aws-sdk-networkfirewall 1.75.0 → 1.77.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d25e10efc371018981b85441b4e4ba6b10a5bb66dfb5edc0f2036cae500bbd59
-  data.tar.gz: 2081e1591e54a9010f7ffc1d9e10b2ecf3a2787b93c981c182a607c1c914a037
+  metadata.gz: ede64ef386739ee353b1302c14b192a02b89812a4a8b8259b9a2158ca473001a
+  data.tar.gz: 9513247b0b520a6a91543eb03998d3dbaaf58b907f7fabfd196c5f69690b9e26
 SHA512:
-  metadata.gz: 6eec6d1532f60e037bff321cb68c10ba198606421a7d598e2d21a1d9b588a1bdfdd1626c137b3bda5c92586a58d5b978e6da09abff2a9e3ae1421ca92b525fde
-  data.tar.gz: b94a06bc940ee2fd1039238bc9b997b532cc23170ffb99b7230e5dfc356e19434024483429fb66fdcbe6c910f88a072dc559e7ea08b116ba6f190ebde7814f9f
+  metadata.gz: 43f5bfe571ffeaa10cbc635fd5debfa40cee2cd42c19004208055fcbf5866bc908dcfbdc6c77e1f2c6a691120231a5c3720680b77c851ddb63f9c2020cd9da56
+  data.tar.gz: c24a6fde89ab499fe37f75211426bde470362b23d59280cf9b9c7f903add191e99915168a2c5e02d8c0dea5e54a09d682fb7d9c084811fcefedf0b692506828d

data/CHANGELOG.md

@@ -1,6 +1,16 @@
 Unreleased Changes
 ------------------
 
+1.77.0 (2025-09-25)
+------------------
+
+* Feature - Network Firewall now introduces Reject and Alert action support for stateful domain list rule groups, providing customers with more granular control over their network traffic.
+
+1.76.0 (2025-09-17)
+------------------
+
+* Feature - Network Firewall now prevents TLS handshakes with the target server until after the Server Name Indication (SNI) has been seen and verified. The monitoring dashboard now provides deeper insights into PrivateLink endpoint candidates and offers filters based on IP addresses and protocol.
+
 1.75.0 (2025-08-28)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.75.0
+1.77.0

data/lib/aws-sdk-networkfirewall/client.rb

@@ -871,7 +871,7 @@ module Aws::NetworkFirewall
     #   endpoints for a transit gateway-attached firewall. You must specify at
     #   least one Availability Zone. Consider enabling the firewall in every
     #   Availability Zone where you have workloads to maintain Availability
-    #   Zone independence.
+    #   Zone isolation.
     #
     #   You can modify Availability Zones later using
     #   AssociateAvailabilityZones or DisassociateAvailabilityZones, but this
@@ -1080,6 +1080,7 @@ module Aws::NetworkFirewall
     #           },
     #         },
     #       },
+    #       enable_tls_session_holding: false,
     #     },
     #     description: "Description",
     #     tags: [
@@ -1291,7 +1292,7 @@ module Aws::NetworkFirewall
     #         rules_source_list: {
     #           targets: ["CollectionMember_String"], # required
     #           target_types: ["TLS_SNI"], # required, accepts TLS_SNI, HTTP_HOST
-    #           generated_rules_type: "ALLOWLIST", # required, accepts ALLOWLIST, DENYLIST
+    #           generated_rules_type: "ALLOWLIST", # required, accepts ALLOWLIST, DENYLIST, REJECTLIST, ALERTLIST
     #         },
     #         stateful_rules: [
     #           {
@@ -1838,7 +1839,7 @@ module Aws::NetworkFirewall
     # the firewall owner or the transit gateway owner can delete the
     # attachment.
     #
-    # After you delete a transit gateway attachment, raffic will no longer
+    # After you delete a transit gateway attachment, traffic will no longer
     # flow through the firewall endpoints.
     #
     # After you initiate the delete operation, use DescribeFirewall to
@@ -2268,6 +2269,7 @@ module Aws::NetworkFirewall
     #   resp.firewall_policy.policy_variables.rule_variables #=> Hash
     #   resp.firewall_policy.policy_variables.rule_variables["RuleVariableName"].definition #=> Array
     #   resp.firewall_policy.policy_variables.rule_variables["RuleVariableName"].definition[0] #=> String
+    #   resp.firewall_policy.enable_tls_session_holding #=> Boolean
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/DescribeFirewallPolicy AWS API Documentation
     #
@@ -2488,7 +2490,7 @@ module Aws::NetworkFirewall
     #   resp.rule_group.rules_source.rules_source_list.targets[0] #=> String
     #   resp.rule_group.rules_source.rules_source_list.target_types #=> Array
     #   resp.rule_group.rules_source.rules_source_list.target_types[0] #=> String, one of "TLS_SNI", "HTTP_HOST"
-    #   resp.rule_group.rules_source.rules_source_list.generated_rules_type #=> String, one of "ALLOWLIST", "DENYLIST"
+    #   resp.rule_group.rules_source.rules_source_list.generated_rules_type #=> String, one of "ALLOWLIST", "DENYLIST", "REJECTLIST", "ALERTLIST"
     #   resp.rule_group.rules_source.stateful_rules #=> Array
     #   resp.rule_group.rules_source.stateful_rules[0].action #=> String, one of "PASS", "DROP", "ALERT", "REJECT"
     #   resp.rule_group.rules_source.stateful_rules[0].header.protocol #=> String, one of "IP", "TCP", "UDP", "ICMP", "HTTP", "FTP", "TLS", "SMB", "DNS", "DCERPC", "SSH", "SMTP", "IMAP", "MSN", "KRB5", "IKEV2", "TFTP", "NTP", "DHCP", "HTTP2", "QUIC"
@@ -3722,8 +3724,9 @@ module Aws::NetworkFirewall
     # creation of routing components between the transit gateway and
     # firewall endpoints.
     #
-    # Only the firewall owner can reject the attachment. After rejection, no
-    # traffic will flow through the firewall endpoints for this attachment.
+    # Only the transit gateway owner can reject the attachment. After
+    # rejection, no traffic will flow through the firewall endpoints for
+    # this attachment.
     #
     # Use DescribeFirewall to monitor the rejection status. To accept the
     # attachment instead of rejecting it, use
@@ -4541,6 +4544,7 @@ module Aws::NetworkFirewall
     #           },
     #         },
     #       },
+    #       enable_tls_session_holding: false,
     #     },
     #     description: "Description",
     #     dry_run: false,
@@ -4890,7 +4894,7 @@ module Aws::NetworkFirewall
     #         rules_source_list: {
     #           targets: ["CollectionMember_String"], # required
     #           target_types: ["TLS_SNI"], # required, accepts TLS_SNI, HTTP_HOST
-    #           generated_rules_type: "ALLOWLIST", # required, accepts ALLOWLIST, DENYLIST
+    #           generated_rules_type: "ALLOWLIST", # required, accepts ALLOWLIST, DENYLIST, REJECTLIST, ALERTLIST
     #         },
     #         stateful_rules: [
     #           {
@@ -5273,7 +5277,7 @@ module Aws::NetworkFirewall
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-networkfirewall'
-      context[:gem_version] = '1.75.0'
+      context[:gem_version] = '1.77.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-networkfirewall/client_api.rb

@@ -119,6 +119,7 @@ module Aws::NetworkFirewall
     DisassociateSubnetsResponse = Shapes::StructureShape.new(name: 'DisassociateSubnetsResponse')
     Domain = Shapes::StringShape.new(name: 'Domain')
     EnableMonitoringDashboard = Shapes::BooleanShape.new(name: 'EnableMonitoringDashboard')
+    EnableTLSSessionHolding = Shapes::BooleanShape.new(name: 'EnableTLSSessionHolding')
     EnabledAnalysisType = Shapes::StringShape.new(name: 'EnabledAnalysisType')
     EnabledAnalysisTypes = Shapes::ListShape.new(name: 'EnabledAnalysisTypes')
     EncryptionConfiguration = Shapes::StructureShape.new(name: 'EncryptionConfiguration')
@@ -792,6 +793,7 @@ module Aws::NetworkFirewall
     FirewallPolicy.add_member(:stateful_engine_options, Shapes::ShapeRef.new(shape: StatefulEngineOptions, location_name: "StatefulEngineOptions"))
     FirewallPolicy.add_member(:tls_inspection_configuration_arn, Shapes::ShapeRef.new(shape: ResourceArn, location_name: "TLSInspectionConfigurationArn"))
     FirewallPolicy.add_member(:policy_variables, Shapes::ShapeRef.new(shape: PolicyVariables, location_name: "PolicyVariables"))
+    FirewallPolicy.add_member(:enable_tls_session_holding, Shapes::ShapeRef.new(shape: EnableTLSSessionHolding, location_name: "EnableTLSSessionHolding"))
     FirewallPolicy.struct_class = Types::FirewallPolicy
 
     FirewallPolicyMetadata.add_member(:name, Shapes::ShapeRef.new(shape: ResourceName, location_name: "Name"))

data/lib/aws-sdk-networkfirewall/types.rb

@@ -949,7 +949,7 @@ module Aws::NetworkFirewall
     #   endpoints for a transit gateway-attached firewall. You must specify
     #   at least one Availability Zone. Consider enabling the firewall in
     #   every Availability Zone where you have workloads to maintain
-    #   Availability Zone independence.
+    #   Availability Zone isolation.
     #
     #   You can modify Availability Zones later using
     #   AssociateAvailabilityZones or DisassociateAvailabilityZones, but
@@ -2969,6 +2969,12 @@ module Aws::NetworkFirewall
     #   settings in your firewall policy.
     #   @return [Types::PolicyVariables]
     #
+    # @!attribute [rw] enable_tls_session_holding
+    #   When true, prevents TCP and TLS packets from reaching destination
+    #   servers until TLS Inspection has evaluated Server Name Indication
+    #   (SNI) rules. Requires an associated TLS Inspection configuration.
+    #   @return [Boolean]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/FirewallPolicy AWS API Documentation
     #
     class FirewallPolicy < Struct.new(
@@ -2980,7 +2986,8 @@ module Aws::NetworkFirewall
       :stateful_default_actions,
       :stateful_engine_options,
       :tls_inspection_configuration_arn,
-      :policy_variables)
+      :policy_variables,
+      :enable_tls_session_holding)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -5198,8 +5205,15 @@ module Aws::NetworkFirewall
     #   @return [Array<String>]
     #
     # @!attribute [rw] generated_rules_type
-    #   Whether you want to allow or deny access to the domains in your
-    #   target list.
+    #   Whether you want to apply allow, reject, alert, or drop behavior to
+    #   the domains in your target list.
+    #
+    #   <note markdown="1"> When logging is enabled and you choose Alert, traffic that matches
+    #   the domain specifications generates an alert in the firewall's
+    #   logs. Then, traffic either passes, is rejected, or drops based on
+    #   other rules in the firewall policy.
+    #
+    #    </note>
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/RulesSourceList AWS API Documentation

data/lib/aws-sdk-networkfirewall.rb

@@ -54,7 +54,7 @@ module Aws::NetworkFirewall
   autoload :EndpointProvider, 'aws-sdk-networkfirewall/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-networkfirewall/endpoints'
 
-  GEM_VERSION = '1.75.0'
+  GEM_VERSION = '1.77.0'
 
 end
 

data/sig/client.rbs

@@ -242,7 +242,8 @@ module Aws
                                         rule_variables: Hash[::String, {
                                             definition: Array[::String]
                                           }]?
-                                      }?
+                                      }?,
+                                      enable_tls_session_holding: bool?
                                     },
                                     ?description: ::String,
                                     ?tags: Array[
@@ -286,7 +287,7 @@ module Aws
                                    rules_source_list: {
                                      targets: Array[::String],
                                      target_types: Array[("TLS_SNI" | "HTTP_HOST")],
-                                     generated_rules_type: ("ALLOWLIST" | "DENYLIST")
+                                     generated_rules_type: ("ALLOWLIST" | "DENYLIST" | "REJECTLIST" | "ALERTLIST")
                                    }?,
                                    stateful_rules: Array[
                                      {
@@ -1161,7 +1162,8 @@ module Aws
                                         rule_variables: Hash[::String, {
                                             definition: Array[::String]
                                           }]?
-                                      }?
+                                      }?,
+                                      enable_tls_session_holding: bool?
                                     },
                                     ?description: ::String,
                                     ?dry_run: bool,
@@ -1241,7 +1243,7 @@ module Aws
                                    rules_source_list: {
                                      targets: Array[::String],
                                      target_types: Array[("TLS_SNI" | "HTTP_HOST")],
-                                     generated_rules_type: ("ALLOWLIST" | "DENYLIST")
+                                     generated_rules_type: ("ALLOWLIST" | "DENYLIST" | "REJECTLIST" | "ALERTLIST")
                                    }?,
                                    stateful_rules: Array[
                                      {

data/sig/types.rbs

@@ -557,6 +557,7 @@ module Aws::NetworkFirewall
       attr_accessor stateful_engine_options: Types::StatefulEngineOptions
       attr_accessor tls_inspection_configuration_arn: ::String
       attr_accessor policy_variables: Types::PolicyVariables
+      attr_accessor enable_tls_session_holding: bool
       SENSITIVE: []
     end
 
@@ -1008,7 +1009,7 @@ module Aws::NetworkFirewall
     class RulesSourceList
       attr_accessor targets: ::Array[::String]
       attr_accessor target_types: ::Array[("TLS_SNI" | "HTTP_HOST")]
-      attr_accessor generated_rules_type: ("ALLOWLIST" | "DENYLIST")
+      attr_accessor generated_rules_type: ("ALLOWLIST" | "DENYLIST" | "REJECTLIST" | "ALERTLIST")
       SENSITIVE: []
     end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-networkfirewall
 version: !ruby/object:Gem::Version
-  version: 1.75.0
+  version: 1.77.0
 platform: ruby
 authors:
 - Amazon Web Services