NetworkFirewall / Client / describe_firewall_policy

describe_firewall_policy¶

NetworkFirewall.Client.describe_firewall_policy(**kwargs)¶

Returns the data objects for the specified firewall policy.

Request Syntax

response = client.describe_firewall_policy(
    FirewallPolicyName='string',
    FirewallPolicyArn='string'
)

Parameters:

FirewallPolicyName (string) –
The descriptive name of the firewall policy. You can’t change the name of a firewall policy after you create it.

You must specify the ARN or the name, and you can specify both.
FirewallPolicyArn (string) –
The Amazon Resource Name (ARN) of the firewall policy.

You must specify the ARN or the name, and you can specify both.

Return type:

dict

Returns:

Response Syntax

{
    'UpdateToken': 'string',
    'FirewallPolicyResponse': {
        'FirewallPolicyName': 'string',
        'FirewallPolicyArn': 'string',
        'FirewallPolicyId': 'string',
        'Description': 'string',
        'FirewallPolicyStatus': 'ACTIVE'|'DELETING'|'ERROR'|'UPDATING',
        'StatusMessage': 'string',
        'Tags': [
            {
                'Key': 'string',
                'Value': 'string'
            },
        ],
        'ConsumedStatelessRuleCapacity': 123,
        'ConsumedStatefulRuleCapacity': 123,
        'ConsumedStatefulDomainCapacity': 123,
        'NumberOfAssociations': 123,
        'EncryptionConfiguration': {
            'KeyId': 'string',
            'Type': 'CUSTOMER_KMS'|'AWS_OWNED_KMS_KEY'
        },
        'Errors': [
            {
                'Code': 'DNS_FIREWALL_RULE_GROUP_UNAVAILABLE'|'ROUTE53_RESOLVED_IP_VALIDATION_MISSING',
                'Message': 'string',
                'ResourceId': 'string'
            },
        ],
        'LastModifiedTime': datetime(2015, 1, 1)
    },
    'FirewallPolicy': {
        'StatelessRuleGroupReferences': [
            {
                'ResourceArn': 'string',
                'Priority': 123
            },
        ],
        'StatelessDefaultActions': [
            'string',
        ],
        'StatelessFragmentDefaultActions': [
            'string',
        ],
        'StatelessCustomActions': [
            {
                'ActionName': 'string',
                'ActionDefinition': {
                    'PublishMetricAction': {
                        'Dimensions': [
                            {
                                'Value': 'string'
                            },
                        ]
                    }
                }
            },
        ],
        'StatefulRuleGroupReferences': [
            {
                'ResourceArn': 'string',
                'Priority': 123,
                'Override': {
                    'Action': 'DROP_TO_ALERT'
                },
                'DeepThreatInspection': True|False
            },
        ],
        'StatefulDefaultActions': [
            'string',
        ],
        'StatefulEngineOptions': {
            'RuleOrder': 'DEFAULT_ACTION_ORDER'|'STRICT_ORDER',
            'StreamExceptionPolicy': 'DROP'|'CONTINUE'|'REJECT',
            'FlowTimeouts': {
                'TcpIdleTimeoutSeconds': 123
            }
        },
        'TLSInspectionConfigurationArn': 'string',
        'PolicyVariables': {
            'RuleVariables': {
                'string': {
                    'Definition': [
                        'string',
                    ]
                }
            }
        },
        'EnableTLSSessionHolding': True|False,
        'Route53ResolvedIPValidation': {
            'Action': 'REJECT'|'DROP'|'ALERT',
            'DNSFirewallRuleGroupId': 'string',
            'DNSExpiryExceptionPolicy': 'REJECT'|'DROP'|'CONTINUE',
            'BypassDestinationValidationIPRanges': [
                {
                    'AddressDefinition': 'string'
                },
            ],
            'SourceIPRanges': [
                {
                    'AddressDefinition': 'string'
                },
            ]
        }
    }
}

Response Structure

(dict) –
- UpdateToken (string) –
  
  A token used for optimistic locking. Network Firewall returns a token to your requests that access the firewall policy. The token marks the state of the policy resource at the time of the request.
  
  To make changes to the policy, you provide the token in your request. Network Firewall uses the token to ensure that the policy hasn’t changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the firewall policy again to get a current copy of it with current token. Reapply your changes as needed, then try the operation again using the new token.
- FirewallPolicyResponse (dict) –
  
  The high-level properties of a firewall policy. This, along with the FirewallPolicy, define the policy. You can retrieve all objects for a firewall policy by calling DescribeFirewallPolicy.
  - FirewallPolicyName (string) –
    
    The descriptive name of the firewall policy. You can’t change the name of a firewall policy after you create it.
  - FirewallPolicyArn (string) –
    
    The Amazon Resource Name (ARN) of the firewall policy.
    
    Note
    If this response is for a create request that had DryRun set to TRUE, then this ARN is a placeholder that isn’t attached to a valid resource.
  - FirewallPolicyId (string) –
    
    The unique identifier for the firewall policy.
  - Description (string) –
    
    A description of the firewall policy.
  - FirewallPolicyStatus (string) –
    
    The current status of the firewall policy. You can retrieve this for a firewall policy by calling DescribeFirewallPolicy and providing the firewall policy’s name or ARN.
  - StatusMessage (string) –
    
    Additional detail about the firewall policy’s current status, when applicable. For example, while an Amazon Route 53 Resolver DNS Firewall rule group change is in progress, the status is UPDATING and this message is “A DNS Firewall rule group change is in progress.”
  - Tags (list) –
    
    The key:value pairs to associate with the resource.
    - (dict) –
      
      A key:value pair associated with an Amazon Web Services resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as “environment”) and the tag value represents a specific value within that category (such as “test,” “development,” or “production”). You can add up to 50 tags to each Amazon Web Services resource.
      - Key (string) –
        
        The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as “customer.” Tag keys are case-sensitive.
      - Value (string) –
        
        The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as “companyA” or “companyB.” Tag values are case-sensitive.
  - ConsumedStatelessRuleCapacity (integer) –
    
    The number of capacity units currently consumed by the policy’s stateless rules.
  - ConsumedStatefulRuleCapacity (integer) –
    
    The number of capacity units currently consumed by the policy’s stateful rules.
  - ConsumedStatefulDomainCapacity (integer) –
    
    The total number of domain name specifications across all domain list rule groups in the firewall policy that use the stateful-domain-rulegroup resource type.
  - NumberOfAssociations (integer) –
    
    The number of firewalls that are associated with this firewall policy.
  - EncryptionConfiguration (dict) –
    
    A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall policy.
    - KeyId (string) –
      
      The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you’re using a key that’s managed by another account. If you’re using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide.
    - Type (string) –
      
      The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.
  - Errors (list) –
    
    Any configuration errors that apply to the firewall policy. Network Firewall detects these errors asynchronously, after you create or update the policy, so an error can appear after the request that caused it has already succeeded. Each entry describes the problem and how to resolve it, and Network Firewall clears it automatically after you resolve the problem.
    - (dict) –
      
      A configuration error that Network Firewall detected for a firewall policy.
      - Code (string) –
        
        The error code identifies the type of error. Valid values are the following:
        
        DNS_FIREWALL_RULE_GROUP_UNAVAILABLE – The Amazon Route 53 Resolver DNS Firewall rule group that resolved IP validation references is unavailable, for example, because it was deleted or is no longer accessible from your account. Update the rule group ID or remove the resolved IP validation configuration.
        
        ROUTE53_RESOLVED_IP_VALIDATION_MISSING – An associated stateful rule group uses the aws_route_53_resolved_domain keyword, but the policy doesn’t have resolved IP validation configured. The affected rules are inactive until you add resolved IP validation to the policy or remove the keyword rules.
      - Message (string) –
        
        A description of the error and how to resolve it.
      - ResourceId (string) –
        
        The ID of the resource that the error relates to, when applicable. For example, for DNS_FIREWALL_RULE_GROUP_UNAVAILABLE this is the Amazon Route 53 Resolver DNS Firewall rule group ID.
  - LastModifiedTime (datetime) –
    
    The last time that the firewall policy was changed.
- FirewallPolicy (dict) –
  
  The policy for the specified firewall policy.
  - StatelessRuleGroupReferences (list) –
    
    References to the stateless rule groups that are used in the policy. These define the matching criteria in stateless rules.
    - (dict) –
      
      Identifier for a single stateless rule group, used in a firewall policy to refer to the rule group.
      - ResourceArn (string) –
        
        The Amazon Resource Name (ARN) of the stateless rule group.
      - Priority (integer) –
        
        An integer setting that indicates the order in which to run the stateless rule groups in a single FirewallPolicy. Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy.
  - StatelessDefaultActions (list) –
    
    The actions to take on a packet if it doesn’t match any of the stateless rules in the policy. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    
    You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice.
    
    For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.
    - (string) –
  - StatelessFragmentDefaultActions (list) –
    
    The actions to take on a fragmented UDP packet if it doesn’t match any of the stateless rules in the policy. Network Firewall only manages UDP packet fragments and silently drops packet fragments for other protocols. If you want non-matching fragmented UDP packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    
    You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice.
    
    For example, you could specify ["aws:pass"] or you could specify ["aws:pass", “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.
    - (string) –
  - StatelessCustomActions (list) –
    
    The custom action definitions that are available for use in the firewall policy’s StatelessDefaultActions setting. You name each custom action that you define, and then you can use it by name in your default actions specifications.
    - (dict) –
      
      An optional, non-standard action to use for stateless packet handling. You can define this in addition to the standard action that you must specify.
      
      You define and name the custom actions that you want to be able to use, and then you reference them by name in your actions settings.
      
      You can use custom actions in the following places:
      - In a rule group’s StatelessRulesAndCustomActions specification. The custom actions are available for use by name inside the StatelessRulesAndCustomActions where you define them. You can use them for your stateless rule actions to specify what to do with a packet that matches the rule’s match attributes.
      - In a FirewallPolicy specification, in StatelessCustomActions. The custom actions are available for use inside the policy where you define them. You can use them for the policy’s default stateless actions settings to specify what to do with packets that don’t match any of the policy’s stateless rules.
      - ActionName (string) –
        
        The descriptive name of the custom action. You can’t change the name of a custom action after you create it.
      - ActionDefinition (dict) –
        
        The custom action associated with the action name.
        
        PublishMetricAction (dict) –
        
        Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published.
        
        You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.
        
        Dimensions (list) –
        
        (dict) –
        
        The value to use in an Amazon CloudWatch custom metric dimension. This is used in the PublishMetrics CustomAction. A CloudWatch custom metric dimension is a name/value pair that’s part of the identity of a metric.
        
        Network Firewall sets the dimension name to CustomAction and you provide the dimension value.
        
        For more information about CloudWatch custom metric dimensions, see Publishing Custom Metrics in the Amazon CloudWatch User Guide.
        
        Value (string) –
        
        The value to use in the custom metric dimension.
  - StatefulRuleGroupReferences (list) –
    
    References to the stateful rule groups that are used in the policy. These define the inspection criteria in stateful rules.
    - (dict) –
      
      Identifier for a single stateful rule group, used in a firewall policy to refer to a rule group.
      - ResourceArn (string) –
        
        The Amazon Resource Name (ARN) of the stateful rule group.
      - Priority (integer) –
        
        An integer setting that indicates the order in which to run the stateful rule groups in a single FirewallPolicy. This setting only applies to firewall policies that specify the STRICT_ORDER rule order in the stateful engine options settings.
        
        Network Firewall evalutes each stateful rule group against a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy.
        
        You can change the priority settings of your rule groups at any time. To make it easier to insert rule groups later, number them so there’s a wide range in between, for example use 100, 200, and so on.
      - Override (dict) –
        
        The action that allows the policy owner to override the behavior of the rule group within a policy.
        
        Action (string) –
        
        The action that changes the rule group from DROP to ALERT. This only applies to managed rule groups.
      - DeepThreatInspection (boolean) –
        
        Network Firewall plans to augment the active threat defense managed rule group with an additional deep threat inspection capability. When this capability is released, Amazon Web Services will analyze service logs of network traffic processed by these rule groups to identify threat indicators across customers. Amazon Web Services will use these threat indicators to improve the active threat defense managed rule groups and protect the security of Amazon Web Services customers and services.
        
        Note
        Customers can opt-out of deep threat inspection at any time through the Network Firewall console or API. When customers opt out, Network Firewall will not use the network traffic processed by those customers’ active threat defense rule groups for rule group improvement.
  - StatefulDefaultActions (list) –
    
    The default actions to take on a packet that doesn’t match any stateful rules. The stateful default action is optional, and is only valid when using the strict rule order.
    
    Valid values of the stateful default action:
    - aws:drop_strict
    - aws:drop_established
    - aws:alert_strict
    - aws:alert_established
    - aws:drop_established_app_layer
    - aws:alert_established_app_layer
    - aws:drop_established_app_layer_to_server
    - aws:alert_established_app_layer_to_server
    For more information, see Strict evaluation order in the Network Firewall Developer Guide.
    - (string) –
  - StatefulEngineOptions (dict) –
    
    Additional options governing how Network Firewall handles stateful rules. The stateful rule groups that you use in your policy must have stateful rule options settings that are compatible with these settings.
    - RuleOrder (string) –
      
      Indicates how to manage the order of stateful rule evaluation for the policy. STRICT_ORDER is the recommended option, but DEFAULT_ACTION_ORDER is the default option. With STRICT_ORDER, provide your rules in the order that you want them to be evaluated. You can then choose one or more default actions for packets that don’t match any rules. Choose STRICT_ORDER to have the stateful rules engine determine the evaluation order of your rules. The default action for this rule order is PASS, followed by DROP, REJECT, and ALERT actions. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on your settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide.
    - StreamExceptionPolicy (string) –
      
      Configures how Network Firewall processes traffic when a network connection breaks midstream. Network connections can break due to disruptions in external networks or within the firewall itself.
      - DROP - Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior.
      - CONTINUE - Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule to drop http traffic, Network Firewall won’t match the traffic for this rule because the service won’t have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using a flow:stateless rule would still match, as would the aws:drop_strict default action.
      - REJECT - Network Firewall fails closed and drops all subsequent traffic going to the firewall. Network Firewall also sends a TCP reject packet back to your client so that the client can immediately establish a new session. Network Firewall will have context about the new session and will apply rules to the subsequent traffic.
    - FlowTimeouts (dict) –
      
      Configures the amount of time that can pass without any traffic sent through the firewall before the firewall determines that the connection is idle.
      - TcpIdleTimeoutSeconds (integer) –
        
        The number of seconds that can pass without any TCP traffic sent through the firewall before the firewall determines that the connection is idle. After the idle timeout passes, data packets are dropped, however, the next TCP SYN packet is considered a new flow and is processed by the firewall. Clients or targets can use TCP keepalive packets to reset the idle timeout.
        
        You can define the TcpIdleTimeoutSeconds value to be between 60 and 6000 seconds. If no value is provided, it defaults to 350 seconds.
  - TLSInspectionConfigurationArn (string) –
    
    The Amazon Resource Name (ARN) of the TLS inspection configuration.
  - PolicyVariables (dict) –
    
    Contains variables that you can use to override default Suricata settings in your firewall policy.
    - RuleVariables (dict) –
      
      The IPv4 or IPv6 addresses in CIDR notation to use for the Suricata HOME_NET variable. If your firewall uses an inspection VPC, you might want to override the HOME_NET variable with the CIDRs of your home networks. If you don’t override HOME_NET with your own CIDRs, Network Firewall by default uses the CIDR of your inspection VPC.
      - (string) –
        
        (dict) –
        
        A list of IP addresses and address ranges, in CIDR notation. This is part of a RuleVariables.
        
        Definition (list) –
        
        The list of IP addresses and address ranges, in CIDR notation.
        
        (string) –
  - EnableTLSSessionHolding (boolean) –
    
    When true, prevents TCP and TLS packets from reaching destination servers until TLS Inspection has evaluated Server Name Indication (SNI) rules. Requires an associated TLS Inspection configuration.
  - Route53ResolvedIPValidation (dict) –
    
    The settings that enable resolved IP validation for the policy. Resolved IP validation verifies that a connection’s destination IP address is one that the Amazon Route 53 Resolver returned in a DNS response for a domain. The response must come from a VPC that’s associated with the Route 53 Resolver DNS Firewall rule group that you specify. This checks how the destination IP address was obtained, instead of relying only on the domain that the client asserts in its TLS Server Name Indication (SNI) or HTTP Host header. For more information, see Route53ResolvedIPValidation.
    - Action (string) –
      
      The action that Network Firewall takes for a connection whose destination IP address fails resolved IP validation. A destination IP address fails validation when the Route 53 Resolver didn’t return it in a DNS response in an associated VPC. Valid values are the following:
      - ALERT – Tags the matching connection in the firewall’s flow logs without blocking it, when you enable logging. Use this to observe the effect of resolved IP validation before you enforce it.
      - DROP – Silently blocks the connection without sending any response to the client.
      - REJECT – Blocks the connection and sends a TCP reset (RST) to the client. Because a TCP reset applies only to TCP connections, Network Firewall drops non-TCP traffic instead of resetting it.
    - DNSFirewallRuleGroupId (string) –
      
      The ID of the Route 53 Resolver DNS Firewall rule group that determines which VPCs’ DNS resolutions count for resolved IP validation. A destination IP address counts as resolved for a domain only when the Route 53 Resolver returned it in a DNS response within a VPC that’s associated with this rule group. Associate the rule group with the VPCs that send traffic to the firewall. The ID must match the pattern ^rslvr-frg-[0-9a-f]+$. It must also exist and be accessible from your account. Network Firewall validates this when you create or update the policy.
      
      Changing this value swaps the managed rule group association. Network Firewall processes the swap asynchronously. Each policy can have only one managed Route 53 Resolver DNS Firewall association. While a swap is in progress, Network Firewall rejects further changes to this setting. Wait until the swap completes, then retry.
    - DNSExpiryExceptionPolicy (string) –
      
      The action that Network Firewall takes when the DNS resolution recorded for a destination IP address has expired from the resolved IP cache. This applies when Network Firewall still sees traffic to that IP address after the expiry. Network Firewall keeps a resolution for longer than the DNS record’s time to live (TTL). Valid values are the following:
      - CONTINUE – Treats the expired resolution as still valid and doesn’t block the connection because of expiry.
      - DROP – Silently blocks traffic to the IP address after its resolution has expired, without sending any response to the client.
      - REJECT – Blocks traffic to the IP address after its resolution has expired and sends a TCP reset (RST) to the client. Network Firewall drops non-TCP traffic instead of resetting it.
    - BypassDestinationValidationIPRanges (list) –
      
      The destination IP address ranges that are exempt from the policy-level resolved IP check. Network Firewall doesn’t apply the Action in this configuration to a connection whose destination falls in these ranges, even if the Route 53 Resolver didn’t return that IP address in an associated VPC. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries.
      
      This exemption applies only to the policy-level check. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate connections to these destinations and match them independently of this list.
      - (dict) –
        
        A single IP address specification. This is used in the MatchAttributes source and destination specifications.
        
        AddressDefinition (string) –
        
        Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.
        
        Examples:
        
        To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32.
        
        To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24.
        
        To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128.
        
        To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64.
        
        For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing.
    - SourceIPRanges (list) –
      
      The client source IP address ranges whose connections are subject to resolved IP validation. Specify each entry as an IPv4 or IPv6 address or CIDR range, up to 100 entries. If you omit this field, resolved IP validation applies to the CIDR ranges of the firewall’s VPC and of any additional VPCs attached to the firewall. Specifying an empty list is not the same as omitting the field: an empty list means that Network Firewall doesn’t validate any source addresses.
      
      This scope applies to the policy-level check only. Stateful rules that use the AWS_ROUTE_53_RESOLVED_DOMAIN target type or the aws_route_53_resolved_domain keyword still evaluate their destinations regardless of SourceIPRanges.
      - (dict) –
        
        A single IP address specification. This is used in the MatchAttributes source and destination specifications.
        
        AddressDefinition (string) –
        
        Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.
        
        Examples:
        
        To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32.
        
        To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24.
        
        To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128.
        
        To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64.
        
        For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing.

Exceptions

NetworkFirewall.Client.exceptions.InvalidRequestException
NetworkFirewall.Client.exceptions.ResourceNotFoundException
NetworkFirewall.Client.exceptions.ThrottlingException
NetworkFirewall.Client.exceptions.InternalServerError