aws-sdk-networkfirewall 1.75.0 → 1.76.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d25e10efc371018981b85441b4e4ba6b10a5bb66dfb5edc0f2036cae500bbd59
-  data.tar.gz: 2081e1591e54a9010f7ffc1d9e10b2ecf3a2787b93c981c182a607c1c914a037
+  metadata.gz: d936459df2b08a670efa388fb6cc4cf7f12e94826bbdac256af86b3a11538e94
+  data.tar.gz: 8d0fd2bab8a5e15f155b791dd3e01d30449f09127c46be8d4fd033b1881a9bd0
 SHA512:
-  metadata.gz: 6eec6d1532f60e037bff321cb68c10ba198606421a7d598e2d21a1d9b588a1bdfdd1626c137b3bda5c92586a58d5b978e6da09abff2a9e3ae1421ca92b525fde
-  data.tar.gz: b94a06bc940ee2fd1039238bc9b997b532cc23170ffb99b7230e5dfc356e19434024483429fb66fdcbe6c910f88a072dc559e7ea08b116ba6f190ebde7814f9f
+  metadata.gz: 86d75b7c026a73450f5084e8b87e04af2d6ba3d67ae46797bea0d12099894b3c395c439780b7e9a54ae488827c3b9b3ef0cdd4ae56d2883be957842165a9ca32
+  data.tar.gz: 258b2c22dba477d6ac2601ae020b6218b50bc06d6222b831df98bd1ca405f6339091550d39c08bfa9de52310ecd9013af7579f62c8105f022211c667ca289fb8

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.76.0 (2025-09-17)
+------------------
+
+* Feature - Network Firewall now prevents TLS handshakes with the target server until after the Server Name Indication (SNI) has been seen and verified. The monitoring dashboard now provides deeper insights into PrivateLink endpoint candidates and offers filters based on IP addresses and protocol.
+
 1.75.0 (2025-08-28)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.75.0
+1.76.0

data/lib/aws-sdk-networkfirewall/client.rb

@@ -871,7 +871,7 @@ module Aws::NetworkFirewall
     #   endpoints for a transit gateway-attached firewall. You must specify at
     #   least one Availability Zone. Consider enabling the firewall in every
     #   Availability Zone where you have workloads to maintain Availability
-    #   Zone independence.
+    #   Zone isolation.
     #
     #   You can modify Availability Zones later using
     #   AssociateAvailabilityZones or DisassociateAvailabilityZones, but this
@@ -1080,6 +1080,7 @@ module Aws::NetworkFirewall
     #           },
     #         },
     #       },
+    #       enable_tls_session_holding: false,
     #     },
     #     description: "Description",
     #     tags: [
@@ -1838,7 +1839,7 @@ module Aws::NetworkFirewall
     # the firewall owner or the transit gateway owner can delete the
     # attachment.
     #
-    # After you delete a transit gateway attachment, raffic will no longer
+    # After you delete a transit gateway attachment, traffic will no longer
     # flow through the firewall endpoints.
     #
     # After you initiate the delete operation, use DescribeFirewall to
@@ -2268,6 +2269,7 @@ module Aws::NetworkFirewall
     #   resp.firewall_policy.policy_variables.rule_variables #=> Hash
     #   resp.firewall_policy.policy_variables.rule_variables["RuleVariableName"].definition #=> Array
     #   resp.firewall_policy.policy_variables.rule_variables["RuleVariableName"].definition[0] #=> String
+    #   resp.firewall_policy.enable_tls_session_holding #=> Boolean
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/DescribeFirewallPolicy AWS API Documentation
     #
@@ -3722,8 +3724,9 @@ module Aws::NetworkFirewall
     # creation of routing components between the transit gateway and
     # firewall endpoints.
     #
-    # Only the firewall owner can reject the attachment. After rejection, no
-    # traffic will flow through the firewall endpoints for this attachment.
+    # Only the transit gateway owner can reject the attachment. After
+    # rejection, no traffic will flow through the firewall endpoints for
+    # this attachment.
     #
     # Use DescribeFirewall to monitor the rejection status. To accept the
     # attachment instead of rejecting it, use
@@ -4541,6 +4544,7 @@ module Aws::NetworkFirewall
     #           },
     #         },
     #       },
+    #       enable_tls_session_holding: false,
     #     },
     #     description: "Description",
     #     dry_run: false,
@@ -5273,7 +5277,7 @@ module Aws::NetworkFirewall
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-networkfirewall'
-      context[:gem_version] = '1.75.0'
+      context[:gem_version] = '1.76.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-networkfirewall/client_api.rb

@@ -119,6 +119,7 @@ module Aws::NetworkFirewall
     DisassociateSubnetsResponse = Shapes::StructureShape.new(name: 'DisassociateSubnetsResponse')
     Domain = Shapes::StringShape.new(name: 'Domain')
     EnableMonitoringDashboard = Shapes::BooleanShape.new(name: 'EnableMonitoringDashboard')
+    EnableTLSSessionHolding = Shapes::BooleanShape.new(name: 'EnableTLSSessionHolding')
     EnabledAnalysisType = Shapes::StringShape.new(name: 'EnabledAnalysisType')
     EnabledAnalysisTypes = Shapes::ListShape.new(name: 'EnabledAnalysisTypes')
     EncryptionConfiguration = Shapes::StructureShape.new(name: 'EncryptionConfiguration')
@@ -792,6 +793,7 @@ module Aws::NetworkFirewall
     FirewallPolicy.add_member(:stateful_engine_options, Shapes::ShapeRef.new(shape: StatefulEngineOptions, location_name: "StatefulEngineOptions"))
     FirewallPolicy.add_member(:tls_inspection_configuration_arn, Shapes::ShapeRef.new(shape: ResourceArn, location_name: "TLSInspectionConfigurationArn"))
     FirewallPolicy.add_member(:policy_variables, Shapes::ShapeRef.new(shape: PolicyVariables, location_name: "PolicyVariables"))
+    FirewallPolicy.add_member(:enable_tls_session_holding, Shapes::ShapeRef.new(shape: EnableTLSSessionHolding, location_name: "EnableTLSSessionHolding"))
     FirewallPolicy.struct_class = Types::FirewallPolicy
 
     FirewallPolicyMetadata.add_member(:name, Shapes::ShapeRef.new(shape: ResourceName, location_name: "Name"))

data/lib/aws-sdk-networkfirewall/types.rb

@@ -949,7 +949,7 @@ module Aws::NetworkFirewall
     #   endpoints for a transit gateway-attached firewall. You must specify
     #   at least one Availability Zone. Consider enabling the firewall in
     #   every Availability Zone where you have workloads to maintain
-    #   Availability Zone independence.
+    #   Availability Zone isolation.
     #
     #   You can modify Availability Zones later using
     #   AssociateAvailabilityZones or DisassociateAvailabilityZones, but
@@ -2969,6 +2969,12 @@ module Aws::NetworkFirewall
     #   settings in your firewall policy.
     #   @return [Types::PolicyVariables]
     #
+    # @!attribute [rw] enable_tls_session_holding
+    #   When true, prevents TCP and TLS packets from reaching destination
+    #   servers until TLS Inspection has evaluated Server Name Indication
+    #   (SNI) rules. Requires an associated TLS Inspection configuration.
+    #   @return [Boolean]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/FirewallPolicy AWS API Documentation
     #
     class FirewallPolicy < Struct.new(
@@ -2980,7 +2986,8 @@ module Aws::NetworkFirewall
       :stateful_default_actions,
       :stateful_engine_options,
       :tls_inspection_configuration_arn,
-      :policy_variables)
+      :policy_variables,
+      :enable_tls_session_holding)
       SENSITIVE = []
       include Aws::Structure
     end

data/lib/aws-sdk-networkfirewall.rb

@@ -54,7 +54,7 @@ module Aws::NetworkFirewall
   autoload :EndpointProvider, 'aws-sdk-networkfirewall/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-networkfirewall/endpoints'
 
-  GEM_VERSION = '1.75.0'
+  GEM_VERSION = '1.76.0'
 
 end
 

data/sig/client.rbs

@@ -242,7 +242,8 @@ module Aws
                                         rule_variables: Hash[::String, {
                                             definition: Array[::String]
                                           }]?
-                                      }?
+                                      }?,
+                                      enable_tls_session_holding: bool?
                                     },
                                     ?description: ::String,
                                     ?tags: Array[
@@ -1161,7 +1162,8 @@ module Aws
                                         rule_variables: Hash[::String, {
                                             definition: Array[::String]
                                           }]?
-                                      }?
+                                      }?,
+                                      enable_tls_session_holding: bool?
                                     },
                                     ?description: ::String,
                                     ?dry_run: bool,

data/sig/types.rbs

@@ -557,6 +557,7 @@ module Aws::NetworkFirewall
       attr_accessor stateful_engine_options: Types::StatefulEngineOptions
       attr_accessor tls_inspection_configuration_arn: ::String
       attr_accessor policy_variables: Types::PolicyVariables
+      attr_accessor enable_tls_session_holding: bool
       SENSITIVE: []
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-networkfirewall
 version: !ruby/object:Gem::Version
-  version: 1.75.0
+  version: 1.76.0
 platform: ruby
 authors:
 - Amazon Web Services