이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

aws_network_firewall_firewall

`account_id`

Type: STRING

`delete_protection`

Type: BOOLEAN
Provider name: DeleteProtection
Description: A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE.

`description`

Type: STRING
Provider name: Description
Description: A description of the firewall.

`encryption_configuration`

Type: STRUCT
Provider name: EncryptionConfiguration
Description: A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall.

key_id
Type: STRING
Provider name: KeyId
Description: The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you’re using a key that’s managed by another account. If you’re using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide.
type
Type: STRING
Provider name: Type
Description: The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.

`firewall_arn`

Type: STRING
Provider name: FirewallArn
Description: The Amazon Resource Name (ARN) of the firewall.

`firewall_id`

Type: STRING
Provider name: FirewallId
Description: The unique identifier for the firewall.

`firewall_name`

Type: STRING
Provider name: FirewallName
Description: The descriptive name of the firewall. You can’t change the name of a firewall after you create it.

`firewall_policy`

Type: STRUCT
Provider name: FirewallPolicy
Description: The policy for the specified firewall policy.

policy_variables
Type: STRUCT
Provider name: PolicyVariables
Description: Contains variables that you can use to override default Suricata settings in your firewall policy.
- rule_variables
  Type: STRING
  Provider name: RuleVariables
  Description: The IPv4 or IPv6 addresses in CIDR notation to use for the Suricata HOME_NET variable. If your firewall uses an inspection VPC, you might want to override the HOME_NET variable with the CIDRs of your home networks. If you don’t override HOME_NET with your own CIDRs, Network Firewall by default uses the CIDR of your inspection VPC.
stateful_default_actions
Type: UNORDERED_LIST_STRING
Provider name: StatefulDefaultActions
Description: The default actions to take on a packet that doesn’t match any stateful rules. The stateful default action is optional, and is only valid when using the strict rule order. Valid values of the stateful default action:
- aws:drop_strict
- aws:drop_established
- aws:alert_strict
- aws:alert_established
For more information, see Strict evaluation order in the Network Firewall Developer Guide.
stateful_engine_options
Type: STRUCT
Provider name: StatefulEngineOptions
Description: Additional options governing how Network Firewall handles stateful rules. The stateful rule groups that you use in your policy must have stateful rule options settings that are compatible with these settings.
- rule_order
  Type: STRING
  Provider name: RuleOrder
  Description: Indicates how to manage the order of stateful rule evaluation for the policy. STRICT_ORDER is the default and recommended option. With STRICT_ORDER, provide your rules in the order that you want them to be evaluated. You can then choose one or more default actions for packets that don’t match any rules. Choose STRICT_ORDER to have the stateful rules engine determine the evaluation order of your rules. The default action for this rule order is PASS, followed by DROP, REJECT, and ALERT actions. Stateful rules are provided to the rule engine as Suricata compatible strings, and Suricata evaluates them based on your settings. For more information, see Evaluation order for stateful rules in the Network Firewall Developer Guide.
- stream_exception_policy
  Type: STRING
  Provider name: StreamExceptionPolicy
  Description: Configures how Network Firewall processes traffic when a network connection breaks midstream. Network connections can break due to disruptions in external networks or within the firewall itself.
  - DROP - Network Firewall fails closed and drops all subsequent traffic going to the firewall. This is the default behavior.
  - CONTINUE - Network Firewall continues to apply rules to the subsequent traffic without context from traffic before the break. This impacts the behavior of rules that depend on this context. For example, if you have a stateful rule to drop http traffic, Network Firewall won’t match the traffic for this rule because the service won’t have the context from session initialization defining the application layer protocol as HTTP. However, this behavior is rule dependent—a TCP-layer rule using a flow:stateless rule would still match, as would the aws:drop_strict default action.
  - REJECT - Network Firewall fails closed and drops all subsequent traffic going to the firewall. Network Firewall also sends a TCP reject packet back to your client so that the client can immediately establish a new session. Network Firewall will have context about the new session and will apply rules to the subsequent traffic.
stateful_rule_group_references
Type: UNORDERED_LIST_STRUCT
Provider name: StatefulRuleGroupReferences
Description: References to the stateful rule groups that are used in the policy. These define the inspection criteria in stateful rules.
- override
  Type: STRUCT
  Provider name: Override
  Description: The action that allows the policy owner to override the behavior of the rule group within a policy.
  - action
    Type: STRING
    Provider name: Action
    Description: The action that changes the rule group from DROP to ALERT. This only applies to managed rule groups.
- priority
  Type: INT32
  Provider name: Priority
  Description: An integer setting that indicates the order in which to run the stateful rule groups in a single FirewallPolicy. This setting only applies to firewall policies that specify the STRICT_ORDER rule order in the stateful engine options settings. Network Firewall evalutes each stateful rule group against a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy. You can change the priority settings of your rule groups at any time. To make it easier to insert rule groups later, number them so there’s a wide range in between, for example use 100, 200, and so on.
- resource_arn
  Type: STRING
  Provider name: ResourceArn
  Description: The Amazon Resource Name (ARN) of the stateful rule group.
stateless_custom_actions
Type: UNORDERED_LIST_STRUCT
Provider name: StatelessCustomActions
Description: The custom action definitions that are available for use in the firewall policy’s StatelessDefaultActions setting. You name each custom action that you define, and then you can use it by name in your default actions specifications.
- action_definition
  Type: STRUCT
  Provider name: ActionDefinition
  Description: The custom action associated with the action name.
  - publish_metric_action
    Type: STRUCT
    Provider name: PublishMetricAction
    Description: Stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. This setting defines a CloudWatch dimension value to be published. You can pair this custom action with any of the standard stateless rule actions. For example, you could pair this in a rule action with the standard action that forwards the packet for stateful inspection. Then, when a packet matches the rule, Network Firewall publishes metrics for the packet and forwards it.
    - dimensions
      Type: UNORDERED_LIST_STRUCT
      Provider name: Dimensions
      Description:
      - value
        Type: STRING
        Provider name: Value
        Description: The value to use in the custom metric dimension.
- action_name
  Type: STRING
  Provider name: ActionName
  Description: The descriptive name of the custom action. You can’t change the name of a custom action after you create it.
stateless_default_actions
Type: UNORDERED_LIST_STRING
Provider name: StatelessDefaultActions
Description: The actions to take on a packet if it doesn’t match any of the stateless rules in the policy. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe. You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice. For example, you could specify [“aws:pass”] or you could specify [“aws:pass”, “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.
stateless_fragment_default_actions
Type: UNORDERED_LIST_STRING
Provider name: StatelessFragmentDefaultActions
Description: The actions to take on a fragmented UDP packet if it doesn’t match any of the stateless rules in the policy. Network Firewall only manages UDP packet fragments and silently drops packet fragments for other protocols. If you want non-matching fragmented UDP packets to be forwarded for stateful inspection, specify aws:forward_to_sfe. You must specify one of the standard actions: aws:pass, aws:drop, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard section choice. For example, you could specify [“aws:pass”] or you could specify [“aws:pass”, “customActionName”]. For information about compatibility, see the custom action descriptions under CustomAction.
stateless_rule_group_references
Type: UNORDERED_LIST_STRUCT
Provider name: StatelessRuleGroupReferences
Description: References to the stateless rule groups that are used in the policy. These define the matching criteria in stateless rules.
- priority
  Type: INT32
  Provider name: Priority
  Description: An integer setting that indicates the order in which to run the stateless rule groups in a single FirewallPolicy. Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting. You must ensure that the priority settings are unique within each policy.
- resource_arn
  Type: STRING
  Provider name: ResourceArn
  Description: The Amazon Resource Name (ARN) of the stateless rule group.
tls_inspection_configuration_arn
Type: STRING
Provider name: TLSInspectionConfigurationArn
Description: The Amazon Resource Name (ARN) of the TLS inspection configuration.

`firewall_policy_arn`

Type: STRING
Provider name: FirewallPolicyArn
Description: The Amazon Resource Name (ARN) of the firewall policy. The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.

`firewall_policy_change_protection`

Type: BOOLEAN
Provider name: FirewallPolicyChangeProtection
Description: A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

`firewall_policy_response`

Type: STRUCT
Provider name: FirewallPolicyResponse
Description: The high-level properties of a firewall policy. This, along with the FirewallPolicy, define the policy. You can retrieve all objects for a firewall policy by calling DescribeFirewallPolicy.

consumed_stateful_rule_capacity
Type: INT32
Provider name: ConsumedStatefulRuleCapacity
Description: The number of capacity units currently consumed by the policy’s stateful rules.
consumed_stateless_rule_capacity
Type: INT32
Provider name: ConsumedStatelessRuleCapacity
Description: The number of capacity units currently consumed by the policy’s stateless rules.
description
Type: STRING
Provider name: Description
Description: A description of the firewall policy.
encryption_configuration
Type: STRUCT
Provider name: EncryptionConfiguration
Description: A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall policy.
- key_id
  Type: STRING
  Provider name: KeyId
  Description: The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you’re using a key that’s managed by another account. If you’re using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide.
- type
  Type: STRING
  Provider name: Type
  Description: The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.
firewall_policy_arn
Type: STRING
Provider name: FirewallPolicyArn
Description: The Amazon Resource Name (ARN) of the firewall policy. If this response is for a create request that had DryRun set to TRUE, then this ARN is a placeholder that isn’t attached to a valid resource.
firewall_policy_id
Type: STRING
Provider name: FirewallPolicyId
Description: The unique identifier for the firewall policy.
firewall_policy_name
Type: STRING
Provider name: FirewallPolicyName
Description: The descriptive name of the firewall policy. You can’t change the name of a firewall policy after you create it.
firewall_policy_status
Type: STRING
Provider name: FirewallPolicyStatus
Description: The current status of the firewall policy. You can retrieve this for a firewall policy by calling DescribeFirewallPolicy and providing the firewall policy’s name or ARN.
last_modified_time
Type: TIMESTAMP
Provider name: LastModifiedTime
Description: The last time that the firewall policy was changed.
number_of_associations
Type: INT32
Provider name: NumberOfAssociations
Description: The number of firewalls that are associated with this firewall policy.

`firewall_status`

Type: STRUCT
Provider name: FirewallStatus
Description: Detailed information about the current status of a Firewall. You can retrieve this for a firewall by calling DescribeFirewall and providing the firewall name and ARN.

capacity_usage_summary
Type: STRUCT
Provider name: CapacityUsageSummary
Description: Describes the capacity usage of the resources contained in a firewall’s reference sets. Network Firewall calclulates the capacity usage by taking an aggregated count of all of the resources used by all of the reference sets in a firewall.
- cidrs
  Type: STRUCT
  Provider name: CIDRs
  Description: Describes the capacity usage of the CIDR blocks used by the IP set references in a firewall.
  - available_cidr_count
    Type: INT32
    Provider name: AvailableCIDRCount
    Description: The number of CIDR blocks available for use by the IP set references in a firewall.
  - ip_set_references
    Type: STRING
    Provider name: IPSetReferences
    Description: The list of the IP set references used by a firewall.
  - utilized_cidr_count
    Type: INT32
    Provider name: UtilizedCIDRCount
    Description: The number of CIDR blocks used by the IP set references in a firewall.
configuration_sync_state_summary
Type: STRING
Provider name: ConfigurationSyncStateSummary
Description: The configuration sync state for the firewall. This summarizes the sync states reported in the Config settings for all of the Availability Zones where you have configured the firewall. When you create a firewall or update its configuration, for example by adding a rule group to its firewall policy, Network Firewall distributes the configuration changes to all zones where the firewall is in use. This summary indicates whether the configuration changes have been applied everywhere. This status must be IN_SYNC for the firewall to be ready for use, but it doesn’t indicate that the firewall is ready. The Status setting indicates firewall readiness.
status
Type: STRING
Provider name: Status
Description: The readiness of the configured firewall to handle network traffic across all of the Availability Zones where you’ve configured it. This setting is READY only when the ConfigurationSyncStateSummary value is IN_SYNC and the Attachment Status values for all of the configured subnets are READY.
sync_states
Type: STRING
Provider name: SyncStates
Description: The subnets that you’ve configured for use by the Network Firewall firewall. This contains one array element per Availability Zone where you’ve configured a subnet. These objects provide details of the information that is summarized in the ConfigurationSyncStateSummary and Status, broken down by zone and configuration object.

`logging_configuration`

Type: STRUCT
Provider name: LoggingConfiguration

log_destination_configs
Type: UNORDERED_LIST_STRUCT
Provider name: LogDestinationConfigs
Description: Defines the logging destinations for the logs for a firewall. Network Firewall generates logs for stateful rule groups.
- log_destination
  Type: MAP_STRING_STRING
  Provider name: LogDestination
  Description: The named location for the logs, provided in a key:value mapping that is specific to the chosen destination type.
  - For an Amazon S3 bucket, provide the name of the bucket, with key bucketName, and optionally provide a prefix, with key prefix. The following example specifies an Amazon S3 bucket named DOC-EXAMPLE-BUCKET and the prefix alerts: “LogDestination”: { “bucketName”: “DOC-EXAMPLE-BUCKET”, “prefix”: “alerts” }
  - For a CloudWatch log group, provide the name of the CloudWatch log group, with key logGroup. The following example specifies a log group named alert-log-group: “LogDestination”: { “logGroup”: “alert-log-group” }
  - For a Firehose delivery stream, provide the name of the delivery stream, with key deliveryStream. The following example specifies a delivery stream named alert-delivery-stream: “LogDestination”: { “deliveryStream”: “alert-delivery-stream” }
- log_destination_type
  Type: STRING
  Provider name: LogDestinationType
  Description: The type of storage destination to send these logs to. You can send logs to an Amazon S3 bucket, a CloudWatch log group, or a Firehose delivery stream.
- log_type
  Type: STRING
  Provider name: LogType
  Description: The type of log to record. You can record the following types of logs from your Network Firewall stateful engine.
  - ALERT - Logs for traffic that matches your stateful rules and that have an action that sends an alert. A stateful rule sends alerts for the rule actions DROP, ALERT, and REJECT. For more information, see StatefulRule.
  - FLOW - Standard network traffic flow logs. The stateful rules engine records flow logs for all network traffic that it receives. Each flow log record captures the network flow for a specific standard stateless rule group.
  - TLS - Logs for events that are related to TLS inspection. For more information, see Inspecting SSL/TLS traffic with TLS inspection configurations in the Network Firewall Developer Guide.

`subnet_change_protection`

Type: BOOLEAN
Provider name: SubnetChangeProtection
Description: A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

`subnet_mappings`

Type: UNORDERED_LIST_STRUCT
Provider name: SubnetMappings
Description: The public subnets that Network Firewall is using for the firewall. Each subnet must belong to a different Availability Zone.

ip_address_type
Type: STRING
Provider name: IPAddressType
Description: The subnet’s IP address type. You can’t change the IP address type after you create the subnet.
subnet_id
Type: STRING
Provider name: SubnetId
Description: The unique identifier for the subnet.

`tags`

Type: UNORDERED_LIST_STRING

`update_token`

Type: STRING
Provider name: UpdateToken
Description: A token used for optimistic locking. Network Firewall returns a token to your requests that access the firewall policy. The token marks the state of the policy resource at the time of the request. To make changes to the policy, you provide the token in your request. Network Firewall uses the token to ensure that the policy hasn’t changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the firewall policy again to get a current copy of it with current token. Reapply your changes as needed, then try the operation again using the new token.

`vpc_id`

Type: STRING
Provider name: VpcId
Description: The unique identifier of the VPC where the firewall is in use.