aws_network_firewall_firewall

account_id

Type: STRING

delete_protection

Type: BOOLEAN
Provider name: DeleteProtection
Description: A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE.

description

Type: STRING
Provider name: Description
Description: A description of the firewall.

encryption_configuration

Type: STRUCT
Provider name: EncryptionConfiguration
Description: A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall.

• key_id
  Type: STRING
  Provider name: KeyId
  Description: The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you’re using a key that’s managed by another account. If you’re using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide.
  
• type
  Type: STRING
  Provider name: Type
  Description: The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.
  

firewall_arn

Type: STRING
Provider name: FirewallArn
Description: The Amazon Resource Name (ARN) of the firewall.

firewall_id

Type: STRING
Provider name: FirewallId
Description: The unique identifier for the firewall.

firewall_name

Type: STRING
Provider name: FirewallName
Description: The descriptive name of the firewall. You can’t change the name of a firewall after you create it.

firewall_policy

Type: STRUCT
Provider name: FirewallPolicy
Description: The policy for the specified firewall policy.

• policy_variables
  Type: STRUCT
  Provider name: PolicyVariables
  Description: Contains variables that you can use to override default Suricata settings in your firewall policy.
  
  • rule_variables
    Type: STRING
    Provider name: RuleVariables
    Description: The IPv4 or IPv6 addresses in CIDR notation to use for the Suricata HOME_NET variable. If your firewall uses an inspection VPC, you might want to override the HOME_NET variable with the CIDRs of your home networks. If you don’t override HOME_NET with your own CIDRs, Network Firewall by default uses the CIDR of your inspection VPC.
    
• stateful_default_actions
  Type: UNORDERED_LIST_STRING
  Provider name: StatefulDefaultActions
  Description: The default actions to take on a packet that doesn’t match any stateful rules. The stateful default action is optional, and is only valid when using the strict rule order. Valid values of the stateful default action:
  • aws:drop_strict
  • aws:drop_established
  • aws:alert_strict
  • aws:alert_established
  For more information, see Strict evaluation order in the Network Firewall Developer Guide.
  
• stateful_engine_options
  Type: STRUCT
  Provider name: StatefulEngineOptions
  Description: Additional options governing how Network Firewall handles stateful rules. The stateful rule groups that you use in your policy must have stateful rule options settings that are compatible with these settings.
  
  • rule_order
    Type: STRING
    Provider name: RuleOrder
    Description: Indicates how to manage the order of stateful rule evaluation for the policy. STRICT_ORDER is the default and recommended option. With STRICT_ORDER, provide your rules in the order that you want them to be evaluated. You can then choose one or more default actions for packets that don’t match any rules. Choose STRICT_ORDER to have the stateful rules engine determine the evaluation order of your rules. The default action for this rule order is PASS, followed by DROP, REJECT, and ALERT actions. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on your settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide.
    
  • stream_exception_policy
    Type: STRING
    Provider name: StreamExceptionPolicy
    Description: Configures how Network Firewall processes traffic when a network connection breaks midstream. Network connections can break due to disruptions in external networks or within the firewall itself.
    • DROP - Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior.
    • CONTINUE - Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule to drop http traffic, Network Firewall won’t match the traffic for this rule because the service won’t have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using a flow:stateless rule would still match, as would the aws:drop_strict default action.
    • REJECT - Network Firewall fails closed and drops all subsequent traffic going to the firewall. Network Firewall also sends a TCP reject packet back to your client so that the client can immediately establish a new session. Network Firewall will have context about the new session and will apply rules to the subsequent traffic.
• stateful_rule_group_references
  Type: UNORDERED_LIST_STRUCT
  Provider name: StatefulRuleGroupReferences
  Description: References to the stateful rule groups that are used in the policy. These define the inspection criteria in stateful rules.
  
  • override
    Type: STRUCT
    Provider name: Override
    Description: The action that allows the policy owner to override the behavior of the rule group within a policy.
    
    • action
      Type: STRING
      Provider name: Action
      Description: The action that changes the rule group from DROP to ALERT. This only applies to managed rule groups.
      
  • priority
    Type: INT32
    Provider name: Priority
    Description: An integer setting that indicates the order in which to run the stateful rule groups in a single FirewallPolicy. This setting only applies to firewall policies that specify the STRICT_ORDER rule order in the stateful engine options settings. Network Firewall evalutes each stateful rule group against a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy. You can change the priority settings of your rule groups at any time. To make it easier to insert rule groups later, number them so there’s a wide range in between, for example use 100, 200, and so on.
    
  • resource_arn
    Type: STRING
    Provider name: ResourceArn
    Description: The Amazon Resource Name (ARN) of the stateful rule group.
    
• stateless_custom_actions
  Type: UNORDERED_LIST_STRUCT
  Provider name: StatelessCustomActions
  Description: The custom action definitions that are available for use in the firewall policy’s StatelessDefaultActions setting. You name each custom action that you define, and then you can use it by name in your default actions specifications.
  
  • action_definition
    Type: STRUCT
    Provider name: ActionDefinition
    Description: The custom action associated with the action name.
    
    • publish_metric_action
      Type: STRUCT
      Provider name: PublishMetricAction
      Description: Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published. You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.
      
      • dimensions
        Type: UNORDERED_LIST_STRUCT
        Provider name: Dimensions
        Description:
        
        • value
          Type: STRING
          Provider name: Value
          Description: The value to use in the custom metric dimension.
          
  • action_name
    Type: STRING
    Provider name: ActionName
    Description: The descriptive name of the custom action. You can’t change the name of a custom action after you create it.
    
• stateless_default_actions
  Type: UNORDERED_LIST_STRING
  Provider name: StatelessDefaultActions
  Description: The actions to take on a packet if it doesn’t match any of the stateless rules in the policy. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe. You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice. For example, you could specify [“aws:pass”] or you could specify [“aws:pass”, “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.
  
• stateless_fragment_default_actions
  Type: UNORDERED_LIST_STRING
  Provider name: StatelessFragmentDefaultActions
  Description: The actions to take on a fragmented UDP packet if it doesn’t match any of the stateless rules in the policy. Network Firewall only manages UDP packet fragments and silently drops packet fragments for other protocols. If you want non-matching fragmented UDP packets to be forwarded for stateful inspection, specify aws:forward_to_sfe. You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice. For example, you could specify [“aws:pass”] or you could specify [“aws:pass”, “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.
  
• stateless_rule_group_references
  Type: UNORDERED_LIST_STRUCT
  Provider name: StatelessRuleGroupReferences
  Description: References to the stateless rule groups that are used in the policy. These define the matching criteria in stateless rules.
  
  • priority
    Type: INT32
    Provider name: Priority
    Description: An integer setting that indicates the order in which to run the stateless rule groups in a single FirewallPolicy. Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy.
    
  • resource_arn
    Type: STRING
    Provider name: ResourceArn
    Description: The Amazon Resource Name (ARN) of the stateless rule group.
    
• tls_inspection_configuration_arn
  Type: STRING
  Provider name: TLSInspectionConfigurationArn
  Description: The Amazon Resource Name (ARN) of the TLS inspection configuration.
  

firewall_policy_arn

Type: STRING
Provider name: FirewallPolicyArn
Description: The Amazon Resource Name (ARN) of the firewall policy. The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.

firewall_policy_change_protection

Type: BOOLEAN
Provider name: FirewallPolicyChangeProtection
Description: A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

firewall_policy_response

Type: STRUCT
Provider name: FirewallPolicyResponse
Description: The high-level properties of a firewall policy. This, along with the FirewallPolicy, define the policy. You can retrieve all objects for a firewall policy by calling DescribeFirewallPolicy.

• consumed_stateful_rule_capacity
  Type: INT32
  Provider name: ConsumedStatefulRuleCapacity
  Description: The number of capacity units currently consumed by the policy’s stateful rules.
  
• consumed_stateless_rule_capacity
  Type: INT32
  Provider name: ConsumedStatelessRuleCapacity
  Description: The number of capacity units currently consumed by the policy’s stateless rules.
  
• description
  Type: STRING
  Provider name: Description
  Description: A description of the firewall policy.
  
• encryption_configuration
  Type: STRUCT
  Provider name: EncryptionConfiguration
  Description: A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall policy.
  
  • key_id
    Type: STRING
    Provider name: KeyId
    Description: The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you’re using a key that’s managed by another account. If you’re using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide.
    
  • type
    Type: STRING
    Provider name: Type
    Description: The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.
    
• firewall_policy_arn
  Type: STRING
  Provider name: FirewallPolicyArn
  Description: The Amazon Resource Name (ARN) of the firewall policy. If this response is for a create request that had DryRun set to TRUE, then this ARN is a placeholder that isn’t attached to a valid resource.
  
• firewall_policy_id
  Type: STRING
  Provider name: FirewallPolicyId
  Description: The unique identifier for the firewall policy.
  
• firewall_policy_name
  Type: STRING
  Provider name: FirewallPolicyName
  Description: The descriptive name of the firewall policy. You can’t change the name of a firewall policy after you create it.
  
• firewall_policy_status
  Type: STRING
  Provider name: FirewallPolicyStatus
  Description: The current status of the firewall policy. You can retrieve this for a firewall policy by calling DescribeFirewallPolicy and providing the firewall policy’s name or ARN.
  
• last_modified_time
  Type: TIMESTAMP
  Provider name: LastModifiedTime
  Description: The last time that the firewall policy was changed.
  
• number_of_associations
  Type: INT32
  Provider name: NumberOfAssociations
  Description: The number of firewalls that are associated with this firewall policy.
  

firewall_status

Type: STRUCT
Provider name: FirewallStatus
Description: Detailed information about the current status of a Firewall. You can retrieve this for a firewall by calling DescribeFirewall and providing the firewall name and ARN.

• capacity_usage_summary
  Type: STRUCT
  Provider name: CapacityUsageSummary
  Description: Describes the capacity usage of the resources contained in a firewall’s reference sets. Network Firewall calclulates the capacity usage by taking an aggregated count of all of the resources used by all of the reference sets in a firewall.
  
  • cidrs
    Type: STRUCT
    Provider name: CIDRs
    Description: Describes the capacity usage of the CIDR blocks used by the IP set references in a firewall.
    
    • available_cidr_count
      Type: INT32
      Provider name: AvailableCIDRCount
      Description: The number of CIDR blocks available for use by the IP set references in a firewall.
      
    • ip_set_references
      Type: STRING
      Provider name: IPSetReferences
      Description: The list of the IP set references used by a firewall.
      
    • utilized_cidr_count
      Type: INT32
      Provider name: UtilizedCIDRCount
      Description: The number of CIDR blocks used by the IP set references in a firewall.
      
• configuration_sync_state_summary
  Type: STRING
  Provider name: ConfigurationSyncStateSummary
  Description: The configuration sync state for the firewall. This summarizes the sync states reported in the Config settings for all of the Availability Zones where you have configured the firewall. When you create a firewall or update its configuration, for example by adding a rule group to its firewall policy, Network Firewall distributes the configuration changes to all zones where the firewall is in use. This summary indicates whether the configuration changes have been applied everywhere. This status must be IN_SYNC for the firewall to be ready for use, but it doesn’t indicate that the firewall is ready. The Status setting indicates firewall readiness.
  
• status
  Type: STRING
  Provider name: Status
  Description: The readiness of the configured firewall to handle network traffic across all of the Availability Zones where you’ve configured it. This setting is READY only when the ConfigurationSyncStateSummary value is IN_SYNC and the Attachment Status values for all of the configured subnets are READY.
  
• sync_states
  Type: STRING
  Provider name: SyncStates
  Description: The subnets that you’ve configured for use by the Network Firewall firewall. This contains one array element per Availability Zone where you’ve configured a subnet. These objects provide details of the information that is summarized in the ConfigurationSyncStateSummary and Status, broken down by zone and configuration object.
  

logging_configuration

Type: STRUCT
Provider name: LoggingConfiguration

• log_destination_configs
  Type: UNORDERED_LIST_STRUCT
  Provider name: LogDestinationConfigs
  Description: Defines the logging destinations for the logs for a firewall. Network Firewall generates logs for stateful rule groups.
  
  • log_destination
    Type: MAP_STRING_STRING
    Provider name: LogDestination
    Description: The named location for the logs, provided in a key:value mapping that is specific to the chosen destination type.
    • For an Amazon S3 bucket, provide the name of the bucket, with key bucketName, and optionally provide a prefix, with key prefix. The following example specifies an Amazon S3 bucket named DOC-EXAMPLE-BUCKET and the prefix alerts: “LogDestination”: { “bucketName”: “DOC-EXAMPLE-BUCKET”, “prefix”: “alerts” }
    • For a CloudWatch log group, provide the name of the CloudWatch log group, with key logGroup. The following example specifies a log group named alert-log-group: “LogDestination”: { “logGroup”: “alert-log-group” }
    • For a Firehose delivery stream, provide the name of the delivery stream, with key deliveryStream. The following example specifies a delivery stream named alert-delivery-stream: “LogDestination”: { “deliveryStream”: “alert-delivery-stream” }
  • log_destination_type
    Type: STRING
    Provider name: LogDestinationType
    Description: The type of storage destination to send these logs to. You can send logs to an Amazon S3 bucket, a CloudWatch log group, or a Firehose delivery stream.
    
  • log_type
    Type: STRING
    Provider name: LogType
    Description: The type of log to record. You can record the following types of logs from your Network Firewall stateful engine.
    • ALERT - Logs for traffic that matches your stateful rules and that have an action that sends an alert. A stateful rule sends alerts for the rule actions DROP, ALERT, and REJECT. For more information, see StatefulRule.
    • FLOW - Standard network traffic flow logs. The stateful rules engine records flow logs for all network traffic that it receives. Each flow log record captures the network flow for a specific standard stateless rule group.
    • TLS - Logs for events that are related to TLS inspection. For more information, see Inspecting SSL/TLS traffic with TLS inspection configurations in the Network Firewall Developer Guide.

subnet_change_protection

Type: BOOLEAN
Provider name: SubnetChangeProtection
Description: A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

subnet_mappings

Type: UNORDERED_LIST_STRUCT
Provider name: SubnetMappings
Description: The public subnets that Network Firewall is using for the firewall. Each subnet must belong to a different Availability Zone.

• ip_address_type
  Type: STRING
  Provider name: IPAddressType
  Description: The subnet’s IP address type. You can’t change the IP address type after you create the subnet.
  
• subnet_id
  Type: STRING
  Provider name: SubnetId
  Description: The unique identifier for the subnet.
  

tags

Type: UNORDERED_LIST_STRING

update_token

Type: STRING
Provider name: UpdateToken
Description: A token used for optimistic locking. Network Firewall returns a token to your requests that access the firewall policy. The token marks the state of the policy resource at the time of the request. To make changes to the policy, you provide the token in your request. Network Firewall uses the token to ensure that the policy hasn’t changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the firewall policy again to get a current copy of it with current token. Reapply your changes as needed, then try the operation again using the new token.

vpc_id

Type: STRING
Provider name: VpcId
Description: The unique identifier of the VPC where the firewall is in use.