All Downloads are FREE. Search and download functionalities are using the official Maven repository.
  • Log In
  • Register

    • software.amazon.awssdk.services.fms.model.SecurityServicePolicyData Maven / Gradle / Ivy

    /*
 * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
 * 
 * Licensed under the Apache License, Version 2.0 (the "License"). You may not use this file except in compliance with
 * the License. A copy of the License is located at
 * 
 * http://aws.amazon.com/apache2.0
 * 
 * or in the "license" file accompanying this file. This file is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
 * CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions
 * and limitations under the License.
 */

package software.amazon.awssdk.services.fms.model;

import java.io.Serializable;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import java.util.Objects;
import java.util.Optional;
import java.util.function.BiConsumer;
import java.util.function.Consumer;
import java.util.function.Function;
import software.amazon.awssdk.annotations.Generated;
import software.amazon.awssdk.core.SdkField;
import software.amazon.awssdk.core.SdkPojo;
import software.amazon.awssdk.core.protocol.MarshallLocation;
import software.amazon.awssdk.core.protocol.MarshallingType;
import software.amazon.awssdk.core.traits.LocationTrait;
import software.amazon.awssdk.utils.ToString;
import software.amazon.awssdk.utils.builder.CopyableBuilder;
import software.amazon.awssdk.utils.builder.ToCopyableBuilder;

/**
 * 
    
 * Details about the security service that is being used to protect the resources.
 * 
    
 */
@Generated("software.amazon.awssdk:codegen")
public final class SecurityServicePolicyData implements SdkPojo, Serializable,
        ToCopyableBuilder {
    private static final SdkField TYPE_FIELD = SdkField. builder(MarshallingType.STRING).memberName("Type")
            .getter(getter(SecurityServicePolicyData::typeAsString)).setter(setter(Builder::type))
            .traits(LocationTrait.builder().location(MarshallLocation.PAYLOAD).locationName("Type").build()).build();

    private static final SdkField MANAGED_SERVICE_DATA_FIELD = SdkField. builder(MarshallingType.STRING)
            .memberName("ManagedServiceData").getter(getter(SecurityServicePolicyData::managedServiceData))
            .setter(setter(Builder::managedServiceData))
            .traits(LocationTrait.builder().location(MarshallLocation.PAYLOAD).locationName("ManagedServiceData").build())
            .build();

    private static final SdkField POLICY_OPTION_FIELD = SdkField. builder(MarshallingType.SDK_POJO)
            .memberName("PolicyOption").getter(getter(SecurityServicePolicyData::policyOption))
            .setter(setter(Builder::policyOption)).constructor(PolicyOption::builder)
            .traits(LocationTrait.builder().location(MarshallLocation.PAYLOAD).locationName("PolicyOption").build()).build();

    private static final List> SDK_FIELDS = Collections.unmodifiableList(Arrays.asList(TYPE_FIELD,
            MANAGED_SERVICE_DATA_FIELD, POLICY_OPTION_FIELD));

    private static final long serialVersionUID = 1L;

    private final String type;

    private final String managedServiceData;

    private final PolicyOption policyOption;

    private SecurityServicePolicyData(BuilderImpl builder) {
        this.type = builder.type;
        this.managedServiceData = builder.managedServiceData;
        this.policyOption = builder.policyOption;
    }

    /**
     * 
    
     * The service that the policy is using to protect the resources. This specifies the type of policy that is created,
     * either an WAF policy, a Shield Advanced policy, or a security group policy. For security group policies, Firewall
     * Manager supports one security group for each common policy and for each content audit policy. This is an
     * adjustable limit that you can increase by contacting Amazon Web Services Support.
     * 
    
     * 
    
     * If the service returns an enum value that is not available in the current SDK version, {@link #type} will return
     * {@link SecurityServiceType#UNKNOWN_TO_SDK_VERSION}. The raw value returned by the service is available from
     * {@link #typeAsString}.
     * 
    
     * 
     * @return The service that the policy is using to protect the resources. This specifies the type of policy that is
     *         created, either an WAF policy, a Shield Advanced policy, or a security group policy. For security group
     *         policies, Firewall Manager supports one security group for each common policy and for each content audit
     *         policy. This is an adjustable limit that you can increase by contacting Amazon Web Services Support.
     * @see SecurityServiceType
     */
    public final SecurityServiceType type() {
        return SecurityServiceType.fromValue(type);
    }

    /**
     * 
    
     * The service that the policy is using to protect the resources. This specifies the type of policy that is created,
     * either an WAF policy, a Shield Advanced policy, or a security group policy. For security group policies, Firewall
     * Manager supports one security group for each common policy and for each content audit policy. This is an
     * adjustable limit that you can increase by contacting Amazon Web Services Support.
     * 
    
     * 
    
     * If the service returns an enum value that is not available in the current SDK version, {@link #type} will return
     * {@link SecurityServiceType#UNKNOWN_TO_SDK_VERSION}. The raw value returned by the service is available from
     * {@link #typeAsString}.
     * 
    
     * 
     * @return The service that the policy is using to protect the resources. This specifies the type of policy that is
     *         created, either an WAF policy, a Shield Advanced policy, or a security group policy. For security group
     *         policies, Firewall Manager supports one security group for each common policy and for each content audit
     *         policy. This is an adjustable limit that you can increase by contacting Amazon Web Services Support.
     * @see SecurityServiceType
     */
    public final String typeAsString() {
        return type;
    }

    /**
     * 
    
     * Details about the service that are specific to the service type, in JSON format.
     * 
    
     * 
      
     * 
    • 
     * 
      
     * Example: DNS_FIREWALL
     * 
      
     * 
      
     * "{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"
     * 
      
     * 
     * 
      
     * Valid values for preProcessRuleGroups are between 1 and 99. Valid values for
     * postProcessRuleGroups are between 9901 and 10000.
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: IMPORT_NETWORK_FIREWALL
     * "{\"type\":\"IMPORT_NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-2:000000000000:stateless-rulegroup\/rg1\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:drop\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:pass\"],\"networkFirewallStatelessCustomActions\":[],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-2:aws-managed:stateful-rulegroup\/ThreatSignaturesEmergingEventsStrictOrder\",\"priority\":8}],\"networkFirewallStatefulEngineOptions\":{\"ruleOrder\":\"STRICT_ORDER\"},\"networkFirewallStatefulDefaultActions\":[\"aws:drop_strict\"]}}"
     * 
      
     * 
      
     * "{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"
     * 
      
     * 
     * 
      
     * Valid values for preProcessRuleGroups are between 1 and 99. Valid values for
     * postProcessRuleGroups are between 9901 and 10000.
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: NETWORK_FIREWALL - Centralized deployment model
     * 
      
     * 
      
     * "{\"type\":\"NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}},\"firewallDeploymentModel\":{\"centralizedFirewallDeploymentModel\":{\"centralizedFirewallOrchestrationConfig\":{\"inspectionVpcIds\":[{\"resourceId\":\"vpc-1234\",\"accountId\":\"123456789011\"}],\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneId\":null,\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"allowedIPV4CidrList\":[]}}}}"
     * 
      
     * 
      
     * To use the centralized deployment model, you must set PolicyOption to
     * CENTRALIZED.
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone
     * configuration
     * 
      
     * 
      
     *  "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":[\"10.0.0.0/28\",\"192.168.0.0/28\"],\"routeManagementAction\":\"OFF\"},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}}" 
     * 
      
     * 
      
     * With automatic Availbility Zone configuration, Firewall Manager chooses which Availability Zones to create the
     * endpoints in. To use the distributed deployment model, you must set PolicyOption to
     * NULL.
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone
     * configuration and route management
     * 
      
     * 
      
     *  "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":[\"10.0.0.0/28\",\"192.168.0.0/28\"],\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"]},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\": \"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}}" 
     * 
      
     * 
      
     * To use the distributed deployment model, you must set PolicyOption to
     * NULL.
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration
     * 
      
     * 
      
     * "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}" 
     * 
      
     * 
      
     * With custom Availability Zone configuration, you define which specific Availability Zones to create endpoints in
     * by configuring firewallCreationConfig. To configure the Availability Zones in
     * firewallCreationConfig, specify either the availabilityZoneName or
     * availabilityZoneId parameter, not both parameters.
     * 
      
     * 
      
     * To use the distributed deployment model, you must set PolicyOption to
     * NULL.
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration
     * and route management
     * 
      
     * 
      
     * "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}" 
     * 
      
     * 
      
     * To use the distributed deployment model, you must set PolicyOption to
     * NULL.
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: THIRD_PARTY_FIREWALL
     * 
      
     * 
      
     * "{ "type":"THIRD_PARTY_FIREWALL", "thirdPartyFirewall":"PALO_ALTO_NETWORKS_CLOUD_NGFW", "thirdPartyFirewallConfig":{ "thirdPartyFirewallPolicyList":["global-1"] }, "firewallDeploymentModel":{ "distributedFirewallDeploymentModel":{ "distributedFirewallOrchestrationConfig":{ "firewallCreationConfig":{ "endpointLocation":{ "availabilityZoneConfigList":[ { "availabilityZoneName":"${AvailabilityZone}" } ] } }, "allowedIPV4CidrList":[ ] } } } }"
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: SECURITY_GROUPS_COMMON
     * 
      
     * 
      
     * "{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: SECURITY_GROUPS_COMMON - Security group tag distribution
     * 
      
     * 
      
     * ""{\"type\":\"SECURITY_GROUPS_COMMON\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"revertManualSecurityGroupChanges\":true,\"exclusiveResourceSecurityGroupManagement\":false,\"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":false,\"enableTagDistribution\":true}""
     * 
      
     * 
      
     * Firewall Manager automatically distributes tags from the primary group to the security groups created by this
     * policy. To use security group tag distribution, you must also set revertManualSecurityGroupChanges
     * to true, otherwise Firewall Manager won't be able to create the policy. When you enable
     * revertManualSecurityGroupChanges, Firewall Manager identifies and reports when the security groups
     * created by this policy become non-compliant.
     * 
      
     * 
      
     * Firewall Manager won't distrubute system tags added by Amazon Web Services services into the replica security
     * groups. System tags begin with the aws: prefix.
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the
     * account owns
     * 
      
     * 
      
     * "{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: SECURITY_GROUPS_CONTENT_AUDIT
     * 
      
     * 
      
     * "{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"
     * 
      
     * 
      
     * The security group action for content audit can be ALLOW or DENY. For
     * ALLOW, all in-scope security group rules must be within the allowed range of the policy's security
     * group rules. For DENY, all in-scope security group rules must not contain a value or a range that
     * matches a rule value or range in the policy security group.
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: SECURITY_GROUPS_USAGE_AUDIT
     * 
      
     * 
      
     * "{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Specification for SHIELD_ADVANCED for Amazon CloudFront distributions
     * 
      
     * 
      
     * "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED|IGNORED|DISABLED\", \"automaticResponseAction\":\"BLOCK|COUNT\"}, \"overrideCustomerWebaclClassic\":true|false}"
     * 
      
     * 
      
     * For example:
     * "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"
     * 
      
     * 
      
     * The default value for automaticResponseStatus is IGNORED. The value for
     * automaticResponseAction is only required when automaticResponseStatus is set to
     * ENABLED. The default value for overrideCustomerWebaclClassic is false.
     * 
      
     * 
      
     * For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData
     * configuration is an empty string.
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: WAFV2 - Account takeover prevention and Bot Control managed rule groups, and rule action
     * override
     * 
      
     * 
      
     * "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesATPRuleSet\",\"managedRuleGroupConfigs\":[{\"awsmanagedRulesATPRuleSet\":{\"loginPath\":\"/loginpath\",\"requestInspection\":{\"payloadType\":\"FORM_ENCODED|JSON\",\"usernameField\":{\"identifier\":\"/form/username\"},\"passwordField\":{\"identifier\":\"/form/password\"}}}}]},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[],\"sampledRequestsEnabled\":true},{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesBotControlRuleSet\",\"managedRuleGroupConfigs\":[{\"awsmanagedRulesBotControlRuleSet\":{\"inspectionLevel\":\"TARGETED|COMMON\"}}]},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[],\"sampledRequestsEnabled\":true,\"ruleActionOverrides\":[{\"name\":\"Rule1\",\"actionToUse\":{\"allow|block|count|captcha|challenge\":{}}},{\"name\":\"Rule2\",\"actionToUse\":{\"allow|block|count|captcha|challenge\":{}}}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"customRequestHandling\":null,\"customResponse\":null,\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":null,\"sampledRequestsEnabledForDefaultActions\":true}"
     * 
      
     * 
        
     * 
      • 
     * 
        
     * Fraud Control account takeover prevention (ATP) - For information about the properties available for
     * AWSManagedRulesATPRuleSet managed rule groups, see AWSManagedRulesATPRuleSet in the WAF API Reference.
     * 
        
     * 
        • 
     * 
      • 
     * 
        
     * Bot Control - For information about AWSManagedRulesBotControlRuleSet managed rule groups, see 
     * AWSManagedRulesBotControlRuleSet in the WAF API Reference.
     * 
        
     * 
        • 
     * 
      • 
     * 
        
     * Rule action overrides - Firewall Manager supports rule action overrides only for managed rule groups. To
     * configure a RuleActionOverrides add the Name of the rule to override, and
     * ActionToUse, which is the new action to use for the rule. For information about using rule action
     * override, see RuleActionOverride in
     * the WAF API Reference.
     * 
        
     * 
        • 
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: WAFV2 - CAPTCHA and Challenge configs
     * 
      
     * 
      
     * "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesAdminProtectionRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[],\"sampledRequestsEnabled\":true}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"customRequestHandling\":null,\"customResponse\":null,\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":null,\"sampledRequestsEnabledForDefaultActions\":true,\"captchaConfig\":{\"immunityTimeProperty\":{\"immunityTime\":500}},\"challengeConfig\":{\"immunityTimeProperty\":{\"immunityTime\":800}},\"tokenDomains\":[\"google.com\",\"amazon.com\"]}"
     * 
      
     * 
      
     * If you update the policy's values for captchaConfig, challengeConfig, or
     * tokenDomains, Firewall Manager will overwrite your local web ACLs to contain the new value(s).
     * However, if you don't update the policy's captchaConfig, challengeConfig, or
     * tokenDomains values, the values in your local web ACLs will remain unchanged. For information about
     * CAPTCHA and Challenge configs, see CaptchaConfig and ChallengeConfig in the
     * WAF API Reference.
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: WAFV2 - Firewall Manager support for WAF managed rule group versioning
     * 
      
     * 
      
     * "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"
     * 
      
     * 
      
     * To use a specific version of a WAF managed rule group in your Firewall Manager policy, you must set
     * versionEnabled to true, and set version to the version you'd like to use.
     * If you don't set versionEnabled to true, or if you omit versionEnabled,
     * then Firewall Manager uses the default version of the WAF managed rule group.
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: WAFV2 - Logging configurations
     * 
      
     * 
      
     * "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null, \"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\": {\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\", \"managedRuleGroupName\":\"AWSManagedRulesAdminProtectionRuleSet\"} ,\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[], \"sampledRequestsEnabled\":true}],\"postProcessRuleGroups\":[], \"defaultAction\":{\"type\":\"ALLOW\"},\"customRequestHandling\" :null,\"customResponse\":null,\"overrideCustomerWebACLAssociation\" :false,\"loggingConfiguration\":{\"logDestinationConfigs\": [\"arn:aws:s3:::aws-waf-logs-example-bucket\"] ,\"redactedFields\":[],\"loggingFilterConfigs\":{\"defaultBehavior\":\"KEEP\", \"filters\":[{\"behavior\":\"KEEP\",\"requirement\":\"MEETS_ALL\", \"conditions\":[{\"actionCondition\":\"CAPTCHA\"},{\"actionCondition\": \"CHALLENGE\"}, {\"actionCondition\":\"EXCLUDED_AS_COUNT\"}]}]}},\"sampledRequestsEnabledForDefaultActions\":true}"
     * 
      
     * 
      
     * Firewall Manager supports Amazon Kinesis Data Firehose and Amazon S3 as the logDestinationConfigs in
     * your loggingConfiguration. For information about WAF logging configurations, see LoggingConfiguration
     * in the WAF API Reference
     * 
      
     * 
      
     * In the loggingConfiguration, you can specify one logDestinationConfigs. Optionally
     * provide as many as 20 redactedFields. The RedactedFieldType must be one of
     * URI, QUERY_STRING, HEADER, or METHOD.
     * 
      
     * 
      • 
     * 
    • 
     * 
      
     * Example: WAF Classic
     * 
      
     * 
      
     * "{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"
     * 
      
     * 
      • 
     * 
    
     * 
     * @return Details about the service that are specific to the service type, in JSON format. 
    
     *         
      
     *         
    • 
     *         
      
     *         Example: DNS_FIREWALL
     *         
      
     *         
      
     *         "{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"
     *         
      
     *         
     *         
      
     *         Valid values for preProcessRuleGroups are between 1 and 99. Valid values for
     *         postProcessRuleGroups are between 9901 and 10000.
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: IMPORT_NETWORK_FIREWALL
     *         "{\"type\":\"IMPORT_NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-2:000000000000:stateless-rulegroup\/rg1\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:drop\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:pass\"],\"networkFirewallStatelessCustomActions\":[],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-2:aws-managed:stateful-rulegroup\/ThreatSignaturesEmergingEventsStrictOrder\",\"priority\":8}],\"networkFirewallStatefulEngineOptions\":{\"ruleOrder\":\"STRICT_ORDER\"},\"networkFirewallStatefulDefaultActions\":[\"aws:drop_strict\"]}}"
     *         
      
     *         
      
     *         "{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"
     *         
      
     *         
     *         
      
     *         Valid values for preProcessRuleGroups are between 1 and 99. Valid values for
     *         postProcessRuleGroups are between 9901 and 10000.
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: NETWORK_FIREWALL - Centralized deployment model
     *         
      
     *         
      
     *         "{\"type\":\"NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}},\"firewallDeploymentModel\":{\"centralizedFirewallDeploymentModel\":{\"centralizedFirewallOrchestrationConfig\":{\"inspectionVpcIds\":[{\"resourceId\":\"vpc-1234\",\"accountId\":\"123456789011\"}],\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneId\":null,\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"allowedIPV4CidrList\":[]}}}}"
     *         
      
     *         
      
     *         To use the centralized deployment model, you must set PolicyOption to
     *         CENTRALIZED.
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone
     *         configuration
     *         
      
     *         
      
     *          "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":[\"10.0.0.0/28\",\"192.168.0.0/28\"],\"routeManagementAction\":\"OFF\"},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}}" 
     *         
      
     *         
      
     *         With automatic Availbility Zone configuration, Firewall Manager chooses which Availability Zones to
     *         create the endpoints in. To use the distributed deployment model, you must set PolicyOption to
     *         NULL.
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone
     *         configuration and route management
     *         
      
     *         
      
     *          "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":[\"10.0.0.0/28\",\"192.168.0.0/28\"],\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"]},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\": \"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}}" 
     *         
      
     *         
      
     *         To use the distributed deployment model, you must set PolicyOption to
     *         NULL.
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone
     *         configuration
     *         
      
     *         
      
     *         "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}" 
     *         
      
     *         
      
     *         With custom Availability Zone configuration, you define which specific Availability Zones to create
     *         endpoints in by configuring firewallCreationConfig. To configure the Availability Zones in
     *         firewallCreationConfig, specify either the availabilityZoneName or
     *         availabilityZoneId parameter, not both parameters.
     *         
      
     *         
      
     *         To use the distributed deployment model, you must set PolicyOption to
     *         NULL.
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone
     *         configuration and route management
     *         
      
     *         
      
     *         "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}" 
     *         
      
     *         
      
     *         To use the distributed deployment model, you must set PolicyOption to
     *         NULL.
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: THIRD_PARTY_FIREWALL
     *         
      
     *         
      
     *         "{ "type":"THIRD_PARTY_FIREWALL", "thirdPartyFirewall":"PALO_ALTO_NETWORKS_CLOUD_NGFW", "thirdPartyFirewallConfig":{ "thirdPartyFirewallPolicyList":["global-1"] }, "firewallDeploymentModel":{ "distributedFirewallDeploymentModel":{ "distributedFirewallOrchestrationConfig":{ "firewallCreationConfig":{ "endpointLocation":{ "availabilityZoneConfigList":[ { "availabilityZoneName":"${AvailabilityZone}" } ] } }, "allowedIPV4CidrList":[ ] } } } }"
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: SECURITY_GROUPS_COMMON
     *         
      
     *         
      
     *         "{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: SECURITY_GROUPS_COMMON - Security group tag distribution
     *         
      
     *         
      
     *         ""{\"type\":\"SECURITY_GROUPS_COMMON\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"revertManualSecurityGroupChanges\":true,\"exclusiveResourceSecurityGroupManagement\":false,\"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":false,\"enableTagDistribution\":true}""
     *         
      
     *         
      
     *         Firewall Manager automatically distributes tags from the primary group to the security groups created by
     *         this policy. To use security group tag distribution, you must also set
     *         revertManualSecurityGroupChanges to true, otherwise Firewall Manager won't be
     *         able to create the policy. When you enable revertManualSecurityGroupChanges, Firewall
     *         Manager identifies and reports when the security groups created by this policy become non-compliant.
     *         
      
     *         
      
     *         Firewall Manager won't distrubute system tags added by Amazon Web Services services into the replica
     *         security groups. System tags begin with the aws: prefix.
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs
     *         that the account owns
     *         
      
     *         
      
     *         "{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: SECURITY_GROUPS_CONTENT_AUDIT
     *         
      
     *         
      
     *         "{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"
     *         
      
     *         
      
     *         The security group action for content audit can be ALLOW or DENY. For
     *         ALLOW, all in-scope security group rules must be within the allowed range of the policy's
     *         security group rules. For DENY, all in-scope security group rules must not contain a value
     *         or a range that matches a rule value or range in the policy security group.
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: SECURITY_GROUPS_USAGE_AUDIT
     *         
      
     *         
      
     *         "{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Specification for SHIELD_ADVANCED for Amazon CloudFront distributions
     *         
      
     *         
      
     *         "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED|IGNORED|DISABLED\", \"automaticResponseAction\":\"BLOCK|COUNT\"}, \"overrideCustomerWebaclClassic\":true|false}"
     *         
      
     *         
      
     *         For example:
     *         "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"
     *         
      
     *         
      
     *         The default value for automaticResponseStatus is IGNORED. The value for
     *         automaticResponseAction is only required when automaticResponseStatus is set to
     *         ENABLED. The default value for overrideCustomerWebaclClassic is
     *         false.
     *         
      
     *         
      
     *         For other resource types that you can protect with a Shield Advanced policy, this
     *         ManagedServiceData configuration is an empty string.
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: WAFV2 - Account takeover prevention and Bot Control managed rule groups, and rule
     *         action override
     *         
      
     *         
      
     *         "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesATPRuleSet\",\"managedRuleGroupConfigs\":[{\"awsmanagedRulesATPRuleSet\":{\"loginPath\":\"/loginpath\",\"requestInspection\":{\"payloadType\":\"FORM_ENCODED|JSON\",\"usernameField\":{\"identifier\":\"/form/username\"},\"passwordField\":{\"identifier\":\"/form/password\"}}}}]},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[],\"sampledRequestsEnabled\":true},{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesBotControlRuleSet\",\"managedRuleGroupConfigs\":[{\"awsmanagedRulesBotControlRuleSet\":{\"inspectionLevel\":\"TARGETED|COMMON\"}}]},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[],\"sampledRequestsEnabled\":true,\"ruleActionOverrides\":[{\"name\":\"Rule1\",\"actionToUse\":{\"allow|block|count|captcha|challenge\":{}}},{\"name\":\"Rule2\",\"actionToUse\":{\"allow|block|count|captcha|challenge\":{}}}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"customRequestHandling\":null,\"customResponse\":null,\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":null,\"sampledRequestsEnabledForDefaultActions\":true}"
     *         
      
     *         
        
     *         
      • 
     *         
        
     *         Fraud Control account takeover prevention (ATP) - For information about the properties available for
     *         AWSManagedRulesATPRuleSet managed rule groups, see AWSManagedRulesATPRuleSet in the WAF API Reference.
     *         
        
     *         
        • 
     *         
      • 
     *         
        
     *         Bot Control - For information about AWSManagedRulesBotControlRuleSet managed rule groups,
     *         see AWSManagedRulesBotControlRuleSet in the WAF API Reference.
     *         
        
     *         
        • 
     *         
      • 
     *         
        
     *         Rule action overrides - Firewall Manager supports rule action overrides only for managed rule groups. To
     *         configure a RuleActionOverrides add the Name of the rule to override, and
     *         ActionToUse, which is the new action to use for the rule. For information about using rule
     *         action override, see RuleActionOverride in the WAF API Reference.
     *         
        
     *         
        • 
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: WAFV2 - CAPTCHA and Challenge configs
     *         
      
     *         
      
     *         "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesAdminProtectionRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[],\"sampledRequestsEnabled\":true}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"customRequestHandling\":null,\"customResponse\":null,\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":null,\"sampledRequestsEnabledForDefaultActions\":true,\"captchaConfig\":{\"immunityTimeProperty\":{\"immunityTime\":500}},\"challengeConfig\":{\"immunityTimeProperty\":{\"immunityTime\":800}},\"tokenDomains\":[\"google.com\",\"amazon.com\"]}"
     *         
      
     *         
      
     *         If you update the policy's values for captchaConfig, challengeConfig, or
     *         tokenDomains, Firewall Manager will overwrite your local web ACLs to contain the new
     *         value(s). However, if you don't update the policy's captchaConfig,
     *         challengeConfig, or tokenDomains values, the values in your local web ACLs will
     *         remain unchanged. For information about CAPTCHA and Challenge configs, see CaptchaConfig and
     *         ChallengeConfig
     *         in the WAF API Reference.
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: WAFV2 - Firewall Manager support for WAF managed rule group versioning
     *         
      
     *         
      
     *         "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"
     *         
      
     *         
      
     *         To use a specific version of a WAF managed rule group in your Firewall Manager policy, you must set
     *         versionEnabled to true, and set version to the version you'd like
     *         to use. If you don't set versionEnabled to true, or if you omit
     *         versionEnabled, then Firewall Manager uses the default version of the WAF managed rule
     *         group.
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: WAFV2 - Logging configurations
     *         
      
     *         
      
     *         "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null, \"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\": {\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\", \"managedRuleGroupName\":\"AWSManagedRulesAdminProtectionRuleSet\"} ,\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[], \"sampledRequestsEnabled\":true}],\"postProcessRuleGroups\":[], \"defaultAction\":{\"type\":\"ALLOW\"},\"customRequestHandling\" :null,\"customResponse\":null,\"overrideCustomerWebACLAssociation\" :false,\"loggingConfiguration\":{\"logDestinationConfigs\": [\"arn:aws:s3:::aws-waf-logs-example-bucket\"] ,\"redactedFields\":[],\"loggingFilterConfigs\":{\"defaultBehavior\":\"KEEP\", \"filters\":[{\"behavior\":\"KEEP\",\"requirement\":\"MEETS_ALL\", \"conditions\":[{\"actionCondition\":\"CAPTCHA\"},{\"actionCondition\": \"CHALLENGE\"}, {\"actionCondition\":\"EXCLUDED_AS_COUNT\"}]}]}},\"sampledRequestsEnabledForDefaultActions\":true}"
     *         
      
     *         
      
     *         Firewall Manager supports Amazon Kinesis Data Firehose and Amazon S3 as the
     *         logDestinationConfigs in your loggingConfiguration. For information about WAF
     *         logging configurations, see LoggingConfiguration in the WAF API Reference
     *         
      
     *         
      
     *         In the loggingConfiguration, you can specify one logDestinationConfigs.
     *         Optionally provide as many as 20 redactedFields. The RedactedFieldType must be
     *         one of URI, QUERY_STRING, HEADER, or METHOD.
     *         
      
     *         
      • 
     *         
    • 
     *         
      
     *         Example: WAF Classic
     *         
      
     *         
      
     *         "{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"
     *         
      
     *         
      • 
     */
    public final String managedServiceData() {
        return managedServiceData;
    }

    /**
     * 
      
     * Contains the Network Firewall firewall policy options to configure a centralized deployment model.
     * 
      
     * 
     * @return Contains the Network Firewall firewall policy options to configure a centralized deployment model.
     */
    public final PolicyOption policyOption() {
        return policyOption;
    }

    @Override
    public Builder toBuilder() {
        return new BuilderImpl(this);
    }

    public static Builder builder() {
        return new BuilderImpl();
    }

    public static Class serializableBuilderClass() {
        return BuilderImpl.class;
    }

    @Override
    public final int hashCode() {
        int hashCode = 1;
        hashCode = 31 * hashCode + Objects.hashCode(typeAsString());
        hashCode = 31 * hashCode + Objects.hashCode(managedServiceData());
        hashCode = 31 * hashCode + Objects.hashCode(policyOption());
        return hashCode;
    }

    @Override
    public final boolean equals(Object obj) {
        return equalsBySdkFields(obj);
    }

    @Override
    public final boolean equalsBySdkFields(Object obj) {
        if (this == obj) {
            return true;
        }
        if (obj == null) {
            return false;
        }
        if (!(obj instanceof SecurityServicePolicyData)) {
            return false;
        }
        SecurityServicePolicyData other = (SecurityServicePolicyData) obj;
        return Objects.equals(typeAsString(), other.typeAsString())
                && Objects.equals(managedServiceData(), other.managedServiceData())
                && Objects.equals(policyOption(), other.policyOption());
    }

    /**
     * Returns a string representation of this object. This is useful for testing and debugging. Sensitive data will be
     * redacted from this string using a placeholder value.
     */
    @Override
    public final String toString() {
        return ToString.builder("SecurityServicePolicyData").add("Type", typeAsString())
                .add("ManagedServiceData", managedServiceData()).add("PolicyOption", policyOption()).build();
    }

    public final  Optional getValueForField(String fieldName, Class clazz) {
        switch (fieldName) {
        case "Type":
            return Optional.ofNullable(clazz.cast(typeAsString()));
        case "ManagedServiceData":
            return Optional.ofNullable(clazz.cast(managedServiceData()));
        case "PolicyOption":
            return Optional.ofNullable(clazz.cast(policyOption()));
        default:
            return Optional.empty();
        }
    }

    @Override
    public final List> sdkFields() {
        return SDK_FIELDS;
    }

    private static  Function getter(Function g) {
        return obj -> g.apply((SecurityServicePolicyData) obj);
    }

    private static  BiConsumer setter(BiConsumer s) {
        return (obj, val) -> s.accept((Builder) obj, val);
    }

    public interface Builder extends SdkPojo, CopyableBuilder {
        /**
         * 
      
         * The service that the policy is using to protect the resources. This specifies the type of policy that is
         * created, either an WAF policy, a Shield Advanced policy, or a security group policy. For security group
         * policies, Firewall Manager supports one security group for each common policy and for each content audit
         * policy. This is an adjustable limit that you can increase by contacting Amazon Web Services Support.
         * 
      
         * 
         * @param type
         *        The service that the policy is using to protect the resources. This specifies the type of policy that
         *        is created, either an WAF policy, a Shield Advanced policy, or a security group policy. For security
         *        group policies, Firewall Manager supports one security group for each common policy and for each
         *        content audit policy. This is an adjustable limit that you can increase by contacting Amazon Web
         *        Services Support.
         * @see SecurityServiceType
         * @return Returns a reference to this object so that method calls can be chained together.
         * @see SecurityServiceType
         */
        Builder type(String type);

        /**
         * 
      
         * The service that the policy is using to protect the resources. This specifies the type of policy that is
         * created, either an WAF policy, a Shield Advanced policy, or a security group policy. For security group
         * policies, Firewall Manager supports one security group for each common policy and for each content audit
         * policy. This is an adjustable limit that you can increase by contacting Amazon Web Services Support.
         * 
      
         * 
         * @param type
         *        The service that the policy is using to protect the resources. This specifies the type of policy that
         *        is created, either an WAF policy, a Shield Advanced policy, or a security group policy. For security
         *        group policies, Firewall Manager supports one security group for each common policy and for each
         *        content audit policy. This is an adjustable limit that you can increase by contacting Amazon Web
         *        Services Support.
         * @see SecurityServiceType
         * @return Returns a reference to this object so that method calls can be chained together.
         * @see SecurityServiceType
         */
        Builder type(SecurityServiceType type);

        /**
         * 
      
         * Details about the service that are specific to the service type, in JSON format.
         * 
      
         * 
        
         * 
      • 
         * 
        
         * Example: DNS_FIREWALL
         * 
        
         * 
        
         * "{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"
         * 
        
         * 
         * 
        
         * Valid values for preProcessRuleGroups are between 1 and 99. Valid values for
         * postProcessRuleGroups are between 9901 and 10000.
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: IMPORT_NETWORK_FIREWALL
         * "{\"type\":\"IMPORT_NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-2:000000000000:stateless-rulegroup\/rg1\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:drop\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:pass\"],\"networkFirewallStatelessCustomActions\":[],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-2:aws-managed:stateful-rulegroup\/ThreatSignaturesEmergingEventsStrictOrder\",\"priority\":8}],\"networkFirewallStatefulEngineOptions\":{\"ruleOrder\":\"STRICT_ORDER\"},\"networkFirewallStatefulDefaultActions\":[\"aws:drop_strict\"]}}"
         * 
        
         * 
        
         * "{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"
         * 
        
         * 
         * 
        
         * Valid values for preProcessRuleGroups are between 1 and 99. Valid values for
         * postProcessRuleGroups are between 9901 and 10000.
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: NETWORK_FIREWALL - Centralized deployment model
         * 
        
         * 
        
         * "{\"type\":\"NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}},\"firewallDeploymentModel\":{\"centralizedFirewallDeploymentModel\":{\"centralizedFirewallOrchestrationConfig\":{\"inspectionVpcIds\":[{\"resourceId\":\"vpc-1234\",\"accountId\":\"123456789011\"}],\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneId\":null,\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"allowedIPV4CidrList\":[]}}}}"
         * 
        
         * 
        
         * To use the centralized deployment model, you must set PolicyOption to
         * CENTRALIZED.
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone
         * configuration
         * 
        
         * 
        
         *  "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":[\"10.0.0.0/28\",\"192.168.0.0/28\"],\"routeManagementAction\":\"OFF\"},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}}" 
         * 
        
         * 
        
         * With automatic Availbility Zone configuration, Firewall Manager chooses which Availability Zones to create
         * the endpoints in. To use the distributed deployment model, you must set PolicyOption to
         * NULL.
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone
         * configuration and route management
         * 
        
         * 
        
         *  "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":[\"10.0.0.0/28\",\"192.168.0.0/28\"],\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"]},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\": \"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}}" 
         * 
        
         * 
        
         * To use the distributed deployment model, you must set PolicyOption to
         * NULL.
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone
         * configuration
         * 
        
         * 
        
         * "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}" 
         * 
        
         * 
        
         * With custom Availability Zone configuration, you define which specific Availability Zones to create endpoints
         * in by configuring firewallCreationConfig. To configure the Availability Zones in
         * firewallCreationConfig, specify either the availabilityZoneName or
         * availabilityZoneId parameter, not both parameters.
         * 
        
         * 
        
         * To use the distributed deployment model, you must set PolicyOption to
         * NULL.
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone
         * configuration and route management
         * 
        
         * 
        
         * "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}" 
         * 
        
         * 
        
         * To use the distributed deployment model, you must set PolicyOption to
         * NULL.
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: THIRD_PARTY_FIREWALL
         * 
        
         * 
        
         * "{ "type":"THIRD_PARTY_FIREWALL", "thirdPartyFirewall":"PALO_ALTO_NETWORKS_CLOUD_NGFW", "thirdPartyFirewallConfig":{ "thirdPartyFirewallPolicyList":["global-1"] }, "firewallDeploymentModel":{ "distributedFirewallDeploymentModel":{ "distributedFirewallOrchestrationConfig":{ "firewallCreationConfig":{ "endpointLocation":{ "availabilityZoneConfigList":[ { "availabilityZoneName":"${AvailabilityZone}" } ] } }, "allowedIPV4CidrList":[ ] } } } }"
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: SECURITY_GROUPS_COMMON
         * 
        
         * 
        
         * "{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: SECURITY_GROUPS_COMMON - Security group tag distribution
         * 
        
         * 
        
         * ""{\"type\":\"SECURITY_GROUPS_COMMON\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"revertManualSecurityGroupChanges\":true,\"exclusiveResourceSecurityGroupManagement\":false,\"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":false,\"enableTagDistribution\":true}""
         * 
        
         * 
        
         * Firewall Manager automatically distributes tags from the primary group to the security groups created by this
         * policy. To use security group tag distribution, you must also set
         * revertManualSecurityGroupChanges to true, otherwise Firewall Manager won't be able
         * to create the policy. When you enable revertManualSecurityGroupChanges, Firewall Manager
         * identifies and reports when the security groups created by this policy become non-compliant.
         * 
        
         * 
        
         * Firewall Manager won't distrubute system tags added by Amazon Web Services services into the replica security
         * groups. System tags begin with the aws: prefix.
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that
         * the account owns
         * 
        
         * 
        
         * "{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: SECURITY_GROUPS_CONTENT_AUDIT
         * 
        
         * 
        
         * "{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"
         * 
        
         * 
        
         * The security group action for content audit can be ALLOW or DENY. For
         * ALLOW, all in-scope security group rules must be within the allowed range of the policy's
         * security group rules. For DENY, all in-scope security group rules must not contain a value or a
         * range that matches a rule value or range in the policy security group.
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: SECURITY_GROUPS_USAGE_AUDIT
         * 
        
         * 
        
         * "{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Specification for SHIELD_ADVANCED for Amazon CloudFront distributions
         * 
        
         * 
        
         * "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED|IGNORED|DISABLED\", \"automaticResponseAction\":\"BLOCK|COUNT\"}, \"overrideCustomerWebaclClassic\":true|false}"
         * 
        
         * 
        
         * For example:
         * "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"
         * 
        
         * 
        
         * The default value for automaticResponseStatus is IGNORED. The value for
         * automaticResponseAction is only required when automaticResponseStatus is set to
         * ENABLED. The default value for overrideCustomerWebaclClassic is false.
         * 
        
         * 
        
         * For other resource types that you can protect with a Shield Advanced policy, this
         * ManagedServiceData configuration is an empty string.
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: WAFV2 - Account takeover prevention and Bot Control managed rule groups, and rule
         * action override
         * 
        
         * 
        
         * "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesATPRuleSet\",\"managedRuleGroupConfigs\":[{\"awsmanagedRulesATPRuleSet\":{\"loginPath\":\"/loginpath\",\"requestInspection\":{\"payloadType\":\"FORM_ENCODED|JSON\",\"usernameField\":{\"identifier\":\"/form/username\"},\"passwordField\":{\"identifier\":\"/form/password\"}}}}]},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[],\"sampledRequestsEnabled\":true},{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesBotControlRuleSet\",\"managedRuleGroupConfigs\":[{\"awsmanagedRulesBotControlRuleSet\":{\"inspectionLevel\":\"TARGETED|COMMON\"}}]},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[],\"sampledRequestsEnabled\":true,\"ruleActionOverrides\":[{\"name\":\"Rule1\",\"actionToUse\":{\"allow|block|count|captcha|challenge\":{}}},{\"name\":\"Rule2\",\"actionToUse\":{\"allow|block|count|captcha|challenge\":{}}}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"customRequestHandling\":null,\"customResponse\":null,\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":null,\"sampledRequestsEnabledForDefaultActions\":true}"
         * 
        
         * 
          
         * 
        • 
         * 
          
         * Fraud Control account takeover prevention (ATP) - For information about the properties available for
         * AWSManagedRulesATPRuleSet managed rule groups, see AWSManagedRulesATPRuleSet in the WAF API Reference.
         * 
          
         * 
          • 
         * 
        • 
         * 
          
         * Bot Control - For information about AWSManagedRulesBotControlRuleSet managed rule groups, see 
         * AWSManagedRulesBotControlRuleSet in the WAF API Reference.
         * 
          
         * 
          • 
         * 
        • 
         * 
          
         * Rule action overrides - Firewall Manager supports rule action overrides only for managed rule groups. To
         * configure a RuleActionOverrides add the Name of the rule to override, and
         * ActionToUse, which is the new action to use for the rule. For information about using rule
         * action override, see RuleActionOverride
         * in the WAF API Reference.
         * 
          
         * 
          • 
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: WAFV2 - CAPTCHA and Challenge configs
         * 
        
         * 
        
         * "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesAdminProtectionRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[],\"sampledRequestsEnabled\":true}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"customRequestHandling\":null,\"customResponse\":null,\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":null,\"sampledRequestsEnabledForDefaultActions\":true,\"captchaConfig\":{\"immunityTimeProperty\":{\"immunityTime\":500}},\"challengeConfig\":{\"immunityTimeProperty\":{\"immunityTime\":800}},\"tokenDomains\":[\"google.com\",\"amazon.com\"]}"
         * 
        
         * 
        
         * If you update the policy's values for captchaConfig, challengeConfig, or
         * tokenDomains, Firewall Manager will overwrite your local web ACLs to contain the new value(s).
         * However, if you don't update the policy's captchaConfig, challengeConfig, or
         * tokenDomains values, the values in your local web ACLs will remain unchanged. For information
         * about CAPTCHA and Challenge configs, see CaptchaConfig and ChallengeConfig in
         * the WAF API Reference.
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: WAFV2 - Firewall Manager support for WAF managed rule group versioning
         * 
        
         * 
        
         * "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"
         * 
        
         * 
        
         * To use a specific version of a WAF managed rule group in your Firewall Manager policy, you must set
         * versionEnabled to true, and set version to the version you'd like to
         * use. If you don't set versionEnabled to true, or if you omit
         * versionEnabled, then Firewall Manager uses the default version of the WAF managed rule group.
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: WAFV2 - Logging configurations
         * 
        
         * 
        
         * "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null, \"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\": {\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\", \"managedRuleGroupName\":\"AWSManagedRulesAdminProtectionRuleSet\"} ,\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[], \"sampledRequestsEnabled\":true}],\"postProcessRuleGroups\":[], \"defaultAction\":{\"type\":\"ALLOW\"},\"customRequestHandling\" :null,\"customResponse\":null,\"overrideCustomerWebACLAssociation\" :false,\"loggingConfiguration\":{\"logDestinationConfigs\": [\"arn:aws:s3:::aws-waf-logs-example-bucket\"] ,\"redactedFields\":[],\"loggingFilterConfigs\":{\"defaultBehavior\":\"KEEP\", \"filters\":[{\"behavior\":\"KEEP\",\"requirement\":\"MEETS_ALL\", \"conditions\":[{\"actionCondition\":\"CAPTCHA\"},{\"actionCondition\": \"CHALLENGE\"}, {\"actionCondition\":\"EXCLUDED_AS_COUNT\"}]}]}},\"sampledRequestsEnabledForDefaultActions\":true}"
         * 
        
         * 
        
         * Firewall Manager supports Amazon Kinesis Data Firehose and Amazon S3 as the
         * logDestinationConfigs in your loggingConfiguration. For information about WAF
         * logging configurations, see LoggingConfiguration in the WAF API Reference
         * 
        
         * 
        
         * In the loggingConfiguration, you can specify one logDestinationConfigs. Optionally
         * provide as many as 20 redactedFields. The RedactedFieldType must be one of
         * URI, QUERY_STRING, HEADER, or METHOD.
         * 
        
         * 
        • 
         * 
      • 
         * 
        
         * Example: WAF Classic
         * 
        
         * 
        
         * "{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"
         * 
        
         * 
        • 
         * 
      
         * 
         * @param managedServiceData
         *        Details about the service that are specific to the service type, in JSON format. 
      
         *        
        
         *        
      • 
         *        
        
         *        Example: DNS_FIREWALL
         *        
        
         *        
        
         *        "{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"
         *        
        
         *        
         *        
        
         *        Valid values for preProcessRuleGroups are between 1 and 99. Valid values for
         *        postProcessRuleGroups are between 9901 and 10000.
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: IMPORT_NETWORK_FIREWALL
         *        "{\"type\":\"IMPORT_NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-2:000000000000:stateless-rulegroup\/rg1\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:drop\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:pass\"],\"networkFirewallStatelessCustomActions\":[],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-2:aws-managed:stateful-rulegroup\/ThreatSignaturesEmergingEventsStrictOrder\",\"priority\":8}],\"networkFirewallStatefulEngineOptions\":{\"ruleOrder\":\"STRICT_ORDER\"},\"networkFirewallStatefulDefaultActions\":[\"aws:drop_strict\"]}}"
         *        
        
         *        
        
         *        "{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"
         *        
        
         *        
         *        
        
         *        Valid values for preProcessRuleGroups are between 1 and 99. Valid values for
         *        postProcessRuleGroups are between 9901 and 10000.
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: NETWORK_FIREWALL - Centralized deployment model
         *        
        
         *        
        
         *        "{\"type\":\"NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}},\"firewallDeploymentModel\":{\"centralizedFirewallDeploymentModel\":{\"centralizedFirewallOrchestrationConfig\":{\"inspectionVpcIds\":[{\"resourceId\":\"vpc-1234\",\"accountId\":\"123456789011\"}],\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneId\":null,\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"allowedIPV4CidrList\":[]}}}}"
         *        
        
         *        
        
         *        To use the centralized deployment model, you must set PolicyOption
         *        to CENTRALIZED.
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone
         *        configuration
         *        
        
         *        
        
         *         "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":[\"10.0.0.0/28\",\"192.168.0.0/28\"],\"routeManagementAction\":\"OFF\"},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}}" 
         *        
        
         *        
        
         *        With automatic Availbility Zone configuration, Firewall Manager chooses which Availability Zones to
         *        create the endpoints in. To use the distributed deployment model, you must set PolicyOption
         *        to NULL.
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone
         *        configuration and route management
         *        
        
         *        
        
         *         "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":[\"10.0.0.0/28\",\"192.168.0.0/28\"],\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"]},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\": \"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}}" 
         *        
        
         *        
        
         *        To use the distributed deployment model, you must set PolicyOption
         *        to NULL.
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone
         *        configuration
         *        
        
         *        
        
         *        "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}" 
         *        
        
         *        
        
         *        With custom Availability Zone configuration, you define which specific Availability Zones to create
         *        endpoints in by configuring firewallCreationConfig. To configure the Availability Zones
         *        in firewallCreationConfig, specify either the availabilityZoneName or
         *        availabilityZoneId parameter, not both parameters.
         *        
        
         *        
        
         *        To use the distributed deployment model, you must set PolicyOption
         *        to NULL.
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone
         *        configuration and route management
         *        
        
         *        
        
         *        "{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}" 
         *        
        
         *        
        
         *        To use the distributed deployment model, you must set PolicyOption
         *        to NULL.
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: THIRD_PARTY_FIREWALL
         *        
        
         *        
        
         *        "{ "type":"THIRD_PARTY_FIREWALL", "thirdPartyFirewall":"PALO_ALTO_NETWORKS_CLOUD_NGFW", "thirdPartyFirewallConfig":{ "thirdPartyFirewallPolicyList":["global-1"] }, "firewallDeploymentModel":{ "distributedFirewallDeploymentModel":{ "distributedFirewallOrchestrationConfig":{ "firewallCreationConfig":{ "endpointLocation":{ "availabilityZoneConfigList":[ { "availabilityZoneName":"${AvailabilityZone}" } ] } }, "allowedIPV4CidrList":[ ] } } } }"
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: SECURITY_GROUPS_COMMON
         *        
        
         *        
        
         *        "{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: SECURITY_GROUPS_COMMON - Security group tag distribution
         *        
        
         *        
        
         *        ""{\"type\":\"SECURITY_GROUPS_COMMON\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"revertManualSecurityGroupChanges\":true,\"exclusiveResourceSecurityGroupManagement\":false,\"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":false,\"enableTagDistribution\":true}""
         *        
        
         *        
        
         *        Firewall Manager automatically distributes tags from the primary group to the security groups created
         *        by this policy. To use security group tag distribution, you must also set
         *        revertManualSecurityGroupChanges to true, otherwise Firewall Manager won't
         *        be able to create the policy. When you enable revertManualSecurityGroupChanges, Firewall
         *        Manager identifies and reports when the security groups created by this policy become non-compliant.
         *        
        
         *        
        
         *        Firewall Manager won't distrubute system tags added by Amazon Web Services services into the replica
         *        security groups. System tags begin with the aws: prefix.
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in
         *        VPCs that the account owns
         *        
        
         *        
        
         *        "{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: SECURITY_GROUPS_CONTENT_AUDIT
         *        
        
         *        
        
         *        "{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"
         *        
        
         *        
        
         *        The security group action for content audit can be ALLOW or DENY. For
         *        ALLOW, all in-scope security group rules must be within the allowed range of the policy's
         *        security group rules. For DENY, all in-scope security group rules must not contain a
         *        value or a range that matches a rule value or range in the policy security group.
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: SECURITY_GROUPS_USAGE_AUDIT
         *        
        
         *        
        
         *        "{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Specification for SHIELD_ADVANCED for Amazon CloudFront distributions
         *        
        
         *        
        
         *        "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED|IGNORED|DISABLED\", \"automaticResponseAction\":\"BLOCK|COUNT\"}, \"overrideCustomerWebaclClassic\":true|false}"
         *        
        
         *        
        
         *        For example:
         *        "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"
         *        
        
         *        
        
         *        The default value for automaticResponseStatus is IGNORED. The value for
         *        automaticResponseAction is only required when automaticResponseStatus is set
         *        to ENABLED. The default value for overrideCustomerWebaclClassic is
         *        false.
         *        
        
         *        
        
         *        For other resource types that you can protect with a Shield Advanced policy, this
         *        ManagedServiceData configuration is an empty string.
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: WAFV2 - Account takeover prevention and Bot Control managed rule groups, and
         *        rule action override
         *        
        
         *        
        
         *        "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesATPRuleSet\",\"managedRuleGroupConfigs\":[{\"awsmanagedRulesATPRuleSet\":{\"loginPath\":\"/loginpath\",\"requestInspection\":{\"payloadType\":\"FORM_ENCODED|JSON\",\"usernameField\":{\"identifier\":\"/form/username\"},\"passwordField\":{\"identifier\":\"/form/password\"}}}}]},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[],\"sampledRequestsEnabled\":true},{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesBotControlRuleSet\",\"managedRuleGroupConfigs\":[{\"awsmanagedRulesBotControlRuleSet\":{\"inspectionLevel\":\"TARGETED|COMMON\"}}]},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[],\"sampledRequestsEnabled\":true,\"ruleActionOverrides\":[{\"name\":\"Rule1\",\"actionToUse\":{\"allow|block|count|captcha|challenge\":{}}},{\"name\":\"Rule2\",\"actionToUse\":{\"allow|block|count|captcha|challenge\":{}}}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"customRequestHandling\":null,\"customResponse\":null,\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":null,\"sampledRequestsEnabledForDefaultActions\":true}"
         *        
        
         *        
          
         *        
        • 
         *        
          
         *        Fraud Control account takeover prevention (ATP) - For information about the properties available for
         *        AWSManagedRulesATPRuleSet managed rule groups, see AWSManagedRulesATPRuleSet in the WAF API Reference.
         *        
          
         *        
          • 
         *        
        • 
         *        
          
         *        Bot Control - For information about AWSManagedRulesBotControlRuleSet managed rule groups,
         *        see AWSManagedRulesBotControlRuleSet in the WAF API Reference.
         *        
          
         *        
          • 
         *        
        • 
         *        
          
         *        Rule action overrides - Firewall Manager supports rule action overrides only for managed rule groups.
         *        To configure a RuleActionOverrides add the Name of the rule to override, and
         *        ActionToUse, which is the new action to use for the rule. For information about using
         *        rule action override, see RuleActionOverride in the WAF API Reference.
         *        
          
         *        
          • 
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: WAFV2 - CAPTCHA and Challenge configs
         *        
        
         *        
        
         *        "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesAdminProtectionRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[],\"sampledRequestsEnabled\":true}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"customRequestHandling\":null,\"customResponse\":null,\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":null,\"sampledRequestsEnabledForDefaultActions\":true,\"captchaConfig\":{\"immunityTimeProperty\":{\"immunityTime\":500}},\"challengeConfig\":{\"immunityTimeProperty\":{\"immunityTime\":800}},\"tokenDomains\":[\"google.com\",\"amazon.com\"]}"
         *        
        
         *        
        
         *        If you update the policy's values for captchaConfig, challengeConfig, or
         *        tokenDomains, Firewall Manager will overwrite your local web ACLs to contain the new
         *        value(s). However, if you don't update the policy's captchaConfig,
         *        challengeConfig, or tokenDomains values, the values in your local web ACLs
         *        will remain unchanged. For information about CAPTCHA and Challenge configs, see CaptchaConfig
         *        and ChallengeConfig
         *         in the WAF API Reference.
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: WAFV2 - Firewall Manager support for WAF managed rule group versioning
         *        
        
         *        
        
         *        "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"
         *        
        
         *        
        
         *        To use a specific version of a WAF managed rule group in your Firewall Manager policy, you must set
         *        versionEnabled to true, and set version to the version you'd
         *        like to use. If you don't set versionEnabled to true, or if you omit
         *        versionEnabled, then Firewall Manager uses the default version of the WAF managed rule
         *        group.
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: WAFV2 - Logging configurations
         *        
        
         *        
        
         *        "{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null, \"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\": {\"versionEnabled\":null,\"version\":null,\"vendorName\":\"AWS\", \"managedRuleGroupName\":\"AWSManagedRulesAdminProtectionRuleSet\"} ,\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[], \"sampledRequestsEnabled\":true}],\"postProcessRuleGroups\":[], \"defaultAction\":{\"type\":\"ALLOW\"},\"customRequestHandling\" :null,\"customResponse\":null,\"overrideCustomerWebACLAssociation\" :false,\"loggingConfiguration\":{\"logDestinationConfigs\": [\"arn:aws:s3:::aws-waf-logs-example-bucket\"] ,\"redactedFields\":[],\"loggingFilterConfigs\":{\"defaultBehavior\":\"KEEP\", \"filters\":[{\"behavior\":\"KEEP\",\"requirement\":\"MEETS_ALL\", \"conditions\":[{\"actionCondition\":\"CAPTCHA\"},{\"actionCondition\": \"CHALLENGE\"}, {\"actionCondition\":\"EXCLUDED_AS_COUNT\"}]}]}},\"sampledRequestsEnabledForDefaultActions\":true}"
         *        
        
         *        
        
         *        Firewall Manager supports Amazon Kinesis Data Firehose and Amazon S3 as the
         *        logDestinationConfigs in your loggingConfiguration. For information about
         *        WAF logging configurations, see LoggingConfiguration in the WAF API Reference
         *        
        
         *        
        
         *        In the loggingConfiguration, you can specify one logDestinationConfigs.
         *        Optionally provide as many as 20 redactedFields. The RedactedFieldType must
         *        be one of URI, QUERY_STRING, HEADER, or METHOD.
         *        
        
         *        
        • 
         *        
      • 
         *        
        
         *        Example: WAF Classic
         *        
        
         *        
        
         *        "{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"
         *        
        
         *        
        • 
         * @return Returns a reference to this object so that method calls can be chained together.
         */
        Builder managedServiceData(String managedServiceData);

        /**
         * 
        
         * Contains the Network Firewall firewall policy options to configure a centralized deployment model.
         * 
        
         * 
         * @param policyOption
         *        Contains the Network Firewall firewall policy options to configure a centralized deployment model.
         * @return Returns a reference to this object so that method calls can be chained together.
         */
        Builder policyOption(PolicyOption policyOption);

        /**
         * 
        
         * Contains the Network Firewall firewall policy options to configure a centralized deployment model.
         * 
        
         * This is a convenience method that creates an instance of the {@link PolicyOption.Builder} avoiding the need
         * to create one manually via {@link PolicyOption#builder()}.
         *
         * 
        
         * When the {@link Consumer} completes, {@link PolicyOption.Builder#build()} is called immediately and its
         * result is passed to {@link #policyOption(PolicyOption)}.
         * 
         * @param policyOption
         *        a consumer that will call methods on {@link PolicyOption.Builder}
         * @return Returns a reference to this object so that method calls can be chained together.
         * @see #policyOption(PolicyOption)
         */
        default Builder policyOption(Consumer policyOption) {
            return policyOption(PolicyOption.builder().applyMutation(policyOption).build());
        }
    }

    static final class BuilderImpl implements Builder {
        private String type;

        private String managedServiceData;

        private PolicyOption policyOption;

        private BuilderImpl() {
        }

        private BuilderImpl(SecurityServicePolicyData model) {
            type(model.type);
            managedServiceData(model.managedServiceData);
            policyOption(model.policyOption);
        }

        public final String getType() {
            return type;
        }

        public final void setType(String type) {
            this.type = type;
        }

        @Override
        public final Builder type(String type) {
            this.type = type;
            return this;
        }

        @Override
        public final Builder type(SecurityServiceType type) {
            this.type(type == null ? null : type.toString());
            return this;
        }

        public final String getManagedServiceData() {
            return managedServiceData;
        }

        public final void setManagedServiceData(String managedServiceData) {
            this.managedServiceData = managedServiceData;
        }

        @Override
        public final Builder managedServiceData(String managedServiceData) {
            this.managedServiceData = managedServiceData;
            return this;
        }

        public final PolicyOption.Builder getPolicyOption() {
            return policyOption != null ? policyOption.toBuilder() : null;
        }

        public final void setPolicyOption(PolicyOption.BuilderImpl policyOption) {
            this.policyOption = policyOption != null ? policyOption.build() : null;
        }

        @Override
        public final Builder policyOption(PolicyOption policyOption) {
            this.policyOption = policyOption;
            return this;
        }

        @Override
        public SecurityServicePolicyData build() {
            return new SecurityServicePolicyData(this);
        }

        @Override
        public List> sdkFields() {
            return SDK_FIELDS;
        }
    }
}




    © 2015 - 2025 Weber Informatics LLC | Privacy Policy