Package software.amazon.awscdk.services.networkfirewall

Class CfnRuleGroup

java.lang.Object

software.amazon.jsii.JsiiObject

software.constructs.Construct

software.amazon.awscdk.CfnElement

software.amazon.awscdk.CfnRefElement

software.amazon.awscdk.CfnResource

software.amazon.awscdk.services.networkfirewall.CfnRuleGroup

All Implemented Interfaces:

IInspectable, IEnvironmentAware, IRuleGroupRef, ITaggable, software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable

@Generated(value="jsii-pacmak/1.119.0 (build 1634eac)",
           date="2025-11-20T23:37:25.615Z")
@Stability(Stable)
public class CfnRuleGroup
extends CfnResource
implements IInspectable, IRuleGroupRef, ITaggable

Use the to define a reusable collection of stateless or stateful network traffic filtering rules. You use rule groups in an firewall policy to specify the filtering behavior of an firewall.

Example:

 // The code below shows an example of how to instantiate this type.
 // The values are placeholders you should change.
 import software.amazon.awscdk.services.networkfirewall.*;
 CfnRuleGroup cfnRuleGroup = CfnRuleGroup.Builder.create(this, "MyCfnRuleGroup")
         .capacity(123)
         .ruleGroupName("ruleGroupName")
         .type("type")
         // the properties below are optional
         .description("description")
         .ruleGroup(RuleGroupProperty.builder()
                 .rulesSource(RulesSourceProperty.builder()
                         .rulesSourceList(RulesSourceListProperty.builder()
                                 .generatedRulesType("generatedRulesType")
                                 .targets(List.of("targets"))
                                 .targetTypes(List.of("targetTypes"))
                                 .build())
                         .rulesString("rulesString")
                         .statefulRules(List.of(StatefulRuleProperty.builder()
                                 .action("action")
                                 .header(HeaderProperty.builder()
                                         .destination("destination")
                                         .destinationPort("destinationPort")
                                         .direction("direction")
                                         .protocol("protocol")
                                         .source("source")
                                         .sourcePort("sourcePort")
                                         .build())
                                 .ruleOptions(List.of(RuleOptionProperty.builder()
                                         .keyword("keyword")
                                         // the properties below are optional
                                         .settings(List.of("settings"))
                                         .build()))
                                 .build()))
                         .statelessRulesAndCustomActions(StatelessRulesAndCustomActionsProperty.builder()
                                 .statelessRules(List.of(StatelessRuleProperty.builder()
                                         .priority(123)
                                         .ruleDefinition(RuleDefinitionProperty.builder()
                                                 .actions(List.of("actions"))
                                                 .matchAttributes(MatchAttributesProperty.builder()
                                                         .destinationPorts(List.of(PortRangeProperty.builder()
                                                                 .fromPort(123)
                                                                 .toPort(123)
                                                                 .build()))
                                                         .destinations(List.of(AddressProperty.builder()
                                                                 .addressDefinition("addressDefinition")
                                                                 .build()))
                                                         .protocols(List.of(123))
                                                         .sourcePorts(List.of(PortRangeProperty.builder()
                                                                 .fromPort(123)
                                                                 .toPort(123)
                                                                 .build()))
                                                         .sources(List.of(AddressProperty.builder()
                                                                 .addressDefinition("addressDefinition")
                                                                 .build()))
                                                         .tcpFlags(List.of(TCPFlagFieldProperty.builder()
                                                                 .flags(List.of("flags"))
                                                                 // the properties below are optional
                                                                 .masks(List.of("masks"))
                                                                 .build()))
                                                         .build())
                                                 .build())
                                         .build()))
                                 // the properties below are optional
                                 .customActions(List.of(CustomActionProperty.builder()
                                         .actionDefinition(ActionDefinitionProperty.builder()
                                                 .publishMetricAction(PublishMetricActionProperty.builder()
                                                         .dimensions(List.of(DimensionProperty.builder()
                                                                 .value("value")
                                                                 .build()))
                                                         .build())
                                                 .build())
                                         .actionName("actionName")
                                         .build()))
                                 .build())
                         .build())
                 // the properties below are optional
                 .referenceSets(ReferenceSetsProperty.builder()
                         .ipSetReferences(Map.of(
                                 "ipSetReferencesKey", Map.of(
                                         "referenceArn", "referenceArn")))
                         .build())
                 .ruleVariables(RuleVariablesProperty.builder()
                         .ipSets(Map.of(
                                 "ipSetsKey", Map.of(
                                         "definition", List.of("definition"))))
                         .portSets(Map.of(
                                 "portSetsKey", PortSetProperty.builder()
                                         .definition(List.of("definition"))
                                         .build()))
                         .build())
                 .statefulRuleOptions(StatefulRuleOptionsProperty.builder()
                         .ruleOrder("ruleOrder")
                         .build())
                 .build())
         .summaryConfiguration(SummaryConfigurationProperty.builder()
                 .ruleOptions(List.of("ruleOptions"))
                 .build())
         .tags(List.of(CfnTag.builder()
                 .key("key")
                 .value("value")
                 .build()))
         .build();
 

See Also:

• http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-rulegroup.html

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static interface	CfnRuleGroup.ActionDefinitionProperty	A custom action to use in stateless rule actions settings.
static interface	CfnRuleGroup.AddressProperty	A single IP address specification.
static final class	CfnRuleGroup.Builder	A fluent builder for CfnRuleGroup.
static interface	CfnRuleGroup.CustomActionProperty	An optional, non-standard action to use for stateless packet handling.
static interface	CfnRuleGroup.DimensionProperty	The value to use in an Amazon CloudWatch custom metric dimension.
static interface	CfnRuleGroup.HeaderProperty	The 5-tuple criteria for AWS Network Firewall to use to inspect packet headers in stateful traffic flow inspection.
static interface	CfnRuleGroup.IPSetProperty	A list of IP addresses and address ranges, in CIDR notation.
static interface	CfnRuleGroup.IPSetReferenceProperty	Configures one or more IP set references for a Suricata-compatible rule group.
static interface	CfnRuleGroup.MatchAttributesProperty	Criteria for Network Firewall to use to inspect an individual packet in stateless rule inspection.
static interface	CfnRuleGroup.PortRangeProperty	A single port range specification.
static interface	CfnRuleGroup.PortSetProperty	A set of port ranges for use in the rules in a rule group.
static interface	CfnRuleGroup.PublishMetricActionProperty	Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet.
static interface	CfnRuleGroup.ReferenceSetsProperty	Configures the reference sets for a stateful rule group.
static interface	CfnRuleGroup.RuleDefinitionProperty	The inspection criteria and action for a single stateless rule.
static interface	CfnRuleGroup.RuleGroupProperty	The object that defines the rules in a rule group.
static interface	CfnRuleGroup.RuleOptionProperty	Additional settings for a stateful rule.
static interface	CfnRuleGroup.RulesSourceListProperty	Stateful inspection criteria for a domain list rule group.
static interface	CfnRuleGroup.RulesSourceProperty	The stateless or stateful rules definitions for use in a single rule group.
static interface	CfnRuleGroup.RuleVariablesProperty	Settings that are available for use in the rules in the rule group where this is defined.
static interface	CfnRuleGroup.StatefulRuleOptionsProperty	Additional options governing how Network Firewall handles the rule group.
static interface	CfnRuleGroup.StatefulRuleProperty	A single Suricata rules specification, for use in a stateful rule group.
static interface	CfnRuleGroup.StatelessRuleProperty	A single stateless rule.
static interface	CfnRuleGroup.StatelessRulesAndCustomActionsProperty	Stateless inspection criteria.
static interface	CfnRuleGroup.SummaryConfigurationProperty	A complex type that specifies which Suricata rule metadata fields to use when displaying threat information.
static interface	CfnRuleGroup.TCPFlagFieldProperty	TCP flags and masks to inspect packets for.

Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject

software.amazon.jsii.JsiiObject.InitializationMode

Nested classes/interfaces inherited from interface software.constructs.IConstruct

software.constructs.IConstruct.Jsii$Default

Nested classes/interfaces inherited from interface software.amazon.awscdk.IInspectable

IInspectable.Jsii$Default, IInspectable.Jsii$Proxy

Nested classes/interfaces inherited from interface software.amazon.awscdk.interfaces.networkfirewall.IRuleGroupRef

IRuleGroupRef.Jsii$Default, IRuleGroupRef.Jsii$Proxy

Nested classes/interfaces inherited from interface software.amazon.awscdk.ITaggable

ITaggable.Jsii$Default, ITaggable.Jsii$Proxy

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CFN_RESOURCE_TYPE_NAME	The CloudFormation resource type name for this resource class.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	CfnRuleGroup(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)
protected	CfnRuleGroup(software.amazon.jsii.JsiiObjectRef objRef)
	CfnRuleGroup(software.constructs.Construct scope, String id, CfnRuleGroupProps props)	Create a new AWS::NetworkFirewall::RuleGroup.

Method Summary

Modifier and Type	Method	Description
static String	arnForRuleGroup(IRuleGroupRef resource)
String	getAttrRuleGroupArn()	The Amazon Resource Name (ARN) of the rule group.
String	getAttrRuleGroupId()	The unique ID of the rule group resource.
Number	getCapacity()	The maximum operating resources that this rule group can use.
protected Map<String,Object>	getCfnProperties()
String	getDescription()	A description of the rule group.
Object	getRuleGroup()	An object that defines the rule group rules.
String	getRuleGroupName()	The descriptive name of the rule group.
RuleGroupReference	getRuleGroupRef()	A reference to a RuleGroup resource.
Object	getSummaryConfiguration()	A complex type containing the currently selected rule option fields that will be displayed for rule summarization returned by DescribeRuleGroupSummary .
TagManager	getTags()	Tag Manager which manages the tags for this resource.
List<CfnTag>	getTagsRaw()	An array of key-value pairs to apply to this resource.
String	getType()	Indicates whether the rule group is stateless or stateful.
void	inspect(TreeInspector inspector)	Examines the CloudFormation resource and discloses attributes.
protected Map<String,Object>	renderProperties(Map<String,Object> props)
void	setCapacity(Number value)	The maximum operating resources that this rule group can use.
void	setDescription(String value)	A description of the rule group.
void	setRuleGroup(IResolvable value)	An object that defines the rule group rules.
void	setRuleGroup(CfnRuleGroup.RuleGroupProperty value)	An object that defines the rule group rules.
void	setRuleGroupName(String value)	The descriptive name of the rule group.
void	setSummaryConfiguration(IResolvable value)	A complex type containing the currently selected rule option fields that will be displayed for rule summarization returned by DescribeRuleGroupSummary .
void	setSummaryConfiguration(CfnRuleGroup.SummaryConfigurationProperty value)	A complex type containing the currently selected rule option fields that will be displayed for rule summarization returned by DescribeRuleGroupSummary .
void	setTagsRaw(List<CfnTag> value)	An array of key-value pairs to apply to this resource.
void	setType(String value)	Indicates whether the rule group is stateless or stateful.

Methods inherited from class software.amazon.awscdk.CfnResource

addDeletionOverride, addDependency, addDependsOn, addMetadata, addOverride, addPropertyDeletionOverride, addPropertyOverride, applyRemovalPolicy, applyRemovalPolicy, applyRemovalPolicy, getAtt, getAtt, getCfnOptions, getCfnResourceType, getEnv, getMetadata, getUpdatedProperites, getUpdatedProperties, isCfnResource, obtainDependencies, obtainResourceDependencies, removeDependency, replaceDependency, shouldSynthesize, toString, validateProperties

Methods inherited from class software.amazon.awscdk.CfnRefElement

getRef

Methods inherited from class software.amazon.awscdk.CfnElement

getCreationStack, getLogicalId, getStack, isCfnElement, overrideLogicalId

Methods inherited from class software.constructs.Construct

getNode, isConstruct

Methods inherited from class software.amazon.jsii.JsiiObject

jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface software.constructs.IConstruct

getNode

Methods inherited from interface software.amazon.awscdk.interfaces.IEnvironmentAware

getEnv

Methods inherited from interface software.amazon.jsii.JsiiSerializable

$jsii$toJson

Field Details

CFN_RESOURCE_TYPE_NAME

@Stability(Stable)
public static final String CFN_RESOURCE_TYPE_NAME

The CloudFormation resource type name for this resource class.

Constructor Details

CfnRuleGroup

protected CfnRuleGroup(software.amazon.jsii.JsiiObjectRef objRef)

CfnRuleGroup

protected CfnRuleGroup(software.amazon.jsii.JsiiObject.InitializationMode initializationMode)

CfnRuleGroup

@Stability(Stable)
public CfnRuleGroup(@NotNull
 software.constructs.Construct scope,
 @NotNull
 String id,
 @NotNull
 CfnRuleGroupProps props)

Create a new AWS::NetworkFirewall::RuleGroup.

Parameters:

scope - Scope in which this resource is defined. This parameter is required.

id - Construct identifier for this resource (unique in its scope). This parameter is required.

props - Resource properties. This parameter is required.

Method Details

arnForRuleGroup

@Stability(Stable)
@NotNull
public static String arnForRuleGroup(@NotNull
 IRuleGroupRef resource)

Parameters:

resource - This parameter is required.

inspect

@Stability(Stable)
public void inspect(@NotNull
 TreeInspector inspector)

Examines the CloudFormation resource and discloses attributes.

Specified by:

inspect in interface IInspectable

Parameters:

inspector - tree inspector to collect and process attributes. This parameter is required.

renderProperties

@Stability(Stable)
@NotNull
protected Map<String,Object> renderProperties(@NotNull
 Map<String,Object> props)

Overrides:

renderProperties in class CfnResource

Parameters:

props - This parameter is required.

getAttrRuleGroupArn

@Stability(Stable)
@NotNull
public String getAttrRuleGroupArn()

The Amazon Resource Name (ARN) of the rule group.

getAttrRuleGroupId

@Stability(Stable)
@NotNull
public String getAttrRuleGroupId()

The unique ID of the rule group resource.

getCfnProperties

@Stability(Stable)
@NotNull
protected Map<String,Object> getCfnProperties()

Overrides:

getCfnProperties in class CfnResource

getRuleGroupRef

@Stability(Stable)
@NotNull
public RuleGroupReference getRuleGroupRef()

A reference to a RuleGroup resource.

Specified by:

getRuleGroupRef in interface IRuleGroupRef

getTags

@Stability(Stable)
@NotNull
public TagManager getTags()

Tag Manager which manages the tags for this resource.

Specified by:

getTags in interface ITaggable

getCapacity

@Stability(Stable)
@NotNull
public Number getCapacity()

The maximum operating resources that this rule group can use.

setCapacity

@Stability(Stable)
public void setCapacity(@NotNull
 Number value)

The maximum operating resources that this rule group can use.

getRuleGroupName

@Stability(Stable)
@NotNull
public String getRuleGroupName()

The descriptive name of the rule group.

setRuleGroupName

@Stability(Stable)
public void setRuleGroupName(@NotNull
 String value)

The descriptive name of the rule group.

getType

@Stability(Stable)
@NotNull
public String getType()

Indicates whether the rule group is stateless or stateful.

setType

@Stability(Stable)
public void setType(@NotNull
 String value)

Indicates whether the rule group is stateless or stateful.

getDescription

@Stability(Stable)
@Nullable
public String getDescription()

A description of the rule group.

setDescription

@Stability(Stable)
public void setDescription(@Nullable
 String value)

A description of the rule group.

getRuleGroup

@Stability(Stable)
@Nullable
public Object getRuleGroup()

An object that defines the rule group rules.

Returns union: either IResolvable or CfnRuleGroup.RuleGroupProperty

setRuleGroup

@Stability(Stable)
public void setRuleGroup(@Nullable
 IResolvable value)

An object that defines the rule group rules.

setRuleGroup

@Stability(Stable)
public void setRuleGroup(@Nullable
 CfnRuleGroup.RuleGroupProperty value)

An object that defines the rule group rules.

getSummaryConfiguration

@Stability(Stable)
@Nullable
public Object getSummaryConfiguration()

A complex type containing the currently selected rule option fields that will be displayed for rule summarization returned by DescribeRuleGroupSummary .

Returns union: either IResolvable or CfnRuleGroup.SummaryConfigurationProperty

setSummaryConfiguration

@Stability(Stable)
public void setSummaryConfiguration(@Nullable
 IResolvable value)

A complex type containing the currently selected rule option fields that will be displayed for rule summarization returned by DescribeRuleGroupSummary .

setSummaryConfiguration

@Stability(Stable)
public void setSummaryConfiguration(@Nullable
 CfnRuleGroup.SummaryConfigurationProperty value)

A complex type containing the currently selected rule option fields that will be displayed for rule summarization returned by DescribeRuleGroupSummary .

getTagsRaw

@Stability(Stable)
@Nullable
public List<CfnTag> getTagsRaw()

An array of key-value pairs to apply to this resource.

setTagsRaw

@Stability(Stable)
public void setTagsRaw(@Nullable
 List<CfnTag> value)

An array of key-value pairs to apply to this resource.