@propulsionworks/cloudformation 0.0.2 → 0.1.0

package/out/exports/resources.generated/aws-networkfirewall-rulegroup.d.ts

@@ -0,0 +1,496 @@
+import type { ResourceDefinitionWithAttributes, Tag } from "../main.ts";
+export type NetworkFirewallRuleGroup = ResourceDefinitionWithAttributes<"AWS::NetworkFirewall::RuleGroup", NetworkFirewallRuleGroupProps, NetworkFirewallRuleGroupAttribs>;
+/**
+ * Use the `RuleGroup` to define a reusable collection of stateless or stateful network traffic filtering rules. You use rule groups in an `FirewallPolicy` to specify the filtering behavior of an `Firewall` .
+ */
+export type NetworkFirewallRuleGroupProps = {
+    /**
+     * The maximum operating resources that this rule group can use. You can't change a rule group's capacity setting after you create the rule group. When you update a rule group, you are limited to this capacity. When you reference a rule group from a firewall policy, Network Firewall reserves this capacity for the rule group.
+     */
+    Capacity: number;
+    /**
+     * A description of the rule group.
+     * @minLength 1
+     * @maxLength 512
+     * @pattern ^.*$
+     */
+    Description?: string | undefined;
+    /**
+     * An object that defines the rule group rules.
+     */
+    RuleGroup?: RuleGroup | undefined;
+    /**
+     * The descriptive name of the rule group. You can't change the name of a rule group after you create it.
+     * @minLength 1
+     * @maxLength 128
+     * @pattern ^[a-zA-Z0-9-]+$
+     */
+    RuleGroupName: string;
+    /**
+     * An array of key-value pairs to apply to this resource.
+     *
+     * For more information, see [Tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) .
+     */
+    Tags?: Tag[] | undefined;
+    /**
+     * Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains
+     * stateless rules. If it is stateful, it contains stateful rules.
+     */
+    Type: "STATELESS" | "STATEFUL";
+};
+export type NetworkFirewallRuleGroupAttribs = {
+    /**
+     * The Amazon Resource Name (ARN) of the `RuleGroup` .
+     */
+    RuleGroupArn: string;
+    /**
+     * The unique ID of the `RuleGroup` resource.
+     * @minLength 36
+     * @maxLength 36
+     * @pattern ^([0-9a-f]{8})-([0-9a-f]{4}-){3}([0-9a-f]{12})$
+     */
+    RuleGroupId: string;
+};
+/**
+ * A custom action to use in stateless rule actions settings.
+ */
+export type ActionDefinition = {
+    /**
+     * Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.
+     *
+     * You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.
+     */
+    PublishMetricAction?: PublishMetricAction | undefined;
+};
+/**
+ * A single IP address specification. This is used in the `RuleGroup.MatchAttributes` source and destination specifications.
+ */
+export type Address = {
+    /**
+     * Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.
+     *
+     * Examples:
+     *
+     * - To configure Network Firewall to inspect for the IP address 192.0.2.44, specify `192.0.2.44/32` .
+     * - To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify `192.0.2.0/24` .
+     * - To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify `1111:0000:0000:0000:0000:0000:0000:0111/128` .
+     * - To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify `1111:0000:0000:0000:0000:0000:0000:0000/64` .
+     *
+     * For more information about CIDR notation, see the Wikipedia entry [Classless Inter-Domain Routing](https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) .
+     * @minLength 1
+     * @maxLength 255
+     * @pattern ^([a-fA-F\d:\.]+/\d{1,3})$
+     */
+    AddressDefinition: string;
+};
+/**
+ * An optional, non-standard action to use for stateless packet handling. You can define this in addition to the standard action that you must specify.
+ *
+ * You define and name the custom actions that you want to be able to use, and then you reference them by name in your actions settings.
+ *
+ * You can use custom actions in the following places:
+ *
+ * - In an `RuleGroup.StatelessRulesAndCustomActions` . The custom actions are available for use by name inside the `StatelessRulesAndCustomActions` where you define them. You can use them for your stateless rule actions to specify what to do with a packet that matches the rule's match attributes.
+ * - In an `FirewallPolicy` specification, in `StatelessCustomActions` . The custom actions are available for use inside the policy where you define them. You can use them for the policy's default stateless actions settings to specify what to do with packets that don't match any of the policy's stateless rules.
+ */
+export type CustomAction = {
+    /**
+     * The custom action associated with the action name.
+     */
+    ActionDefinition: ActionDefinition;
+    /**
+     * The descriptive name of the custom action. You can't change the name of a custom action after you create it.
+     * @minLength 1
+     * @maxLength 128
+     * @pattern ^[a-zA-Z0-9]+$
+     */
+    ActionName: string;
+};
+/**
+ * The value to use in an Amazon CloudWatch custom metric dimension. This is used in the `PublishMetrics` custom action. A CloudWatch custom metric dimension is a name/value pair that's part of the identity of a metric.
+ *
+ * AWS Network Firewall sets the dimension name to `CustomAction` and you provide the dimension value.
+ *
+ * For more information about CloudWatch custom metric dimensions, see [Publishing Custom Metrics](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/publishingMetrics.html#usingDimensions) in the [Amazon CloudWatch User Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html) .
+ */
+export type Dimension = {
+    /**
+     * The value to use in the custom metric dimension.
+     * @minLength 1
+     * @maxLength 128
+     * @pattern ^[a-zA-Z0-9-_ ]+$
+     */
+    Value: string;
+};
+export type GeneratedRulesType = "ALLOWLIST" | "DENYLIST";
+/**
+ * The 5-tuple criteria for AWS Network Firewall to use to inspect packet headers in stateful traffic flow inspection. Traffic flows that match the criteria are a match for the corresponding stateful rule.
+ */
+export type Header = {
+    /**
+     * The destination IP address or address range to inspect for, in CIDR notation. To match with any address, specify `ANY` .
+     *
+     * Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.
+     *
+     * Examples:
+     *
+     * - To configure Network Firewall to inspect for the IP address 192.0.2.44, specify `192.0.2.44/32` .
+     * - To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify `192.0.2.0/24` .
+     * - To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify `1111:0000:0000:0000:0000:0000:0000:0111/128` .
+     * - To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify `1111:0000:0000:0000:0000:0000:0000:0000/64` .
+     *
+     * For more information about CIDR notation, see the Wikipedia entry [Classless Inter-Domain Routing](https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) .
+     * @minLength 1
+     * @maxLength 1024
+     * @pattern ^.*$
+     */
+    Destination: string;
+    /**
+     * The destination port to inspect for. You can specify an individual port, for example `1994` and you can specify a port range, for example `1990:1994` . To match with any port, specify `ANY` .
+     */
+    DestinationPort: string;
+    /**
+     * The direction of traffic flow to inspect. If set to `ANY` , the inspection matches bidirectional traffic, both from the source to the destination and from the destination to the source. If set to `FORWARD` , the inspection only matches traffic going from the source to the destination.
+     */
+    Direction: "FORWARD" | "ANY";
+    /**
+     * The protocol to inspect for. To specify all, you can use `IP` , because all traffic on AWS and on the internet is IP.
+     */
+    Protocol: "IP" | "TCP" | "UDP" | "ICMP" | "HTTP" | "FTP" | "TLS" | "SMB" | "DNS" | "DCERPC" | "SSH" | "SMTP" | "IMAP" | "MSN" | "KRB5" | "IKEV2" | "TFTP" | "NTP" | "DHCP";
+    /**
+     * The source IP address or address range to inspect for, in CIDR notation. To match with any address, specify `ANY` .
+     *
+     * Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.
+     *
+     * Examples:
+     *
+     * - To configure Network Firewall to inspect for the IP address 192.0.2.44, specify `192.0.2.44/32` .
+     * - To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify `192.0.2.0/24` .
+     * - To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify `1111:0000:0000:0000:0000:0000:0000:0111/128` .
+     * - To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify `1111:0000:0000:0000:0000:0000:0000:0000/64` .
+     *
+     * For more information about CIDR notation, see the Wikipedia entry [Classless Inter-Domain Routing](https://docs.aws.amazon.com/https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) .
+     * @minLength 1
+     * @maxLength 1024
+     * @pattern ^.*$
+     */
+    Source: string;
+    /**
+     * The source port to inspect for. You can specify an individual port, for example `1994` and you can specify a port range, for example `1990:1994` . To match with any port, specify `ANY` .
+     */
+    SourcePort: string;
+};
+/**
+ * A list of IP addresses and address ranges, in CIDR notation. This is part of a `RuleGroup.RuleVariables` .
+ */
+export type IPSet = {
+    /**
+     * The list of IP addresses and address ranges, in CIDR notation.
+     */
+    Definition?: string[] | undefined;
+};
+/**
+ * Configures one or more `IPSetReferences` for a Suricata-compatible rule group. An IP set reference is a rule variable that references a resource that you create and manage in another AWS service, such as an Amazon VPC prefix list. Network Firewall IP set references enable you to dynamically update the contents of your rules. When you create, update, or delete the IP set you are referencing in your rule, Network Firewall automatically updates the rule's content with the changes. For more information about IP set references in Network Firewall , see [Using IP set references](https://docs.aws.amazon.com/network-firewall/latest/developerguide/rule-groups-ip-set-references.html) in the *Network Firewall Developer Guide* .
+ */
+export type IPSetReference = {
+    /**
+     * The Amazon Resource Name (ARN) of the resource to include in the `RuleGroup.IPSetReference` .
+     */
+    ReferenceArn?: string | undefined;
+};
+/**
+ * Criteria for Network Firewall to use to inspect an individual packet in stateless rule inspection. Each match attributes set can include one or more items such as IP address, CIDR range, port number, protocol, and TCP flags.
+ */
+export type MatchAttributes = {
+    /**
+     * The destination port to inspect for. You can specify an individual port, for example `1994` and you can specify a port range, for example `1990:1994` . To match with any port, specify `ANY` .
+     *
+     * This setting is only used for protocols 6 (TCP) and 17 (UDP).
+     */
+    DestinationPorts?: PortRange[] | undefined;
+    /**
+     * The destination IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any destination address.
+     */
+    Destinations?: Address[] | undefined;
+    /**
+     * The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol.
+     */
+    Protocols?: number[] | undefined;
+    /**
+     * The source port to inspect for. You can specify an individual port, for example `1994` and you can specify a port range, for example `1990:1994` . To match with any port, specify `ANY` .
+     *
+     * If not specified, this matches with any source port.
+     *
+     * This setting is only used for protocols 6 (TCP) and 17 (UDP).
+     */
+    SourcePorts?: PortRange[] | undefined;
+    /**
+     * The source IP addresses and address ranges to inspect for, in CIDR notation. If not specified, this matches with any source address.
+     */
+    Sources?: Address[] | undefined;
+    /**
+     * The TCP flags and masks to inspect for. If not specified, this matches with any settings. This setting is only used for protocol 6 (TCP).
+     */
+    TCPFlags?: TCPFlagField[] | undefined;
+};
+/**
+ * A single port range specification. This is used for source and destination port ranges in the stateless `RuleGroup.MatchAttributes` .
+ */
+export type PortRange = {
+    /**
+     * The lower limit of the port range. This must be less than or equal to the `ToPort` specification.
+     */
+    FromPort: number;
+    /**
+     * The upper limit of the port range. This must be greater than or equal to the `FromPort` specification.
+     */
+    ToPort: number;
+};
+/**
+ * A set of port ranges for use in the rules in a rule group.
+ */
+export type PortSet = {
+    /**
+     * The set of port ranges.
+     */
+    Definition?: string[] | undefined;
+};
+/**
+ * Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.
+ */
+export type PublishMetricAction = {
+    Dimensions: Dimension[];
+};
+/**
+ * Configures the `ReferenceSets` for a stateful rule group. For more information, see the [Using IP set references in Suricata compatible rule groups](https://docs.aws.amazon.com/network-firewall/latest/developerguide/rule-groups-ip-set-references.html) in the *Network Firewall User Guide* .
+ */
+export type ReferenceSets = {
+    /**
+     * The IP set references to use in the stateful rule group.
+     */
+    IPSetReferences?: Record<string, IPSetReference> | undefined;
+};
+/**
+ * The inspection criteria and action for a single stateless rule. AWS Network Firewall inspects each packet for the specified matching criteria. When a packet matches the criteria, Network Firewall performs the rule's actions on the packet.
+ */
+export type RuleDefinition = {
+    /**
+     * The actions to take on a packet that matches one of the stateless rule definition's match attributes. You must specify a standard action and you can add custom actions.
+     *
+     * > Network Firewall only forwards a packet for stateful rule inspection if you specify `aws:forward_to_sfe` for a rule that the packet matches, or if the packet doesn't match any stateless rule and you specify `aws:forward_to_sfe` for the `StatelessDefaultActions` setting for the `FirewallPolicy` .
+     *
+     * For every rule, you must specify exactly one of the following standard actions.
+     *
+     * - *aws:pass* - Discontinues all inspection of the packet and permits it to go to its intended destination.
+     * - *aws:drop* - Discontinues all inspection of the packet and blocks it from going to its intended destination.
+     * - *aws:forward_to_sfe* - Discontinues stateless inspection of the packet and forwards it to the stateful rule engine for inspection.
+     *
+     * Additionally, you can specify a custom action. To do this, you define a custom action by name and type, then provide the name you've assigned to the action in this `Actions` setting.
+     *
+     * To provide more than one action in this setting, separate the settings with a comma. For example, if you have a publish metrics custom action that you've named `MyMetricsAction` , then you could specify the standard action `aws:pass` combined with the custom action using `[“aws:pass”, “MyMetricsAction”]` .
+     */
+    Actions: string[];
+    /**
+     * Criteria for Network Firewall to use to inspect an individual packet in stateless rule inspection. Each match attributes set can include one or more items such as IP address, CIDR range, port number, protocol, and TCP flags.
+     */
+    MatchAttributes: MatchAttributes;
+};
+/**
+ * The object that defines the rules in a rule group.
+ *
+ * AWS Network Firewall uses a rule group to inspect and control network traffic. You define stateless rule groups to inspect individual packets and you define stateful rule groups to inspect packets in the context of their traffic flow.
+ *
+ * To use a rule group, you include it by reference in an Network Firewall firewall policy, then you use the policy in a firewall. You can reference a rule group from more than one firewall policy, and you can use a firewall policy in more than one firewall.
+ */
+export type RuleGroup = {
+    /**
+     * The reference sets for the stateful rule group.
+     */
+    ReferenceSets?: ReferenceSets | undefined;
+    /**
+     * Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
+     */
+    RuleVariables?: RuleVariables | undefined;
+    /**
+     * The stateful rules or stateless rules for the rule group.
+     */
+    RulesSource: RulesSource;
+    /**
+     * Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these settings. Some limitations apply; for more information, see [Strict evaluation order](https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-limitations-caveats.html) in the *AWS Network Firewall Developer Guide* .
+     */
+    StatefulRuleOptions?: StatefulRuleOptions | undefined;
+};
+/**
+ * Additional settings for a stateful rule.
+ */
+export type RuleOption = {
+    /**
+     * The Suricata rule option keywords. For Network Firewall , the keyword signature ID (sid) is required in the format `sid:112233` . The sid must be unique within the rule group. For information about Suricata rule option keywords, see [Rule options](https://docs.aws.amazon.com/https://suricata.readthedocs.io/en/suricata-6.0.9/rules/intro.html#rule-options) .
+     * @minLength 1
+     * @maxLength 128
+     * @pattern ^.*$
+     */
+    Keyword: string;
+    /**
+     * The Suricata rule option settings. Settings have zero or more values, and the number of possible settings and required settings depends on the keyword. The format for Settings is `number` . For information about Suricata rule option settings, see [Rule options](https://docs.aws.amazon.com/https://suricata.readthedocs.io/en/suricata-6.0.9/rules/intro.html#rule-options) .
+     */
+    Settings?: string[] | undefined;
+};
+export type RuleOrder = "DEFAULT_ACTION_ORDER" | "STRICT_ORDER";
+/**
+ * Settings that are available for use in the rules in the `RuleGroup` where this is defined.
+ */
+export type RuleVariables = {
+    /**
+     * A list of IP addresses and address ranges, in CIDR notation.
+     */
+    IPSets?: Record<string, IPSet> | undefined;
+    /**
+     * A list of port ranges.
+     */
+    PortSets?: Record<string, PortSet> | undefined;
+};
+/**
+ * The stateless or stateful rules definitions for use in a single rule group. Each rule group requires a single `RulesSource` . You can use an instance of this for either stateless rules or stateful rules.
+ */
+export type RulesSource = {
+    /**
+     * Stateful inspection criteria for a domain list rule group.
+     */
+    RulesSourceList?: RulesSourceList | undefined;
+    /**
+     * Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.
+     *
+     * These rules contain the inspection criteria and the action to take for traffic that matches the criteria, so this type of rule group doesn't have a separate action setting.
+     *
+     * > You can't use the `priority` keyword if the `RuleOrder` option in `StatefulRuleOptions` is set to `STRICT_ORDER` .
+     */
+    RulesString?: string | undefined;
+    /**
+     * An array of individual stateful rules inspection criteria to be used together in a stateful rule group. Use this option to specify simple Suricata rules with protocol, source and destination, ports, direction, and rule options. For information about the Suricata `Rules` format, see [Rules Format](https://docs.aws.amazon.com/https://suricata.readthedocs.io/en/suricata-7.0.3/rules/intro.html) .
+     */
+    StatefulRules?: StatefulRule[] | undefined;
+    /**
+     * Stateless inspection criteria to be used in a stateless rule group.
+     */
+    StatelessRulesAndCustomActions?: StatelessRulesAndCustomActions | undefined;
+};
+/**
+ * Stateful inspection criteria for a domain list rule group.
+ *
+ * For HTTPS traffic, domain filtering is SNI-based. It uses the server name indicator extension of the TLS handshake.
+ *
+ * By default, Network Firewall domain list inspection only includes traffic coming from the VPC where you deploy the firewall. To inspect traffic from IP addresses outside of the deployment VPC, you set the `HOME_NET` rule variable to include the CIDR range of the deployment VPC plus the other CIDR ranges. For more information, see `RuleGroup.RuleVariables` in this guide and [Stateful domain list rule groups in AWS Network Firewall](https://docs.aws.amazon.com/network-firewall/latest/developerguide/stateful-rule-groups-domain-names.html) in the *Network Firewall Developer Guide*
+ */
+export type RulesSourceList = {
+    /**
+     * Whether you want to allow or deny access to the domains in your target list.
+     */
+    GeneratedRulesType: GeneratedRulesType;
+    /**
+     * The types of targets to inspect for. Valid values are `TLS_SNI` and `HTTP_HOST` .
+     */
+    TargetTypes: TargetType[];
+    /**
+     * The domains that you want to inspect for in your traffic flows. Valid domain specifications are the following:
+     *
+     * - Explicit names. For example, `abc.example.com` matches only the domain `abc.example.com` .
+     * - Names that use a domain wildcard, which you indicate with an initial ' `.` '. For example, `.example.com` matches `example.com` and matches all subdomains of `example.com` , such as `abc.example.com` and `www.example.com` .
+     */
+    Targets: string[];
+};
+/**
+ * A single Suricata rules specification, for use in a stateful rule group. Use this option to specify a simple Suricata rule with protocol, source and destination, ports, direction, and rule options. For information about the Suricata `Rules` format, see [Rules Format](https://docs.aws.amazon.com/https://suricata.readthedocs.io/en/suricata-7.0.3/rules/intro.html) .
+ */
+export type StatefulRule = {
+    /**
+     * Defines what Network Firewall should do with the packets in a traffic flow when the flow matches the stateful rule criteria. For all actions, Network Firewall performs the specified action and discontinues stateful inspection of the traffic flow.
+     *
+     * The actions for a stateful rule are defined as follows:
+     *
+     * - *PASS* - Permits the packets to go to the intended destination.
+     * - *DROP* - Blocks the packets from going to the intended destination and sends an alert log message, if alert logging is configured in the `Firewall` `LoggingConfiguration` .
+     * - *REJECT* - Drops traffic that matches the conditions of the stateful rule and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a `RST` bit contained in the TCP header flags. `REJECT` is available only for TCP traffic.
+     * - *ALERT* - Permits the packets to go to the intended destination and sends an alert log message, if alert logging is configured in the `Firewall` `LoggingConfiguration` .
+     *
+     * You can use this action to test a rule that you intend to use to drop traffic. You can enable the rule with `ALERT` action, verify in the logs that the rule is filtering as you want, then change the action to `DROP` .
+     * - *REJECT* - Drops TCP traffic that matches the conditions of the stateful rule, and sends a TCP reset packet back to sender of the packet. A TCP reset packet is a packet with no payload and a `RST` bit contained in the TCP header flags. Also sends an alert log mesage if alert logging is configured in the `Firewall` `LoggingConfiguration` .
+     *
+     * `REJECT` isn't currently available for use with IMAP and FTP protocols.
+     */
+    Action: "PASS" | "DROP" | "ALERT" | "REJECT";
+    /**
+     * The stateful inspection criteria for this rule, used to inspect traffic flows.
+     */
+    Header: Header;
+    /**
+     * Additional settings for a stateful rule, provided as keywords and settings.
+     */
+    RuleOptions: RuleOption[];
+};
+/**
+ * Additional options governing how Network Firewall handles the rule group. You can only use these for stateful rule groups.
+ */
+export type StatefulRuleOptions = {
+    /**
+     * Indicates how to manage the order of the rule evaluation for the rule group. `DEFAULT_ACTION_ORDER` is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see [Evaluation order for stateful rules](https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-rule-evaluation-order.html) in the *AWS Network Firewall Developer Guide* .
+     */
+    RuleOrder?: RuleOrder | undefined;
+};
+/**
+ * A single stateless rule. This is used in `RuleGroup.StatelessRulesAndCustomActions` .
+ */
+export type StatelessRule = {
+    /**
+     * Indicates the order in which to run this rule relative to all of the rules that are defined for a stateless rule group. Network Firewall evaluates the rules in a rule group starting with the lowest priority setting. You must ensure that the priority settings are unique for the rule group.
+     *
+     * Each stateless rule group uses exactly one `StatelessRulesAndCustomActions` object, and each `StatelessRulesAndCustomActions` contains exactly one `StatelessRules` object. To ensure unique priority settings for your rule groups, set unique priorities for the stateless rules that you define inside any single `StatelessRules` object.
+     *
+     * You can change the priority settings of your rules at any time. To make it easier to insert rules later, number them so there's a wide range in between, for example use 100, 200, and so on.
+     * @min 1
+     * @max 65535
+     */
+    Priority: number;
+    /**
+     * Defines the stateless 5-tuple packet inspection criteria and the action to take on a packet that matches the criteria.
+     */
+    RuleDefinition: RuleDefinition;
+};
+/**
+ * Stateless inspection criteria. Each stateless rule group uses exactly one of these data types to define its stateless rules.
+ */
+export type StatelessRulesAndCustomActions = {
+    /**
+     * Defines an array of individual custom action definitions that are available for use by the stateless rules in this `StatelessRulesAndCustomActions` specification. You name each custom action that you define, and then you can use it by name in your stateless rule `RuleGroup.RuleDefinition` `Actions` specification.
+     */
+    CustomActions?: CustomAction[] | undefined;
+    /**
+     * Defines the set of stateless rules for use in a stateless rule group.
+     */
+    StatelessRules: StatelessRule[];
+};
+export type TCPFlag = "FIN" | "SYN" | "RST" | "PSH" | "ACK" | "URG" | "ECE" | "CWR";
+/**
+ * TCP flags and masks to inspect packets for. This is used in the `RuleGroup.MatchAttributes` specification.
+ *
+ * For example:
+ *
+ * `"TCPFlags": [ { "Flags": [ "ECE", "SYN" ], "Masks": [ "SYN", "ECE" ] } ]`
+ */
+export type TCPFlagField = {
+    /**
+     * Used in conjunction with the `Masks` setting to define the flags that must be set and flags that must not be set in order for the packet to match. This setting can only specify values that are also specified in the `Masks` setting.
+     *
+     * For the flags that are specified in the masks setting, the following must be true for the packet to match:
+     *
+     * - The ones that are set in this flags setting must be set in the packet.
+     * - The ones that are not set in this flags setting must also not be set in the packet.
+     */
+    Flags: TCPFlag[];
+    /**
+     * The set of flags to consider in the inspection. To inspect all flags in the valid values list, leave this with no setting.
+     */
+    Masks?: TCPFlag[] | undefined;
+};
+export type TargetType = "TLS_SNI" | "HTTP_HOST";
+//# sourceMappingURL=aws-networkfirewall-rulegroup.d.ts.map