aws_network_firewall_firewall

account_id

Type: STRING

delete_protection

Type: BOOLEAN
Provider name: DeleteProtection
Description: A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE.

description

Type: STRING
Provider name: Description
Description: A description of the firewall.

encryption_configuration

Type: STRUCT
Provider name: EncryptionConfiguration
Description: A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall.

• key_id
  Type: STRING
  Provider name: KeyId
  Description: The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you’re using a key that’s managed by another account. If you’re using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide.
  
• type
  Type: STRING
  Provider name: Type
  Description: The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.
  

firewall_arn

Type: STRING
Provider name: FirewallArn
Description: The Amazon Resource Name (ARN) of the firewall.

firewall_id

Type: STRING
Provider name: FirewallId
Description: The unique identifier for the firewall.

firewall_name

Type: STRING
Provider name: FirewallName
Description: The descriptive name of the firewall. You can’t change the name of a firewall after you create it.

firewall_policy_arn

Type: STRING
Provider name: FirewallPolicyArn
Description: The Amazon Resource Name (ARN) of the firewall policy. The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.

firewall_policy_change_protection

Type: BOOLEAN
Provider name: FirewallPolicyChangeProtection
Description: A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

firewall_status

Type: STRUCT
Provider name: FirewallStatus
Description: Detailed information about the current status of a Firewall. You can retrieve this for a firewall by calling DescribeFirewall and providing the firewall name and ARN.

• capacity_usage_summary
  Type: STRUCT
  Provider name: CapacityUsageSummary
  Description: Describes the capacity usage of the resources contained in a firewall’s reference sets. Network Firewall calclulates the capacity usage by taking an aggregated count of all of the resources used by all of the reference sets in a firewall.
  
  • cidrs
    Type: STRUCT
    Provider name: CIDRs
    Description: Describes the capacity usage of the CIDR blocks used by the IP set references in a firewall.
    
    • available_cidr_count
      Type: INT32
      Provider name: AvailableCIDRCount
      Description: The number of CIDR blocks available for use by the IP set references in a firewall.
      
    • ip_set_references
      Type: STRING
      Provider name: IPSetReferences
      Description: The list of the IP set references used by a firewall.
      
    • utilized_cidr_count
      Type: INT32
      Provider name: UtilizedCIDRCount
      Description: The number of CIDR blocks used by the IP set references in a firewall.
      
• configuration_sync_state_summary
  Type: STRING
  Provider name: ConfigurationSyncStateSummary
  Description: The configuration sync state for the firewall. This summarizes the sync states reported in the Config settings for all of the Availability Zones where you have configured the firewall. When you create a firewall or update its configuration, for example by adding a rule group to its firewall policy, Network Firewall distributes the configuration changes to all zones where the firewall is in use. This summary indicates whether the configuration changes have been applied everywhere. This status must be IN_SYNC for the firewall to be ready for use, but it doesn’t indicate that the firewall is ready. The Status setting indicates firewall readiness.
  
• status
  Type: STRING
  Provider name: Status
  Description: The readiness of the configured firewall to handle network traffic across all of the Availability Zones where you’ve configured it. This setting is READY only when the ConfigurationSyncStateSummary value is IN_SYNC and the Attachment Status values for all of the configured subnets are READY.
  
• sync_states
  Type: STRING
  Provider name: SyncStates
  Description: The subnets that you’ve configured for use by the Network Firewall firewall. This contains one array element per Availability Zone where you’ve configured a subnet. These objects provide details of the information that is summarized in the ConfigurationSyncStateSummary and Status, broken down by zone and configuration object.
  

logging_configuration

Type: STRUCT
Provider name: LoggingConfiguration

• log_destination_configs
  Type: UNORDERED_LIST_STRUCT
  Provider name: LogDestinationConfigs
  Description: Defines the logging destinations for the logs for a firewall. Network Firewall generates logs for stateful rule groups.
  
  • log_destination
    Type: MAP_STRING_STRING
    Provider name: LogDestination
    Description: The named location for the logs, provided in a key:value mapping that is specific to the chosen destination type.
    • For an Amazon S3 bucket, provide the name of the bucket, with key bucketName, and optionally provide a prefix, with key prefix. The following example specifies an Amazon S3 bucket named DOC-EXAMPLE-BUCKET and the prefix alerts: “LogDestination”: { “bucketName”: “DOC-EXAMPLE-BUCKET”, “prefix”: “alerts” }
    • For a CloudWatch log group, provide the name of the CloudWatch log group, with key logGroup. The following example specifies a log group named alert-log-group: “LogDestination”: { “logGroup”: “alert-log-group” }
    • For a Firehose delivery stream, provide the name of the delivery stream, with key deliveryStream. The following example specifies a delivery stream named alert-delivery-stream: “LogDestination”: { “deliveryStream”: “alert-delivery-stream” }
  • log_destination_type
    Type: STRING
    Provider name: LogDestinationType
    Description: The type of storage destination to send these logs to. You can send logs to an Amazon S3 bucket, a CloudWatch log group, or a Firehose delivery stream.
    
  • log_type
    Type: STRING
    Provider name: LogType
    Description: The type of log to record. You can record the following types of logs from your Network Firewall stateful engine.
    • ALERT - Logs for traffic that matches your stateful rules and that have an action that sends an alert. A stateful rule sends alerts for the rule actions DROP, ALERT, and REJECT. For more information, see StatefulRule.
    • FLOW - Standard network traffic flow logs. The stateful rules engine records flow logs for all network traffic that it receives. Each flow log record captures the network flow for a specific standard stateless rule group.
    • TLS - Logs for events that are related to TLS inspection. For more information, see Inspecting SSL/TLS traffic with TLS inspection configurations in the Network Firewall Developer Guide.

subnet_change_protection

Type: BOOLEAN
Provider name: SubnetChangeProtection
Description: A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

subnet_mappings

Type: UNORDERED_LIST_STRUCT
Provider name: SubnetMappings
Description: The public subnets that Network Firewall is using for the firewall. Each subnet must belong to a different Availability Zone.

• ip_address_type
  Type: STRING
  Provider name: IPAddressType
  Description: The subnet’s IP address type. You can’t change the IP address type after you create the subnet.
  
• subnet_id
  Type: STRING
  Provider name: SubnetId
  Description: The unique identifier for the subnet.
  

tags

Type: UNORDERED_LIST_STRING

update_token

Type: STRING
Provider name: UpdateToken
Description: An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request. To make an unconditional change to the firewall, omit the token in your update request. Without the token, Network Firewall performs your updates regardless of whether the firewall has changed since you last retrieved it. To make a conditional change to the firewall, provide the token in your update request. Network Firewall uses the token to ensure that the firewall hasn’t changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the firewall again to get a current copy of it with a new token. Reapply your changes as needed, then try the operation again using the new token.

vpc_id

Type: STRING
Provider name: VpcId
Description: The unique identifier of the VPC where the firewall is in use.