Package com.pulumi.aws.networkfirewall.inputs

Class FirewallPolicyFirewallPolicyArgs.Builder

    • Method Detail

      • enableTlsSessionHolding

        public FirewallPolicyFirewallPolicyArgs.Builder enableTlsSessionHolding​(@Nullable
                                                                        com.pulumi.core.Output<java.lang.Boolean> enableTlsSessionHolding)
        Parameters:
        enableTlsSessionHolding - Boolean indicating whether to prevent TCP and TLS packets from reaching destination servers until TLS Inspection has evaluated Server Name Indication (SNI) rules. If `true`, `tlsInspectionConfigurationArn` is required. Default value: `false`.
        Returns:
        builder

      • enableTlsSessionHolding

        public FirewallPolicyFirewallPolicyArgs.Builder enableTlsSessionHolding​(java.lang.Boolean enableTlsSessionHolding)
        Parameters:
        enableTlsSessionHolding - Boolean indicating whether to prevent TCP and TLS packets from reaching destination servers until TLS Inspection has evaluated Server Name Indication (SNI) rules. If `true`, `tlsInspectionConfigurationArn` is required. Default value: `false`.
        Returns:
        builder

      • statefulDefaultActions

        public FirewallPolicyFirewallPolicyArgs.Builder statefulDefaultActions​(@Nullable
                                                                       com.pulumi.core.Output<java.util.List<java.lang.String>> statefulDefaultActions)
        Parameters:
        statefulDefaultActions - Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a `statefulEngineOptions` block with a `ruleOrder` value of `STRICT_ORDER`. Value values: `aws:drop_strict`, `aws:drop_established`, `aws:drop_established_app_layer`, `aws:alert_strict`, ` aws:alert_established, `aws:alert_established_app_layer`. For more information, see [Strict evaluation order](https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-rule-evaluation-order.html#suricata-strict-rule-evaluation-order.html) in the AWS Network Firewall Developer Guide.
        Returns:
        builder

      • statefulDefaultActions

        public FirewallPolicyFirewallPolicyArgs.Builder statefulDefaultActions​(java.util.List<java.lang.String> statefulDefaultActions)
        Parameters:
        statefulDefaultActions - Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a `statefulEngineOptions` block with a `ruleOrder` value of `STRICT_ORDER`. Value values: `aws:drop_strict`, `aws:drop_established`, `aws:drop_established_app_layer`, `aws:alert_strict`, ` aws:alert_established, `aws:alert_established_app_layer`. For more information, see [Strict evaluation order](https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-rule-evaluation-order.html#suricata-strict-rule-evaluation-order.html) in the AWS Network Firewall Developer Guide.
        Returns:
        builder

      • statefulDefaultActions

        public FirewallPolicyFirewallPolicyArgs.Builder statefulDefaultActions​(java.lang.String... statefulDefaultActions)
        Parameters:
        statefulDefaultActions - Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a `statefulEngineOptions` block with a `ruleOrder` value of `STRICT_ORDER`. Value values: `aws:drop_strict`, `aws:drop_established`, `aws:drop_established_app_layer`, `aws:alert_strict`, ` aws:alert_established, `aws:alert_established_app_layer`. For more information, see [Strict evaluation order](https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-rule-evaluation-order.html#suricata-strict-rule-evaluation-order.html) in the AWS Network Firewall Developer Guide.
        Returns:
        builder

      • statelessCustomActions

        public FirewallPolicyFirewallPolicyArgs.Builder statelessCustomActions​(@Nullable
                                                                       com.pulumi.core.Output<java.util.List<FirewallPolicyFirewallPolicyStatelessCustomActionArgs>> statelessCustomActions)
        Parameters:
        statelessCustomActions - Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's `statelessDefaultActions`. See Stateless Custom Action below for details.
        Returns:
        builder

      • statelessDefaultActions

        public FirewallPolicyFirewallPolicyArgs.Builder statelessDefaultActions​(com.pulumi.core.Output<java.util.List<java.lang.String>> statelessDefaultActions)
        Parameters:
        statelessDefaultActions - Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: `aws:drop`, `aws:pass`, or `aws:forward_to_sfe`. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify `aws:forward_to_sfe`.
        Returns:
        builder

      • statelessDefaultActions

        public FirewallPolicyFirewallPolicyArgs.Builder statelessDefaultActions​(java.util.List<java.lang.String> statelessDefaultActions)
        Parameters:
        statelessDefaultActions - Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: `aws:drop`, `aws:pass`, or `aws:forward_to_sfe`. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify `aws:forward_to_sfe`.
        Returns:
        builder

      • statelessDefaultActions

        public FirewallPolicyFirewallPolicyArgs.Builder statelessDefaultActions​(java.lang.String... statelessDefaultActions)
        Parameters:
        statelessDefaultActions - Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: `aws:drop`, `aws:pass`, or `aws:forward_to_sfe`. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify `aws:forward_to_sfe`.
        Returns:
        builder

      • statelessFragmentDefaultActions

        public FirewallPolicyFirewallPolicyArgs.Builder statelessFragmentDefaultActions​(com.pulumi.core.Output<java.util.List<java.lang.String>> statelessFragmentDefaultActions)
        Parameters:
        statelessFragmentDefaultActions - Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: `aws:drop`, `aws:pass`, or `aws:forward_to_sfe`. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify `aws:forward_to_sfe`.
        Returns:
        builder

      • statelessFragmentDefaultActions

        public FirewallPolicyFirewallPolicyArgs.Builder statelessFragmentDefaultActions​(java.util.List<java.lang.String> statelessFragmentDefaultActions)
        Parameters:
        statelessFragmentDefaultActions - Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: `aws:drop`, `aws:pass`, or `aws:forward_to_sfe`. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify `aws:forward_to_sfe`.
        Returns:
        builder

      • statelessFragmentDefaultActions

        public FirewallPolicyFirewallPolicyArgs.Builder statelessFragmentDefaultActions​(java.lang.String... statelessFragmentDefaultActions)
        Parameters:
        statelessFragmentDefaultActions - Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: `aws:drop`, `aws:pass`, or `aws:forward_to_sfe`. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify `aws:forward_to_sfe`.
        Returns:
        builder

      • tlsInspectionConfigurationArn

        public FirewallPolicyFirewallPolicyArgs.Builder tlsInspectionConfigurationArn​(@Nullable
                                                                              com.pulumi.core.Output<java.lang.String> tlsInspectionConfigurationArn)
        Parameters:
        tlsInspectionConfigurationArn - The (ARN) of the TLS Inspection policy to attach to the FW Policy. This must be added at creation of the resource per AWS documentation. "You can only add a TLS inspection configuration to a new policy, not to an existing policy." This cannot be removed from a FW Policy.
        Returns:
        builder

      • tlsInspectionConfigurationArn

        public FirewallPolicyFirewallPolicyArgs.Builder tlsInspectionConfigurationArn​(java.lang.String tlsInspectionConfigurationArn)
        Parameters:
        tlsInspectionConfigurationArn - The (ARN) of the TLS Inspection policy to attach to the FW Policy. This must be added at creation of the resource per AWS documentation. "You can only add a TLS inspection configuration to a new policy, not to an existing policy." This cannot be removed from a FW Policy.
        Returns:
        builder