Firewall Management Service Update: AWS Firewall Manager now supports the network firewall service stream exception policy feature for accounts within your organization.

Author: AWS

.changes/next-release/feature-FirewallManagementService-6551ab8.json

@@ -0,0 +1,6 @@
+{
+    "type": "feature",
+    "category": "Firewall Management Service",
+    "contributor": "",
+    "description": "AWS Firewall Manager now supports the network firewall service stream exception policy feature for accounts within your organization."
+}

services/fms/src/main/resources/codegen-resources/service-2.json

@@ -2633,15 +2633,15 @@
       "members":{
         "FirstEntries":{
           "shape":"NetworkAclEntries",
-          "documentation":"<p>The rules that you want to run first in the Firewall Manager managed network ACLs. </p> <note> <p>Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates. </p> </note>"
+          "documentation":"<p>The rules that you want to run first in the Firewall Manager managed network ACLs. </p> <note> <p>Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates. </p> </note> <p>You must specify at least one first entry or one last entry in any network ACL policy. </p>"
         },
         "ForceRemediateForFirstEntries":{
           "shape":"BooleanObject",
           "documentation":"<p>Applies only when remediation is enabled for the policy as a whole. Firewall Manager uses this setting when it finds policy violations that involve conflicts between the custom entries and the policy entries. </p> <p>If forced remediation is disabled, Firewall Manager marks the network ACL as noncompliant and does not try to remediate. For more information about the remediation behavior, see <a href=\"https://docs.aws.amazon.com/waf/latest/developerguide/network-acl-policies.html\">Network access control list (ACL) policies</a> in the <i>Firewall Manager Developer Guide</i>.</p>"
         },
         "LastEntries":{
           "shape":"NetworkAclEntries",
-          "documentation":"<p>The rules that you want to run last in the Firewall Manager managed network ACLs. </p> <note> <p>Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates. </p> </note>"
+          "documentation":"<p>The rules that you want to run last in the Firewall Manager managed network ACLs. </p> <note> <p>Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates. </p> </note> <p>You must specify at least one first entry or one last entry in any network ACL policy. </p>"
         },
         "ForceRemediateForLastEntries":{
           "shape":"BooleanObject",
@@ -4241,7 +4241,11 @@
       "members":{
         "RuleOrder":{
           "shape":"RuleOrder",
-          "documentation":"<p>Indicates how to manage the order of stateful rule evaluation for the policy. <code>DEFAULT_ACTION_ORDER</code> is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see <a href=\"https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-rule-evaluation-order.html\">Evaluation order for stateful rules</a> in the <i>Network Firewall Developer Guide</i>.</p>"
+          "documentation":"<p>Indicates how to manage the order of stateful rule evaluation for the policy. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on certain settings. For more information, see <a href=\"https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-rule-evaluation-order.html\">Evaluation order for stateful rules</a> in the <i>Network Firewall Developer Guide</i>.</p> <p>Default: <code>DEFAULT_ACTION_ORDER</code> </p>"
+        },
+        "StreamExceptionPolicy":{
+          "shape":"StreamExceptionPolicy",
+          "documentation":"<p>Indicates how Network Firewall should handle traffic when a network connection breaks midstream.</p> <ul> <li> <p> <code>DROP</code> - Fail closed and drop all subsequent traffic going to the firewall.</p> </li> <li> <p> <code>CONTINUE</code> - Continue to apply rules to subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on context. For example, with a stateful rule that drops HTTP traffic, Network Firewall won't match subsequent traffic because the it won't have the context from session initialization, which defines the application layer protocol as HTTP. However, a TCP-layer rule using a <code>flow:stateless</code> rule would still match, and so would the <code>aws:drop_strict</code> default action. </p> </li> <li> <p> <code>REJECT</code> - Fail closed and drop all subsequent traffic going to the firewall. With this option, Network Firewall also sends a TCP reject packet back to the client so the client can immediately establish a new session. With the new session, Network Firewall will have context and will apply rules appropriately.</p> <p>For applications that are reliant on long-lived TCP connections that trigger Gateway Load Balancer idle timeouts, this is the recommended setting. </p> </li> <li> <p> <code>FMS_IGNORE</code> - Firewall Manager doesn't monitor or modify the Network Firewall stream exception policy settings. </p> </li> </ul> <p>For more information, see <a href=\"https://docs.aws.amazon.com/network-firewall/latest/developerguide/stream-exception-policy.html\">Stream exception policy in your firewall policy</a> in the <i>Network Firewall Developer Guide</i>.</p> <p>Default: <code>FMS_IGNORE</code> </p>"
         }
       },
       "documentation":"<p>Configuration settings for the handling of the stateful rule groups in a Network Firewall firewall policy.</p>"
@@ -4299,6 +4303,15 @@
       "max":65535,
       "min":1
     },
+    "StreamExceptionPolicy":{
+      "type":"string",
+      "enum":[
+        "DROP",
+        "CONTINUE",
+        "REJECT",
+        "FMS_IGNORE"
+      ]
+    },
     "Tag":{
       "type":"structure",
       "required":[