Package com.pulumi.aws.networkfirewall
Class RuleGroup
- java.lang.Object
-
- com.pulumi.resources.Resource
-
- com.pulumi.resources.CustomResource
-
- com.pulumi.aws.networkfirewall.RuleGroup
-
public class RuleGroup extends com.pulumi.resources.CustomResourceProvides an AWS Network Firewall Rule Group Resource ## Example Usage ### Stateful Inspection for denying access to a domain
### Stateful Inspection for permitting packets from a source IP address ### Stateful Inspection for blocking packets from going to an intended destinationpackage generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.networkfirewall.RuleGroup; import com.pulumi.aws.networkfirewall.RuleGroupArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceRulesSourceListArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var example = new RuleGroup("example", RuleGroupArgs.builder() .ruleGroup(RuleGroupRuleGroupArgs.builder() .rulesSource(RuleGroupRuleGroupRulesSourceArgs.builder() .rulesSourceList(RuleGroupRuleGroupRulesSourceRulesSourceListArgs.builder() .generatedRulesType("DENYLIST") .targetTypes("HTTP_HOST") .targets("test.example.com") .build()) .build()) .build()) .capacity(100) .name("example") .type("STATEFUL") .tags(Map.ofEntries( Map.entry("Tag1", "Value1"), Map.entry("Tag2", "Value2") )) .build()); } }
### Stateful Inspection from rules specifications defined in Suricata flat formatpackage generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.networkfirewall.RuleGroup; import com.pulumi.aws.networkfirewall.RuleGroupArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatefulRuleArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatefulRuleHeaderArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatefulRuleRuleOptionArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var example = new RuleGroup("example", RuleGroupArgs.builder() .ruleGroup(RuleGroupRuleGroupArgs.builder() .rulesSource(RuleGroupRuleGroupRulesSourceArgs.builder() .statefulRules(RuleGroupRuleGroupRulesSourceStatefulRuleArgs.builder() .header(RuleGroupRuleGroupRulesSourceStatefulRuleHeaderArgs.builder() .destination("124.1.1.24/32") .destinationPort("53") .direction("ANY") .protocol("TCP") .source("1.2.3.4/32") .sourcePort("53") .build()) .ruleOptions(RuleGroupRuleGroupRulesSourceStatefulRuleRuleOptionArgs.builder() .keyword("sid") .settings("1") .build()) .action("DROP") .build()) .build()) .build()) .capacity(100) .name("example") .type("STATEFUL") .tags(Map.ofEntries( Map.entry("Tag1", "Value1"), Map.entry("Tag2", "Value2") )) .build()); } }
### Stateful Inspection from rule group specifications using rule variables and Suricata format rulespackage generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.networkfirewall.RuleGroup; import com.pulumi.aws.networkfirewall.RuleGroupArgs; import com.pulumi.std.StdFunctions; import com.pulumi.std.inputs.FileArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var example = new RuleGroup("example", RuleGroupArgs.builder() .capacity(100) .name("example") .type("STATEFUL") .rules(StdFunctions.file(FileArgs.builder() .input("example.rules") .build()).result()) .tags(Map.ofEntries( Map.entry("Tag1", "Value1"), Map.entry("Tag2", "Value2") )) .build()); } }
### Stateless Inspection with a Custom Actionpackage generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.networkfirewall.RuleGroup; import com.pulumi.aws.networkfirewall.RuleGroupArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRuleVariablesArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRuleVariablesIpSetArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRuleVariablesIpSetIpSetArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRuleVariablesPortSetArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRuleVariablesPortSetPortSetArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceArgs; import com.pulumi.std.StdFunctions; import com.pulumi.std.inputs.FileArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var example = new RuleGroup("example", RuleGroupArgs.builder() .ruleGroup(RuleGroupRuleGroupArgs.builder() .ruleVariables(RuleGroupRuleGroupRuleVariablesArgs.builder() .ipSets( RuleGroupRuleGroupRuleVariablesIpSetArgs.builder() .ipSet(RuleGroupRuleGroupRuleVariablesIpSetIpSetArgs.builder() .definitions( "10.0.0.0/16", "10.0.1.0/24", "192.168.0.0/16") .build()) .key("WEBSERVERS_HOSTS") .build(), RuleGroupRuleGroupRuleVariablesIpSetArgs.builder() .ipSet(RuleGroupRuleGroupRuleVariablesIpSetIpSetArgs.builder() .definitions("1.2.3.4/32") .build()) .key("EXTERNAL_HOST") .build()) .portSets(RuleGroupRuleGroupRuleVariablesPortSetArgs.builder() .portSet(RuleGroupRuleGroupRuleVariablesPortSetPortSetArgs.builder() .definitions( "443", "80") .build()) .key("HTTP_PORTS") .build()) .build()) .rulesSource(RuleGroupRuleGroupRulesSourceArgs.builder() .rulesString(StdFunctions.file(FileArgs.builder() .input("suricata_rules_file") .build()).result()) .build()) .build()) .capacity(100) .name("example") .type("STATEFUL") .tags(Map.ofEntries( Map.entry("Tag1", "Value1"), Map.entry("Tag2", "Value2") )) .build()); } }
### IP Set References to the Rule Grouppackage generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.networkfirewall.RuleGroup; import com.pulumi.aws.networkfirewall.RuleGroupArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsCustomActionArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsCustomActionActionDefinitionArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsCustomActionActionDefinitionPublishMetricActionArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsCustomActionActionDefinitionPublishMetricActionDimensionArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesDestinationPortArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesDestinationArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesSourcePortArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesSourceArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesTcpFlagArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var example = new RuleGroup("example", RuleGroupArgs.builder() .ruleGroup(RuleGroupRuleGroupArgs.builder() .rulesSource(RuleGroupRuleGroupRulesSourceArgs.builder() .statelessRulesAndCustomActions(RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsArgs.builder() .customActions(RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsCustomActionArgs.builder() .actionDefinition(RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsCustomActionActionDefinitionArgs.builder() .publishMetricAction(RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsCustomActionActionDefinitionPublishMetricActionArgs.builder() .dimensions(RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsCustomActionActionDefinitionPublishMetricActionDimensionArgs.builder() .value("2") .build()) .build()) .build()) .actionName("ExampleMetricsAction") .build()) .statelessRules(RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleArgs.builder() .ruleDefinition(RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionArgs.builder() .matchAttributes(RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesArgs.builder() .destinationPorts(RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesDestinationPortArgs.builder() .fromPort(443) .toPort(443) .build()) .destinations(RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesDestinationArgs.builder() .addressDefinition("124.1.1.5/32") .build()) .sourcePorts(RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesSourcePortArgs.builder() .fromPort(443) .toPort(443) .build()) .sources(RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesSourceArgs.builder() .addressDefinition("1.2.3.4/32") .build()) .tcpFlags(RuleGroupRuleGroupRulesSourceStatelessRulesAndCustomActionsStatelessRuleRuleDefinitionMatchAttributesTcpFlagArgs.builder() .flags("SYN") .masks( "SYN", "ACK") .build()) .protocols(6) .build()) .actions( "aws:pass", "ExampleMetricsAction") .build()) .priority(1) .build()) .build()) .build()) .build()) .description("Stateless Rate Limiting Rule") .capacity(100) .name("example") .type("STATELESS") .tags(Map.ofEntries( Map.entry("Tag1", "Value1"), Map.entry("Tag2", "Value2") )) .build()); } }
### Example with S3 as source for the suricata rulespackage generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.networkfirewall.RuleGroup; import com.pulumi.aws.networkfirewall.RuleGroupArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceRulesSourceListArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupReferenceSetsArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupReferenceSetsIpSetReferenceArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupReferenceSetsIpSetReferenceIpSetReferenceArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { var example = new RuleGroup("example", RuleGroupArgs.builder() .ruleGroup(RuleGroupRuleGroupArgs.builder() .rulesSource(RuleGroupRuleGroupRulesSourceArgs.builder() .rulesSourceList(RuleGroupRuleGroupRulesSourceRulesSourceListArgs.builder() .generatedRulesType("DENYLIST") .targetTypes("HTTP_HOST") .targets("test.example.com") .build()) .build()) .referenceSets(RuleGroupRuleGroupReferenceSetsArgs.builder() .ipSetReferences(RuleGroupRuleGroupReferenceSetsIpSetReferenceArgs.builder() .ipSetReferences(RuleGroupRuleGroupReferenceSetsIpSetReferenceIpSetReferenceArgs.builder() .referenceArn(this_.arn()) .build()) .key("example") .build()) .build()) .build()) .capacity(100) .name("example") .type("STATEFUL") .tags(Map.ofEntries( Map.entry("Tag1", "Value1"), Map.entry("Tag2", "Value2") )) .build()); } }
## Import Using `pulumi import`, import Network Firewall Rule Groups using their `arn`. For example: ```sh $ pulumi import aws:networkfirewall/ruleGroup:RuleGroup example arn:aws:network-firewall:us-west-1:123456789012:stateful-rulegroup/example ```package generated_program; import com.pulumi.Context; import com.pulumi.Pulumi; import com.pulumi.core.Output; import com.pulumi.aws.s3.S3Functions; import com.pulumi.aws.s3.inputs.GetObjectArgs; import com.pulumi.aws.networkfirewall.RuleGroup; import com.pulumi.aws.networkfirewall.RuleGroupArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRuleVariablesArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRuleVariablesIpSetArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRuleVariablesIpSetIpSetArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRuleVariablesPortSetArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRuleVariablesPortSetPortSetArgs; import com.pulumi.aws.networkfirewall.inputs.RuleGroupRuleGroupRulesSourceArgs; import java.util.ArrayList; import java.util.Arrays; import java.util.Map; import java.io.File; import java.nio.file.Files; import java.nio.file.Paths; public class App { public static void main(String[] args) { Pulumi.run(App::stack); } public static void stack(Context ctx) { final var suricataRules = S3Functions.getObject(GetObjectArgs.builder() .bucket(suricataRulesAwsS3Bucket.id()) .key("rules/custom.rules") .build()); var s3RulesExample = new RuleGroup("s3RulesExample", RuleGroupArgs.builder() .ruleGroup(RuleGroupRuleGroupArgs.builder() .ruleVariables(RuleGroupRuleGroupRuleVariablesArgs.builder() .ipSets(RuleGroupRuleGroupRuleVariablesIpSetArgs.builder() .ipSet(RuleGroupRuleGroupRuleVariablesIpSetIpSetArgs.builder() .definitions( "10.0.0.0/16", "192.168.0.0/16", "172.16.0.0/12") .build()) .key("HOME_NET") .build()) .portSets(RuleGroupRuleGroupRuleVariablesPortSetArgs.builder() .portSet(RuleGroupRuleGroupRuleVariablesPortSetPortSetArgs.builder() .definitions( "443", "80") .build()) .key("HTTP_PORTS") .build()) .build()) .rulesSource(RuleGroupRuleGroupRulesSourceArgs.builder() .rulesString(suricataRules.body()) .build()) .build()) .capacity(1000) .name("my-terraform-s3-rules") .type("STATEFUL") .tags(Map.of("ManagedBy", "terraform")) .build()); } }
-
-
Constructor Summary
Constructors Constructor Description RuleGroup(java.lang.String name)RuleGroup(java.lang.String name, RuleGroupArgs args)RuleGroup(java.lang.String name, RuleGroupArgs args, com.pulumi.resources.CustomResourceOptions options)
-
Method Summary
All Methods Static Methods Instance Methods Concrete Methods Modifier and Type Method Description com.pulumi.core.Output<java.lang.String>arn()com.pulumi.core.Output<java.lang.Integer>capacity()com.pulumi.core.Output<java.util.Optional<java.lang.String>>description()com.pulumi.core.Output<java.util.Optional<RuleGroupEncryptionConfiguration>>encryptionConfiguration()static RuleGroupget(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, RuleGroupState state, com.pulumi.resources.CustomResourceOptions options)Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.com.pulumi.core.Output<java.lang.String>name()com.pulumi.core.Output<java.lang.String>region()com.pulumi.core.Output<RuleGroupRuleGroup>ruleGroup()com.pulumi.core.Output<java.util.Optional<java.lang.String>>rules()com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,java.lang.String>>>tags()com.pulumi.core.Output<java.util.Map<java.lang.String,java.lang.String>>tagsAll()com.pulumi.core.Output<java.lang.String>type()com.pulumi.core.Output<java.lang.String>updateToken()
-
-
-
Constructor Detail
-
RuleGroup
public RuleGroup(java.lang.String name)
- Parameters:
name- The _unique_ name of the resulting resource.
-
RuleGroup
public RuleGroup(java.lang.String name, RuleGroupArgs args)- Parameters:
name- The _unique_ name of the resulting resource.args- The arguments to use to populate this resource's properties.
-
RuleGroup
public RuleGroup(java.lang.String name, RuleGroupArgs args, @Nullable com.pulumi.resources.CustomResourceOptions options)- Parameters:
name- The _unique_ name of the resulting resource.args- The arguments to use to populate this resource's properties.options- A bag of options that control this resource's behavior.
-
-
Method Detail
-
arn
public com.pulumi.core.Output<java.lang.String> arn()
- Returns:
- ARN that identifies the rule group.
-
capacity
public com.pulumi.core.Output<java.lang.Integer> capacity()
- Returns:
- The maximum number of operating resources that this rule group can use. For a stateless rule group, the capacity required is the sum of the capacity requirements of the individual rules. For a stateful rule group, the minimum capacity required is the number of individual rules.
-
description
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> description()
- Returns:
- A friendly description of the rule group.
-
encryptionConfiguration
public com.pulumi.core.Output<java.util.Optional<RuleGroupEncryptionConfiguration>> encryptionConfiguration()
- Returns:
- KMS encryption configuration settings. See Encryption Configuration below for details.
-
name
public com.pulumi.core.Output<java.lang.String> name()
- Returns:
- A friendly name of the rule group.
-
region
public com.pulumi.core.Output<java.lang.String> region()
- Returns:
- Region where this resource will be [managed](https://docs.aws.amazon.com/general/latest/gr/rande.html#regional-endpoints). Defaults to the Region set in the provider configuration.
-
ruleGroup
public com.pulumi.core.Output<RuleGroupRuleGroup> ruleGroup()
- Returns:
- A configuration block that defines the rule group rules. Required unless `rules` is specified. See Rule Group below for details.
-
rules
public com.pulumi.core.Output<java.util.Optional<java.lang.String>> rules()
- Returns:
- The stateful rule group rules specifications in Suricata file format, with one rule per line. Use this to import your existing Suricata compatible rule groups. Required unless `ruleGroup` is specified.
-
tags
public com.pulumi.core.Output<java.util.Optional<java.util.Map<java.lang.String,java.lang.String>>> tags()
- Returns:
- A map of key:value pairs to associate with the resource. If configured with a provider `defaultTags` configuration block present, tags with matching keys will overwrite those defined at the provider-level.
-
tagsAll
public com.pulumi.core.Output<java.util.Map<java.lang.String,java.lang.String>> tagsAll()
- Returns:
- A map of tags assigned to the resource, including those inherited from the provider `defaultTags` configuration block.
-
type
public com.pulumi.core.Output<java.lang.String> type()
- Returns:
- Whether the rule group is stateless (containing stateless rules) or stateful (containing stateful rules). Valid values include: `STATEFUL` or `STATELESS`.
-
updateToken
public com.pulumi.core.Output<java.lang.String> updateToken()
- Returns:
- A string token used when updating the rule group.
-
get
public static RuleGroup get(java.lang.String name, com.pulumi.core.Output<java.lang.String> id, @Nullable RuleGroupState state, @Nullable com.pulumi.resources.CustomResourceOptions options)
Get an existing Host resource's state with the given name, ID, and optional extra properties used to qualify the lookup.- Parameters:
name- The _unique_ name of the resulting resource.id- The _unique_ provider ID of the resource to lookup.state-options- Optional settings to control the behavior of the CustomResource.
-
-