Each stateless rule group uses exactly one StatelessRulesAndCustomActions object, and each StatelessRulesAndCustomActions contains exactly one StatelessRules object. To ensure unique priority settings for your rule groups, set unique priorities for the stateless rules that you define inside any single StatelessRules object.

    You can change the priority settings of your rules at any time. To make it easier to insert rules later, number them so there's a wide range in between, for example use 100, 200, and so on.

    RuleDefinition RuleGroupRuleDefinition
    Defines the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria.
    priority Integer

    Indicates the order in which to run this rule relative to all of the rules that are defined for a stateless rule group. Network Firewall evaluates the rules in a rule group starting with the lowest priority setting. You must ensure that the priority settings are unique for the rule group.

    Each stateless rule group uses exactly one StatelessRulesAndCustomActions object, and each StatelessRulesAndCustomActions contains exactly one StatelessRules object. To ensure unique priority settings for your rule groups, set unique priorities for the stateless rules that you define inside any single StatelessRules object.

    You can change the priority settings of your rules at any time. To make it easier to insert rules later, number them so there's a wide range in between, for example use 100, 200, and so on.

    ruleDefinition RuleGroupRuleDefinition
    Defines the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria.
    priority number

    Indicates the order in which to run this rule relative to all of the rules that are defined for a stateless rule group. Network Firewall evaluates the rules in a rule group starting with the lowest priority setting. You must ensure that the priority settings are unique for the rule group.

    Each stateless rule group uses exactly one StatelessRulesAndCustomActions object, and each StatelessRulesAndCustomActions contains exactly one StatelessRules object. To ensure unique priority settings for your rule groups, set unique priorities for the stateless rules that you define inside any single StatelessRules object.

    You can change the priority settings of your rules at any time. To make it easier to insert rules later, number them so there's a wide range in between, for example use 100, 200, and so on.

    ruleDefinition RuleGroupRuleDefinition
    Defines the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria.
    priority int

    Indicates the order in which to run this rule relative to all of the rules that are defined for a stateless rule group. Network Firewall evaluates the rules in a rule group starting with the lowest priority setting. You must ensure that the priority settings are unique for the rule group.

    Each stateless rule group uses exactly one StatelessRulesAndCustomActions object, and each StatelessRulesAndCustomActions contains exactly one StatelessRules object. To ensure unique priority settings for your rule groups, set unique priorities for the stateless rules that you define inside any single StatelessRules object.

    You can change the priority settings of your rules at any time. To make it easier to insert rules later, number them so there's a wide range in between, for example use 100, 200, and so on.

    rule_definition RuleGroupRuleDefinition
    Defines the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria.
    priority Number

    Indicates the order in which to run this rule relative to all of the rules that are defined for a stateless rule group. Network Firewall evaluates the rules in a rule group starting with the lowest priority setting. You must ensure that the priority settings are unique for the rule group.

    Each stateless rule group uses exactly one StatelessRulesAndCustomActions object, and each StatelessRulesAndCustomActions contains exactly one StatelessRules object. To ensure unique priority settings for your rule groups, set unique priorities for the stateless rules that you define inside any single StatelessRules object.

    You can change the priority settings of your rules at any time. To make it easier to insert rules later, number them so there's a wide range in between, for example use 100, 200, and so on.

    ruleDefinition Property Map
    Defines the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria.

    RuleGroupStatelessRulesAndCustomActions, RuleGroupStatelessRulesAndCustomActionsArgs

    StatelessRules List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupStatelessRule>
    Defines the set of stateless rules for use in a stateless rule group.
    CustomActions List<Pulumi.AwsNative.NetworkFirewall.Inputs.RuleGroupCustomAction>
    Defines an array of individual custom action definitions that are available for use by the stateless rules in this StatelessRulesAndCustomActions specification. You name each custom action that you define, and then you can use it by name in your stateless rule RuleGroup.RuleDefinition Actions specification.
    StatelessRules []RuleGroupStatelessRule
    Defines the set of stateless rules for use in a stateless rule group.
    CustomActions []RuleGroupCustomAction
    Defines an array of individual custom action definitions that are available for use by the stateless rules in this StatelessRulesAndCustomActions specification. You name each custom action that you define, and then you can use it by name in your stateless rule RuleGroup.RuleDefinition Actions specification.
    statelessRules List<RuleGroupStatelessRule>
    Defines the set of stateless rules for use in a stateless rule group.
    customActions List<RuleGroupCustomAction>
    Defines an array of individual custom action definitions that are available for use by the stateless rules in this StatelessRulesAndCustomActions specification. You name each custom action that you define, and then you can use it by name in your stateless rule RuleGroup.RuleDefinition Actions specification.
    statelessRules RuleGroupStatelessRule[]
    Defines the set of stateless rules for use in a stateless rule group.
    customActions RuleGroupCustomAction[]
    Defines an array of individual custom action definitions that are available for use by the stateless rules in this StatelessRulesAndCustomActions specification. You name each custom action that you define, and then you can use it by name in your stateless rule RuleGroup.RuleDefinition Actions specification.
    stateless_rules Sequence[RuleGroupStatelessRule]
    Defines the set of stateless rules for use in a stateless rule group.
    custom_actions Sequence[RuleGroupCustomAction]
    Defines an array of individual custom action definitions that are available for use by the stateless rules in this StatelessRulesAndCustomActions specification. You name each custom action that you define, and then you can use it by name in your stateless rule RuleGroup.RuleDefinition Actions specification.
    statelessRules List<Property Map>
    Defines the set of stateless rules for use in a stateless rule group.
    customActions List<Property Map>
    Defines an array of individual custom action definitions that are available for use by the stateless rules in this StatelessRulesAndCustomActions specification. You name each custom action that you define, and then you can use it by name in your stateless rule RuleGroup.RuleDefinition Actions specification.

    RuleGroupTargetType, RuleGroupTargetTypeArgs

    TlsSni
    TLS_SNI
    HttpHost
    HTTP_HOST
    RuleGroupTargetTypeTlsSni
    TLS_SNI
    RuleGroupTargetTypeHttpHost
    HTTP_HOST
    TlsSni
    TLS_SNI
    HttpHost
    HTTP_HOST
    TlsSni
    TLS_SNI
    HttpHost
    HTTP_HOST
    TLS_SNI
    TLS_SNI
    HTTP_HOST
    HTTP_HOST
    "TLS_SNI"
    TLS_SNI
    "HTTP_HOST"
    HTTP_HOST

    RuleGroupTcpFlag, RuleGroupTcpFlagArgs

    Fin
    FIN
    Syn
    SYN
    Rst
    RST
    Psh
    PSH
    Ack
    ACK
    Urg
    URG
    Ece
    ECE
    Cwr
    CWR
    RuleGroupTcpFlagFin
    FIN
    RuleGroupTcpFlagSyn
    SYN
    RuleGroupTcpFlagRst
    RST
    RuleGroupTcpFlagPsh
    PSH
    RuleGroupTcpFlagAck
    ACK
    RuleGroupTcpFlagUrg
    URG
    RuleGroupTcpFlagEce
    ECE
    RuleGroupTcpFlagCwr
    CWR
    Fin
    FIN
    Syn
    SYN
    Rst
    RST
    Psh
    PSH
    Ack
    ACK
    Urg
    URG
    Ece
    ECE
    Cwr
    CWR
    Fin
    FIN
    Syn
    SYN
    Rst
    RST
    Psh
    PSH
    Ack
    ACK
    Urg
    URG
    Ece
    ECE
    Cwr
    CWR
    FIN
    FIN
    SYN
    SYN
    RST
    RST
    PSH
    PSH
    ACK
    ACK
    URG
    URG
    ECE
    ECE
    CWR
    CWR
    "FIN"
    FIN
    "SYN"
    SYN
    "RST"
    RST
    "PSH"
    PSH
    "ACK"
    ACK
    "URG"
    URG
    "ECE"
    ECE
    "CWR"
    CWR

    RuleGroupTcpFlagField, RuleGroupTcpFlagFieldArgs

    Flags List<Pulumi.AwsNative.NetworkFirewall.RuleGroupTcpFlag>

    Used in conjunction with the Masks setting to define the flags that must be set and flags that must not be set in order for the packet to match. This setting can only specify values that are also specified in the Masks setting.

    For the flags that are specified in the masks setting, the following must be true for the packet to match:

    • The ones that are set in this flags setting must be set in the packet.
    • The ones that are not set in this flags setting must also not be set in the packet.
    Masks List<Pulumi.AwsNative.NetworkFirewall.RuleGroupTcpFlag>
    The set of flags to consider in the inspection. To inspect all flags in the valid values list, leave this with no setting.
    Flags []RuleGroupTcpFlag

    Used in conjunction with the Masks setting to define the flags that must be set and flags that must not be set in order for the packet to match. This setting can only specify values that are also specified in the Masks setting.

    For the flags that are specified in the masks setting, the following must be true for the packet to match:

    • The ones that are set in this flags setting must be set in the packet.
    • The ones that are not set in this flags setting must also not be set in the packet.
    Masks []RuleGroupTcpFlag
    The set of flags to consider in the inspection. To inspect all flags in the valid values list, leave this with no setting.
    flags List<RuleGroupTcpFlag>

    Used in conjunction with the Masks setting to define the flags that must be set and flags that must not be set in order for the packet to match. This setting can only specify values that are also specified in the Masks setting.

    For the flags that are specified in the masks setting, the following must be true for the packet to match:

    • The ones that are set in this flags setting must be set in the packet.
    • The ones that are not set in this flags setting must also not be set in the packet.
    masks List<RuleGroupTcpFlag>
    The set of flags to consider in the inspection. To inspect all flags in the valid values list, leave this with no setting.
    flags RuleGroupTcpFlag[]

    Used in conjunction with the Masks setting to define the flags that must be set and flags that must not be set in order for the packet to match. This setting can only specify values that are also specified in the Masks setting.

    For the flags that are specified in the masks setting, the following must be true for the packet to match:

    • The ones that are set in this flags setting must be set in the packet.
    • The ones that are not set in this flags setting must also not be set in the packet.
    masks RuleGroupTcpFlag[]
    The set of flags to consider in the inspection. To inspect all flags in the valid values list, leave this with no setting.
    flags Sequence[RuleGroupTcpFlag]

    Used in conjunction with the Masks setting to define the flags that must be set and flags that must not be set in order for the packet to match. This setting can only specify values that are also specified in the Masks setting.

    For the flags that are specified in the masks setting, the following must be true for the packet to match:

    • The ones that are set in this flags setting must be set in the packet.
    • The ones that are not set in this flags setting must also not be set in the packet.
    masks Sequence[RuleGroupTcpFlag]
    The set of flags to consider in the inspection. To inspect all flags in the valid values list, leave this with no setting.
    flags List<"FIN" | "SYN" | "RST" | "PSH" | "ACK" | "URG" | "ECE" | "CWR">

    Used in conjunction with the Masks setting to define the flags that must be set and flags that must not be set in order for the packet to match. This setting can only specify values that are also specified in the Masks setting.

    For the flags that are specified in the masks setting, the following must be true for the packet to match:

    • The ones that are set in this flags setting must be set in the packet.
    • The ones that are not set in this flags setting must also not be set in the packet.
    masks List<"FIN" | "SYN" | "RST" | "PSH" | "ACK" | "URG" | "ECE" | "CWR">
    The set of flags to consider in the inspection. To inspect all flags in the valid values list, leave this with no setting.

    RuleGroupTypeEnum, RuleGroupTypeEnumArgs

    Stateless
    STATELESS
    Stateful
    STATEFUL
    RuleGroupTypeEnumStateless
    STATELESS
    RuleGroupTypeEnumStateful
    STATEFUL
    Stateless
    STATELESS
    Stateful
    STATEFUL
    Stateless
    STATELESS
    Stateful
    STATEFUL
    STATELESS
    STATELESS
    STATEFUL
    STATEFUL
    "STATELESS"
    STATELESS
    "STATEFUL"
    STATEFUL

    Tag, TagArgs

    Key string
    The key name of the tag
    Value string
    The value of the tag
    Key string
    The key name of the tag
    Value string
    The value of the tag
    key String
    The key name of the tag
    value String
    The value of the tag
    key string
    The key name of the tag
    value string
    The value of the tag
    key str
    The key name of the tag
    value str
    The value of the tag
    key String
    The key name of the tag
    value String
    The value of the tag

    Package Details

    Repository
    AWS Native pulumi/pulumi-aws-native
    License
    Apache-2.0
    aws-native logo

    We recommend new projects start with resources from the AWS provider.

    AWS Native v0.126.0 published on Monday, Sep 30, 2024 by Pulumi
    pulumi/pulumi-aws-native