aws-sdk-networkfirewall 1.47.0 → 1.48.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +5 -0
- data/VERSION +1 -1
- data/lib/aws-sdk-networkfirewall/client.rb +14 -12
- data/lib/aws-sdk-networkfirewall/types.rb +37 -14
- data/lib/aws-sdk-networkfirewall.rb +1 -1
- data/sig/client.rbs +1 -1
- data/sig/types.rbs +1 -1
- metadata +2 -2
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: b546797808123a231ff6fff93bed1db903297ffc984182fb23059b35d8f38933
|
4
|
+
data.tar.gz: 1db2f3de8ec6245f72beae7082b3834841b90ea4ffd9dfe59982f5e909510b5e
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: ef6611a4ffa9ba062aa5f9a4039567c00863abdf16ce68738eab60008ea3d3c49997db1e9c67b43306e7b2a531d03c8dfb41a45e002ace13f4406b0448711c1c
|
7
|
+
data.tar.gz: 421979f20e2e0c732c8a7fc2f2a78b3b3f7f5dd1e091662e71463fabf5ee2bb262eba7bb4cd60d89245a989585702527c5b11298117f121f8492d903d0a2779e
|
data/CHANGELOG.md
CHANGED
@@ -1,6 +1,11 @@
|
|
1
1
|
Unreleased Changes
|
2
2
|
------------------
|
3
3
|
|
4
|
+
1.48.0 (2024-07-25)
|
5
|
+
------------------
|
6
|
+
|
7
|
+
* Feature - You can now log events that are related to TLS inspection, in addition to the existing alert and flow logging.
|
8
|
+
|
4
9
|
1.47.0 (2024-07-02)
|
5
10
|
------------------
|
6
11
|
|
data/VERSION
CHANGED
@@ -1 +1 @@
|
|
1
|
-
1.
|
1
|
+
1.48.0
|
@@ -1169,14 +1169,16 @@ module Aws::NetworkFirewall
|
|
1169
1169
|
req.send_request(options)
|
1170
1170
|
end
|
1171
1171
|
|
1172
|
-
# Creates an Network Firewall TLS inspection configuration.
|
1173
|
-
# inspection
|
1174
|
-
#
|
1175
|
-
# Firewall
|
1176
|
-
#
|
1177
|
-
#
|
1178
|
-
#
|
1179
|
-
#
|
1172
|
+
# Creates an Network Firewall TLS inspection configuration. Network
|
1173
|
+
# Firewall uses TLS inspection configurations to decrypt your
|
1174
|
+
# firewall's inbound and outbound SSL/TLS traffic. After decryption,
|
1175
|
+
# Network Firewall inspects the traffic according to your firewall
|
1176
|
+
# policy's stateful rules, and then re-encrypts it before sending it to
|
1177
|
+
# its destination. You can enable inspection of your firewall's inbound
|
1178
|
+
# traffic, outbound traffic, or both. To use TLS inspection with your
|
1179
|
+
# firewall, you must first import or provision certificates using ACM,
|
1180
|
+
# create a TLS inspection configuration, add that configuration to a new
|
1181
|
+
# firewall policy, and then associate that policy with your firewall.
|
1180
1182
|
#
|
1181
1183
|
# To update the settings for a TLS inspection configuration, use
|
1182
1184
|
# UpdateTLSInspectionConfiguration.
|
@@ -1803,7 +1805,7 @@ module Aws::NetworkFirewall
|
|
1803
1805
|
#
|
1804
1806
|
# resp.firewall_arn #=> String
|
1805
1807
|
# resp.logging_configuration.log_destination_configs #=> Array
|
1806
|
-
# resp.logging_configuration.log_destination_configs[0].log_type #=> String, one of "ALERT", "FLOW"
|
1808
|
+
# resp.logging_configuration.log_destination_configs[0].log_type #=> String, one of "ALERT", "FLOW", "TLS"
|
1807
1809
|
# resp.logging_configuration.log_destination_configs[0].log_destination_type #=> String, one of "S3", "CloudWatchLogs", "KinesisDataFirehose"
|
1808
1810
|
# resp.logging_configuration.log_destination_configs[0].log_destination #=> Hash
|
1809
1811
|
# resp.logging_configuration.log_destination_configs[0].log_destination["HashMapKey"] #=> String
|
@@ -3112,7 +3114,7 @@ module Aws::NetworkFirewall
|
|
3112
3114
|
# logging_configuration: {
|
3113
3115
|
# log_destination_configs: [ # required
|
3114
3116
|
# {
|
3115
|
-
# log_type: "ALERT", # required, accepts ALERT, FLOW
|
3117
|
+
# log_type: "ALERT", # required, accepts ALERT, FLOW, TLS
|
3116
3118
|
# log_destination_type: "S3", # required, accepts S3, CloudWatchLogs, KinesisDataFirehose
|
3117
3119
|
# log_destination: { # required
|
3118
3120
|
# "HashMapKey" => "HashMapValue",
|
@@ -3127,7 +3129,7 @@ module Aws::NetworkFirewall
|
|
3127
3129
|
# resp.firewall_arn #=> String
|
3128
3130
|
# resp.firewall_name #=> String
|
3129
3131
|
# resp.logging_configuration.log_destination_configs #=> Array
|
3130
|
-
# resp.logging_configuration.log_destination_configs[0].log_type #=> String, one of "ALERT", "FLOW"
|
3132
|
+
# resp.logging_configuration.log_destination_configs[0].log_type #=> String, one of "ALERT", "FLOW", "TLS"
|
3131
3133
|
# resp.logging_configuration.log_destination_configs[0].log_destination_type #=> String, one of "S3", "CloudWatchLogs", "KinesisDataFirehose"
|
3132
3134
|
# resp.logging_configuration.log_destination_configs[0].log_destination #=> Hash
|
3133
3135
|
# resp.logging_configuration.log_destination_configs[0].log_destination["HashMapKey"] #=> String
|
@@ -3649,7 +3651,7 @@ module Aws::NetworkFirewall
|
|
3649
3651
|
params: params,
|
3650
3652
|
config: config)
|
3651
3653
|
context[:gem_name] = 'aws-sdk-networkfirewall'
|
3652
|
-
context[:gem_version] = '1.
|
3654
|
+
context[:gem_version] = '1.48.0'
|
3653
3655
|
Seahorse::Client::Request.new(handlers, context)
|
3654
3656
|
end
|
3655
3657
|
|
@@ -2696,25 +2696,40 @@ module Aws::NetworkFirewall
|
|
2696
2696
|
|
2697
2697
|
# Defines where Network Firewall sends logs for the firewall for one log
|
2698
2698
|
# type. This is used in LoggingConfiguration. You can send each type of
|
2699
|
-
# log to an Amazon S3 bucket, a CloudWatch log group, or a
|
2700
|
-
#
|
2699
|
+
# log to an Amazon S3 bucket, a CloudWatch log group, or a Firehose
|
2700
|
+
# delivery stream.
|
2701
2701
|
#
|
2702
2702
|
# Network Firewall generates logs for stateful rule groups. You can save
|
2703
|
-
# alert and
|
2704
|
-
# for all network traffic that it receives. It records alert logs for
|
2705
|
-
# traffic that matches stateful rules that have the rule action set to
|
2706
|
-
# `DROP` or `ALERT`.
|
2703
|
+
# alert, flow, and TLS log types.
|
2707
2704
|
#
|
2708
2705
|
# @!attribute [rw] log_type
|
2709
|
-
# The type of log to
|
2710
|
-
#
|
2711
|
-
#
|
2706
|
+
# The type of log to record. You can record the following types of
|
2707
|
+
# logs from your Network Firewall stateful engine.
|
2708
|
+
#
|
2709
|
+
# * `ALERT` - Logs for traffic that matches your stateful rules and
|
2710
|
+
# that have an action that sends an alert. A stateful rule sends
|
2711
|
+
# alerts for the rule actions DROP, ALERT, and REJECT. For more
|
2712
|
+
# information, see StatefulRule.
|
2713
|
+
#
|
2714
|
+
# * `FLOW` - Standard network traffic flow logs. The stateful rules
|
2715
|
+
# engine records flow logs for all network traffic that it receives.
|
2716
|
+
# Each flow log record captures the network flow for a specific
|
2717
|
+
# standard stateless rule group.
|
2718
|
+
#
|
2719
|
+
# * `TLS` - Logs for events that are related to TLS inspection. For
|
2720
|
+
# more information, see [Inspecting SSL/TLS traffic with TLS
|
2721
|
+
# inspection configurations][1] in the *Network Firewall Developer
|
2722
|
+
# Guide*.
|
2723
|
+
#
|
2724
|
+
#
|
2725
|
+
#
|
2726
|
+
# [1]: https://docs.aws.amazon.com/network-firewall/latest/developerguide/tls-inspection-configurations.html
|
2712
2727
|
# @return [String]
|
2713
2728
|
#
|
2714
2729
|
# @!attribute [rw] log_destination_type
|
2715
2730
|
# The type of storage destination to send these logs to. You can send
|
2716
|
-
# logs to an Amazon S3 bucket, a CloudWatch log group, or a
|
2717
|
-
#
|
2731
|
+
# logs to an Amazon S3 bucket, a CloudWatch log group, or a Firehose
|
2732
|
+
# delivery stream.
|
2718
2733
|
# @return [String]
|
2719
2734
|
#
|
2720
2735
|
# @!attribute [rw] log_destination
|
@@ -2723,6 +2738,7 @@ module Aws::NetworkFirewall
|
|
2723
2738
|
#
|
2724
2739
|
# * For an Amazon S3 bucket, provide the name of the bucket, with key
|
2725
2740
|
# `bucketName`, and optionally provide a prefix, with key `prefix`.
|
2741
|
+
#
|
2726
2742
|
# The following example specifies an Amazon S3 bucket named
|
2727
2743
|
# `DOC-EXAMPLE-BUCKET` and the prefix `alerts`:
|
2728
2744
|
#
|
@@ -2735,9 +2751,9 @@ module Aws::NetworkFirewall
|
|
2735
2751
|
#
|
2736
2752
|
# `"LogDestination": \{ "logGroup": "alert-log-group" \}`
|
2737
2753
|
#
|
2738
|
-
# * For a
|
2739
|
-
#
|
2740
|
-
#
|
2754
|
+
# * For a Firehose delivery stream, provide the name of the delivery
|
2755
|
+
# stream, with key `deliveryStream`. The following example specifies
|
2756
|
+
# a delivery stream named `alert-delivery-stream`:
|
2741
2757
|
#
|
2742
2758
|
# `"LogDestination": \{ "deliveryStream": "alert-delivery-stream"
|
2743
2759
|
# \}`
|
@@ -3711,6 +3727,13 @@ module Aws::NetworkFirewall
|
|
3711
3727
|
# drop traffic. You can enable the rule with `ALERT` action, verify
|
3712
3728
|
# in the logs that the rule is filtering as you want, then change
|
3713
3729
|
# the action to `DROP`.
|
3730
|
+
#
|
3731
|
+
# * **REJECT** - Drops traffic that matches the conditions of the
|
3732
|
+
# stateful rule, and sends a TCP reset packet back to sender of the
|
3733
|
+
# packet. A TCP reset packet is a packet with no payload and an RST
|
3734
|
+
# bit contained in the TCP header flags. REJECT is available only
|
3735
|
+
# for TCP traffic. This option doesn't support FTP or IMAP
|
3736
|
+
# protocols.
|
3714
3737
|
# @return [String]
|
3715
3738
|
#
|
3716
3739
|
# @!attribute [rw] header
|
data/sig/client.rbs
CHANGED
@@ -815,7 +815,7 @@ module Aws
|
|
815
815
|
?logging_configuration: {
|
816
816
|
log_destination_configs: Array[
|
817
817
|
{
|
818
|
-
log_type: ("ALERT" | "FLOW"),
|
818
|
+
log_type: ("ALERT" | "FLOW" | "TLS"),
|
819
819
|
log_destination_type: ("S3" | "CloudWatchLogs" | "KinesisDataFirehose"),
|
820
820
|
log_destination: Hash[::String, ::String]
|
821
821
|
},
|
data/sig/types.rbs
CHANGED
@@ -526,7 +526,7 @@ module Aws::NetworkFirewall
|
|
526
526
|
end
|
527
527
|
|
528
528
|
class LogDestinationConfig
|
529
|
-
attr_accessor log_type: ("ALERT" | "FLOW")
|
529
|
+
attr_accessor log_type: ("ALERT" | "FLOW" | "TLS")
|
530
530
|
attr_accessor log_destination_type: ("S3" | "CloudWatchLogs" | "KinesisDataFirehose")
|
531
531
|
attr_accessor log_destination: ::Hash[::String, ::String]
|
532
532
|
SENSITIVE: []
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: aws-sdk-networkfirewall
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 1.
|
4
|
+
version: 1.48.0
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- Amazon Web Services
|
8
8
|
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date: 2024-07-
|
11
|
+
date: 2024-07-25 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: aws-sdk-core
|