---
title: Getting Started with Datadog
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Infrastructure > Datadog Resource Catalog
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# aws_elbv2_listener_rule{% #aws_elbv2_listener_rule %}

## `account_id`{% #account_id %}

**Type**: `STRING` 

## `actions`{% #actions %}

**Type**: `UNORDERED_LIST_STRUCT` **Provider name**: `Actions` **Description**: The actions. Each rule must include exactly one of the following types of actions: `forward`, `redirect`, or `fixed-response`, and it must be the last action to be performed. 

- `authenticate_cognito_config`**Type**: `STRUCT`**Provider name**: `AuthenticateCognitoConfig`**Description**: [HTTPS listeners] Information for using Amazon Cognito to authenticate users. Specify only when `Type` is `authenticate-cognito`.
  - `authentication_request_extra_params`**Type**: `MAP_STRING_STRING`**Provider name**: `AuthenticationRequestExtraParams`**Description**: The query parameters (up to 10) to include in the redirect request to the authorization endpoint.
  - `on_unauthenticated_request`**Type**: `STRING`**Provider name**: `OnUnauthenticatedRequest`**Description**: The behavior if the user is not authenticated. The following are possible values:
    - deny`- Return an HTTP 401 Unauthorized error.`
    - allow`- Allow the request to be forwarded to the target.`
    - authenticate`- Redirect the request to the IdP authorization endpoint. This is the default value.`
  - `scope`**Type**: `STRING`**Provider name**: `Scope`**Description**: The set of user claims to be requested from the IdP. The default is `openid`. To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP.
  - `session_cookie_name`**Type**: `STRING`**Provider name**: `SessionCookieName`**Description**: The name of the cookie used to maintain session information. The default is AWSELBAuthSessionCookie.
  - `session_timeout`**Type**: `INT64`**Provider name**: `SessionTimeout`**Description**: The maximum duration of the authentication session, in seconds. The default is 604800 seconds (7 days).
  - `user_pool_arn`**Type**: `STRING`**Provider name**: `UserPoolArn`**Description**: The Amazon Resource Name (ARN) of the Amazon Cognito user pool.
  - `user_pool_client_id`**Type**: `STRING`**Provider name**: `UserPoolClientId`**Description**: The ID of the Amazon Cognito user pool client.
  - `user_pool_domain`**Type**: `STRING`**Provider name**: `UserPoolDomain`**Description**: The domain prefix or fully-qualified domain name of the Amazon Cognito user pool.
- `authenticate_oidc_config`**Type**: `STRUCT`**Provider name**: `AuthenticateOidcConfig`**Description**: [HTTPS listeners] Information about an identity provider that is compliant with OpenID Connect (OIDC). Specify only when `Type` is `authenticate-oidc`.
  - `authentication_request_extra_params`**Type**: `MAP_STRING_STRING`**Provider name**: `AuthenticationRequestExtraParams`**Description**: The query parameters (up to 10) to include in the redirect request to the authorization endpoint.
  - `authorization_endpoint`**Type**: `STRING`**Provider name**: `AuthorizationEndpoint`**Description**: The authorization endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.
  - `client_id`**Type**: `STRING`**Provider name**: `ClientId`**Description**: The OAuth 2.0 client identifier.
  - `client_secret`**Type**: `STRING`**Provider name**: `ClientSecret`**Description**: The OAuth 2.0 client secret. This parameter is required if you are creating a rule. If you are modifying a rule, you can omit this parameter if you set `UseExistingClientSecret` to true.
  - `issuer`**Type**: `STRING`**Provider name**: `Issuer`**Description**: The OIDC issuer identifier of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.
  - `on_unauthenticated_request`**Type**: `STRING`**Provider name**: `OnUnauthenticatedRequest`**Description**: The behavior if the user is not authenticated. The following are possible values:
    - deny`- Return an HTTP 401 Unauthorized error.`
    - allow`- Allow the request to be forwarded to the target.`
    - authenticate`- Redirect the request to the IdP authorization endpoint. This is the default value.`
  - `scope`**Type**: `STRING`**Provider name**: `Scope`**Description**: The set of user claims to be requested from the IdP. The default is `openid`. To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP.
  - `session_cookie_name`**Type**: `STRING`**Provider name**: `SessionCookieName`**Description**: The name of the cookie used to maintain session information. The default is AWSELBAuthSessionCookie.
  - `session_timeout`**Type**: `INT64`**Provider name**: `SessionTimeout`**Description**: The maximum duration of the authentication session, in seconds. The default is 604800 seconds (7 days).
  - `token_endpoint`**Type**: `STRING`**Provider name**: `TokenEndpoint`**Description**: The token endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.
  - `use_existing_client_secret`**Type**: `BOOLEAN`**Provider name**: `UseExistingClientSecret`**Description**: Indicates whether to use the existing client secret when modifying a rule. If you are creating a rule, you can omit this parameter or set it to false.
  - `user_info_endpoint`**Type**: `STRING`**Provider name**: `UserInfoEndpoint`**Description**: The user info endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.
- `fixed_response_config`**Type**: `STRUCT`**Provider name**: `FixedResponseConfig`**Description**: [Application Load Balancer] Information for creating an action that returns a custom HTTP response. Specify only when `Type` is `fixed-response`.
  - `content_type`**Type**: `STRING`**Provider name**: `ContentType`**Description**: The content type. Valid Values: text/plain | text/css | text/html | application/javascript | application/json
  - `message_body`**Type**: `STRING`**Provider name**: `MessageBody`**Description**: The message.
  - `status_code`**Type**: `STRING`**Provider name**: `StatusCode`**Description**: The HTTP response code (2XX, 4XX, or 5XX).
- `forward_config`**Type**: `STRUCT`**Provider name**: `ForwardConfig`**Description**: Information for creating an action that distributes requests among one or more target groups. For Network Load Balancers, you can specify a single target group. Specify only when `Type` is `forward`. If you specify both `ForwardConfig` and `TargetGroupArn`, you can specify only one target group using `ForwardConfig` and it must be the same target group specified in `TargetGroupArn`.
  - `target_group_stickiness_config`**Type**: `STRUCT`**Provider name**: `TargetGroupStickinessConfig`**Description**: The target group stickiness for the rule.
    - `duration_seconds`**Type**: `INT32`**Provider name**: `DurationSeconds`**Description**: The time period, in seconds, during which requests from a client should be routed to the same target group. The range is 1-604800 seconds (7 days).
    - `enabled`**Type**: `BOOLEAN`**Provider name**: `Enabled`**Description**: Indicates whether target group stickiness is enabled.
  - `target_groups`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `TargetGroups`**Description**: The target groups. For Network Load Balancers, you can specify a single target group.
    - `target_group_arn`**Type**: `STRING`**Provider name**: `TargetGroupArn`**Description**: The Amazon Resource Name (ARN) of the target group.
    - `weight`**Type**: `INT32`**Provider name**: `Weight`**Description**: The weight. The range is 0 to 999.
- `order`**Type**: `INT32`**Provider name**: `Order`**Description**: The order for the action. This value is required for rules with multiple actions. The action with the lowest value for order is performed first.
- `redirect_config`**Type**: `STRUCT`**Provider name**: `RedirectConfig`**Description**: [Application Load Balancer] Information for creating a redirect action. Specify only when `Type` is `redirect`.
  - `host`**Type**: `STRING`**Provider name**: `Host`**Description**: The hostname. This component is not percent-encoded. The hostname can contain #{host}.
  - `path`**Type**: `STRING`**Provider name**: `Path`**Description**: The absolute path, starting with the leading "/". This component is not percent-encoded. The path can contain #{host}, #{path}, and #{port}.
  - `port`**Type**: `STRING`**Provider name**: `Port`**Description**: The port. You can specify a value from 1 to 65535 or #{port}.
  - `protocol`**Type**: `STRING`**Provider name**: `Protocol`**Description**: The protocol. You can specify HTTP, HTTPS, or #{protocol}. You can redirect HTTP to HTTP, HTTP to HTTPS, and HTTPS to HTTPS. You can't redirect HTTPS to HTTP.
  - `query`**Type**: `STRING`**Provider name**: `Query`**Description**: The query parameters, URL-encoded when necessary, but not percent-encoded. Do not include the leading "?", as it is automatically added. You can specify any of the reserved keywords.
  - `status_code`**Type**: `STRING`**Provider name**: `StatusCode`**Description**: The HTTP redirect code. The redirect is either permanent (HTTP 301) or temporary (HTTP 302).
- `target_group_arn`**Type**: `STRING`**Provider name**: `TargetGroupArn`**Description**: The Amazon Resource Name (ARN) of the target group. Specify only when `Type` is `forward` and you want to route to a single target group. To route to one or more target groups, use `ForwardConfig` instead.
- `type`**Type**: `STRING`**Provider name**: `Type`**Description**: The type of action.

## `alpn_policy`{% #alpn_policy %}

**Type**: `UNORDERED_LIST_STRING` **Provider name**: `AlpnPolicy` **Description**: [TLS listener] The name of the Application-Layer Protocol Negotiation (ALPN) policy. 

## `certificates`{% #certificates %}

**Type**: `UNORDERED_LIST_STRUCT` **Provider name**: `Certificates` **Description**: [HTTPS or TLS listener] The default certificate for the listener. 

- `certificate_arn`**Type**: `STRING`**Provider name**: `CertificateArn`**Description**: The Amazon Resource Name (ARN) of the certificate.
- `is_default`**Type**: `BOOLEAN`**Provider name**: `IsDefault`**Description**: Indicates whether the certificate is the default certificate. Do not set this value when specifying a certificate as an input. This value is not included in the output when describing a listener, but is included when describing listener certificates.

## `conditions`{% #conditions %}

**Type**: `UNORDERED_LIST_STRUCT` **Provider name**: `Conditions` **Description**: The conditions. Each rule can include zero or one of the following conditions: `http-request-method`, `host-header`, `path-pattern`, and `source-ip`, and zero or more of the following conditions: `http-header` and `query-string`. 

- `field`**Type**: `STRING`**Provider name**: `Field`**Description**: The field in the HTTP request. The following are the possible values:
  - `http-header`
  - `http-request-method`
  - `host-header`
  - `path-pattern`
  - `query-string`
  - `source-ip`
- `host_header_config`**Type**: `STRUCT`**Provider name**: `HostHeaderConfig`**Description**: Information for a host header condition. Specify only when `Field` is `host-header`.
  - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The host names. The maximum size of each name is 128 characters. The comparison is case insensitive. The following wildcard characters are supported: * (matches 0 or more characters) and ? (matches exactly 1 character). If you specify multiple strings, the condition is satisfied if one of the strings matches the host name.
- `http_header_config`**Type**: `STRUCT`**Provider name**: `HttpHeaderConfig`**Description**: Information for an HTTP header condition. Specify only when `Field` is `http-header`.
  - `http_header_name`**Type**: `STRING`**Provider name**: `HttpHeaderName`**Description**: The name of the HTTP header field. The maximum size is 40 characters. The header name is case insensitive. The allowed characters are specified by RFC 7230. Wildcards are not supported. You can't use an HTTP header condition to specify the host header. Use HostHeaderConditionConfig to specify a host header condition.
  - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The strings to compare against the value of the HTTP header. The maximum size of each string is 128 characters. The comparison strings are case insensitive. The following wildcard characters are supported: * (matches 0 or more characters) and ? (matches exactly 1 character). If the same header appears multiple times in the request, we search them in order until a match is found. If you specify multiple strings, the condition is satisfied if one of the strings matches the value of the HTTP header. To require that all of the strings are a match, create one condition per string.
- `http_request_method_config`**Type**: `STRUCT`**Provider name**: `HttpRequestMethodConfig`**Description**: Information for an HTTP method condition. Specify only when `Field` is `http-request-method`.
  - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The name of the request method. The maximum size is 40 characters. The allowed characters are A-Z, hyphen (-), and underscore (_). The comparison is case sensitive. Wildcards are not supported; therefore, the method name must be an exact match. If you specify multiple strings, the condition is satisfied if one of the strings matches the HTTP request method. We recommend that you route GET and HEAD requests in the same way, because the response to a HEAD request may be cached.
- `path_pattern_config`**Type**: `STRUCT`**Provider name**: `PathPatternConfig`**Description**: Information for a path pattern condition. Specify only when `Field` is `path-pattern`.
  - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The path patterns to compare against the request URL. The maximum size of each string is 128 characters. The comparison is case sensitive. The following wildcard characters are supported: * (matches 0 or more characters) and ? (matches exactly 1 character). If you specify multiple strings, the condition is satisfied if one of them matches the request URL. The path pattern is compared only to the path of the URL, not to its query string. To compare against the query string, use QueryStringConditionConfig.
- `query_string_config`**Type**: `STRUCT`**Provider name**: `QueryStringConfig`**Description**: Information for a query string condition. Specify only when `Field` is `query-string`.
  - `values`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `Values`**Description**: The key/value pairs or values to find in the query string. The maximum size of each string is 128 characters. The comparison is case insensitive. The following wildcard characters are supported: * (matches 0 or more characters) and ? (matches exactly 1 character). To search for a literal '*' or '?' character in a query string, you must escape these characters in `Values` using a '' character. If you specify multiple key/value pairs or values, the condition is satisfied if one of them is found in the query string.
    - `key`**Type**: `STRING`**Provider name**: `Key`**Description**: The key. You can omit the key.
    - `value`**Type**: `STRING`**Provider name**: `Value`**Description**: The value.
- `source_ip_config`**Type**: `STRUCT`**Provider name**: `SourceIpConfig`**Description**: Information for a source IP condition. Specify only when `Field` is `source-ip`.
  - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The source IP addresses, in CIDR format. You can use both IPv4 and IPv6 addresses. Wildcards are not supported. If you specify multiple addresses, the condition is satisfied if the source IP address of the request matches one of the CIDR blocks. This condition is not satisfied by the addresses in the X-Forwarded-For header. To search for addresses in the X-Forwarded-For header, use HttpHeaderConditionConfig. The total number of values must be less than, or equal to five.
- `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The condition value. Specify only when `Field` is `host-header` or `path-pattern`. Alternatively, to specify multiple host names or multiple path patterns, use `HostHeaderConfig` or `PathPatternConfig`. If `Field` is `host-header` and you are not using `HostHeaderConfig`, you can specify a single host name (for example, my.example.com) in `Values`. A host name is case insensitive, can be up to 128 characters in length, and can contain any of the following characters.
  - A-Z, a-z, 0-9
  - - .
  - \* (matches 0 or more characters)
  - ? (matches exactly 1 character)
If `Field` is `path-pattern` and you are not using `PathPatternConfig`, you can specify a single path pattern (for example, /img/*) in `Values`. A path pattern is case-sensitive, can be up to 128 characters in length, and can contain any of the following characters.
  - A-Z, a-z, 0-9
  - _ - . $ / ~ " ' @ : +
  - & (using &)
  - \* (matches 0 or more characters)
  - ? (matches exactly 1 character)

## `default_actions`{% #default_actions %}

**Type**: `UNORDERED_LIST_STRUCT` **Provider name**: `DefaultActions` **Description**: The default actions for the listener. 

- `authenticate_cognito_config`**Type**: `STRUCT`**Provider name**: `AuthenticateCognitoConfig`**Description**: [HTTPS listeners] Information for using Amazon Cognito to authenticate users. Specify only when `Type` is `authenticate-cognito`.
  - `authentication_request_extra_params`**Type**: `MAP_STRING_STRING`**Provider name**: `AuthenticationRequestExtraParams`**Description**: The query parameters (up to 10) to include in the redirect request to the authorization endpoint.
  - `on_unauthenticated_request`**Type**: `STRING`**Provider name**: `OnUnauthenticatedRequest`**Description**: The behavior if the user is not authenticated. The following are possible values:
    - deny`- Return an HTTP 401 Unauthorized error.`
    - allow`- Allow the request to be forwarded to the target.`
    - authenticate`- Redirect the request to the IdP authorization endpoint. This is the default value.`
  - `scope`**Type**: `STRING`**Provider name**: `Scope`**Description**: The set of user claims to be requested from the IdP. The default is `openid`. To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP.
  - `session_cookie_name`**Type**: `STRING`**Provider name**: `SessionCookieName`**Description**: The name of the cookie used to maintain session information. The default is AWSELBAuthSessionCookie.
  - `session_timeout`**Type**: `INT64`**Provider name**: `SessionTimeout`**Description**: The maximum duration of the authentication session, in seconds. The default is 604800 seconds (7 days).
  - `user_pool_arn`**Type**: `STRING`**Provider name**: `UserPoolArn`**Description**: The Amazon Resource Name (ARN) of the Amazon Cognito user pool.
  - `user_pool_client_id`**Type**: `STRING`**Provider name**: `UserPoolClientId`**Description**: The ID of the Amazon Cognito user pool client.
  - `user_pool_domain`**Type**: `STRING`**Provider name**: `UserPoolDomain`**Description**: The domain prefix or fully-qualified domain name of the Amazon Cognito user pool.
- `authenticate_oidc_config`**Type**: `STRUCT`**Provider name**: `AuthenticateOidcConfig`**Description**: [HTTPS listeners] Information about an identity provider that is compliant with OpenID Connect (OIDC). Specify only when `Type` is `authenticate-oidc`.
  - `authentication_request_extra_params`**Type**: `MAP_STRING_STRING`**Provider name**: `AuthenticationRequestExtraParams`**Description**: The query parameters (up to 10) to include in the redirect request to the authorization endpoint.
  - `authorization_endpoint`**Type**: `STRING`**Provider name**: `AuthorizationEndpoint`**Description**: The authorization endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.
  - `client_id`**Type**: `STRING`**Provider name**: `ClientId`**Description**: The OAuth 2.0 client identifier.
  - `client_secret`**Type**: `STRING`**Provider name**: `ClientSecret`**Description**: The OAuth 2.0 client secret. This parameter is required if you are creating a rule. If you are modifying a rule, you can omit this parameter if you set `UseExistingClientSecret` to true.
  - `issuer`**Type**: `STRING`**Provider name**: `Issuer`**Description**: The OIDC issuer identifier of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.
  - `on_unauthenticated_request`**Type**: `STRING`**Provider name**: `OnUnauthenticatedRequest`**Description**: The behavior if the user is not authenticated. The following are possible values:
    - deny`- Return an HTTP 401 Unauthorized error.`
    - allow`- Allow the request to be forwarded to the target.`
    - authenticate`- Redirect the request to the IdP authorization endpoint. This is the default value.`
  - `scope`**Type**: `STRING`**Provider name**: `Scope`**Description**: The set of user claims to be requested from the IdP. The default is `openid`. To verify which scope values your IdP supports and how to separate multiple values, see the documentation for your IdP.
  - `session_cookie_name`**Type**: `STRING`**Provider name**: `SessionCookieName`**Description**: The name of the cookie used to maintain session information. The default is AWSELBAuthSessionCookie.
  - `session_timeout`**Type**: `INT64`**Provider name**: `SessionTimeout`**Description**: The maximum duration of the authentication session, in seconds. The default is 604800 seconds (7 days).
  - `token_endpoint`**Type**: `STRING`**Provider name**: `TokenEndpoint`**Description**: The token endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.
  - `use_existing_client_secret`**Type**: `BOOLEAN`**Provider name**: `UseExistingClientSecret`**Description**: Indicates whether to use the existing client secret when modifying a rule. If you are creating a rule, you can omit this parameter or set it to false.
  - `user_info_endpoint`**Type**: `STRING`**Provider name**: `UserInfoEndpoint`**Description**: The user info endpoint of the IdP. This must be a full URL, including the HTTPS protocol, the domain, and the path.
- `fixed_response_config`**Type**: `STRUCT`**Provider name**: `FixedResponseConfig`**Description**: [Application Load Balancer] Information for creating an action that returns a custom HTTP response. Specify only when `Type` is `fixed-response`.
  - `content_type`**Type**: `STRING`**Provider name**: `ContentType`**Description**: The content type. Valid Values: text/plain | text/css | text/html | application/javascript | application/json
  - `message_body`**Type**: `STRING`**Provider name**: `MessageBody`**Description**: The message.
  - `status_code`**Type**: `STRING`**Provider name**: `StatusCode`**Description**: The HTTP response code (2XX, 4XX, or 5XX).
- `forward_config`**Type**: `STRUCT`**Provider name**: `ForwardConfig`**Description**: Information for creating an action that distributes requests among multiple target groups. Specify only when `Type` is `forward`. If you specify both `ForwardConfig` and `TargetGroupArn`, you can specify only one target group using `ForwardConfig` and it must be the same target group specified in `TargetGroupArn`.
  - `target_group_stickiness_config`**Type**: `STRUCT`**Provider name**: `TargetGroupStickinessConfig`**Description**: The target group stickiness for the rule.
    - `duration_seconds`**Type**: `INT32`**Provider name**: `DurationSeconds`**Description**: [Application Load Balancers] The time period, in seconds, during which requests from a client should be routed to the same target group. The range is 1-604800 seconds (7 days). You must specify this value when enabling target group stickiness.
    - `enabled`**Type**: `BOOLEAN`**Provider name**: `Enabled`**Description**: Indicates whether target group stickiness is enabled.
  - `target_groups`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `TargetGroups`**Description**: The target groups.
    - `target_group_arn`**Type**: `STRING`**Provider name**: `TargetGroupArn`**Description**: The Amazon Resource Name (ARN) of the target group.
    - `weight`**Type**: `INT32`**Provider name**: `Weight`**Description**: The weight. The range is 0 to 999.
- `jwt_validation_config`**Type**: `STRUCT`**Provider name**: `JwtValidationConfig`**Description**: [HTTPS listeners] Information for validating JWT access tokens in client requests. Specify only when `Type` is `jwt-validation`.
  - `additional_claims`**Type**: `UNORDERED_LIST_STRUCT`**Provider name**: `AdditionalClaims`**Description**: Additional claims to validate. The maximum size of the list is 10. We validate the `exp`, `iss`, `nbf`, and `iat` claims by default.
    - `format`**Type**: `STRING`**Provider name**: `Format`**Description**: The format of the claim value.
    - `name`**Type**: `STRING`**Provider name**: `Name`**Description**: The name of the claim. You can't specify `exp`, `iss`, `nbf`, or `iat` because we validate them by default.
    - `values`**Type**: `UNORDERED_LIST_STRING`**Provider name**: `Values`**Description**: The claim value. The maximum size of the list is 10. Each value can be up to 256 characters in length. If the format is `space-separated-values`, the values can't include spaces.
  - `issuer`**Type**: `STRING`**Provider name**: `Issuer`**Description**: The issuer of the JWT. The maximum length is 256 characters.
  - `jwks_endpoint`**Type**: `STRING`**Provider name**: `JwksEndpoint`**Description**: The JSON Web Key Set (JWKS) endpoint. This endpoint contains JSON Web Keys (JWK) that are used to validate signatures from the provider. This must be a full URL, including the HTTPS protocol, the domain, and the path. The maximum length is 256 characters.
- `order`**Type**: `INT32`**Provider name**: `Order`**Description**: The order for the action. This value is required for rules with multiple actions. The action with the lowest value for order is performed first.
- `redirect_config`**Type**: `STRUCT`**Provider name**: `RedirectConfig`**Description**: [Application Load Balancer] Information for creating a redirect action. Specify only when `Type` is `redirect`.
  - `host`**Type**: `STRING`**Provider name**: `Host`**Description**: The hostname. This component is not percent-encoded. The hostname can contain #{host}.
  - `path`**Type**: `STRING`**Provider name**: `Path`**Description**: The absolute path, starting with the leading "/". This component is not percent-encoded. The path can contain #{host}, #{path}, and #{port}.
  - `port`**Type**: `STRING`**Provider name**: `Port`**Description**: The port. You can specify a value from 1 to 65535 or #{port}.
  - `protocol`**Type**: `STRING`**Provider name**: `Protocol`**Description**: The protocol. You can specify HTTP, HTTPS, or #{protocol}. You can redirect HTTP to HTTP, HTTP to HTTPS, and HTTPS to HTTPS. You can't redirect HTTPS to HTTP.
  - `query`**Type**: `STRING`**Provider name**: `Query`**Description**: The query parameters, URL-encoded when necessary, but not percent-encoded. Do not include the leading "?", as it is automatically added. You can specify any of the reserved keywords.
  - `status_code`**Type**: `STRING`**Provider name**: `StatusCode`**Description**: The HTTP redirect code. The redirect is either permanent (HTTP 301) or temporary (HTTP 302).
- `target_group_arn`**Type**: `STRING`**Provider name**: `TargetGroupArn`**Description**: The Amazon Resource Name (ARN) of the target group. Specify only when `Type` is `forward` and you want to route to a single target group. To route to multiple target groups, you must use `ForwardConfig` instead.
- `type`**Type**: `STRING`**Provider name**: `Type`**Description**: The type of action.

## `is_default`{% #is_default %}

**Type**: `BOOLEAN` **Provider name**: `IsDefault` **Description**: Indicates whether this is the default rule. 

## `listener_arn`{% #listener_arn %}

**Type**: `STRING` **Provider name**: `ListenerArn` **Description**: The Amazon Resource Name (ARN) of the listener. 

## `load_balancer_arn`{% #load_balancer_arn %}

**Type**: `STRING` **Provider name**: `LoadBalancerArn` **Description**: The Amazon Resource Name (ARN) of the load balancer. 

## `mutual_authentication`{% #mutual_authentication %}

**Type**: `STRUCT` **Provider name**: `MutualAuthentication` **Description**: The mutual authentication configuration information. 

- `advertise_trust_store_ca_names`**Type**: `STRING`**Provider name**: `AdvertiseTrustStoreCaNames`**Description**: Indicates whether trust store CA certificate names are advertised.
- `ignore_client_certificate_expiry`**Type**: `BOOLEAN`**Provider name**: `IgnoreClientCertificateExpiry`**Description**: Indicates whether expired client certificates are ignored.
- `mode`**Type**: `STRING`**Provider name**: `Mode`**Description**: The client certificate handling method. Options are `off`, `passthrough` or `verify`. The default value is `off`.
- `trust_store_arn`**Type**: `STRING`**Provider name**: `TrustStoreArn`**Description**: The Amazon Resource Name (ARN) of the trust store.
- `trust_store_association_status`**Type**: `STRING`**Provider name**: `TrustStoreAssociationStatus`**Description**: Indicates a shared trust stores association status.

## `port`{% #port %}

**Type**: `INT32` **Provider name**: `Port` **Description**: The port on which the load balancer is listening. 

## `priority`{% #priority %}

**Type**: `STRING` **Provider name**: `Priority` **Description**: The priority. 

## `protocol`{% #protocol %}

**Type**: `STRING` **Provider name**: `Protocol` **Description**: The protocol for connections from clients to the load balancer. 

## `rule_arn`{% #rule_arn %}

**Type**: `STRING` 

## `ssl_policy`{% #ssl_policy %}

**Type**: `STRING` **Provider name**: `SslPolicy` **Description**: [HTTPS or TLS listener] The security policy that defines which protocols and ciphers are supported. 

## `tags`{% #tags %}

**Type**: `UNORDERED_LIST_STRING`