AWS Cloud Control v1.28.0, May 19 25

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.28.0 published on Monday, May 19, 2025 by Pulumi

pulumi/pulumi-aws-native

aws-native.fms.getPolicy

Explore with Pulumi AI

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.28.0 published on Monday, May 19, 2025 by Pulumi

pulumi/pulumi-aws-native

Using getPolicy

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getPolicy(args: GetPolicyArgs, opts?: InvokeOptions): Promise<GetPolicyResult>
function getPolicyOutput(args: GetPolicyOutputArgs, opts?: InvokeOptions): Output<GetPolicyResult>

def get_policy(id: Optional[str] = None,
               opts: Optional[InvokeOptions] = None) -> GetPolicyResult
def get_policy_output(id: Optional[pulumi.Input[str]] = None,
               opts: Optional[InvokeOptions] = None) -> Output[GetPolicyResult]

func LookupPolicy(ctx *Context, args *LookupPolicyArgs, opts ...InvokeOption) (*LookupPolicyResult, error)
func LookupPolicyOutput(ctx *Context, args *LookupPolicyOutputArgs, opts ...InvokeOption) LookupPolicyResultOutput

> Note: This function is named LookupPolicy in the Go SDK.

public static class GetPolicy 
{
    public static Task<GetPolicyResult> InvokeAsync(GetPolicyArgs args, InvokeOptions? opts = null)
    public static Output<GetPolicyResult> Invoke(GetPolicyInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetPolicyResult> getPolicy(GetPolicyArgs args, InvokeOptions options)
public static Output<GetPolicyResult> getPolicy(GetPolicyArgs args, InvokeOptions options)

fn::invoke:
  function: aws-native:fms:getPolicy
  arguments:
    # arguments dictionary

The following arguments are supported:

Id string: The ID of the policy.

Id string: The ID of the policy.

id String: The ID of the policy.

id string: The ID of the policy.

id str: The ID of the policy.

id String: The ID of the policy.

getPolicy Result

The following output properties are available:

Arn string

The Amazon Resource Name (ARN) of the policy.

ExcludeMap Pulumi.AwsNative.Fms.Outputs.PolicyIeMap

Specifies the AWS account IDs and AWS Organizations organizational units (OUs) to exclude from the policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.

You can specify inclusions or exclusions, but not both. If you specify an IncludeMap , AWS Firewall Manager applies the policy to all accounts specified by the IncludeMap , and does not evaluate any ExcludeMap specifications. If you do not specify an IncludeMap , then Firewall Manager applies the policy to all accounts except for those specified by the ExcludeMap .

You can specify account IDs, OUs, or a combination:

Specify account IDs by setting the key to ACCOUNT . For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"]} .
Specify OUs by setting the key to ORGUNIT . For example, the following is a valid map: {"ORGUNIT" : ["ouid111", "ouid112"]} .
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"], "ORGUNIT" : ["ouid111", "ouid112"]} .

ExcludeResourceTags bool

Used only when tags are specified in the ResourceTags property. If this property is True , resources with the specified tags are not in scope of the policy. If it's False , only resources with the specified tags are in scope of the policy.

Id string

The ID of the policy.

IncludeMap Pulumi.AwsNative.Fms.Outputs.PolicyIeMap

Specifies the AWS account IDs and AWS Organizations organizational units (OUs) to include in the policy. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.

You can specify account IDs, OUs, or a combination:

Specify account IDs by setting the key to ACCOUNT . For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"]} .
Specify OUs by setting the key to ORGUNIT . For example, the following is a valid map: {"ORGUNIT" : ["ouid111", "ouid112"]} .
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"], "ORGUNIT" : ["ouid111", "ouid112"]} .

PolicyDescription string

Your description of the AWS Firewall Manager policy.

PolicyName string

The name of the AWS Firewall Manager policy.

RemediationEnabled bool

Indicates if the policy should be automatically applied to new resources.

ResourceSetIds List<string>

The unique identifiers of the resource sets used by the policy.

ResourceTagLogicalOperator Pulumi.AwsNative.Fms.PolicyResourceTagLogicalOperator

Specifies whether to combine multiple resource tags with AND, so that a resource must have all tags to be included or excluded, or OR, so that a resource must have at least one tag.

Default: AND

ResourceTags List<Pulumi.AwsNative.Fms.Outputs.PolicyResourceTag>

An array of ResourceTag objects, used to explicitly include resources in the policy scope or explicitly exclude them. If this isn't set, then tags aren't used to modify policy scope. See also ExcludeResourceTags .

ResourceType string

The type of resource protected by or in scope of the policy. This is in the format shown in the AWS Resource Types Reference . To apply this policy to multiple resource types, specify a resource type of ResourceTypeList and then specify the resource types in a ResourceTypeList .

The following are valid resource types for each Firewall Manager policy type:

AWS WAF Classic - AWS::ApiGateway::Stage , AWS::CloudFront::Distribution , and AWS::ElasticLoadBalancingV2::LoadBalancer .
AWS WAF - AWS::ApiGateway::Stage , AWS::ElasticLoadBalancingV2::LoadBalancer , and AWS::CloudFront::Distribution .
Shield Advanced - AWS::ElasticLoadBalancingV2::LoadBalancer , AWS::ElasticLoadBalancing::LoadBalancer , AWS::EC2::EIP , and AWS::CloudFront::Distribution .
Network ACL - AWS::EC2::Subnet .
Security group usage audit - AWS::EC2::SecurityGroup .
Security group content audit - AWS::EC2::SecurityGroup , AWS::EC2::NetworkInterface , and AWS::EC2::Instance .
DNS Firewall, AWS Network Firewall , and third-party firewall - AWS::EC2::VPC .

ResourceTypeList List<string>

An array of ResourceType objects. Use this only to specify multiple resource types. To specify a single resource type, use ResourceType .

ResourcesCleanUp bool

Indicates whether AWS Firewall Manager should automatically remove protections from resources that leave the policy scope and clean up resources that Firewall Manager is managing for accounts when those accounts leave policy scope. For example, Firewall Manager will disassociate a Firewall Manager managed web ACL from a protected customer resource when the customer resource leaves policy scope.

By default, Firewall Manager doesn't remove protections or delete Firewall Manager managed resources.

This option is not available for Shield Advanced or AWS WAF Classic policies.

SecurityServicePolicyData Pulumi.AwsNative.Fms.Outputs.PolicySecurityServicePolicyData

Details about the security service that is being used to protect the resources.

This contains the following settings:

Type - Indicates the service type that the policy uses to protect the resource. For security group policies, Firewall Manager supports one security group for each common policy and for each content audit policy. This is an adjustable limit that you can increase by contacting .

ManagedServiceData - Details about the service that are specific to the service type, in JSON format.
Example: DNS_FIREWALL

"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"

Valid values for preProcessRuleGroups are between 1 and 99. Valid values for postProcessRuleGroups are between 9901 and 10000.

Example: NETWORK_FIREWALL - Centralized deployment model

"{\"type\":\"NETWORK_FIREWALL\",\"awsNetworkFirewallConfig\":{\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}},\"firewallDeploymentModel\":{\"centralizedFirewallDeploymentModel\":{\"centralizedFirewallOrchestrationConfig\":{\"inspectionVpcIds\":[{\"resourceId\":\"vpc-1234\",\"accountId\":\"123456789011\"}],\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneId\":null,\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"allowedIPV4CidrList\":[]}}}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration

With automatic Availbility Zone configuration, Firewall Manager chooses which Availability Zones to create the endpoints in. To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":[\"10.0.0.0/28\",\"192.168.0.0/28\"],\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"]},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\": \"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":true}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

With custom Availability Zone configuration, you define which specific Availability Zones to create endpoints in by configuring firewallCreationConfig . To configure the Availability Zones in firewallCreationConfig , specify either the availabilityZoneName or availabilityZoneId parameter, not both parameters.

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall centralized deployment model

"{ \"type\":\"THIRD_PARTY_FIREWALL\", \"thirdPartyFirewall\":\"PALO_ALTO_NETWORKS_CLOUD_NGFW\", \"thirdPartyFirewallConfig\":{ \"thirdPartyFirewallPolicyList\":[\"global-1\"] },\"firewallDeploymentModel\":{\"centralizedFirewallDeploymentModel\":{\"centralizedFirewallOrchestrationConfig\":{\"inspectionVpcIds\":[{\"resourceId\":\"vpc-1234\",\"accountId\":\"123456789011\"}],\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneId\":null,\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"allowedIPV4CidrList\":[]}}}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to CENTRALIZED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall distributed deployment model

"{\"type\":\"THIRD_PARTY_FIREWALL\",\"thirdPartyFirewall\":\"PALO_ALTO_NETWORKS_CLOUD_NGFW\",\"thirdPartyFirewallConfig\":{\"thirdPartyFirewallPolicyList\":[\"global-1\"] },\"firewallDeploymentModel\":{ \"distributedFirewallDeploymentModel\":{ \"distributedFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{ \"availabilityZoneConfigList\":[ {\"availabilityZoneName\":\"${AvailabilityZone}\" } ] } }, \"allowedIPV4CidrList\":[ ] } } } }"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Specification for SHIELD_ADVANCED for Amazon CloudFront distributions

"{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED|IGNORED|DISABLED\", \"automaticResponseAction\":\"BLOCK|COUNT\"}, \"overrideCustomerWebaclClassic\":true|false}"

For example: "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"

The default value for automaticResponseStatus is IGNORED . The value for automaticResponseAction is only required when automaticResponseStatus is set to ENABLED . The default value for overrideCustomerWebaclClassic is false .

For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData configuration is an empty string.

Example: WAFV2

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesAmazonIpReputationList\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

In the loggingConfiguration , you can specify one logDestinationConfigs , you can optionally provide up to 20 redactedFields , and the RedactedFieldType must be one of URI , QUERY_STRING , HEADER , or METHOD .

Example: AWS WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"

Example: WAFV2 - AWS Firewall Manager support for AWS WAF managed rule group versioning

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

To use a specific version of a AWS WAF managed rule group in your Firewall Manager policy, you must set versionEnabled to true , and set version to the version you'd like to use. If you don't set versionEnabled to true , or if you omit versionEnabled , then Firewall Manager uses the default version of the AWS WAF managed rule group.

Example: SECURITY_GROUPS_COMMON

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

The security group action for content audit can be ALLOW or DENY . For ALLOW , all in-scope security group rules must be within the allowed range of the policy's security group rules. For DENY , all in-scope security group rules must not contain a value or a range that matches a rule value or range in the policy security group.

Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

Tags List<Pulumi.AwsNative.Outputs.Tag>

A collection of key:value pairs associated with an AWS resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each AWS resource.

Arn string

The Amazon Resource Name (ARN) of the policy.

ExcludeMap PolicyIeMap

You can specify account IDs, OUs, or a combination:

Specify account IDs by setting the key to ACCOUNT . For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"]} .
Specify OUs by setting the key to ORGUNIT . For example, the following is a valid map: {"ORGUNIT" : ["ouid111", "ouid112"]} .
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"], "ORGUNIT" : ["ouid111", "ouid112"]} .

ExcludeResourceTags bool

Id string

The ID of the policy.

IncludeMap PolicyIeMap

You can specify account IDs, OUs, or a combination:

Specify account IDs by setting the key to ACCOUNT . For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"]} .
Specify OUs by setting the key to ORGUNIT . For example, the following is a valid map: {"ORGUNIT" : ["ouid111", "ouid112"]} .
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"], "ORGUNIT" : ["ouid111", "ouid112"]} .

PolicyDescription string

Your description of the AWS Firewall Manager policy.

PolicyName string

The name of the AWS Firewall Manager policy.

RemediationEnabled bool

Indicates if the policy should be automatically applied to new resources.

ResourceSetIds []string

The unique identifiers of the resource sets used by the policy.

ResourceTagLogicalOperator PolicyResourceTagLogicalOperator

Specifies whether to combine multiple resource tags with AND, so that a resource must have all tags to be included or excluded, or OR, so that a resource must have at least one tag.

Default: AND

ResourceTags []PolicyResourceTag

ResourceType string

The following are valid resource types for each Firewall Manager policy type:

AWS WAF Classic - AWS::ApiGateway::Stage , AWS::CloudFront::Distribution , and AWS::ElasticLoadBalancingV2::LoadBalancer .
AWS WAF - AWS::ApiGateway::Stage , AWS::ElasticLoadBalancingV2::LoadBalancer , and AWS::CloudFront::Distribution .
Shield Advanced - AWS::ElasticLoadBalancingV2::LoadBalancer , AWS::ElasticLoadBalancing::LoadBalancer , AWS::EC2::EIP , and AWS::CloudFront::Distribution .
Network ACL - AWS::EC2::Subnet .
Security group usage audit - AWS::EC2::SecurityGroup .
Security group content audit - AWS::EC2::SecurityGroup , AWS::EC2::NetworkInterface , and AWS::EC2::Instance .
DNS Firewall, AWS Network Firewall , and third-party firewall - AWS::EC2::VPC .

ResourceTypeList []string

An array of ResourceType objects. Use this only to specify multiple resource types. To specify a single resource type, use ResourceType .

ResourcesCleanUp bool

By default, Firewall Manager doesn't remove protections or delete Firewall Manager managed resources.

This option is not available for Shield Advanced or AWS WAF Classic policies.

SecurityServicePolicyData PolicySecurityServicePolicyData

Details about the security service that is being used to protect the resources.

This contains the following settings:

Type - Indicates the service type that the policy uses to protect the resource. For security group policies, Firewall Manager supports one security group for each common policy and for each content audit policy. This is an adjustable limit that you can increase by contacting .

ManagedServiceData - Details about the service that are specific to the service type, in JSON format.
Example: DNS_FIREWALL

"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"

Valid values for preProcessRuleGroups are between 1 and 99. Valid values for postProcessRuleGroups are between 9901 and 10000.

Example: NETWORK_FIREWALL - Centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration and route management

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to CENTRALIZED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall distributed deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Specification for SHIELD_ADVANCED for Amazon CloudFront distributions

For example: "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"

For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData configuration is an empty string.

Example: WAFV2

Example: AWS WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"

Example: WAFV2 - AWS Firewall Manager support for AWS WAF managed rule group versioning

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

Example: SECURITY_GROUPS_COMMON

Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

Tags Tag

arn String

The Amazon Resource Name (ARN) of the policy.

excludeMap PolicyIeMap

You can specify account IDs, OUs, or a combination:

Specify account IDs by setting the key to ACCOUNT . For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"]} .
Specify OUs by setting the key to ORGUNIT . For example, the following is a valid map: {"ORGUNIT" : ["ouid111", "ouid112"]} .
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"], "ORGUNIT" : ["ouid111", "ouid112"]} .

excludeResourceTags Boolean

id String

The ID of the policy.

includeMap PolicyIeMap

You can specify account IDs, OUs, or a combination:

Specify account IDs by setting the key to ACCOUNT . For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"]} .
Specify OUs by setting the key to ORGUNIT . For example, the following is a valid map: {"ORGUNIT" : ["ouid111", "ouid112"]} .
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"], "ORGUNIT" : ["ouid111", "ouid112"]} .

policyDescription String

Your description of the AWS Firewall Manager policy.

policyName String

The name of the AWS Firewall Manager policy.

remediationEnabled Boolean

Indicates if the policy should be automatically applied to new resources.

resourceSetIds List<String>

The unique identifiers of the resource sets used by the policy.

resourceTagLogicalOperator PolicyResourceTagLogicalOperator

Specifies whether to combine multiple resource tags with AND, so that a resource must have all tags to be included or excluded, or OR, so that a resource must have at least one tag.

Default: AND

resourceTags List<PolicyResourceTag>

resourceType String

The following are valid resource types for each Firewall Manager policy type:

AWS WAF Classic - AWS::ApiGateway::Stage , AWS::CloudFront::Distribution , and AWS::ElasticLoadBalancingV2::LoadBalancer .
AWS WAF - AWS::ApiGateway::Stage , AWS::ElasticLoadBalancingV2::LoadBalancer , and AWS::CloudFront::Distribution .
Shield Advanced - AWS::ElasticLoadBalancingV2::LoadBalancer , AWS::ElasticLoadBalancing::LoadBalancer , AWS::EC2::EIP , and AWS::CloudFront::Distribution .
Network ACL - AWS::EC2::Subnet .
Security group usage audit - AWS::EC2::SecurityGroup .
Security group content audit - AWS::EC2::SecurityGroup , AWS::EC2::NetworkInterface , and AWS::EC2::Instance .
DNS Firewall, AWS Network Firewall , and third-party firewall - AWS::EC2::VPC .

resourceTypeList List<String>

An array of ResourceType objects. Use this only to specify multiple resource types. To specify a single resource type, use ResourceType .

resourcesCleanUp Boolean

By default, Firewall Manager doesn't remove protections or delete Firewall Manager managed resources.

This option is not available for Shield Advanced or AWS WAF Classic policies.

securityServicePolicyData PolicySecurityServicePolicyData

Details about the security service that is being used to protect the resources.

This contains the following settings:

Type - Indicates the service type that the policy uses to protect the resource. For security group policies, Firewall Manager supports one security group for each common policy and for each content audit policy. This is an adjustable limit that you can increase by contacting .

ManagedServiceData - Details about the service that are specific to the service type, in JSON format.
Example: DNS_FIREWALL

"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"

Valid values for preProcessRuleGroups are between 1 and 99. Valid values for postProcessRuleGroups are between 9901 and 10000.

Example: NETWORK_FIREWALL - Centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration and route management

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to CENTRALIZED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall distributed deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Specification for SHIELD_ADVANCED for Amazon CloudFront distributions

For example: "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"

For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData configuration is an empty string.

Example: WAFV2

Example: AWS WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"

Example: WAFV2 - AWS Firewall Manager support for AWS WAF managed rule group versioning

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

Example: SECURITY_GROUPS_COMMON

Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

tags List<Tag>

arn string

The Amazon Resource Name (ARN) of the policy.

excludeMap PolicyIeMap

You can specify account IDs, OUs, or a combination:

Specify account IDs by setting the key to ACCOUNT . For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"]} .
Specify OUs by setting the key to ORGUNIT . For example, the following is a valid map: {"ORGUNIT" : ["ouid111", "ouid112"]} .
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"], "ORGUNIT" : ["ouid111", "ouid112"]} .

excludeResourceTags boolean

id string

The ID of the policy.

includeMap PolicyIeMap

You can specify account IDs, OUs, or a combination:

Specify account IDs by setting the key to ACCOUNT . For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"]} .
Specify OUs by setting the key to ORGUNIT . For example, the following is a valid map: {"ORGUNIT" : ["ouid111", "ouid112"]} .
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"], "ORGUNIT" : ["ouid111", "ouid112"]} .

policyDescription string

Your description of the AWS Firewall Manager policy.

policyName string

The name of the AWS Firewall Manager policy.

remediationEnabled boolean

Indicates if the policy should be automatically applied to new resources.

resourceSetIds string[]

The unique identifiers of the resource sets used by the policy.

resourceTagLogicalOperator PolicyResourceTagLogicalOperator

Specifies whether to combine multiple resource tags with AND, so that a resource must have all tags to be included or excluded, or OR, so that a resource must have at least one tag.

Default: AND

resourceTags PolicyResourceTag[]

resourceType string

The following are valid resource types for each Firewall Manager policy type:

AWS WAF Classic - AWS::ApiGateway::Stage , AWS::CloudFront::Distribution , and AWS::ElasticLoadBalancingV2::LoadBalancer .
AWS WAF - AWS::ApiGateway::Stage , AWS::ElasticLoadBalancingV2::LoadBalancer , and AWS::CloudFront::Distribution .
Shield Advanced - AWS::ElasticLoadBalancingV2::LoadBalancer , AWS::ElasticLoadBalancing::LoadBalancer , AWS::EC2::EIP , and AWS::CloudFront::Distribution .
Network ACL - AWS::EC2::Subnet .
Security group usage audit - AWS::EC2::SecurityGroup .
Security group content audit - AWS::EC2::SecurityGroup , AWS::EC2::NetworkInterface , and AWS::EC2::Instance .
DNS Firewall, AWS Network Firewall , and third-party firewall - AWS::EC2::VPC .

resourceTypeList string[]

An array of ResourceType objects. Use this only to specify multiple resource types. To specify a single resource type, use ResourceType .

resourcesCleanUp boolean

By default, Firewall Manager doesn't remove protections or delete Firewall Manager managed resources.

This option is not available for Shield Advanced or AWS WAF Classic policies.

securityServicePolicyData PolicySecurityServicePolicyData

Details about the security service that is being used to protect the resources.

This contains the following settings:

Type - Indicates the service type that the policy uses to protect the resource. For security group policies, Firewall Manager supports one security group for each common policy and for each content audit policy. This is an adjustable limit that you can increase by contacting .

ManagedServiceData - Details about the service that are specific to the service type, in JSON format.
Example: DNS_FIREWALL

"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"

Valid values for preProcessRuleGroups are between 1 and 99. Valid values for postProcessRuleGroups are between 9901 and 10000.

Example: NETWORK_FIREWALL - Centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration and route management

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to CENTRALIZED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall distributed deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Specification for SHIELD_ADVANCED for Amazon CloudFront distributions

For example: "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"

For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData configuration is an empty string.

Example: WAFV2

Example: AWS WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"

Example: WAFV2 - AWS Firewall Manager support for AWS WAF managed rule group versioning

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

Example: SECURITY_GROUPS_COMMON

Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

tags Tag[]

arn str

The Amazon Resource Name (ARN) of the policy.

exclude_map PolicyIeMap

You can specify account IDs, OUs, or a combination:

Specify account IDs by setting the key to ACCOUNT . For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"]} .
Specify OUs by setting the key to ORGUNIT . For example, the following is a valid map: {"ORGUNIT" : ["ouid111", "ouid112"]} .
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"], "ORGUNIT" : ["ouid111", "ouid112"]} .

exclude_resource_tags bool

id str

The ID of the policy.

include_map PolicyIeMap

You can specify account IDs, OUs, or a combination:

Specify account IDs by setting the key to ACCOUNT . For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"]} .
Specify OUs by setting the key to ORGUNIT . For example, the following is a valid map: {"ORGUNIT" : ["ouid111", "ouid112"]} .
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"], "ORGUNIT" : ["ouid111", "ouid112"]} .

policy_description str

Your description of the AWS Firewall Manager policy.

policy_name str

The name of the AWS Firewall Manager policy.

remediation_enabled bool

Indicates if the policy should be automatically applied to new resources.

resource_set_ids Sequence[str]

The unique identifiers of the resource sets used by the policy.

resource_tag_logical_operator PolicyResourceTagLogicalOperator

Specifies whether to combine multiple resource tags with AND, so that a resource must have all tags to be included or excluded, or OR, so that a resource must have at least one tag.

Default: AND

resource_tags Sequence[PolicyResourceTag]

resource_type str

The following are valid resource types for each Firewall Manager policy type:

AWS WAF Classic - AWS::ApiGateway::Stage , AWS::CloudFront::Distribution , and AWS::ElasticLoadBalancingV2::LoadBalancer .
AWS WAF - AWS::ApiGateway::Stage , AWS::ElasticLoadBalancingV2::LoadBalancer , and AWS::CloudFront::Distribution .
Shield Advanced - AWS::ElasticLoadBalancingV2::LoadBalancer , AWS::ElasticLoadBalancing::LoadBalancer , AWS::EC2::EIP , and AWS::CloudFront::Distribution .
Network ACL - AWS::EC2::Subnet .
Security group usage audit - AWS::EC2::SecurityGroup .
Security group content audit - AWS::EC2::SecurityGroup , AWS::EC2::NetworkInterface , and AWS::EC2::Instance .
DNS Firewall, AWS Network Firewall , and third-party firewall - AWS::EC2::VPC .

resource_type_list Sequence[str]

An array of ResourceType objects. Use this only to specify multiple resource types. To specify a single resource type, use ResourceType .

resources_clean_up bool

By default, Firewall Manager doesn't remove protections or delete Firewall Manager managed resources.

This option is not available for Shield Advanced or AWS WAF Classic policies.

security_service_policy_data PolicySecurityServicePolicyData

Details about the security service that is being used to protect the resources.

This contains the following settings:

Type - Indicates the service type that the policy uses to protect the resource. For security group policies, Firewall Manager supports one security group for each common policy and for each content audit policy. This is an adjustable limit that you can increase by contacting .

ManagedServiceData - Details about the service that are specific to the service type, in JSON format.
Example: DNS_FIREWALL

"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"

Valid values for preProcessRuleGroups are between 1 and 99. Valid values for postProcessRuleGroups are between 9901 and 10000.

Example: NETWORK_FIREWALL - Centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration and route management

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to CENTRALIZED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall distributed deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Specification for SHIELD_ADVANCED for Amazon CloudFront distributions

For example: "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"

For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData configuration is an empty string.

Example: WAFV2

Example: AWS WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"

Example: WAFV2 - AWS Firewall Manager support for AWS WAF managed rule group versioning

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

Example: SECURITY_GROUPS_COMMON

Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

tags Sequence[root_Tag]

arn String

The Amazon Resource Name (ARN) of the policy.

excludeMap Property Map

You can specify account IDs, OUs, or a combination:

Specify account IDs by setting the key to ACCOUNT . For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"]} .
Specify OUs by setting the key to ORGUNIT . For example, the following is a valid map: {"ORGUNIT" : ["ouid111", "ouid112"]} .
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"], "ORGUNIT" : ["ouid111", "ouid112"]} .

excludeResourceTags Boolean

id String

The ID of the policy.

includeMap Property Map

You can specify account IDs, OUs, or a combination:

Specify account IDs by setting the key to ACCOUNT . For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"]} .
Specify OUs by setting the key to ORGUNIT . For example, the following is a valid map: {"ORGUNIT" : ["ouid111", "ouid112"]} .
Specify accounts and OUs together in a single map, separated with a comma. For example, the following is a valid map: {"ACCOUNT" : ["accountID1", "accountID2"], "ORGUNIT" : ["ouid111", "ouid112"]} .

policyDescription String

Your description of the AWS Firewall Manager policy.

policyName String

The name of the AWS Firewall Manager policy.

remediationEnabled Boolean

Indicates if the policy should be automatically applied to new resources.

resourceSetIds List<String>

The unique identifiers of the resource sets used by the policy.

resourceTagLogicalOperator "AND" | "OR"

Specifies whether to combine multiple resource tags with AND, so that a resource must have all tags to be included or excluded, or OR, so that a resource must have at least one tag.

Default: AND

resourceTags List<Property Map>

resourceType String

The following are valid resource types for each Firewall Manager policy type:

AWS WAF Classic - AWS::ApiGateway::Stage , AWS::CloudFront::Distribution , and AWS::ElasticLoadBalancingV2::LoadBalancer .
AWS WAF - AWS::ApiGateway::Stage , AWS::ElasticLoadBalancingV2::LoadBalancer , and AWS::CloudFront::Distribution .
Shield Advanced - AWS::ElasticLoadBalancingV2::LoadBalancer , AWS::ElasticLoadBalancing::LoadBalancer , AWS::EC2::EIP , and AWS::CloudFront::Distribution .
Network ACL - AWS::EC2::Subnet .
Security group usage audit - AWS::EC2::SecurityGroup .
Security group content audit - AWS::EC2::SecurityGroup , AWS::EC2::NetworkInterface , and AWS::EC2::Instance .
DNS Firewall, AWS Network Firewall , and third-party firewall - AWS::EC2::VPC .

resourceTypeList List<String>

An array of ResourceType objects. Use this only to specify multiple resource types. To specify a single resource type, use ResourceType .

resourcesCleanUp Boolean

By default, Firewall Manager doesn't remove protections or delete Firewall Manager managed resources.

This option is not available for Shield Advanced or AWS WAF Classic policies.

securityServicePolicyData Property Map

Details about the security service that is being used to protect the resources.

This contains the following settings:

Type - Indicates the service type that the policy uses to protect the resource. For security group policies, Firewall Manager supports one security group for each common policy and for each content audit policy. This is an adjustable limit that you can increase by contacting .

ManagedServiceData - Details about the service that are specific to the service type, in JSON format.
Example: DNS_FIREWALL

"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"

Valid values for preProcessRuleGroups are between 1 and 99. Valid values for postProcessRuleGroups are between 9901 and 10000.

Example: NETWORK_FIREWALL - Centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration and route management

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to CENTRALIZED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall distributed deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Specification for SHIELD_ADVANCED for Amazon CloudFront distributions

For example: "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"

For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData configuration is an empty string.

Example: WAFV2

Example: AWS WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"

Example: WAFV2 - AWS Firewall Manager support for AWS WAF managed rule group versioning

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

Example: SECURITY_GROUPS_COMMON

Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

tags List<Property Map>

Supporting Types

PolicyFirewallDeploymentModel

PolicyIeMap

Account List<string>: The account list for the map.
Orgunit List<string>: The organizational unit list for the map.

Account []string: The account list for the map.
Orgunit []string: The organizational unit list for the map.

account List<String>: The account list for the map.
orgunit List<String>: The organizational unit list for the map.

account string[]: The account list for the map.
orgunit string[]: The organizational unit list for the map.

account Sequence[str]: The account list for the map.
orgunit Sequence[str]: The organizational unit list for the map.

account List<String>: The account list for the map.
orgunit List<String>: The organizational unit list for the map.

PolicyNetworkAclCommonPolicy

NetworkAclEntrySet Pulumi.AwsNative.Fms.Inputs.PolicyNetworkAclEntrySet: The definition of the first and last rules for the network ACL policy.

NetworkAclEntrySet PolicyNetworkAclEntrySet: The definition of the first and last rules for the network ACL policy.

networkAclEntrySet PolicyNetworkAclEntrySet: The definition of the first and last rules for the network ACL policy.

networkAclEntrySet PolicyNetworkAclEntrySet: The definition of the first and last rules for the network ACL policy.

network_acl_entry_set PolicyNetworkAclEntrySet: The definition of the first and last rules for the network ACL policy.

networkAclEntrySet Property Map: The definition of the first and last rules for the network ACL policy.

PolicyNetworkAclEntry

Egress bool: Whether the entry is an egress entry.
Protocol string: Protocol.
RuleAction Pulumi.AwsNative.Fms.PolicyNetworkAclEntryRuleAction: Rule Action.
CidrBlock string: CIDR block.
IcmpTypeCode Pulumi.AwsNative.Fms.Inputs.PolicyNetworkAclEntryIcmpTypeCodeProperties: ICMP type and code.
Ipv6CidrBlock string: IPv6 CIDR block.
PortRange Pulumi.AwsNative.Fms.Inputs.PolicyNetworkAclEntryPortRangeProperties: Port range.

Egress bool: Whether the entry is an egress entry.
Protocol string: Protocol.
RuleAction PolicyNetworkAclEntryRuleAction: Rule Action.
CidrBlock string: CIDR block.
IcmpTypeCode PolicyNetworkAclEntryIcmpTypeCodeProperties: ICMP type and code.
Ipv6CidrBlock string: IPv6 CIDR block.
PortRange PolicyNetworkAclEntryPortRangeProperties: Port range.

egress Boolean: Whether the entry is an egress entry.
protocol String: Protocol.
ruleAction PolicyNetworkAclEntryRuleAction: Rule Action.
cidrBlock String: CIDR block.
icmpTypeCode PolicyNetworkAclEntryIcmpTypeCodeProperties: ICMP type and code.
ipv6CidrBlock String: IPv6 CIDR block.
portRange PolicyNetworkAclEntryPortRangeProperties: Port range.

egress boolean: Whether the entry is an egress entry.
protocol string: Protocol.
ruleAction PolicyNetworkAclEntryRuleAction: Rule Action.
cidrBlock string: CIDR block.
icmpTypeCode PolicyNetworkAclEntryIcmpTypeCodeProperties: ICMP type and code.
ipv6CidrBlock string: IPv6 CIDR block.
portRange PolicyNetworkAclEntryPortRangeProperties: Port range.

egress bool: Whether the entry is an egress entry.
protocol str: Protocol.
rule_action PolicyNetworkAclEntryRuleAction: Rule Action.
cidr_block str: CIDR block.
icmp_type_code PolicyNetworkAclEntryIcmpTypeCodeProperties: ICMP type and code.
ipv6_cidr_block str: IPv6 CIDR block.
port_range PolicyNetworkAclEntryPortRangeProperties: Port range.

egress Boolean: Whether the entry is an egress entry.
protocol String: Protocol.
ruleAction "allow" | "deny": Rule Action.
cidrBlock String: CIDR block.
icmpTypeCode Property Map: ICMP type and code.
ipv6CidrBlock String: IPv6 CIDR block.
portRange Property Map: Port range.

PolicyNetworkAclEntryIcmpTypeCodeProperties

Code int: Code.
Type int: Type.

Code int: Code.
Type int: Type.

code Integer: Code.
type Integer: Type.

code number: Code.
type number: Type.

code int: Code.
type int: Type.

code Number: Code.
type Number: Type.

PolicyNetworkAclEntryPortRangeProperties

From int: From Port.
To int: To Port.

From int: From Port.
To int: To Port.

from Integer: From Port.
to Integer: To Port.

from number: From Port.
to number: To Port.

from_ int: From Port.
to int: To Port.

from Number: From Port.
to Number: To Port.

PolicyNetworkAclEntryRuleAction

PolicyNetworkAclEntrySet

ForceRemediateForFirstEntries bool

Applies only when remediation is enabled for the policy as a whole. Firewall Manager uses this setting when it finds policy violations that involve conflicts between the custom entries and the policy entries.

If forced remediation is disabled, Firewall Manager marks the network ACL as noncompliant and does not try to remediate. For more information about the remediation behavior, see Remediation for managed network ACLs in the AWS Firewall Manager Developer Guide .

ForceRemediateForLastEntries bool

FirstEntries List<Pulumi.AwsNative.Fms.Inputs.PolicyNetworkAclEntry>

The rules that you want to run first in the Firewall Manager managed network ACLs.

Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates.

You must specify at least one first entry or one last entry in any network ACL policy.

LastEntries List<Pulumi.AwsNative.Fms.Inputs.PolicyNetworkAclEntry>

The rules that you want to run last in the Firewall Manager managed network ACLs.

Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates.

You must specify at least one first entry or one last entry in any network ACL policy.

ForceRemediateForFirstEntries bool

ForceRemediateForLastEntries bool

FirstEntries []PolicyNetworkAclEntry

The rules that you want to run first in the Firewall Manager managed network ACLs.

Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates.

You must specify at least one first entry or one last entry in any network ACL policy.

LastEntries []PolicyNetworkAclEntry

The rules that you want to run last in the Firewall Manager managed network ACLs.

Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates.

You must specify at least one first entry or one last entry in any network ACL policy.

forceRemediateForFirstEntries Boolean

forceRemediateForLastEntries Boolean

firstEntries List<PolicyNetworkAclEntry>

The rules that you want to run first in the Firewall Manager managed network ACLs.

Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates.

You must specify at least one first entry or one last entry in any network ACL policy.

lastEntries List<PolicyNetworkAclEntry>

The rules that you want to run last in the Firewall Manager managed network ACLs.

Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates.

You must specify at least one first entry or one last entry in any network ACL policy.

forceRemediateForFirstEntries boolean

forceRemediateForLastEntries boolean

firstEntries PolicyNetworkAclEntry[]

The rules that you want to run first in the Firewall Manager managed network ACLs.

Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates.

You must specify at least one first entry or one last entry in any network ACL policy.

lastEntries PolicyNetworkAclEntry[]

The rules that you want to run last in the Firewall Manager managed network ACLs.

Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates.

You must specify at least one first entry or one last entry in any network ACL policy.

force_remediate_for_first_entries bool

force_remediate_for_last_entries bool

first_entries Sequence[PolicyNetworkAclEntry]

The rules that you want to run first in the Firewall Manager managed network ACLs.

Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates.

You must specify at least one first entry or one last entry in any network ACL policy.

last_entries Sequence[PolicyNetworkAclEntry]

The rules that you want to run last in the Firewall Manager managed network ACLs.

Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates.

You must specify at least one first entry or one last entry in any network ACL policy.

forceRemediateForFirstEntries Boolean

forceRemediateForLastEntries Boolean

firstEntries List<Property Map>

The rules that you want to run first in the Firewall Manager managed network ACLs.

Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates.

You must specify at least one first entry or one last entry in any network ACL policy.

lastEntries List<Property Map>

The rules that you want to run last in the Firewall Manager managed network ACLs.

Provide these in the order in which you want them to run. Firewall Manager will assign the specific rule numbers for you, in the network ACLs that it creates.

You must specify at least one first entry or one last entry in any network ACL policy.

PolicyNetworkFirewallPolicy

FirewallDeploymentModel Pulumi.AwsNative.Fms.PolicyFirewallDeploymentModel: Defines the deployment model to use for the firewall policy. To use a distributed model, set FirewallDeploymentModel to DISTRIBUTED .

FirewallDeploymentModel PolicyFirewallDeploymentModel: Defines the deployment model to use for the firewall policy. To use a distributed model, set FirewallDeploymentModel to DISTRIBUTED .

firewallDeploymentModel PolicyFirewallDeploymentModel: Defines the deployment model to use for the firewall policy. To use a distributed model, set FirewallDeploymentModel to DISTRIBUTED .

firewallDeploymentModel PolicyFirewallDeploymentModel: Defines the deployment model to use for the firewall policy. To use a distributed model, set FirewallDeploymentModel to DISTRIBUTED .

firewall_deployment_model PolicyFirewallDeploymentModel: Defines the deployment model to use for the firewall policy. To use a distributed model, set FirewallDeploymentModel to DISTRIBUTED .

firewallDeploymentModel "DISTRIBUTED" | "CENTRALIZED": Defines the deployment model to use for the firewall policy. To use a distributed model, set FirewallDeploymentModel to DISTRIBUTED .

PolicyOption

NetworkAclCommonPolicy Pulumi.AwsNative.Fms.Inputs.PolicyNetworkAclCommonPolicy: Defines a Firewall Manager network ACL policy.
NetworkFirewallPolicy Pulumi.AwsNative.Fms.Inputs.PolicyNetworkFirewallPolicy: Defines the deployment model to use for the firewall policy.
ThirdPartyFirewallPolicy Pulumi.AwsNative.Fms.Inputs.PolicyThirdPartyFirewallPolicy: Defines the policy options for a third-party firewall policy.

NetworkAclCommonPolicy PolicyNetworkAclCommonPolicy: Defines a Firewall Manager network ACL policy.
NetworkFirewallPolicy PolicyNetworkFirewallPolicy: Defines the deployment model to use for the firewall policy.
ThirdPartyFirewallPolicy PolicyThirdPartyFirewallPolicy: Defines the policy options for a third-party firewall policy.

networkAclCommonPolicy PolicyNetworkAclCommonPolicy: Defines a Firewall Manager network ACL policy.
networkFirewallPolicy PolicyNetworkFirewallPolicy: Defines the deployment model to use for the firewall policy.
thirdPartyFirewallPolicy PolicyThirdPartyFirewallPolicy: Defines the policy options for a third-party firewall policy.

networkAclCommonPolicy PolicyNetworkAclCommonPolicy: Defines a Firewall Manager network ACL policy.
networkFirewallPolicy PolicyNetworkFirewallPolicy: Defines the deployment model to use for the firewall policy.
thirdPartyFirewallPolicy PolicyThirdPartyFirewallPolicy: Defines the policy options for a third-party firewall policy.

network_acl_common_policy PolicyNetworkAclCommonPolicy: Defines a Firewall Manager network ACL policy.
network_firewall_policy PolicyNetworkFirewallPolicy: Defines the deployment model to use for the firewall policy.
third_party_firewall_policy PolicyThirdPartyFirewallPolicy: Defines the policy options for a third-party firewall policy.

networkAclCommonPolicy Property Map: Defines a Firewall Manager network ACL policy.
networkFirewallPolicy Property Map: Defines the deployment model to use for the firewall policy.
thirdPartyFirewallPolicy Property Map: Defines the policy options for a third-party firewall policy.

PolicyResourceTag

Key string: The resource tag key.
Value string: The resource tag value.

Key string: The resource tag key.
Value string: The resource tag value.

key String: The resource tag key.
value String: The resource tag value.

key string: The resource tag key.
value string: The resource tag value.

key str: The resource tag key.
value str: The resource tag value.

key String: The resource tag key.
value String: The resource tag value.

PolicyResourceTagLogicalOperator

PolicySecurityServicePolicyData

Type Pulumi.AwsNative.Fms.PolicyType

The service that the policy is using to protect the resources. This specifies the type of policy that is created, either an AWS WAF policy, a Shield Advanced policy, or a security group policy. For security group policies, Firewall Manager supports one security group for each common policy and for each content audit policy. This is an adjustable limit that you can increase by contacting SUPlong .

ManagedServiceData string

Details about the service that are specific to the service type, in JSON format.

Example: DNS_FIREWALL

"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"

Valid values for preProcessRuleGroups are between 1 and 99. Valid values for postProcessRuleGroups are between 9901 and 10000.

Example: NETWORK_FIREWALL - Centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration and route management

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to CENTRALIZED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall distributed deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Specification for SHIELD_ADVANCED for Amazon CloudFront distributions

For example: "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"

For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData configuration is an empty string.

Example: WAFV2

Example: AWS WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"

Example: WAFV2 - AWS Firewall Manager support for AWS WAF managed rule group versioning

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

Example: SECURITY_GROUPS_COMMON

Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

PolicyOption Pulumi.AwsNative.Fms.Inputs.PolicyOption

Contains the settings to configure a network ACL policy, a AWS Network Firewall firewall policy deployment model, or a third-party firewall policy.

Type PolicyType

ManagedServiceData string

Details about the service that are specific to the service type, in JSON format.

Example: DNS_FIREWALL

"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"

Valid values for preProcessRuleGroups are between 1 and 99. Valid values for postProcessRuleGroups are between 9901 and 10000.

Example: NETWORK_FIREWALL - Centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration and route management

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to CENTRALIZED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall distributed deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Specification for SHIELD_ADVANCED for Amazon CloudFront distributions

For example: "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"

For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData configuration is an empty string.

Example: WAFV2

Example: AWS WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"

Example: WAFV2 - AWS Firewall Manager support for AWS WAF managed rule group versioning

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

Example: SECURITY_GROUPS_COMMON

Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

PolicyOption PolicyOption

Contains the settings to configure a network ACL policy, a AWS Network Firewall firewall policy deployment model, or a third-party firewall policy.

type PolicyType

managedServiceData String

Details about the service that are specific to the service type, in JSON format.

Example: DNS_FIREWALL

"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"

Valid values for preProcessRuleGroups are between 1 and 99. Valid values for postProcessRuleGroups are between 9901 and 10000.

Example: NETWORK_FIREWALL - Centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration and route management

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to CENTRALIZED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall distributed deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Specification for SHIELD_ADVANCED for Amazon CloudFront distributions

For example: "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"

For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData configuration is an empty string.

Example: WAFV2

Example: AWS WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"

Example: WAFV2 - AWS Firewall Manager support for AWS WAF managed rule group versioning

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

Example: SECURITY_GROUPS_COMMON

Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

policyOption PolicyOption

Contains the settings to configure a network ACL policy, a AWS Network Firewall firewall policy deployment model, or a third-party firewall policy.

type PolicyType

managedServiceData string

Details about the service that are specific to the service type, in JSON format.

Example: DNS_FIREWALL

"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"

Valid values for preProcessRuleGroups are between 1 and 99. Valid values for postProcessRuleGroups are between 9901 and 10000.

Example: NETWORK_FIREWALL - Centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration and route management

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to CENTRALIZED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall distributed deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Specification for SHIELD_ADVANCED for Amazon CloudFront distributions

For example: "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"

For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData configuration is an empty string.

Example: WAFV2

Example: AWS WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"

Example: WAFV2 - AWS Firewall Manager support for AWS WAF managed rule group versioning

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

Example: SECURITY_GROUPS_COMMON

Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

policyOption PolicyOption

Contains the settings to configure a network ACL policy, a AWS Network Firewall firewall policy deployment model, or a third-party firewall policy.

type PolicyType

managed_service_data str

Details about the service that are specific to the service type, in JSON format.

Example: DNS_FIREWALL

"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"

Valid values for preProcessRuleGroups are between 1 and 99. Valid values for postProcessRuleGroups are between 9901 and 10000.

Example: NETWORK_FIREWALL - Centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration and route management

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to CENTRALIZED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall distributed deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Specification for SHIELD_ADVANCED for Amazon CloudFront distributions

For example: "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"

For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData configuration is an empty string.

Example: WAFV2

Example: AWS WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"

Example: WAFV2 - AWS Firewall Manager support for AWS WAF managed rule group versioning

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

Example: SECURITY_GROUPS_COMMON

Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

policy_option PolicyOption

Contains the settings to configure a network ACL policy, a AWS Network Firewall firewall policy deployment model, or a third-party firewall policy.

managedServiceData String

Details about the service that are specific to the service type, in JSON format.

Example: DNS_FIREWALL

"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"

Valid values for preProcessRuleGroups are between 1 and 99. Valid values for postProcessRuleGroups are between 9901 and 10000.

Example: NETWORK_FIREWALL - Centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration

Example: NETWORK_FIREWALL - Distributed deployment model with automatic Availability Zone configuration and route management

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\", \"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{ \"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[ \"10.0.0.0/28\"]}]} },\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"OFF\",\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: NETWORK_FIREWALL - Distributed deployment model with custom Availability Zone configuration and route management

"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateless-rulegroup/test\",\"priority\":1}],\"networkFirewallStatelessDefaultActions\":[\"aws:forward_to_sfe\",\"customActionName\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"aws:forward_to_sfe\",\"fragmentcustomactionname\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"customActionName\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"metricdimensionvalue\"}]}}},{\"actionName\":\"fragmentcustomactionname\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"fragmentmetricdimensionvalue\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-east-1:123456789011:stateful-rulegroup/test\"}],\"networkFirewallOrchestrationConfig\":{\"firewallCreationConfig\":{\"endpointLocation\":{\"availabilityZoneConfigList\":[{\"availabilityZoneName\":\"us-east-1a\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]},{\"availabilityZoneName\":\"us-east-1b\",\"allowedIPV4CidrList\":[\"10.0.0.0/28\"]}]}},\"singleFirewallEndpointPerVPC\":false,\"allowedIPV4CidrList\":null,\"routeManagementAction\":\"MONITOR\",\"routeManagementTargetTypes\":[\"InternetGateway\"],\"routeManagementConfig\":{\"allowCrossAZTrafficIfNoEndpoint\":true}},\"networkFirewallLoggingConfiguration\":{\"logDestinationConfigs\":[{\"logDestinationType\":\"S3\",\"logType\":\"ALERT\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}},{\"logDestinationType\":\"S3\",\"logType\":\"FLOW\",\"logDestination\":{\"bucketName\":\"s3-bucket-name\"}}],\"overrideExistingConfig\":boolean}}"

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall centralized deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to CENTRALIZED .

Example: THIRD_PARTY_FIREWALL - Palo Alto Networks Cloud Next-Generation Firewall distributed deployment model

To use the distributed deployment model, you must set FirewallDeploymentModel to DISTRIBUTED .

Specification for SHIELD_ADVANCED for Amazon CloudFront distributions

For example: "{\"type\":\"SHIELD_ADVANCED\",\"automaticResponseConfiguration\": {\"automaticResponseStatus\":\"ENABLED\", \"automaticResponseAction\":\"COUNT\"}}"

For other resource types that you can protect with a Shield Advanced policy, this ManagedServiceData configuration is an empty string.

Example: WAFV2

Example: AWS WAF Classic

"{\"type\": \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\", \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\": \"BLOCK\"}}"

Example: WAFV2 - AWS Firewall Manager support for AWS WAF managed rule group versioning

"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"versionEnabled\":true,\"version\":\"Version_2.0\",\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesCommonRuleSet\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[{\"name\":\"NoUserAgent_HEADER\"}]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"

Example: SECURITY_GROUPS_COMMON

Example: Shared VPCs. Apply the preceding policy to resources in shared VPCs as well as to those in VPCs that the account owns

"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false, \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\" sg-000e55995d61a06bd\"}]}"

Example: SECURITY_GROUPS_CONTENT_AUDIT

"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"

Example: SECURITY_GROUPS_USAGE_AUDIT

"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"

policyOption Property Map

Contains the settings to configure a network ACL policy, a AWS Network Firewall firewall policy deployment model, or a third-party firewall policy.

PolicyThirdPartyFirewallPolicy

FirewallDeploymentModel Pulumi.AwsNative.Fms.PolicyFirewallDeploymentModel: Defines the deployment model to use for the third-party firewall policy.

FirewallDeploymentModel PolicyFirewallDeploymentModel: Defines the deployment model to use for the third-party firewall policy.

firewallDeploymentModel PolicyFirewallDeploymentModel: Defines the deployment model to use for the third-party firewall policy.

firewallDeploymentModel PolicyFirewallDeploymentModel: Defines the deployment model to use for the third-party firewall policy.

firewall_deployment_model PolicyFirewallDeploymentModel: Defines the deployment model to use for the third-party firewall policy.

firewallDeploymentModel "DISTRIBUTED" | "CENTRALIZED": Defines the deployment model to use for the third-party firewall policy.

PolicyType

Package Details

Repository: AWS Native pulumi/pulumi-aws-native
License: Apache-2.0

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.28.0 published on Monday, May 19, 2025 by Pulumi

pulumi/pulumi-aws-native

aws-native.fms.getPolicy

On this page

On this page

Using getPolicy

getPolicy Result

Supporting Types

PolicyFirewallDeploymentModel

PolicyIeMap

PolicyNetworkAclCommonPolicy

PolicyNetworkAclEntry

PolicyNetworkAclEntryIcmpTypeCodeProperties

PolicyNetworkAclEntryPortRangeProperties

PolicyNetworkAclEntryRuleAction

PolicyNetworkAclEntrySet

PolicyNetworkFirewallPolicy

PolicyOption

PolicyResourceTag

PolicyResourceTagLogicalOperator

PolicySecurityServicePolicyData

PolicyThirdPartyFirewallPolicy

PolicyType

Tag

Package Details

On this page

On this page