@aws-sdk/client-fms 3.127.0 → 3.131.0

package/CHANGELOG.md

@@ -3,6 +3,38 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+# [3.131.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.130.0...v3.131.0) (2022-07-15)
+
+**Note:** Version bump only for package @aws-sdk/client-fms
+
+
+
+
+
+# [3.130.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.129.0...v3.130.0) (2022-07-14)
+
+
+### Bug Fixes
+
+* **codegen:** fix error code parsing when it's a number ([#3371](https://github.com/aws/aws-sdk-js-v3/issues/3371)) ([c2d8522](https://github.com/aws/aws-sdk-js-v3/commit/c2d852279a3d23958521a6ceb4f4c642b0cb1848))
+
+
+### Features
+
+* **client-fms:** Adds support for strict ordering in stateful rule groups in Network Firewall policies. ([b6f9a9f](https://github.com/aws/aws-sdk-js-v3/commit/b6f9a9f9e59ce61790e5832dd60e43fe0b622c67))
+
+
+
+
+
+# [3.128.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.127.0...v3.128.0) (2022-07-12)
+
+**Note:** Version bump only for package @aws-sdk/client-fms
+
+
+
+
+
 # [3.127.0](https://github.com/aws/aws-sdk-js-v3/compare/v3.126.0...v3.127.0) (2022-07-11)
 
 **Note:** Version bump only for package @aws-sdk/client-fms

package/dist-cjs/models/models_0.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GetProtectionStatusResponse = exports.GetProtectionStatusRequest = exports.InvalidTypeException = exports.GetPolicyResponse = exports.Policy = exports.SecurityServicePolicyData = exports.SecurityServiceType = exports.PolicyOption = exports.ThirdPartyFirewallPolicy = exports.NetworkFirewallPolicy = exports.FirewallDeploymentModel = exports.ResourceTag = exports.CustomerPolicyScopeIdType = exports.GetPolicyRequest = exports.GetNotificationChannelResponse = exports.GetNotificationChannelRequest = exports.GetComplianceDetailResponse = exports.PolicyComplianceDetail = exports.ComplianceViolator = exports.ViolationReason = exports.DependentServiceName = exports.GetComplianceDetailRequest = exports.GetAppsListResponse = exports.GetAppsListRequest = exports.GetAdminAccountResponse = exports.GetAdminAccountRequest = exports.DisassociateThirdPartyFirewallResponse = exports.DisassociateThirdPartyFirewallRequest = exports.DisassociateAdminAccountRequest = exports.DeleteProtocolsListRequest = exports.DeletePolicyRequest = exports.DeleteNotificationChannelRequest = exports.DeleteAppsListRequest = exports.AwsEc2InstanceViolation = exports.AwsEc2NetworkInterfaceViolation = exports.AssociateThirdPartyFirewallResponse = exports.ThirdPartyFirewallAssociationStatus = exports.AssociateThirdPartyFirewallRequest = exports.ThirdPartyFirewall = exports.ResourceNotFoundException = exports.LimitExceededException = exports.InvalidOperationException = exports.InvalidInputException = exports.InternalErrorException = exports.AssociateAdminAccountRequest = exports.AppsListDataSummary = exports.AppsListData = exports.App = exports.ActionTarget = exports.AccountRoleStatus = void 0;
-exports.ThirdPartyFirewallMissingFirewallViolation = exports.ThirdPartyFirewallMissingExpectedRouteTableViolation = exports.RouteHasOutOfScopeEndpointViolation = exports.PossibleRemediationActions = exports.PossibleRemediationAction = exports.RemediationActionWithOrder = exports.RemediationAction = exports.FMSPolicyUpdateFirewallCreationConfigAction = exports.EC2ReplaceRouteTableAssociationAction = exports.EC2ReplaceRouteAction = exports.EC2DeleteRouteAction = exports.EC2CreateRouteTableAction = exports.EC2CreateRouteAction = exports.EC2CopyRouteTableAction = exports.EC2AssociateRouteTableAction = exports.NetworkFirewallUnexpectedGatewayRoutesViolation = exports.NetworkFirewallUnexpectedFirewallRoutesViolation = exports.NetworkFirewallPolicyModifiedViolation = exports.NetworkFirewallPolicyDescription = exports.StatelessRuleGroup = exports.StatefulRuleGroup = exports.NetworkFirewallMissingSubnetViolation = exports.NetworkFirewallMissingFirewallViolation = exports.NetworkFirewallMissingExpectedRTViolation = exports.NetworkFirewallMissingExpectedRoutesViolation = exports.NetworkFirewallInvalidRouteConfigurationViolation = exports.NetworkFirewallInternetTrafficNotInspectedViolation = exports.ExpectedRoute = exports.NetworkFirewallBlackHoleRouteDetectedViolation = exports.Route = exports.TargetType = exports.DestinationType = exports.FirewallSubnetMissingVPCEndpointViolation = exports.FirewallSubnetIsOutOfScopeViolation = exports.DnsRuleGroupPriorityConflictViolation = exports.DnsRuleGroupLimitExceededViolation = exports.DnsDuplicateRuleGroupViolation = exports.AwsVPCSecurityGroupViolation = exports.SecurityGroupRemediationAction = exports.SecurityGroupRuleDescription = exports.RemediationActionType = exports.PartialMatch = exports.Tag = exports.GetViolationDetailsRequest = exports.GetThirdPartyFirewallAssociationStatusResponse = exports.MarketplaceSubscriptionOnboardingStatus = exports.GetThirdPartyFirewallAssociationStatusRequest = exports.GetProtocolsListResponse = exports.ProtocolsListData = exports.GetProtocolsListRequest = void 0;
-exports.UntagResourceResponse = exports.UntagResourceRequest = exports.TagResourceResponse = exports.TagResourceRequest = exports.PutProtocolsListResponse = exports.PutProtocolsListRequest = exports.PutPolicyResponse = exports.PutPolicyRequest = exports.PutNotificationChannelRequest = exports.PutAppsListResponse = exports.PutAppsListRequest = exports.ListThirdPartyFirewallFirewallPoliciesResponse = exports.ThirdPartyFirewallFirewallPolicy = exports.ListThirdPartyFirewallFirewallPoliciesRequest = exports.ListTagsForResourceResponse = exports.ListTagsForResourceRequest = exports.ListProtocolsListsResponse = exports.ProtocolsListDataSummary = exports.ListProtocolsListsRequest = exports.ListPoliciesResponse = exports.PolicySummary = exports.ListPoliciesRequest = exports.ListMemberAccountsResponse = exports.ListMemberAccountsRequest = exports.ListComplianceStatusResponse = exports.PolicyComplianceStatus = exports.EvaluationResult = exports.PolicyComplianceStatusType = exports.ListComplianceStatusRequest = exports.ListAppsListsResponse = exports.ListAppsListsRequest = exports.GetViolationDetailsResponse = exports.ViolationDetail = exports.ResourceViolation = exports.ThirdPartyFirewallMissingSubnetViolation = void 0;
+exports.RouteHasOutOfScopeEndpointViolation = exports.PossibleRemediationActions = exports.PossibleRemediationAction = exports.RemediationActionWithOrder = exports.RemediationAction = exports.FMSPolicyUpdateFirewallCreationConfigAction = exports.EC2ReplaceRouteTableAssociationAction = exports.EC2ReplaceRouteAction = exports.EC2DeleteRouteAction = exports.EC2CreateRouteTableAction = exports.EC2CreateRouteAction = exports.EC2CopyRouteTableAction = exports.EC2AssociateRouteTableAction = exports.NetworkFirewallUnexpectedGatewayRoutesViolation = exports.NetworkFirewallUnexpectedFirewallRoutesViolation = exports.NetworkFirewallPolicyModifiedViolation = exports.NetworkFirewallPolicyDescription = exports.StatelessRuleGroup = exports.StatefulRuleGroup = exports.StatefulEngineOptions = exports.RuleOrder = exports.NetworkFirewallMissingSubnetViolation = exports.NetworkFirewallMissingFirewallViolation = exports.NetworkFirewallMissingExpectedRTViolation = exports.NetworkFirewallMissingExpectedRoutesViolation = exports.NetworkFirewallInvalidRouteConfigurationViolation = exports.NetworkFirewallInternetTrafficNotInspectedViolation = exports.ExpectedRoute = exports.NetworkFirewallBlackHoleRouteDetectedViolation = exports.Route = exports.TargetType = exports.DestinationType = exports.FirewallSubnetMissingVPCEndpointViolation = exports.FirewallSubnetIsOutOfScopeViolation = exports.DnsRuleGroupPriorityConflictViolation = exports.DnsRuleGroupLimitExceededViolation = exports.DnsDuplicateRuleGroupViolation = exports.AwsVPCSecurityGroupViolation = exports.SecurityGroupRemediationAction = exports.SecurityGroupRuleDescription = exports.RemediationActionType = exports.PartialMatch = exports.Tag = exports.GetViolationDetailsRequest = exports.GetThirdPartyFirewallAssociationStatusResponse = exports.MarketplaceSubscriptionOnboardingStatus = exports.GetThirdPartyFirewallAssociationStatusRequest = exports.GetProtocolsListResponse = exports.ProtocolsListData = exports.GetProtocolsListRequest = void 0;
+exports.UntagResourceResponse = exports.UntagResourceRequest = exports.TagResourceResponse = exports.TagResourceRequest = exports.PutProtocolsListResponse = exports.PutProtocolsListRequest = exports.PutPolicyResponse = exports.PutPolicyRequest = exports.PutNotificationChannelRequest = exports.PutAppsListResponse = exports.PutAppsListRequest = exports.ListThirdPartyFirewallFirewallPoliciesResponse = exports.ThirdPartyFirewallFirewallPolicy = exports.ListThirdPartyFirewallFirewallPoliciesRequest = exports.ListTagsForResourceResponse = exports.ListTagsForResourceRequest = exports.ListProtocolsListsResponse = exports.ProtocolsListDataSummary = exports.ListProtocolsListsRequest = exports.ListPoliciesResponse = exports.PolicySummary = exports.ListPoliciesRequest = exports.ListMemberAccountsResponse = exports.ListMemberAccountsRequest = exports.ListComplianceStatusResponse = exports.PolicyComplianceStatus = exports.EvaluationResult = exports.PolicyComplianceStatusType = exports.ListComplianceStatusRequest = exports.ListAppsListsResponse = exports.ListAppsListsRequest = exports.GetViolationDetailsResponse = exports.ViolationDetail = exports.ResourceViolation = exports.ThirdPartyFirewallMissingSubnetViolation = exports.ThirdPartyFirewallMissingFirewallViolation = exports.ThirdPartyFirewallMissingExpectedRouteTableViolation = void 0;
 const FMSServiceException_1 = require("./FMSServiceException");
 var AccountRoleStatus;
 (function (AccountRoleStatus) {
@@ -564,6 +564,17 @@ var NetworkFirewallMissingSubnetViolation;
         ...obj,
     });
 })(NetworkFirewallMissingSubnetViolation = exports.NetworkFirewallMissingSubnetViolation || (exports.NetworkFirewallMissingSubnetViolation = {}));
+var RuleOrder;
+(function (RuleOrder) {
+    RuleOrder["DEFAULT_ACTION_ORDER"] = "DEFAULT_ACTION_ORDER";
+    RuleOrder["STRICT_ORDER"] = "STRICT_ORDER";
+})(RuleOrder = exports.RuleOrder || (exports.RuleOrder = {}));
+var StatefulEngineOptions;
+(function (StatefulEngineOptions) {
+    StatefulEngineOptions.filterSensitiveLog = (obj) => ({
+        ...obj,
+    });
+})(StatefulEngineOptions = exports.StatefulEngineOptions || (exports.StatefulEngineOptions = {}));
 var StatefulRuleGroup;
 (function (StatefulRuleGroup) {
     StatefulRuleGroup.filterSensitiveLog = (obj) => ({

package/dist-cjs/protocols/Aws_json1_1.js

@@ -2661,6 +2661,12 @@ const deserializeAws_json1_1NetworkFirewallPolicy = (output, context) => {
 };
 const deserializeAws_json1_1NetworkFirewallPolicyDescription = (output, context) => {
     return {
+        StatefulDefaultActions: output.StatefulDefaultActions != null
+            ? deserializeAws_json1_1NetworkFirewallActionList(output.StatefulDefaultActions, context)
+            : undefined,
+        StatefulEngineOptions: output.StatefulEngineOptions != null
+            ? deserializeAws_json1_1StatefulEngineOptions(output.StatefulEngineOptions, context)
+            : undefined,
         StatefulRuleGroups: output.StatefulRuleGroups != null
             ? deserializeAws_json1_1StatefulRuleGroupList(output.StatefulRuleGroups, context)
             : undefined,
@@ -3178,8 +3184,14 @@ const deserializeAws_json1_1SecurityServicePolicyData = (output, context) => {
         Type: (0, smithy_client_1.expectString)(output.Type),
     };
 };
+const deserializeAws_json1_1StatefulEngineOptions = (output, context) => {
+    return {
+        RuleOrder: (0, smithy_client_1.expectString)(output.RuleOrder),
+    };
+};
 const deserializeAws_json1_1StatefulRuleGroup = (output, context) => {
     return {
+        Priority: (0, smithy_client_1.expectInt32)(output.Priority),
         ResourceId: (0, smithy_client_1.expectString)(output.ResourceId),
         RuleGroupName: (0, smithy_client_1.expectString)(output.RuleGroupName),
     };
@@ -3351,6 +3363,9 @@ const loadRestJsonErrorCode = (output, data) => {
     const findKey = (object, key) => Object.keys(object).find((k) => k.toLowerCase() === key.toLowerCase());
     const sanitizeErrorCode = (rawValue) => {
         let cleanValue = rawValue;
+        if (typeof cleanValue === "number") {
+            cleanValue = cleanValue.toString();
+        }
         if (cleanValue.indexOf(":") >= 0) {
             cleanValue = cleanValue.split(":")[0];
         }

package/dist-es/models/models_0.js

@@ -432,6 +432,15 @@ export var NetworkFirewallMissingSubnetViolation;
 (function (NetworkFirewallMissingSubnetViolation) {
     NetworkFirewallMissingSubnetViolation.filterSensitiveLog = function (obj) { return (__assign({}, obj)); };
 })(NetworkFirewallMissingSubnetViolation || (NetworkFirewallMissingSubnetViolation = {}));
+export var RuleOrder;
+(function (RuleOrder) {
+    RuleOrder["DEFAULT_ACTION_ORDER"] = "DEFAULT_ACTION_ORDER";
+    RuleOrder["STRICT_ORDER"] = "STRICT_ORDER";
+})(RuleOrder || (RuleOrder = {}));
+export var StatefulEngineOptions;
+(function (StatefulEngineOptions) {
+    StatefulEngineOptions.filterSensitiveLog = function (obj) { return (__assign({}, obj)); };
+})(StatefulEngineOptions || (StatefulEngineOptions = {}));
 export var StatefulRuleGroup;
 (function (StatefulRuleGroup) {
     StatefulRuleGroup.filterSensitiveLog = function (obj) { return (__assign({}, obj)); };

package/dist-es/protocols/Aws_json1_1.js

@@ -3074,6 +3074,12 @@ var deserializeAws_json1_1NetworkFirewallPolicy = function (output, context) {
 };
 var deserializeAws_json1_1NetworkFirewallPolicyDescription = function (output, context) {
     return {
+        StatefulDefaultActions: output.StatefulDefaultActions != null
+            ? deserializeAws_json1_1NetworkFirewallActionList(output.StatefulDefaultActions, context)
+            : undefined,
+        StatefulEngineOptions: output.StatefulEngineOptions != null
+            ? deserializeAws_json1_1StatefulEngineOptions(output.StatefulEngineOptions, context)
+            : undefined,
         StatefulRuleGroups: output.StatefulRuleGroups != null
             ? deserializeAws_json1_1StatefulRuleGroupList(output.StatefulRuleGroups, context)
             : undefined,
@@ -3589,8 +3595,14 @@ var deserializeAws_json1_1SecurityServicePolicyData = function (output, context)
         Type: __expectString(output.Type),
     };
 };
+var deserializeAws_json1_1StatefulEngineOptions = function (output, context) {
+    return {
+        RuleOrder: __expectString(output.RuleOrder),
+    };
+};
 var deserializeAws_json1_1StatefulRuleGroup = function (output, context) {
     return {
+        Priority: __expectInt32(output.Priority),
         ResourceId: __expectString(output.ResourceId),
         RuleGroupName: __expectString(output.RuleGroupName),
     };
@@ -3774,6 +3786,9 @@ var loadRestJsonErrorCode = function (output, data) {
     var findKey = function (object, key) { return Object.keys(object).find(function (k) { return k.toLowerCase() === key.toLowerCase(); }); };
     var sanitizeErrorCode = function (rawValue) {
         var cleanValue = rawValue;
+        if (typeof cleanValue === "number") {
+            cleanValue = cleanValue.toString();
+        }
         if (cleanValue.indexOf(":") >= 0) {
             cleanValue = cleanValue.split(":")[0];
         }

package/dist-types/models/models_0.d.ts

@@ -693,11 +693,11 @@ export declare namespace NetworkFirewallPolicy {
     const filterSensitiveLog: (obj: NetworkFirewallPolicy) => any;
 }
 /**
- * <p>Configures the policy for the third-party firewall.</p>
+ * <p>Configures the deployment model for the third-party firewall.</p>
  */
 export interface ThirdPartyFirewallPolicy {
     /**
-     * <p>Defines the deployment model to use for the third-party firewall.</p>
+     * <p>Defines the deployment model to use for the third-party firewall policy.</p>
      */
     FirewallDeploymentModel?: FirewallDeploymentModel | string;
 }
@@ -708,8 +708,7 @@ export declare namespace ThirdPartyFirewallPolicy {
     const filterSensitiveLog: (obj: ThirdPartyFirewallPolicy) => any;
 }
 /**
- * <p>Contains the Network Firewall firewall policy options to configure a centralized deployment
- *          model.</p>
+ * <p>Contains the Network Firewall firewall policy options to configure the policy's deployment model and third-party firewall policy settings.</p>
  */
 export interface PolicyOption {
     /**
@@ -761,144 +760,93 @@ export interface SecurityServicePolicyData {
      *                </p>
      *                <note>
      *                   <p>Valid values for <code>preProcessRuleGroups</code> are between 1 and 99. Valid
-     *                 values for <code>postProcessRuleGroups</code> are between 9901 and 10000.</p>
+     *                  values for <code>postProcessRuleGroups</code> are between 9901 and 10000.</p>
      *                </note>
      *             </li>
      *             <li>
-     *                <p>Example: <code>DNS_FIREWALL</code>
-     *                </p>
+     *                <p>Example: <code>NETWORK_FIREWALL</code> - Centralized deployment
+     *              model</p>
      *                <p>
-     *                   <code>"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"</code>
+     *                   <code>"{\"type\":\"NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}},\"firewallDeploymentModel\":{\"centralizedFirewallDeploymentModel\":{\"centralizedFirewallOrchestrationConfig\":{\"inspectionVpcIds\":[{\"resourceId\":\"vpc-1234\",\"accountId\":\"123456789011\"}],\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneId\":null,\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"allowedIPV4CidrList\":[]}}}}"</code>
      *                </p>
-     *                <note>
-     *                   <p>Valid values for <code>preProcessRuleGroups</code> are between 1 and 99. Valid
-     *                  values for <code>postProcessRuleGroups</code> are between 9901 and 10000.</p>
-     *                </note>
+     *                <p> To use the centralized deployment model, you must set <a href="https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PolicyOption.html">PolicyOption</a> to
+     *                 <code>CENTRALIZED</code>. </p>
      *             </li>
      *             <li>
      *                <p>Example: <code>NETWORK_FIREWALL</code> - Distributed deployment model with
-     *               automatic Availability Zone configuration. With automatic Availbility Zone
-     *               configuration, Firewall Manager chooses which Availability Zones to create the endpoints in. </p>
+     *               automatic Availability Zone configuration</p>
      *                <p>
-     *                   <code>"{ \"type\": \"NETWORK_FIREWALL\",
-     *                  \"networkFirewallStatelessRuleGroupReferences\": [ { \"resourceARN\":
-     *                  \"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",
-     *                  \"priority\": 1 } ], \"networkFirewallStatelessDefaultActions\": [
-     *                  \"aws:forward_to_sfe\", \"customActionName\" ],
-     *                  \"networkFirewallStatelessFragmentDefaultActions\": [ \"aws:forward_to_sfe\",
-     *                  \"customActionName\" ], \"networkFirewallStatelessCustomActions\": [ {
-     *                  \"actionName\": \"customActionName\", \"actionDefinition\": {
-     *                  \"publishMetricAction\": { \"dimensions\": [ { \"value\": \"metricdimensionvalue\"
-     *                  } ] } } } ], \"networkFirewallStatefulRuleGroupReferences\": [ { \"resourceARN\":
-     *                  \"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\" } ],
-     *                  \"networkFirewallOrchestrationConfig\": { \"singleFirewallEndpointPerVPC\": false,
-     *                  \"allowedIPV4CidrList\": [ \"10.0.0.0/28\", \"192.168.0.0/28\" ],
-     *                  \"routeManagementAction\": \"OFF\" }, \"networkFirewallLoggingConfiguration\": {
-     *                  \"logDestinationConfigs\": [ { \"logDestinationType\": \"S3\", \"logType\":
-     *                  \"ALERT\", \"logDestination\": { \"bucketName\": \"s3-bucket-name\" } }, {
-     *                  \"logDestinationType\": \"S3\", \"logType\": \"FLOW\", \"logDestination\": {
-     *                  \"bucketName\": \"s3-bucket-name\" } } ], \"overrideExistingConfig\": true }
-     *                  }"</code>
+     *                   <code>
+     *                 "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":[\"10.0.0.0/28\",\"192.168.0.0/28\"],\"routeManagementAction\":\"OFF\"},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}}"
+     *               </code>
      *                </p>
-     *                <p> To use the distributed deployment model, you must set <a href="https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PolicyOption.html">PolicyOption</a> to
+     *                <p> With automatic Availbility Zone configuration, Firewall Manager chooses which Availability Zones to create the endpoints in. To use the distributed deployment model, you must set <a href="https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PolicyOption.html">PolicyOption</a> to
      *                  <code>NULL</code>. </p>
      *             </li>
      *             <li>
      *                <p>Example: <code>NETWORK_FIREWALL</code> - Distributed deployment model with
-     *               automatic Availability Zone configuration, and route management. </p>
+     *               automatic Availability Zone configuration and route management</p>
      *                <p>
-     *                   <code>"{ \"type\": \"NETWORK_FIREWALL\",
-     *                  \"networkFirewallStatelessRuleGroupReferences\": [ { \"resourceARN\":
-     *                  \"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",
-     *                  \"priority\": 1 } ], \"networkFirewallStatelessDefaultActions\": [
-     *                  \"aws:forward_to_sfe\", \"customActionName\" ],
-     *                  \"networkFirewallStatelessFragmentDefaultActions\": [ \"aws:forward_to_sfe\",
-     *                  \"customActionName\" ], \"networkFirewallStatelessCustomActions\": [ {
-     *                  \"actionName\": \"customActionName\", \"actionDefinition\": {
-     *                  \"publishMetricAction\": { \"dimensions\": [ { \"value\": \"metricdimensionvalue\"
-     *                  } ] } } } ], \"networkFirewallStatefulRuleGroupReferences\": [ { \"resourceARN\":
-     *                  \"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\" } ],
-     *                  \"networkFirewallOrchestrationConfig\": { \"singleFirewallEndpointPerVPC\": false,
-     *                  \"allowedIPV4CidrList\": [ \"10.0.0.0/28\", \"192.168.0.0/28\" ],
-     *                  \"routeManagementAction\": \"MONITOR\", \"routeManagementTargetTypes\": [
-     *                  \"InternetGateway\" ] }, \"networkFirewallLoggingConfiguration\": {
-     *                  \"logDestinationConfigs\": [ { \"logDestinationType\": \"S3\", \"logType\":
-     *                  \"ALERT\", \"logDestination\": { \"bucketName\": \"s3-bucket-name\" } }, {
-     *                  \"logDestinationType\": \"S3\", \"logType\": \"FLOW\", \"logDestination\": {
-     *                  \"bucketName\": \"s3-bucket-name\" } } ], \"overrideExistingConfig\": true }
-     *                  }"</code>
+     *                   <code>
+     *                 "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":[\"10.0.0.0/28\",\"192.168.0.0/28\"],\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"]},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\": \"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}}"
+     *               </code>
      *                </p>
+     *                <p>To use the distributed deployment model, you must set <a href="https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PolicyOption.html">PolicyOption</a> to
+     *                  <code>NULL</code>. </p>
      *             </li>
      *             <li>
      *                <p>Example: <code>NETWORK_FIREWALL</code> - Distributed deployment model with
-     *               custom Availability Zone configuration. With custom Availability Zone configuration,
-     *               you define which specific Availability Zones to create endpoints in by configuring
-     *                  <code>firewallCreationConfig</code>. </p>
+     *               custom Availability Zone configuration</p>
      *                <p>
-     *                   <code>"{
-     *                  \"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],
-     *                  \"networkFirewallStatelessDefaultActions\":[ \"aws:forward_to_sfe\",
-     *                  \"customActionName\" ], \"networkFirewallStatelessFragmentDefaultActions\":[
-     *                  \"aws:forward_to_sfe\", \"fragmentcustomactionname\" ],
-     *                  \"networkFirewallStatelessCustomActions\":[ { \"actionName\":\"customActionName\",
-     *                  \"actionDefinition\":{ \"publishMetricAction\":{ \"dimensions\":[ {
-     *                  \"value\":\"metricdimensionvalue\" } ] } } }, {
-     *                  \"actionName\":\"fragmentcustomactionname\", \"actionDefinition\":{
-     *                  \"publishMetricAction\":{ \"dimensions\":[ {
-     *                  \"value\":\"fragmentmetricdimensionvalue\" } ] } } } ],
-     *                  \"networkFirewallStatefulRuleGroupReferences\":[ {
-     *                  \"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"
-     *                  } ], \"networkFirewallOrchestrationConfig\":{ \"firewallCreationConfig\":{
-     *                  \"endpointLocation\":{ \"availabilityZoneConfigList\":[ {
-     *                  \"availabilityZoneId\":null, \"availabilityZoneName\":\"us-east-1a\",
-     *                  \"allowedIPV4CidrList\":[ \"10.0.0.0/28\" ] }, { ¯\"availabilityZoneId\":null,
-     *                  \"availabilityZoneName\":\"us-east-1b\", \"allowedIPV4CidrList\":[ \"10.0.0.0/28\"
-     *                  ] } ] } }, \"singleFirewallEndpointPerVPC\":false, \"allowedIPV4CidrList\":null,
-     *                  \"routeManagementAction\":\"OFF\", \"networkFirewallLoggingConfiguration\":{
-     *                  \"logDestinationConfigs\":[ { \"logDestinationType\":\"S3\",
-     *                  \"logType\":\"ALERT\", \"logDestination\":{ \"bucketName\":\"s3-bucket-name\" } },
-     *                  { \"logDestinationType\":\"S3\", \"logType\":\"FLOW\", \"logDestination\":{
-     *                  \"bucketName\":\"s3-bucket-name\" } } ], \"overrideExistingConfig\":boolean }
-     *                  }"</code>
+     *                   <code>"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"
+     *               </code>
      *                </p>
+     *                <p>
+     *              With custom Availability Zone configuration,
+     *              you define which specific Availability Zones to create endpoints in by configuring
+     *                 <code>firewallCreationConfig</code>. To configure the Availability Zones in <code>firewallCreationConfig</code>, specify either the <code>availabilityZoneName</code> or <code>availabilityZoneId</code> parameter, not both parameters.
+     *            </p>
+     *                <p>To use the distributed deployment model, you must set <a href="https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PolicyOption.html">PolicyOption</a> to
+     *                  <code>NULL</code>. </p>
      *             </li>
      *             <li>
      *                <p>Example: <code>NETWORK_FIREWALL</code> - Distributed deployment model with
-     *               custom Availability Zone configuration, and route management. </p>
+     *               custom Availability Zone configuration and route management</p>
      *                <p>
-     *                   <code>"{
-     *                  \"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],
-     *                  \"networkFirewallStatelessDefaultActions\":[ \"aws:forward_to_sfe\",
-     *                  \"customActionName\" ], \"networkFirewallStatelessFragmentDefaultActions\":[
-     *                  \"aws:forward_to_sfe\", \"fragmentcustomactionname\" ],
-     *                  \"networkFirewallStatelessCustomActions\":[ { \"actionName\":\"customActionName\",
-     *                  \"actionDefinition\":{ \"publishMetricAction\":{ \"dimensions\":[ {
-     *                  \"value\":\"metricdimensionvalue\" } ] } } }, {
-     *                  \"actionName\":\"fragmentcustomactionname\", \"actionDefinition\":{
-     *                  \"publishMetricAction\":{ \"dimensions\":[ {
-     *                  \"value\":\"fragmentmetricdimensionvalue\" } ] } } } ],
-     *                  \"networkFirewallStatefulRuleGroupReferences\":[ {
-     *                  \"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"
-     *                  } ], \"networkFirewallOrchestrationConfig\":{ \"firewallCreationConfig\":{
-     *                  \"endpointLocation\":{ \"availabilityZoneConfigList\":[ {
-     *                  \"availabilityZoneId\":null, \"availabilityZoneName\":\"us-east-1a\",
-     *                  \"allowedIPV4CidrList\":[ \"10.0.0.0/28\" ] }, { ¯\"availabilityZoneId\":null,
-     *                  \"availabilityZoneName\":\"us-east-1b\", \"allowedIPV4CidrList\":[ \"10.0.0.0/28\"
-     *                  ] } ] } }, \"singleFirewallEndpointPerVPC\":false, \"allowedIPV4CidrList\":null,
-     *                  \"routeManagementAction\":\"MONITOR\", \"routeManagementTargetTypes\":[
-     *                  \"InternetGateway\" ], \"routeManagementConfig\":{
-     *                  \"allowCrossAZTrafficIfNoEndpoint\":true } },
-     *                  \"networkFirewallLoggingConfiguration\":{ \"logDestinationConfigs\":[ {
-     *                  \"logDestinationType\":\"S3\", \"logType\":\"ALERT\", \"logDestination\":{
-     *                  \"bucketName\":\"s3-bucket-name\" } }, { \"logDestinationType\":\"S3\",
-     *                  \"logType\":\"FLOW\", \"logDestination\":{ \"bucketName\":\"s3-bucket-name\" } }
-     *                  ], \"overrideExistingConfig\":boolean } }"</code>
+     *                   <code>"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"
+     *               </code>
      *                </p>
+     *                <p>To use the distributed deployment model, you must set <a href="https://docs.aws.amazon.com/fms/2018-01-01/APIReference/API_PolicyOption.html">PolicyOption</a> to
+     *                  <code>NULL</code>. </p>
      *             </li>
      *             <li>
-     *                <p>Example: <code>PARTNER_FIREWALL</code> for Firewall Manager</p>
+     *                <p>Example: <code>THIRD_PARTY_FIREWALL</code>
+     *                </p>
      *                <p>
-     *                   <code>"{\"type\":\"THIRD_PARTY_FIREWALL\",\"thirdPartyrFirewall\":\"PALO_ALTO_NETWORKS_CLOUD_NGFW\",\"thirdPartyFirewallConfig\":{\"thirdPartyFirewallPolicyList\":[\"global-123456789012-1\"],\"networkFirewallLoggingConfiguration\":null},\"firewallDeploymentModel\":{\"distributedFirewallDeploymentModel\":{\"distributedFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneId\":null,\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.1.0/28\"]}]}},\"allowedIPV4CidrList\":null},\"distributedRouteManagementConfig\":null},\"centralizedFirewallDeploymentModel\":null}}""</code>
+     *                   <code>"{
+     *               "type":"THIRD_PARTY_FIREWALL",
+     *               "thirdPartyFirewall":"PALO_ALTO_NETWORKS_CLOUD_NGFW",
+     *               "thirdPartyFirewallConfig":{
+     *                 "thirdPartyFirewallPolicyList":["global-1"]
+     *               },
+     * 	          "firewallDeploymentModel":{
+     *                 "distributedFirewallDeploymentModel":{
+     *                   "distributedFirewallOrchestrationConfig":{
+     *                     "firewallCreationConfig":{
+     *                       "endpointLocation":{
+     *                         "availabilityZoneConfigList":[
+     *                           {
+     *                             "availabilityZoneName":"${AvailabilityZone}"
+     *                           }
+     *                         ]
+     *                       }
+     *                     },
+     *                     "allowedIPV4CidrList":[
+     *                     ]
+     *                   }
+     *                 }
+     *               }
+     *             }"</code>
      *                </p>
      *             </li>
      *             <li>
@@ -963,6 +911,19 @@ export interface SecurityServicePolicyData {
      *                </p>
      *             </li>
      *             <li>
+     *                <p>Example: <code>SECURITY_GROUPS_COMMON</code> - Security group tag distribution
+     *            </p>
+     *                <p>
+     *                   <code>""{\"type\":\"SECURITY_GROUPS_COMMON\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"revertManualSecurityGroupChanges\":true,\"exclusiveResourceSecurityGroupManagement\":false,\"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":false,\"enableTagDistribution\":true}""</code>
+     *                </p>
+     *                <p>
+     *              Firewall Manager automatically distributes tags from the primary group to the security groups created by this policy. To use security group tag distribution, you must also set <code>revertManualSecurityGroupChanges</code> to <code>true</code>, otherwise Firewall Manager won't be able to create the policy. When you enable <code>revertManualSecurityGroupChanges</code>, Firewall Manager identifies and reports when the security groups created by this policy become non-compliant.
+     *            </p>
+     *                <p>
+     *              Firewall Manager won't distrubute system tags added by Amazon Web Services services into the replica security groups. System tags begin with the <code>aws:</code> prefix.
+     *            </p>
+     *             </li>
+     *             <li>
      *                <p>Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as
      *               well as to those in VPCs that the account owns </p>
      *                <p>
@@ -1363,11 +1324,11 @@ export interface GetThirdPartyFirewallAssociationStatusResponse {
      */
     ThirdPartyFirewallStatus?: ThirdPartyFirewallAssociationStatus | string;
     /**
-     * <p>The status for subscribing to the third-party firewall vendor in the AWS Marketplace.</p>
+     * <p>The status for subscribing to the third-party firewall vendor in the Amazon Web Services Marketplace.</p>
      *         <ul>
      *             <li>
      *               <p>
-     *                   <code>NO_SUBSCRIPTION</code> - The Firewall Manager policy administrator isn't subscribed to the third-party firewall service in the AWS Marketplace.</p>
+     *                   <code>NO_SUBSCRIPTION</code> - The Firewall Manager policy administrator isn't subscribed to the third-party firewall service in the Amazon Web Services Marketplace.</p>
      *            </li>
      *             <li>
      *               <p>
@@ -2048,6 +2009,28 @@ export declare namespace NetworkFirewallMissingSubnetViolation {
      */
     const filterSensitiveLog: (obj: NetworkFirewallMissingSubnetViolation) => any;
 }
+export declare enum RuleOrder {
+    DEFAULT_ACTION_ORDER = "DEFAULT_ACTION_ORDER",
+    STRICT_ORDER = "STRICT_ORDER"
+}
+/**
+ * <p>Configuration settings for the handling of the stateful rule groups in a Network Firewall firewall policy.</p>
+ */
+export interface StatefulEngineOptions {
+    /**
+     * <p>Indicates how to manage the order of stateful rule evaluation for the policy.
+     * <code>DEFAULT_ACTION_ORDER</code> is the default behavior. Stateful rules are provided to the rule engine
+     * as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more
+     * information, see <a href="https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-rule-evaluation-order.html">Evaluation order for stateful rules</a> in the <i>Network Firewall Developer Guide</i>.</p>
+     */
+    RuleOrder?: RuleOrder | string;
+}
+export declare namespace StatefulEngineOptions {
+    /**
+     * @internal
+     */
+    const filterSensitiveLog: (obj: StatefulEngineOptions) => any;
+}
 /**
  * <p>Network Firewall stateful rule group, used in a <a>NetworkFirewallPolicyDescription</a>. </p>
  */
@@ -2060,6 +2043,20 @@ export interface StatefulRuleGroup {
      * <p>The resource ID of the rule group.</p>
      */
     ResourceId?: string;
+    /**
+     * <p>An integer setting that indicates the order in which to run the stateful rule groups in a single
+     * Network Firewall firewall policy. This setting only applies to firewall policies that specify the <code>STRICT_ORDER</code>
+     * rule order in the stateful engine options settings.</p>
+     *          <p>
+     *   Network Firewall evalutes each stateful rule group against a packet starting with the group that has
+     * the lowest priority setting. You must ensure that the priority settings are unique within each policy. For information about
+     * </p>
+     *          <p>
+     *   You can change the priority settings of your rule groups at any time. To make it easier to insert rule
+     * groups later, number them so there's a wide range in between, for example use 100, 200, and so on.
+     * </p>
+     */
+    Priority?: number;
 }
 export declare namespace StatefulRuleGroup {
     /**
@@ -2114,6 +2111,34 @@ export interface NetworkFirewallPolicyDescription {
      * <p>The stateful rule groups that are used in the Network Firewall firewall policy. </p>
      */
     StatefulRuleGroups?: StatefulRuleGroup[];
+    /**
+     * <p>The default actions to take on a packet that doesn't match any stateful rules. The stateful default
+     * action is optional, and is only valid when using the strict rule order.</p>
+     *          <p>
+     *   Valid values of the stateful default action:
+     * </p>
+     *          <ul>
+     *             <li>
+     *                <p>aws:drop_strict</p>
+     *             </li>
+     *             <li>
+     *                <p>aws:drop_established</p>
+     *             </li>
+     *             <li>
+     *                <p>aws:alert_strict</p>
+     *             </li>
+     *             <li>
+     *                <p>aws:alert_established</p>
+     *             </li>
+     *          </ul>
+     */
+    StatefulDefaultActions?: string[];
+    /**
+     * <p>Additional options governing how Network Firewall handles stateful rules. The stateful rule groups
+     * that you use in your policy must have stateful rule options settings that are compatible with these
+     * settings.</p>
+     */
+    StatefulEngineOptions?: StatefulEngineOptions;
 }
 export declare namespace NetworkFirewallPolicyDescription {
     /**
@@ -3272,7 +3297,7 @@ export declare namespace ListThirdPartyFirewallFirewallPoliciesRequest {
     const filterSensitiveLog: (obj: ListThirdPartyFirewallFirewallPoliciesRequest) => any;
 }
 /**
- * <p>Configures the firewall policy deployment model for a third-party firewall. The deployment model can either be distributed or centralized.</p>
+ * <p>Configures the third-party firewall's firewall policy.</p>
  */
 export interface ThirdPartyFirewallFirewallPolicy {
     /**

package/dist-types/ts3.4/models/models_0.d.ts

@@ -948,12 +948,27 @@ export declare namespace NetworkFirewallMissingSubnetViolation {
     
     const filterSensitiveLog: (obj: NetworkFirewallMissingSubnetViolation) => any;
 }
+export declare enum RuleOrder {
+    DEFAULT_ACTION_ORDER = "DEFAULT_ACTION_ORDER",
+    STRICT_ORDER = "STRICT_ORDER"
+}
+
+export interface StatefulEngineOptions {
+    
+    RuleOrder?: RuleOrder | string;
+}
+export declare namespace StatefulEngineOptions {
+    
+    const filterSensitiveLog: (obj: StatefulEngineOptions) => any;
+}
 
 export interface StatefulRuleGroup {
     
     RuleGroupName?: string;
     
     ResourceId?: string;
+    
+    Priority?: number;
 }
 export declare namespace StatefulRuleGroup {
     
@@ -984,6 +999,10 @@ export interface NetworkFirewallPolicyDescription {
     StatelessCustomActions?: string[];
     
     StatefulRuleGroups?: StatefulRuleGroup[];
+    
+    StatefulDefaultActions?: string[];
+    
+    StatefulEngineOptions?: StatefulEngineOptions;
 }
 export declare namespace NetworkFirewallPolicyDescription {
     

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aws-sdk/client-fms",
   "description": "AWS SDK for JavaScript Fms Client for Node.js, Browser and React Native",
-  "version": "3.127.0",
+  "version": "3.131.0",
   "scripts": {
     "build": "concurrently 'yarn:build:cjs' 'yarn:build:es' 'yarn:build:types'",
     "build:cjs": "tsc -p tsconfig.cjs.json",
@@ -18,10 +18,10 @@
   "dependencies": {
     "@aws-crypto/sha256-browser": "2.0.0",
     "@aws-crypto/sha256-js": "2.0.0",
-    "@aws-sdk/client-sts": "3.127.0",
-    "@aws-sdk/config-resolver": "3.127.0",
-    "@aws-sdk/credential-provider-node": "3.127.0",
-    "@aws-sdk/fetch-http-handler": "3.127.0",
+    "@aws-sdk/client-sts": "3.131.0",
+    "@aws-sdk/config-resolver": "3.130.0",
+    "@aws-sdk/credential-provider-node": "3.131.0",
+    "@aws-sdk/fetch-http-handler": "3.131.0",
     "@aws-sdk/hash-node": "3.127.0",
     "@aws-sdk/invalid-dependency": "3.127.0",
     "@aws-sdk/middleware-content-length": "3.127.0",
@@ -30,7 +30,7 @@
     "@aws-sdk/middleware-recursion-detection": "3.127.0",
     "@aws-sdk/middleware-retry": "3.127.0",
     "@aws-sdk/middleware-serde": "3.127.0",
-    "@aws-sdk/middleware-signing": "3.127.0",
+    "@aws-sdk/middleware-signing": "3.130.0",
     "@aws-sdk/middleware-stack": "3.127.0",
     "@aws-sdk/middleware-user-agent": "3.127.0",
     "@aws-sdk/node-config-provider": "3.127.0",
@@ -44,7 +44,7 @@
     "@aws-sdk/util-body-length-browser": "3.55.0",
     "@aws-sdk/util-body-length-node": "3.55.0",
     "@aws-sdk/util-defaults-mode-browser": "3.127.0",
-    "@aws-sdk/util-defaults-mode-node": "3.127.0",
+    "@aws-sdk/util-defaults-mode-node": "3.130.0",
     "@aws-sdk/util-user-agent-browser": "3.127.0",
     "@aws-sdk/util-user-agent-node": "3.127.0",
     "@aws-sdk/util-utf8-browser": "3.109.0",