1. Registry
  2. Packages
  3. AWS Cloud Control
  4. API Docs
  5. networksecuritymanager
  6. Policy

We recommend new projects start with resources from the AWS provider.

Viewing docs for AWS Cloud Control v1.85.0
published on Monday, Nov 2, 2026 by Pulumi
aws-native logo aws-native logo AWS Cloud Control

We recommend new projects start with resources from the AWS provider.

Viewing docs for AWS Cloud Control v1.85.0
published on Monday, Nov 2, 2026 by Pulumi

    Resource Type definition for AWS::NetworkSecurityManager::Policy. Creates and manages a Network Security Manager policy.

    Create Policy Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Policy(name: string, args: PolicyArgs, opts?: CustomResourceOptions);
    @overload
    def Policy(resource_name: str,
               args: PolicyArgs,
               opts: Optional[ResourceOptions] = None)
    
    @overload
    def Policy(resource_name: str,
               opts: Optional[ResourceOptions] = None,
               firewall_type: Optional[PolicyFirewallType] = None,
               policy_configuration: Optional[PolicyConfigurationArgs] = None,
               priority: Optional[int] = None,
               associated_template_and_rule_list: Optional[Sequence[PolicyAssociatedTemplateAndRuleArgs]] = None,
               policy_description: Optional[str] = None,
               policy_name: Optional[str] = None,
               tags: Optional[Sequence[_root_inputs.TagArgs]] = None)
    func NewPolicy(ctx *Context, name string, args PolicyArgs, opts ...ResourceOption) (*Policy, error)
    public Policy(string name, PolicyArgs args, CustomResourceOptions? opts = null)
    public Policy(String name, PolicyArgs args)
    public Policy(String name, PolicyArgs args, CustomResourceOptions options)
    
    type: aws-native:networksecuritymanager:Policy
    properties: # The arguments to resource properties.
    options: # Bag of options to control resource's behavior.
    
    
    resource "aws-native_networksecuritymanager_policy" "name" {
        # resource properties
    }

    Parameters

    name string
    The unique name of the resource.
    args PolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args PolicyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args PolicyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args PolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args PolicyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Policy Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Policy resource accepts the following input properties:

    FirewallType Pulumi.AwsNative.NetworkSecurityManager.PolicyFirewallType
    The type of firewall.
    PolicyConfiguration Pulumi.AwsNative.NetworkSecurityManager.Inputs.PolicyConfiguration
    Configuration settings for policy behavior.
    Priority int
    The priority of the policy.
    AssociatedTemplateAndRuleList List<Pulumi.AwsNative.NetworkSecurityManager.Inputs.PolicyAssociatedTemplateAndRule>
    List of templates and rules associated with this policy.
    PolicyDescription string
    A description of the policy.
    PolicyName string
    The name of the policy.
    Tags List<Pulumi.AwsNative.Inputs.Tag>
    The tags associated with the policy.
    FirewallType PolicyFirewallType
    The type of firewall.
    PolicyConfiguration PolicyConfigurationArgs
    Configuration settings for policy behavior.
    Priority int
    The priority of the policy.
    AssociatedTemplateAndRuleList []PolicyAssociatedTemplateAndRuleArgs
    List of templates and rules associated with this policy.
    PolicyDescription string
    A description of the policy.
    PolicyName string
    The name of the policy.
    Tags TagArgs
    The tags associated with the policy.
    firewall_type "WAF" | "SHIELD_ADVANCED"
    The type of firewall.
    policy_configuration object
    Configuration settings for policy behavior.
    priority number
    The priority of the policy.
    associated_template_and_rule_list list(object)
    List of templates and rules associated with this policy.
    policy_description string
    A description of the policy.
    policy_name string
    The name of the policy.
    tags list(object)
    The tags associated with the policy.
    firewallType PolicyFirewallType
    The type of firewall.
    policyConfiguration PolicyConfiguration
    Configuration settings for policy behavior.
    priority Integer
    The priority of the policy.
    associatedTemplateAndRuleList List<PolicyAssociatedTemplateAndRule>
    List of templates and rules associated with this policy.
    policyDescription String
    A description of the policy.
    policyName String
    The name of the policy.
    tags List<Tag>
    The tags associated with the policy.
    firewallType PolicyFirewallType
    The type of firewall.
    policyConfiguration PolicyConfiguration
    Configuration settings for policy behavior.
    priority number
    The priority of the policy.
    associatedTemplateAndRuleList PolicyAssociatedTemplateAndRule[]
    List of templates and rules associated with this policy.
    policyDescription string
    A description of the policy.
    policyName string
    The name of the policy.
    tags Tag[]
    The tags associated with the policy.
    firewall_type PolicyFirewallType
    The type of firewall.
    policy_configuration PolicyConfigurationArgs
    Configuration settings for policy behavior.
    priority int
    The priority of the policy.
    associated_template_and_rule_list Sequence[PolicyAssociatedTemplateAndRuleArgs]
    List of templates and rules associated with this policy.
    policy_description str
    A description of the policy.
    policy_name str
    The name of the policy.
    tags Sequence[TagArgs]
    The tags associated with the policy.
    firewallType "WAF" | "SHIELD_ADVANCED"
    The type of firewall.
    policyConfiguration Property Map
    Configuration settings for policy behavior.
    priority Number
    The priority of the policy.
    associatedTemplateAndRuleList List<Property Map>
    List of templates and rules associated with this policy.
    policyDescription String
    A description of the policy.
    policyName String
    The name of the policy.
    tags List<Property Map>
    The tags associated with the policy.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Policy resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    PolicyArn string
    The ARN of the policy.
    PolicyId string
    The unique identifier of the policy.
    Status Pulumi.AwsNative.NetworkSecurityManager.PolicyStatus
    The status of the policy.
    UpdatedAt string
    An ISO 8601 timestamp indicating when the policy was last modified.
    Version string
    The version number.
    Id string
    The provider-assigned unique ID for this managed resource.
    PolicyArn string
    The ARN of the policy.
    PolicyId string
    The unique identifier of the policy.
    Status PolicyStatus
    The status of the policy.
    UpdatedAt string
    An ISO 8601 timestamp indicating when the policy was last modified.
    Version string
    The version number.
    id string
    The provider-assigned unique ID for this managed resource.
    policy_arn string
    The ARN of the policy.
    policy_id string
    The unique identifier of the policy.
    status "DRAFT" | "ACTIVE" | "DISABLED"
    The status of the policy.
    updated_at string
    An ISO 8601 timestamp indicating when the policy was last modified.
    version string
    The version number.
    id String
    The provider-assigned unique ID for this managed resource.
    policyArn String
    The ARN of the policy.
    policyId String
    The unique identifier of the policy.
    status PolicyStatus
    The status of the policy.
    updatedAt String
    An ISO 8601 timestamp indicating when the policy was last modified.
    version String
    The version number.
    id string
    The provider-assigned unique ID for this managed resource.
    policyArn string
    The ARN of the policy.
    policyId string
    The unique identifier of the policy.
    status PolicyStatus
    The status of the policy.
    updatedAt string
    An ISO 8601 timestamp indicating when the policy was last modified.
    version string
    The version number.
    id str
    The provider-assigned unique ID for this managed resource.
    policy_arn str
    The ARN of the policy.
    policy_id str
    The unique identifier of the policy.
    status PolicyStatus
    The status of the policy.
    updated_at str
    An ISO 8601 timestamp indicating when the policy was last modified.
    version str
    The version number.
    id String
    The provider-assigned unique ID for this managed resource.
    policyArn String
    The ARN of the policy.
    policyId String
    The unique identifier of the policy.
    status "DRAFT" | "ACTIVE" | "DISABLED"
    The status of the policy.
    updatedAt String
    An ISO 8601 timestamp indicating when the policy was last modified.
    version String
    The version number.

    Supporting Types

    PolicyAssociatedTemplateAndRule, PolicyAssociatedTemplateAndRuleArgs

    Associates either a template or a rule with a policy.
    RuleArn string
    ARN of the associated rule.
    TemplateArn string
    ARN of the associated template.
    RuleArn string
    ARN of the associated rule.
    TemplateArn string
    ARN of the associated template.
    rule_arn string
    ARN of the associated rule.
    template_arn string
    ARN of the associated template.
    ruleArn String
    ARN of the associated rule.
    templateArn String
    ARN of the associated template.
    ruleArn string
    ARN of the associated rule.
    templateArn string
    ARN of the associated template.
    rule_arn str
    ARN of the associated rule.
    template_arn str
    ARN of the associated template.
    ruleArn String
    ARN of the associated rule.
    templateArn String
    ARN of the associated template.

    PolicyConfiguration, PolicyConfigurationArgs

    Configuration settings for policy behavior.
    RemediationEnabled bool
    Controls automatic remediation of non-compliant resources.
    ResourcesCleanUp bool
    Controls automatic cleanup of unused resources.
    WafConfig Pulumi.AwsNative.NetworkSecurityManager.Inputs.PolicyWafConfig
    RemediationEnabled bool
    Controls automatic remediation of non-compliant resources.
    ResourcesCleanUp bool
    Controls automatic cleanup of unused resources.
    WafConfig PolicyWafConfig
    remediation_enabled bool
    Controls automatic remediation of non-compliant resources.
    resources_clean_up bool
    Controls automatic cleanup of unused resources.
    waf_config object
    remediationEnabled Boolean
    Controls automatic remediation of non-compliant resources.
    resourcesCleanUp Boolean
    Controls automatic cleanup of unused resources.
    wafConfig PolicyWafConfig
    remediationEnabled boolean
    Controls automatic remediation of non-compliant resources.
    resourcesCleanUp boolean
    Controls automatic cleanup of unused resources.
    wafConfig PolicyWafConfig
    remediation_enabled bool
    Controls automatic remediation of non-compliant resources.
    resources_clean_up bool
    Controls automatic cleanup of unused resources.
    waf_config PolicyWafConfig
    remediationEnabled Boolean
    Controls automatic remediation of non-compliant resources.
    resourcesCleanUp Boolean
    Controls automatic cleanup of unused resources.
    wafConfig Property Map

    PolicyFirewallType, PolicyFirewallTypeArgs

    Waf
    WAF
    ShieldAdvanced
    SHIELD_ADVANCED
    PolicyFirewallTypeWaf
    WAF
    PolicyFirewallTypeShieldAdvanced
    SHIELD_ADVANCED
    "WAF"
    WAF
    "SHIELD_ADVANCED"
    SHIELD_ADVANCED
    Waf
    WAF
    ShieldAdvanced
    SHIELD_ADVANCED
    Waf
    WAF
    ShieldAdvanced
    SHIELD_ADVANCED
    WAF
    WAF
    SHIELD_ADVANCED
    SHIELD_ADVANCED
    "WAF"
    WAF
    "SHIELD_ADVANCED"
    SHIELD_ADVANCED

    PolicyStatus, PolicyStatusArgs

    Draft
    DRAFT
    Active
    ACTIVE
    Disabled
    DISABLED
    PolicyStatusDraft
    DRAFT
    PolicyStatusActive
    ACTIVE
    PolicyStatusDisabled
    DISABLED
    "DRAFT"
    DRAFT
    "ACTIVE"
    ACTIVE
    "DISABLED"
    DISABLED
    Draft
    DRAFT
    Active
    ACTIVE
    Disabled
    DISABLED
    Draft
    DRAFT
    Active
    ACTIVE
    Disabled
    DISABLED
    DRAFT
    DRAFT
    ACTIVE
    ACTIVE
    DISABLED
    DISABLED
    "DRAFT"
    DRAFT
    "ACTIVE"
    ACTIVE
    "DISABLED"
    DISABLED

    PolicyWafConfig, PolicyWafConfigArgs

    WAF-specific policy settings. Populated only for WAF firewall type policies.
    ConflictResolution Pulumi.AwsNative.NetworkSecurityManager.PolicyWafConfigConflictResolution
    Conflict-resolution strategy applied to AWS WAF policies.
    ExistingCustomerWebAclResolution Pulumi.AwsNative.NetworkSecurityManager.PolicyWafConfigExistingCustomerWebAclResolution
    Controls how Network Security Manager handles remediation when a resource already has a customer-created WebACL.
    ConflictResolution PolicyWafConfigConflictResolution
    Conflict-resolution strategy applied to AWS WAF policies.
    ExistingCustomerWebAclResolution PolicyWafConfigExistingCustomerWebAclResolution
    Controls how Network Security Manager handles remediation when a resource already has a customer-created WebACL.
    conflict_resolution "MERGE_WHERE_APPLICABLE"
    Conflict-resolution strategy applied to AWS WAF policies.
    existing_customer_web_acl_resolution "RETROFIT" | "OVERRIDE_ASSOCIATION" | "NO_REMEDIATION"
    Controls how Network Security Manager handles remediation when a resource already has a customer-created WebACL.
    conflictResolution PolicyWafConfigConflictResolution
    Conflict-resolution strategy applied to AWS WAF policies.
    existingCustomerWebAclResolution PolicyWafConfigExistingCustomerWebAclResolution
    Controls how Network Security Manager handles remediation when a resource already has a customer-created WebACL.
    conflictResolution PolicyWafConfigConflictResolution
    Conflict-resolution strategy applied to AWS WAF policies.
    existingCustomerWebAclResolution PolicyWafConfigExistingCustomerWebAclResolution
    Controls how Network Security Manager handles remediation when a resource already has a customer-created WebACL.
    conflict_resolution PolicyWafConfigConflictResolution
    Conflict-resolution strategy applied to AWS WAF policies.
    existing_customer_web_acl_resolution PolicyWafConfigExistingCustomerWebAclResolution
    Controls how Network Security Manager handles remediation when a resource already has a customer-created WebACL.
    conflictResolution "MERGE_WHERE_APPLICABLE"
    Conflict-resolution strategy applied to AWS WAF policies.
    existingCustomerWebAclResolution "RETROFIT" | "OVERRIDE_ASSOCIATION" | "NO_REMEDIATION"
    Controls how Network Security Manager handles remediation when a resource already has a customer-created WebACL.

    PolicyWafConfigConflictResolution, PolicyWafConfigConflictResolutionArgs

    MergeWhereApplicable
    MERGE_WHERE_APPLICABLE
    PolicyWafConfigConflictResolutionMergeWhereApplicable
    MERGE_WHERE_APPLICABLE
    "MERGE_WHERE_APPLICABLE"
    MERGE_WHERE_APPLICABLE
    MergeWhereApplicable
    MERGE_WHERE_APPLICABLE
    MergeWhereApplicable
    MERGE_WHERE_APPLICABLE
    MERGE_WHERE_APPLICABLE
    MERGE_WHERE_APPLICABLE
    "MERGE_WHERE_APPLICABLE"
    MERGE_WHERE_APPLICABLE

    PolicyWafConfigExistingCustomerWebAclResolution, PolicyWafConfigExistingCustomerWebAclResolutionArgs

    Retrofit
    RETROFIT
    OverrideAssociation
    OVERRIDE_ASSOCIATION
    NoRemediation
    NO_REMEDIATION
    PolicyWafConfigExistingCustomerWebAclResolutionRetrofit
    RETROFIT
    PolicyWafConfigExistingCustomerWebAclResolutionOverrideAssociation
    OVERRIDE_ASSOCIATION
    PolicyWafConfigExistingCustomerWebAclResolutionNoRemediation
    NO_REMEDIATION
    "RETROFIT"
    RETROFIT
    "OVERRIDE_ASSOCIATION"
    OVERRIDE_ASSOCIATION
    "NO_REMEDIATION"
    NO_REMEDIATION
    Retrofit
    RETROFIT
    OverrideAssociation
    OVERRIDE_ASSOCIATION
    NoRemediation
    NO_REMEDIATION
    Retrofit
    RETROFIT
    OverrideAssociation
    OVERRIDE_ASSOCIATION
    NoRemediation
    NO_REMEDIATION
    RETROFIT
    RETROFIT
    OVERRIDE_ASSOCIATION
    OVERRIDE_ASSOCIATION
    NO_REMEDIATION
    NO_REMEDIATION
    "RETROFIT"
    RETROFIT
    "OVERRIDE_ASSOCIATION"
    OVERRIDE_ASSOCIATION
    "NO_REMEDIATION"
    NO_REMEDIATION

    Tag, TagArgs

    A set of tags to apply to the resource.
    Key string
    The key name of the tag
    Value string
    The value of the tag
    Key string
    The key name of the tag
    Value string
    The value of the tag
    key string
    The key name of the tag
    value string
    The value of the tag
    key String
    The key name of the tag
    value String
    The value of the tag
    key string
    The key name of the tag
    value string
    The value of the tag
    key str
    The key name of the tag
    value str
    The value of the tag
    key String
    The key name of the tag
    value String
    The value of the tag

    Package Details

    Repository
    AWS Native pulumi/pulumi-aws-native
    License
    Apache-2.0
    aws-native logo aws-native logo AWS Cloud Control

    We recommend new projects start with resources from the AWS provider.

    Viewing docs for AWS Cloud Control v1.85.0
    published on Monday, Nov 2, 2026 by Pulumi

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial