aws.networkfirewall.FirewallPolicy
Explore with Pulumi AI
Provides an AWS Network Firewall Firewall Policy Resource
Policy with a Custom Action for Stateless Inspection
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.networkfirewall.FirewallPolicy;
import com.pulumi.aws.networkfirewall.FirewallPolicyArgs;
import com.pulumi.aws.networkfirewall.inputs.FirewallPolicyFirewallPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var test = new FirewallPolicy("test", FirewallPolicyArgs.builder()
.firewallPolicy(FirewallPolicyFirewallPolicyArgs.builder()
.statelessCustomActions(FirewallPolicyFirewallPolicyStatelessCustomActionArgs.builder()
.actionDefinition(FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionArgs.builder()
.publishMetricAction(FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionArgs.builder()
.dimension(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
.build())
.build())
.actionName("ExampleCustomAction")
.build())
.statelessDefaultActions(
"aws:pass",
"ExampleCustomAction")
.statelessFragmentDefaultActions("aws:drop")
.build())
.build());
}
}
resources:
test:
type: aws:networkfirewall:FirewallPolicy
properties:
firewallPolicy:
statelessCustomActions:
- actionDefinition:
publishMetricAction:
dimension:
- value: '1'
actionName: ExampleCustomAction
statelessDefaultActions:
- aws:pass
- ExampleCustomAction
statelessFragmentDefaultActions:
- aws:drop
Example Usage
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
return await Deployment.RunAsync(() =>
{
var example = new Aws.NetworkFirewall.FirewallPolicy("example", new()
{
FirewallPolicyConfiguration = new Aws.NetworkFirewall.Inputs.FirewallPolicyFirewallPolicyArgs
{
StatelessDefaultActions = new[]
{
"aws:pass",
},
StatelessFragmentDefaultActions = new[]
{
"aws:drop",
},
StatelessRuleGroupReferences = new[]
{
new Aws.NetworkFirewall.Inputs.FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArgs
{
Priority = 1,
ResourceArn = aws_networkfirewall_rule_group.Example.Arn,
},
},
},
Tags =
{
{ "Tag1", "Value1" },
{ "Tag2", "Value2" },
},
});
});
package main
import (
"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/networkfirewall"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
_, err := networkfirewall.NewFirewallPolicy(ctx, "example", &networkfirewall.FirewallPolicyArgs{
FirewallPolicy: &networkfirewall.FirewallPolicyFirewallPolicyArgs{
StatelessDefaultActions: pulumi.StringArray{
pulumi.String("aws:pass"),
},
StatelessFragmentDefaultActions: pulumi.StringArray{
pulumi.String("aws:drop"),
},
StatelessRuleGroupReferences: networkfirewall.FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArray{
&networkfirewall.FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArgs{
Priority: pulumi.Int(1),
ResourceArn: pulumi.Any(aws_networkfirewall_rule_group.Example.Arn),
},
},
},
Tags: pulumi.StringMap{
"Tag1": pulumi.String("Value1"),
"Tag2": pulumi.String("Value2"),
},
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.networkfirewall.FirewallPolicy;
import com.pulumi.aws.networkfirewall.FirewallPolicyArgs;
import com.pulumi.aws.networkfirewall.inputs.FirewallPolicyFirewallPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new FirewallPolicy("example", FirewallPolicyArgs.builder()
.firewallPolicy(FirewallPolicyFirewallPolicyArgs.builder()
.statelessDefaultActions("aws:pass")
.statelessFragmentDefaultActions("aws:drop")
.statelessRuleGroupReferences(FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArgs.builder()
.priority(1)
.resourceArn(aws_networkfirewall_rule_group.example().arn())
.build())
.build())
.tags(Map.ofEntries(
Map.entry("Tag1", "Value1"),
Map.entry("Tag2", "Value2")
))
.build());
}
}
import pulumi
import pulumi_aws as aws
example = aws.networkfirewall.FirewallPolicy("example",
firewall_policy=aws.networkfirewall.FirewallPolicyFirewallPolicyArgs(
stateless_default_actions=["aws:pass"],
stateless_fragment_default_actions=["aws:drop"],
stateless_rule_group_references=[aws.networkfirewall.FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArgs(
priority=1,
resource_arn=aws_networkfirewall_rule_group["example"]["arn"],
)],
),
tags={
"Tag1": "Value1",
"Tag2": "Value2",
})
import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
const example = new aws.networkfirewall.FirewallPolicy("example", {
firewallPolicy: {
statelessDefaultActions: ["aws:pass"],
statelessFragmentDefaultActions: ["aws:drop"],
statelessRuleGroupReferences: [{
priority: 1,
resourceArn: aws_networkfirewall_rule_group.example.arn,
}],
},
tags: {
Tag1: "Value1",
Tag2: "Value2",
},
});
resources:
example:
type: aws:networkfirewall:FirewallPolicy
properties:
firewallPolicy:
statelessDefaultActions:
- aws:pass
statelessFragmentDefaultActions:
- aws:drop
statelessRuleGroupReferences:
- priority: 1
resourceArn: ${aws_networkfirewall_rule_group.example.arn}
tags:
Tag1: Value1
Tag2: Value2
Coming soon!
Coming soon!
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.networkfirewall.FirewallPolicy;
import com.pulumi.aws.networkfirewall.FirewallPolicyArgs;
import com.pulumi.aws.networkfirewall.inputs.FirewallPolicyFirewallPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var test = new FirewallPolicy("test", FirewallPolicyArgs.builder()
.firewallPolicy(FirewallPolicyFirewallPolicyArgs.builder()
.statelessCustomActions(FirewallPolicyFirewallPolicyStatelessCustomActionArgs.builder()
.actionDefinition(FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionArgs.builder()
.publishMetricAction(FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionArgs.builder()
.dimension(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
.build())
.build())
.actionName("ExampleCustomAction")
.build())
.statelessDefaultActions(
"aws:pass",
"ExampleCustomAction")
.statelessFragmentDefaultActions("aws:drop")
.build())
.build());
}
}
Coming soon!
Coming soon!
resources:
test:
type: aws:networkfirewall:FirewallPolicy
properties:
firewallPolicy:
statelessCustomActions:
- actionDefinition:
publishMetricAction:
dimension:
- value: '1'
actionName: ExampleCustomAction
statelessDefaultActions:
- aws:pass
- ExampleCustomAction
statelessFragmentDefaultActions:
- aws:drop
Create FirewallPolicy Resource
new FirewallPolicy(name: string, args: FirewallPolicyArgs, opts?: CustomResourceOptions);
@overload
def FirewallPolicy(resource_name: str,
opts: Optional[ResourceOptions] = None,
description: Optional[str] = None,
encryption_configuration: Optional[FirewallPolicyEncryptionConfigurationArgs] = None,
firewall_policy: Optional[FirewallPolicyFirewallPolicyArgs] = None,
name: Optional[str] = None,
tags: Optional[Mapping[str, str]] = None)
@overload
def FirewallPolicy(resource_name: str,
args: FirewallPolicyArgs,
opts: Optional[ResourceOptions] = None)
func NewFirewallPolicy(ctx *Context, name string, args FirewallPolicyArgs, opts ...ResourceOption) (*FirewallPolicy, error)
public FirewallPolicy(string name, FirewallPolicyArgs args, CustomResourceOptions? opts = null)
public FirewallPolicy(String name, FirewallPolicyArgs args)
public FirewallPolicy(String name, FirewallPolicyArgs args, CustomResourceOptions options)
type: aws:networkfirewall:FirewallPolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args FirewallPolicyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args FirewallPolicyArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args FirewallPolicyArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args FirewallPolicyArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args FirewallPolicyArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
FirewallPolicy Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
The FirewallPolicy resource accepts the following input properties:
- Firewall
Policy FirewallConfiguration Policy Firewall Policy Args A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
- Description string
A friendly description of the firewall policy.
- Encryption
Configuration FirewallPolicy Encryption Configuration Args KMS encryption configuration settings. See Encryption Configuration below for details.
- Name string
A friendly name of the firewall policy.
- Dictionary<string, string>
Map of resource tags to associate with the resource. If configured with a provider
default_tags
configuration block present, tags with matching keys will overwrite those defined at the provider-level.
- Firewall
Policy FirewallPolicy Firewall Policy Args A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
- Description string
A friendly description of the firewall policy.
- Encryption
Configuration FirewallPolicy Encryption Configuration Args KMS encryption configuration settings. See Encryption Configuration below for details.
- Name string
A friendly name of the firewall policy.
- map[string]string
Map of resource tags to associate with the resource. If configured with a provider
default_tags
configuration block present, tags with matching keys will overwrite those defined at the provider-level.
- firewall
Policy FirewallPolicy Firewall Policy Args A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
- description String
A friendly description of the firewall policy.
- encryption
Configuration FirewallPolicy Encryption Configuration Args KMS encryption configuration settings. See Encryption Configuration below for details.
- name String
A friendly name of the firewall policy.
- Map<String,String>
Map of resource tags to associate with the resource. If configured with a provider
default_tags
configuration block present, tags with matching keys will overwrite those defined at the provider-level.
- firewall
Policy FirewallPolicy Firewall Policy Args A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
- description string
A friendly description of the firewall policy.
- encryption
Configuration FirewallPolicy Encryption Configuration Args KMS encryption configuration settings. See Encryption Configuration below for details.
- name string
A friendly name of the firewall policy.
- {[key: string]: string}
Map of resource tags to associate with the resource. If configured with a provider
default_tags
configuration block present, tags with matching keys will overwrite those defined at the provider-level.
- firewall_
policy FirewallPolicy Firewall Policy Args A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
- description str
A friendly description of the firewall policy.
- encryption_
configuration FirewallPolicy Encryption Configuration Args KMS encryption configuration settings. See Encryption Configuration below for details.
- name str
A friendly name of the firewall policy.
- Mapping[str, str]
Map of resource tags to associate with the resource. If configured with a provider
default_tags
configuration block present, tags with matching keys will overwrite those defined at the provider-level.
- firewall
Policy Property Map A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
- description String
A friendly description of the firewall policy.
- encryption
Configuration Property Map KMS encryption configuration settings. See Encryption Configuration below for details.
- name String
A friendly name of the firewall policy.
- Map<String>
Map of resource tags to associate with the resource. If configured with a provider
default_tags
configuration block present, tags with matching keys will overwrite those defined at the provider-level.
Outputs
All input properties are implicitly available as output properties. Additionally, the FirewallPolicy resource produces the following output properties:
- Arn string
The Amazon Resource Name (ARN) that identifies the firewall policy.
- Id string
The provider-assigned unique ID for this managed resource.
- Dictionary<string, string>
A map of tags assigned to the resource, including those inherited from the provider
default_tags
configuration block.- Update
Token string A string token used when updating a firewall policy.
- Arn string
The Amazon Resource Name (ARN) that identifies the firewall policy.
- Id string
The provider-assigned unique ID for this managed resource.
- map[string]string
A map of tags assigned to the resource, including those inherited from the provider
default_tags
configuration block.- Update
Token string A string token used when updating a firewall policy.
- arn String
The Amazon Resource Name (ARN) that identifies the firewall policy.
- id String
The provider-assigned unique ID for this managed resource.
- Map<String,String>
A map of tags assigned to the resource, including those inherited from the provider
default_tags
configuration block.- update
Token String A string token used when updating a firewall policy.
- arn string
The Amazon Resource Name (ARN) that identifies the firewall policy.
- id string
The provider-assigned unique ID for this managed resource.
- {[key: string]: string}
A map of tags assigned to the resource, including those inherited from the provider
default_tags
configuration block.- update
Token string A string token used when updating a firewall policy.
- arn str
The Amazon Resource Name (ARN) that identifies the firewall policy.
- id str
The provider-assigned unique ID for this managed resource.
- Mapping[str, str]
A map of tags assigned to the resource, including those inherited from the provider
default_tags
configuration block.- update_
token str A string token used when updating a firewall policy.
- arn String
The Amazon Resource Name (ARN) that identifies the firewall policy.
- id String
The provider-assigned unique ID for this managed resource.
- Map<String>
A map of tags assigned to the resource, including those inherited from the provider
default_tags
configuration block.- update
Token String A string token used when updating a firewall policy.
Look up Existing FirewallPolicy Resource
Get an existing FirewallPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: FirewallPolicyState, opts?: CustomResourceOptions): FirewallPolicy
@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
arn: Optional[str] = None,
description: Optional[str] = None,
encryption_configuration: Optional[FirewallPolicyEncryptionConfigurationArgs] = None,
firewall_policy: Optional[FirewallPolicyFirewallPolicyArgs] = None,
name: Optional[str] = None,
tags: Optional[Mapping[str, str]] = None,
tags_all: Optional[Mapping[str, str]] = None,
update_token: Optional[str] = None) -> FirewallPolicy
func GetFirewallPolicy(ctx *Context, name string, id IDInput, state *FirewallPolicyState, opts ...ResourceOption) (*FirewallPolicy, error)
public static FirewallPolicy Get(string name, Input<string> id, FirewallPolicyState? state, CustomResourceOptions? opts = null)
public static FirewallPolicy get(String name, Output<String> id, FirewallPolicyState state, CustomResourceOptions options)
Resource lookup is not supported in YAML
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Arn string
The Amazon Resource Name (ARN) that identifies the firewall policy.
- Description string
A friendly description of the firewall policy.
- Encryption
Configuration FirewallPolicy Encryption Configuration Args KMS encryption configuration settings. See Encryption Configuration below for details.
- Firewall
Policy FirewallConfiguration Policy Firewall Policy Args A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
- Name string
A friendly name of the firewall policy.
- Dictionary<string, string>
Map of resource tags to associate with the resource. If configured with a provider
default_tags
configuration block present, tags with matching keys will overwrite those defined at the provider-level.- Dictionary<string, string>
A map of tags assigned to the resource, including those inherited from the provider
default_tags
configuration block.- Update
Token string A string token used when updating a firewall policy.
- Arn string
The Amazon Resource Name (ARN) that identifies the firewall policy.
- Description string
A friendly description of the firewall policy.
- Encryption
Configuration FirewallPolicy Encryption Configuration Args KMS encryption configuration settings. See Encryption Configuration below for details.
- Firewall
Policy FirewallPolicy Firewall Policy Args A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
- Name string
A friendly name of the firewall policy.
- map[string]string
Map of resource tags to associate with the resource. If configured with a provider
default_tags
configuration block present, tags with matching keys will overwrite those defined at the provider-level.- map[string]string
A map of tags assigned to the resource, including those inherited from the provider
default_tags
configuration block.- Update
Token string A string token used when updating a firewall policy.
- arn String
The Amazon Resource Name (ARN) that identifies the firewall policy.
- description String
A friendly description of the firewall policy.
- encryption
Configuration FirewallPolicy Encryption Configuration Args KMS encryption configuration settings. See Encryption Configuration below for details.
- firewall
Policy FirewallPolicy Firewall Policy Args A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
- name String
A friendly name of the firewall policy.
- Map<String,String>
Map of resource tags to associate with the resource. If configured with a provider
default_tags
configuration block present, tags with matching keys will overwrite those defined at the provider-level.- Map<String,String>
A map of tags assigned to the resource, including those inherited from the provider
default_tags
configuration block.- update
Token String A string token used when updating a firewall policy.
- arn string
The Amazon Resource Name (ARN) that identifies the firewall policy.
- description string
A friendly description of the firewall policy.
- encryption
Configuration FirewallPolicy Encryption Configuration Args KMS encryption configuration settings. See Encryption Configuration below for details.
- firewall
Policy FirewallPolicy Firewall Policy Args A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
- name string
A friendly name of the firewall policy.
- {[key: string]: string}
Map of resource tags to associate with the resource. If configured with a provider
default_tags
configuration block present, tags with matching keys will overwrite those defined at the provider-level.- {[key: string]: string}
A map of tags assigned to the resource, including those inherited from the provider
default_tags
configuration block.- update
Token string A string token used when updating a firewall policy.
- arn str
The Amazon Resource Name (ARN) that identifies the firewall policy.
- description str
A friendly description of the firewall policy.
- encryption_
configuration FirewallPolicy Encryption Configuration Args KMS encryption configuration settings. See Encryption Configuration below for details.
- firewall_
policy FirewallPolicy Firewall Policy Args A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
- name str
A friendly name of the firewall policy.
- Mapping[str, str]
Map of resource tags to associate with the resource. If configured with a provider
default_tags
configuration block present, tags with matching keys will overwrite those defined at the provider-level.- Mapping[str, str]
A map of tags assigned to the resource, including those inherited from the provider
default_tags
configuration block.- update_
token str A string token used when updating a firewall policy.
- arn String
The Amazon Resource Name (ARN) that identifies the firewall policy.
- description String
A friendly description of the firewall policy.
- encryption
Configuration Property Map KMS encryption configuration settings. See Encryption Configuration below for details.
- firewall
Policy Property Map A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
- name String
A friendly name of the firewall policy.
- Map<String>
Map of resource tags to associate with the resource. If configured with a provider
default_tags
configuration block present, tags with matching keys will overwrite those defined at the provider-level.- Map<String>
A map of tags assigned to the resource, including those inherited from the provider
default_tags
configuration block.- update
Token String A string token used when updating a firewall policy.
Supporting Types
FirewallPolicyEncryptionConfiguration
- Type string
The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are
CUSTOMER_KMS
andAWS_OWNED_KMS_KEY
.- Key
Id string The ID of the customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
- Type string
The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are
CUSTOMER_KMS
andAWS_OWNED_KMS_KEY
.- Key
Id string The ID of the customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
- type String
The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are
CUSTOMER_KMS
andAWS_OWNED_KMS_KEY
.- key
Id String The ID of the customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
- type string
The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are
CUSTOMER_KMS
andAWS_OWNED_KMS_KEY
.- key
Id string The ID of the customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
- type str
The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are
CUSTOMER_KMS
andAWS_OWNED_KMS_KEY
.- key_
id str The ID of the customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
- type String
The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are
CUSTOMER_KMS
andAWS_OWNED_KMS_KEY
.- key
Id String The ID of the customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
FirewallPolicyFirewallPolicy
- Stateless
Default List<string>Actions Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including:
aws:drop
,aws:pass
, oraws:forward_to_sfe
. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specifyaws:forward_to_sfe
.- Stateless
Fragment List<string>Default Actions Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including:
aws:drop
,aws:pass
, oraws:forward_to_sfe
. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specifyaws:forward_to_sfe
.- Stateful
Default List<string>Actions Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a
stateful_engine_options
block with arule_order
value ofSTRICT_ORDER
. You can specify one of either or neither values ofaws:drop_strict
oraws:drop_established
, as well as any combination ofaws:alert_strict
andaws:alert_established
.- Stateful
Engine FirewallOptions Policy Firewall Policy Stateful Engine Options A configuration block that defines options on how the policy handles stateful rules. See Stateful Engine Options below for details.
- Stateful
Rule List<FirewallGroup References Policy Firewall Policy Stateful Rule Group Reference> Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See Stateful Rule Group Reference below for details.
- Stateless
Custom List<FirewallActions Policy Firewall Policy Stateless Custom Action> Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's
stateless_default_actions
. See Stateless Custom Action below for details.- Stateless
Rule List<FirewallGroup References Policy Firewall Policy Stateless Rule Group Reference> Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See Stateless Rule Group Reference below for details.
- Stateless
Default []stringActions Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including:
aws:drop
,aws:pass
, oraws:forward_to_sfe
. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specifyaws:forward_to_sfe
.- Stateless
Fragment []stringDefault Actions Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including:
aws:drop
,aws:pass
, oraws:forward_to_sfe
. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specifyaws:forward_to_sfe
.- Stateful
Default []stringActions Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a
stateful_engine_options
block with arule_order
value ofSTRICT_ORDER
. You can specify one of either or neither values ofaws:drop_strict
oraws:drop_established
, as well as any combination ofaws:alert_strict
andaws:alert_established
.- Stateful
Engine FirewallOptions Policy Firewall Policy Stateful Engine Options A configuration block that defines options on how the policy handles stateful rules. See Stateful Engine Options below for details.
- Stateful
Rule []FirewallGroup References Policy Firewall Policy Stateful Rule Group Reference Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See Stateful Rule Group Reference below for details.
- Stateless
Custom []FirewallActions Policy Firewall Policy Stateless Custom Action Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's
stateless_default_actions
. See Stateless Custom Action below for details.- Stateless
Rule []FirewallGroup References Policy Firewall Policy Stateless Rule Group Reference Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See Stateless Rule Group Reference below for details.
- stateless
Default List<String>Actions Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including:
aws:drop
,aws:pass
, oraws:forward_to_sfe
. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specifyaws:forward_to_sfe
.- stateless
Fragment List<String>Default Actions Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including:
aws:drop
,aws:pass
, oraws:forward_to_sfe
. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specifyaws:forward_to_sfe
.- stateful
Default List<String>Actions Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a
stateful_engine_options
block with arule_order
value ofSTRICT_ORDER
. You can specify one of either or neither values ofaws:drop_strict
oraws:drop_established
, as well as any combination ofaws:alert_strict
andaws:alert_established
.- stateful
Engine FirewallOptions Policy Firewall Policy Stateful Engine Options A configuration block that defines options on how the policy handles stateful rules. See Stateful Engine Options below for details.
- stateful
Rule List<FirewallGroup References Policy Firewall Policy Stateful Rule Group Reference> Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See Stateful Rule Group Reference below for details.
- stateless
Custom List<FirewallActions Policy Firewall Policy Stateless Custom Action> Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's
stateless_default_actions
. See Stateless Custom Action below for details.- stateless
Rule List<FirewallGroup References Policy Firewall Policy Stateless Rule Group Reference> Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See Stateless Rule Group Reference below for details.
- stateless
Default string[]Actions Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including:
aws:drop
,aws:pass
, oraws:forward_to_sfe
. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specifyaws:forward_to_sfe
.- stateless
Fragment string[]Default Actions Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including:
aws:drop
,aws:pass
, oraws:forward_to_sfe
. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specifyaws:forward_to_sfe
.- stateful
Default string[]Actions Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a
stateful_engine_options
block with arule_order
value ofSTRICT_ORDER
. You can specify one of either or neither values ofaws:drop_strict
oraws:drop_established
, as well as any combination ofaws:alert_strict
andaws:alert_established
.- stateful
Engine FirewallOptions Policy Firewall Policy Stateful Engine Options A configuration block that defines options on how the policy handles stateful rules. See Stateful Engine Options below for details.
- stateful
Rule FirewallGroup References Policy Firewall Policy Stateful Rule Group Reference[] Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See Stateful Rule Group Reference below for details.
- stateless
Custom FirewallActions Policy Firewall Policy Stateless Custom Action[] Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's
stateless_default_actions
. See Stateless Custom Action below for details.- stateless
Rule FirewallGroup References Policy Firewall Policy Stateless Rule Group Reference[] Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See Stateless Rule Group Reference below for details.
- stateless_
default_ Sequence[str]actions Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including:
aws:drop
,aws:pass
, oraws:forward_to_sfe
. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specifyaws:forward_to_sfe
.- stateless_
fragment_ Sequence[str]default_ actions Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including:
aws:drop
,aws:pass
, oraws:forward_to_sfe
. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specifyaws:forward_to_sfe
.- stateful_
default_ Sequence[str]actions Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a
stateful_engine_options
block with arule_order
value ofSTRICT_ORDER
. You can specify one of either or neither values ofaws:drop_strict
oraws:drop_established
, as well as any combination ofaws:alert_strict
andaws:alert_established
.- stateful_
engine_ Firewalloptions Policy Firewall Policy Stateful Engine Options A configuration block that defines options on how the policy handles stateful rules. See Stateful Engine Options below for details.
- stateful_
rule_ Sequence[Firewallgroup_ references Policy Firewall Policy Stateful Rule Group Reference] Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See Stateful Rule Group Reference below for details.
- stateless_
custom_ Sequence[Firewallactions Policy Firewall Policy Stateless Custom Action] Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's
stateless_default_actions
. See Stateless Custom Action below for details.- stateless_
rule_ Sequence[Firewallgroup_ references Policy Firewall Policy Stateless Rule Group Reference] Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See Stateless Rule Group Reference below for details.
- stateless
Default List<String>Actions Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including:
aws:drop
,aws:pass
, oraws:forward_to_sfe
. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specifyaws:forward_to_sfe
.- stateless
Fragment List<String>Default Actions Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including:
aws:drop
,aws:pass
, oraws:forward_to_sfe
. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specifyaws:forward_to_sfe
.- stateful
Default List<String>Actions Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a
stateful_engine_options
block with arule_order
value ofSTRICT_ORDER
. You can specify one of either or neither values ofaws:drop_strict
oraws:drop_established
, as well as any combination ofaws:alert_strict
andaws:alert_established
.- stateful
Engine Property MapOptions A configuration block that defines options on how the policy handles stateful rules. See Stateful Engine Options below for details.
- stateful
Rule List<Property Map>Group References Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See Stateful Rule Group Reference below for details.
- stateless
Custom List<Property Map>Actions Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's
stateless_default_actions
. See Stateless Custom Action below for details.- stateless
Rule List<Property Map>Group References Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See Stateless Rule Group Reference below for details.
FirewallPolicyFirewallPolicyStatefulEngineOptions
- Rule
Order string Indicates how to manage the order of stateful rule evaluation for the policy. Default value:
DEFAULT_ACTION_ORDER
. Valid values:DEFAULT_ACTION_ORDER
,STRICT_ORDER
.
- Rule
Order string Indicates how to manage the order of stateful rule evaluation for the policy. Default value:
DEFAULT_ACTION_ORDER
. Valid values:DEFAULT_ACTION_ORDER
,STRICT_ORDER
.
- rule
Order String Indicates how to manage the order of stateful rule evaluation for the policy. Default value:
DEFAULT_ACTION_ORDER
. Valid values:DEFAULT_ACTION_ORDER
,STRICT_ORDER
.
- rule
Order string Indicates how to manage the order of stateful rule evaluation for the policy. Default value:
DEFAULT_ACTION_ORDER
. Valid values:DEFAULT_ACTION_ORDER
,STRICT_ORDER
.
- rule_
order str Indicates how to manage the order of stateful rule evaluation for the policy. Default value:
DEFAULT_ACTION_ORDER
. Valid values:DEFAULT_ACTION_ORDER
,STRICT_ORDER
.
- rule
Order String Indicates how to manage the order of stateful rule evaluation for the policy. Default value:
DEFAULT_ACTION_ORDER
. Valid values:DEFAULT_ACTION_ORDER
,STRICT_ORDER
.
FirewallPolicyFirewallPolicyStatefulRuleGroupReference
- Resource
Arn string The Amazon Resource Name (ARN) of the stateful rule group.
- Override
Firewall
Policy Firewall Policy Stateful Rule Group Reference Override Configuration block for override values
- Priority int
An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a
stateful_engine_options
block with arule_order
value ofSTRICT_ORDER
. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.
- Resource
Arn string The Amazon Resource Name (ARN) of the stateful rule group.
- Override
Firewall
Policy Firewall Policy Stateful Rule Group Reference Override Configuration block for override values
- Priority int
An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a
stateful_engine_options
block with arule_order
value ofSTRICT_ORDER
. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.
- resource
Arn String The Amazon Resource Name (ARN) of the stateful rule group.
- override
Firewall
Policy Firewall Policy Stateful Rule Group Reference Override Configuration block for override values
- priority Integer
An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a
stateful_engine_options
block with arule_order
value ofSTRICT_ORDER
. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.
- resource
Arn string The Amazon Resource Name (ARN) of the stateful rule group.
- override
Firewall
Policy Firewall Policy Stateful Rule Group Reference Override Configuration block for override values
- priority number
An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a
stateful_engine_options
block with arule_order
value ofSTRICT_ORDER
. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.
- resource_
arn str The Amazon Resource Name (ARN) of the stateful rule group.
- override
Firewall
Policy Firewall Policy Stateful Rule Group Reference Override Configuration block for override values
- priority int
An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a
stateful_engine_options
block with arule_order
value ofSTRICT_ORDER
. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.
- resource
Arn String The Amazon Resource Name (ARN) of the stateful rule group.
- override Property Map
Configuration block for override values
- priority Number
An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a
stateful_engine_options
block with arule_order
value ofSTRICT_ORDER
. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.
FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceOverride
- Action string
The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
- Action string
The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
- action String
The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
- action string
The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
- action str
The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
- action String
The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
FirewallPolicyFirewallPolicyStatelessCustomAction
- Action
Definition FirewallPolicy Firewall Policy Stateless Custom Action Action Definition A configuration block describing the custom action associated with the
action_name
. See Action Definition below for details.- Action
Name string A friendly name of the custom action.
- Action
Definition FirewallPolicy Firewall Policy Stateless Custom Action Action Definition A configuration block describing the custom action associated with the
action_name
. See Action Definition below for details.- Action
Name string A friendly name of the custom action.
- action
Definition FirewallPolicy Firewall Policy Stateless Custom Action Action Definition A configuration block describing the custom action associated with the
action_name
. See Action Definition below for details.- action
Name String A friendly name of the custom action.
- action
Definition FirewallPolicy Firewall Policy Stateless Custom Action Action Definition A configuration block describing the custom action associated with the
action_name
. See Action Definition below for details.- action
Name string A friendly name of the custom action.
- action_
definition FirewallPolicy Firewall Policy Stateless Custom Action Action Definition A configuration block describing the custom action associated with the
action_name
. See Action Definition below for details.- action_
name str A friendly name of the custom action.
- action
Definition Property Map A configuration block describing the custom action associated with the
action_name
. See Action Definition below for details.- action
Name String A friendly name of the custom action.
FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinition
- Publish
Metric FirewallAction Policy Firewall Policy Stateless Custom Action Action Definition Publish Metric Action A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See Publish Metric Action below for details.
- Publish
Metric FirewallAction Policy Firewall Policy Stateless Custom Action Action Definition Publish Metric Action A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See Publish Metric Action below for details.
- publish
Metric FirewallAction Policy Firewall Policy Stateless Custom Action Action Definition Publish Metric Action A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See Publish Metric Action below for details.
- publish
Metric FirewallAction Policy Firewall Policy Stateless Custom Action Action Definition Publish Metric Action A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See Publish Metric Action below for details.
- publish_
metric_ Firewallaction Policy Firewall Policy Stateless Custom Action Action Definition Publish Metric Action A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See Publish Metric Action below for details.
- publish
Metric Property MapAction A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See Publish Metric Action below for details.
FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricAction
- Dimensions
List<Firewall
Policy Firewall Policy Stateless Custom Action Action Definition Publish Metric Action Dimension> Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See Dimension below for more details.
- Dimensions
[]Firewall
Policy Firewall Policy Stateless Custom Action Action Definition Publish Metric Action Dimension Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See Dimension below for more details.
- dimensions
List<Firewall
Policy Firewall Policy Stateless Custom Action Action Definition Publish Metric Action Dimension> Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See Dimension below for more details.
- dimensions
Firewall
Policy Firewall Policy Stateless Custom Action Action Definition Publish Metric Action Dimension[] Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See Dimension below for more details.
- dimensions
Sequence[Firewall
Policy Firewall Policy Stateless Custom Action Action Definition Publish Metric Action Dimension] Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See Dimension below for more details.
- dimensions List<Property Map>
Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See Dimension below for more details.
FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionDimension
- Value string
The string value to use in the custom metric dimension.
- Value string
The string value to use in the custom metric dimension.
- value String
The string value to use in the custom metric dimension.
- value string
The string value to use in the custom metric dimension.
- value str
The string value to use in the custom metric dimension.
- value String
The string value to use in the custom metric dimension.
FirewallPolicyFirewallPolicyStatelessRuleGroupReference
- Priority int
An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
- Resource
Arn string The Amazon Resource Name (ARN) of the stateless rule group.
- Priority int
An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
- Resource
Arn string The Amazon Resource Name (ARN) of the stateless rule group.
- priority Integer
An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
- resource
Arn String The Amazon Resource Name (ARN) of the stateless rule group.
- priority number
An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
- resource
Arn string The Amazon Resource Name (ARN) of the stateless rule group.
- priority int
An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
- resource_
arn str The Amazon Resource Name (ARN) of the stateless rule group.
- priority Number
An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
- resource
Arn String The Amazon Resource Name (ARN) of the stateless rule group.
Import
Network Firewall Policies can be imported using their ARN
.
$ pulumi import aws:networkfirewall/firewallPolicy:FirewallPolicy example arn:aws:network-firewall:us-west-1:123456789012:firewall-policy/example
Package Details
- Repository
- AWS Classic pulumi/pulumi-aws
- License
- Apache-2.0
- Notes
This Pulumi package is based on the
aws
Terraform Provider.