Sign in Dashboard Get started
  1. Packages
  2. Packages
  3. AWS
  4. API Docs
  5. networkfirewall
  6. FirewallPolicy
Viewing docs for AWS v5.43.0 (Older version)
published on Tuesday, Mar 10, 2026 by Pulumi
Go to latest version
Schema (JSON)
pulumi/pulumi-aws

aws.networkfirewall.FirewallPolicy

aws logo
Viewing docs for AWS v5.43.0 (Older version)
published on Tuesday, Mar 10, 2026 by Pulumi
Go to latest version
Schema (JSON)
pulumi/pulumi-aws

    Provides an AWS Network Firewall Firewall Policy Resource

    Policy with a Custom Action for Stateless Inspection

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.networkfirewall.FirewallPolicy;
import com.pulumi.aws.networkfirewall.FirewallPolicyArgs;
import com.pulumi.aws.networkfirewall.inputs.FirewallPolicyFirewallPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var test = new FirewallPolicy("test", FirewallPolicyArgs.builder()        
            .firewallPolicy(FirewallPolicyFirewallPolicyArgs.builder()
                .statelessCustomActions(FirewallPolicyFirewallPolicyStatelessCustomActionArgs.builder()
                    .actionDefinition(FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionArgs.builder()
                        .publishMetricAction(FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionArgs.builder()
                            .dimension(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                            .build())
                        .build())
                    .actionName("ExampleCustomAction")
                    .build())
                .statelessDefaultActions(                
                    "aws:pass",
                    "ExampleCustomAction")
                .statelessFragmentDefaultActions("aws:drop")
                .build())
            .build());

    }
}

    resources:
  test:
    type: aws:networkfirewall:FirewallPolicy
    properties:
      firewallPolicy:
        statelessCustomActions:
          - actionDefinition:
              publishMetricAction:
                dimension:
                  - value: '1'
            actionName: ExampleCustomAction
        statelessDefaultActions:
          - aws:pass
          - ExampleCustomAction
        statelessFragmentDefaultActions:
          - aws:drop

    Example Usage

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;

return await Deployment.RunAsync(() => 
{
    var example = new Aws.NetworkFirewall.FirewallPolicy("example", new()
    {
        FirewallPolicyConfiguration = new Aws.NetworkFirewall.Inputs.FirewallPolicyFirewallPolicyArgs
        {
            StatelessDefaultActions = new[]
            {
                "aws:pass",
            },
            StatelessFragmentDefaultActions = new[]
            {
                "aws:drop",
            },
            StatelessRuleGroupReferences = new[]
            {
                new Aws.NetworkFirewall.Inputs.FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArgs
                {
                    Priority = 1,
                    ResourceArn = aws_networkfirewall_rule_group.Example.Arn,
                },
            },
        },
        Tags = 
        {
            { "Tag1", "Value1" },
            { "Tag2", "Value2" },
        },
    });

});

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/v5/go/aws/networkfirewall"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := networkfirewall.NewFirewallPolicy(ctx, "example", &networkfirewall.FirewallPolicyArgs{
			FirewallPolicy: &networkfirewall.FirewallPolicyFirewallPolicyArgs{
				StatelessDefaultActions: pulumi.StringArray{
					pulumi.String("aws:pass"),
				},
				StatelessFragmentDefaultActions: pulumi.StringArray{
					pulumi.String("aws:drop"),
				},
				StatelessRuleGroupReferences: networkfirewall.FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArray{
					&networkfirewall.FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArgs{
						Priority:    pulumi.Int(1),
						ResourceArn: pulumi.Any(aws_networkfirewall_rule_group.Example.Arn),
					},
				},
			},
			Tags: pulumi.StringMap{
				"Tag1": pulumi.String("Value1"),
				"Tag2": pulumi.String("Value2"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.networkfirewall.FirewallPolicy;
import com.pulumi.aws.networkfirewall.FirewallPolicyArgs;
import com.pulumi.aws.networkfirewall.inputs.FirewallPolicyFirewallPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new FirewallPolicy("example", FirewallPolicyArgs.builder()        
            .firewallPolicy(FirewallPolicyFirewallPolicyArgs.builder()
                .statelessDefaultActions("aws:pass")
                .statelessFragmentDefaultActions("aws:drop")
                .statelessRuleGroupReferences(FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArgs.builder()
                    .priority(1)
                    .resourceArn(aws_networkfirewall_rule_group.example().arn())
                    .build())
                .build())
            .tags(Map.ofEntries(
                Map.entry("Tag1", "Value1"),
                Map.entry("Tag2", "Value2")
            ))
            .build());

    }
}

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

const example = new aws.networkfirewall.FirewallPolicy("example", {
    firewallPolicy: {
        statelessDefaultActions: ["aws:pass"],
        statelessFragmentDefaultActions: ["aws:drop"],
        statelessRuleGroupReferences: [{
            priority: 1,
            resourceArn: aws_networkfirewall_rule_group.example.arn,
        }],
    },
    tags: {
        Tag1: "Value1",
        Tag2: "Value2",
    },
});

    import pulumi
import pulumi_aws as aws

example = aws.networkfirewall.FirewallPolicy("example",
    firewall_policy=aws.networkfirewall.FirewallPolicyFirewallPolicyArgs(
        stateless_default_actions=["aws:pass"],
        stateless_fragment_default_actions=["aws:drop"],
        stateless_rule_group_references=[aws.networkfirewall.FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArgs(
            priority=1,
            resource_arn=aws_networkfirewall_rule_group["example"]["arn"],
        )],
    ),
    tags={
        "Tag1": "Value1",
        "Tag2": "Value2",
    })

    resources:
  example:
    type: aws:networkfirewall:FirewallPolicy
    properties:
      firewallPolicy:
        statelessDefaultActions:
          - aws:pass
        statelessFragmentDefaultActions:
          - aws:drop
        statelessRuleGroupReferences:
          - priority: 1
            resourceArn: ${aws_networkfirewall_rule_group.example.arn}
      tags:
        Tag1: Value1
        Tag2: Value2

    Example coming soon!

    Example coming soon!

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.aws.networkfirewall.FirewallPolicy;
import com.pulumi.aws.networkfirewall.FirewallPolicyArgs;
import com.pulumi.aws.networkfirewall.inputs.FirewallPolicyFirewallPolicyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var test = new FirewallPolicy("test", FirewallPolicyArgs.builder()        
            .firewallPolicy(FirewallPolicyFirewallPolicyArgs.builder()
                .statelessCustomActions(FirewallPolicyFirewallPolicyStatelessCustomActionArgs.builder()
                    .actionDefinition(FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionArgs.builder()
                        .publishMetricAction(FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionArgs.builder()
                            .dimension(%!v(PANIC=Format method: runtime error: invalid memory address or nil pointer dereference))
                            .build())
                        .build())
                    .actionName("ExampleCustomAction")
                    .build())
                .statelessDefaultActions(                
                    "aws:pass",
                    "ExampleCustomAction")
                .statelessFragmentDefaultActions("aws:drop")
                .build())
            .build());

    }
}

    Example coming soon!

    Example coming soon!

    resources:
  test:
    type: aws:networkfirewall:FirewallPolicy
    properties:
      firewallPolicy:
        statelessCustomActions:
          - actionDefinition:
              publishMetricAction:
                dimension:
                  - value: '1'
            actionName: ExampleCustomAction
        statelessDefaultActions:
          - aws:pass
          - ExampleCustomAction
        statelessFragmentDefaultActions:
          - aws:drop

    Create FirewallPolicy Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new FirewallPolicy(name: string, args: FirewallPolicyArgs, opts?: CustomResourceOptions);
    @overload
def FirewallPolicy(resource_name: str,
                   args: FirewallPolicyArgs,
                   opts: Optional[ResourceOptions] = None)

@overload
def FirewallPolicy(resource_name: str,
                   opts: Optional[ResourceOptions] = None,
                   firewall_policy: Optional[FirewallPolicyFirewallPolicyArgs] = None,
                   description: Optional[str] = None,
                   encryption_configuration: Optional[FirewallPolicyEncryptionConfigurationArgs] = None,
                   name: Optional[str] = None,
                   tags: Optional[Mapping[str, str]] = None)
    func NewFirewallPolicy(ctx *Context, name string, args FirewallPolicyArgs, opts ...ResourceOption) (*FirewallPolicy, error)
    public FirewallPolicy(string name, FirewallPolicyArgs args, CustomResourceOptions? opts = null)
    public FirewallPolicy(String name, FirewallPolicyArgs args)
public FirewallPolicy(String name, FirewallPolicyArgs args, CustomResourceOptions options)

    type: aws:networkfirewall:FirewallPolicy
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args FirewallPolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args FirewallPolicyArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args FirewallPolicyArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args FirewallPolicyArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args FirewallPolicyArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var firewallPolicyResource = new Aws.NetworkFirewall.FirewallPolicy("firewallPolicyResource", new()
{
    FirewallPolicyConfiguration = new Aws.NetworkFirewall.Inputs.FirewallPolicyFirewallPolicyArgs
    {
        StatelessDefaultActions = new[]
        {
            "string",
        },
        StatelessFragmentDefaultActions = new[]
        {
            "string",
        },
        StatefulDefaultActions = new[]
        {
            "string",
        },
        StatefulEngineOptions = new Aws.NetworkFirewall.Inputs.FirewallPolicyFirewallPolicyStatefulEngineOptionsArgs
        {
            RuleOrder = "string",
        },
        StatefulRuleGroupReferences = new[]
        {
            new Aws.NetworkFirewall.Inputs.FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceArgs
            {
                ResourceArn = "string",
                Override = new Aws.NetworkFirewall.Inputs.FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceOverrideArgs
                {
                    Action = "string",
                },
                Priority = 0,
            },
        },
        StatelessCustomActions = new[]
        {
            new Aws.NetworkFirewall.Inputs.FirewallPolicyFirewallPolicyStatelessCustomActionArgs
            {
                ActionDefinition = new Aws.NetworkFirewall.Inputs.FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionArgs
                {
                    PublishMetricAction = new Aws.NetworkFirewall.Inputs.FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionArgs
                    {
                        Dimensions = new[]
                        {
                            new Aws.NetworkFirewall.Inputs.FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionDimensionArgs
                            {
                                Value = "string",
                            },
                        },
                    },
                },
                ActionName = "string",
            },
        },
        StatelessRuleGroupReferences = new[]
        {
            new Aws.NetworkFirewall.Inputs.FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArgs
            {
                Priority = 0,
                ResourceArn = "string",
            },
        },
    },
    Description = "string",
    EncryptionConfiguration = new Aws.NetworkFirewall.Inputs.FirewallPolicyEncryptionConfigurationArgs
    {
        Type = "string",
        KeyId = "string",
    },
    Name = "string",
    Tags = 
    {
        { "string", "string" },
    },
});

    example, err := networkfirewall.NewFirewallPolicy(ctx, "firewallPolicyResource", &networkfirewall.FirewallPolicyArgs{
	FirewallPolicy: &networkfirewall.FirewallPolicyFirewallPolicyArgs{
		StatelessDefaultActions: pulumi.StringArray{
			pulumi.String("string"),
		},
		StatelessFragmentDefaultActions: pulumi.StringArray{
			pulumi.String("string"),
		},
		StatefulDefaultActions: pulumi.StringArray{
			pulumi.String("string"),
		},
		StatefulEngineOptions: &networkfirewall.FirewallPolicyFirewallPolicyStatefulEngineOptionsArgs{
			RuleOrder: pulumi.String("string"),
		},
		StatefulRuleGroupReferences: networkfirewall.FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceArray{
			&networkfirewall.FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceArgs{
				ResourceArn: pulumi.String("string"),
				Override: &networkfirewall.FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceOverrideArgs{
					Action: pulumi.String("string"),
				},
				Priority: pulumi.Int(0),
			},
		},
		StatelessCustomActions: networkfirewall.FirewallPolicyFirewallPolicyStatelessCustomActionArray{
			&networkfirewall.FirewallPolicyFirewallPolicyStatelessCustomActionArgs{
				ActionDefinition: &networkfirewall.FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionArgs{
					PublishMetricAction: &networkfirewall.FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionArgs{
						Dimensions: networkfirewall.FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionDimensionArray{
							&networkfirewall.FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionDimensionArgs{
								Value: pulumi.String("string"),
							},
						},
					},
				},
				ActionName: pulumi.String("string"),
			},
		},
		StatelessRuleGroupReferences: networkfirewall.FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArray{
			&networkfirewall.FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArgs{
				Priority:    pulumi.Int(0),
				ResourceArn: pulumi.String("string"),
			},
		},
	},
	Description: pulumi.String("string"),
	EncryptionConfiguration: &networkfirewall.FirewallPolicyEncryptionConfigurationArgs{
		Type:  pulumi.String("string"),
		KeyId: pulumi.String("string"),
	},
	Name: pulumi.String("string"),
	Tags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
})

    var firewallPolicyResource = new FirewallPolicy("firewallPolicyResource", FirewallPolicyArgs.builder()
    .firewallPolicy(FirewallPolicyFirewallPolicyArgs.builder()
        .statelessDefaultActions("string")
        .statelessFragmentDefaultActions("string")
        .statefulDefaultActions("string")
        .statefulEngineOptions(FirewallPolicyFirewallPolicyStatefulEngineOptionsArgs.builder()
            .ruleOrder("string")
            .build())
        .statefulRuleGroupReferences(FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceArgs.builder()
            .resourceArn("string")
            .override(FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceOverrideArgs.builder()
                .action("string")
                .build())
            .priority(0)
            .build())
        .statelessCustomActions(FirewallPolicyFirewallPolicyStatelessCustomActionArgs.builder()
            .actionDefinition(FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionArgs.builder()
                .publishMetricAction(FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionArgs.builder()
                    .dimensions(FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionDimensionArgs.builder()
                        .value("string")
                        .build())
                    .build())
                .build())
            .actionName("string")
            .build())
        .statelessRuleGroupReferences(FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArgs.builder()
            .priority(0)
            .resourceArn("string")
            .build())
        .build())
    .description("string")
    .encryptionConfiguration(FirewallPolicyEncryptionConfigurationArgs.builder()
        .type("string")
        .keyId("string")
        .build())
    .name("string")
    .tags(Map.of("string", "string"))
    .build());

    firewall_policy_resource = aws.networkfirewall.FirewallPolicy("firewallPolicyResource",
    firewall_policy={
        "stateless_default_actions": ["string"],
        "stateless_fragment_default_actions": ["string"],
        "stateful_default_actions": ["string"],
        "stateful_engine_options": {
            "rule_order": "string",
        },
        "stateful_rule_group_references": [{
            "resource_arn": "string",
            "override": {
                "action": "string",
            },
            "priority": 0,
        }],
        "stateless_custom_actions": [{
            "action_definition": {
                "publish_metric_action": {
                    "dimensions": [{
                        "value": "string",
                    }],
                },
            },
            "action_name": "string",
        }],
        "stateless_rule_group_references": [{
            "priority": 0,
            "resource_arn": "string",
        }],
    },
    description="string",
    encryption_configuration={
        "type": "string",
        "key_id": "string",
    },
    name="string",
    tags={
        "string": "string",
    })

    const firewallPolicyResource = new aws.networkfirewall.FirewallPolicy("firewallPolicyResource", {
    firewallPolicy: {
        statelessDefaultActions: ["string"],
        statelessFragmentDefaultActions: ["string"],
        statefulDefaultActions: ["string"],
        statefulEngineOptions: {
            ruleOrder: "string",
        },
        statefulRuleGroupReferences: [{
            resourceArn: "string",
            override: {
                action: "string",
            },
            priority: 0,
        }],
        statelessCustomActions: [{
            actionDefinition: {
                publishMetricAction: {
                    dimensions: [{
                        value: "string",
                    }],
                },
            },
            actionName: "string",
        }],
        statelessRuleGroupReferences: [{
            priority: 0,
            resourceArn: "string",
        }],
    },
    description: "string",
    encryptionConfiguration: {
        type: "string",
        keyId: "string",
    },
    name: "string",
    tags: {
        string: "string",
    },
});

    type: aws:networkfirewall:FirewallPolicy
properties:
    description: string
    encryptionConfiguration:
        keyId: string
        type: string
    firewallPolicy:
        statefulDefaultActions:
            - string
        statefulEngineOptions:
            ruleOrder: string
        statefulRuleGroupReferences:
            - override:
                action: string
              priority: 0
              resourceArn: string
        statelessCustomActions:
            - actionDefinition:
                publishMetricAction:
                    dimensions:
                        - value: string
              actionName: string
        statelessDefaultActions:
            - string
        statelessFragmentDefaultActions:
            - string
        statelessRuleGroupReferences:
            - priority: 0
              resourceArn: string
    name: string
    tags:
        string: string

    FirewallPolicy Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The FirewallPolicy resource accepts the following input properties:

    FirewallPolicyConfiguration FirewallPolicyFirewallPolicy
    A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
    Description string
    A friendly description of the firewall policy.
    EncryptionConfiguration FirewallPolicyEncryptionConfiguration
    KMS encryption configuration settings. See Encryption Configuration below for details.
    Name string
    A friendly name of the firewall policy.
    Tags Dictionary<string, string>
    Map of resource tags to associate with the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    FirewallPolicy FirewallPolicyFirewallPolicyArgs
    A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
    Description string
    A friendly description of the firewall policy.
    EncryptionConfiguration FirewallPolicyEncryptionConfigurationArgs
    KMS encryption configuration settings. See Encryption Configuration below for details.
    Name string
    A friendly name of the firewall policy.
    Tags map[string]string
    Map of resource tags to associate with the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    firewallPolicy FirewallPolicyFirewallPolicy
    A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
    description String
    A friendly description of the firewall policy.
    encryptionConfiguration FirewallPolicyEncryptionConfiguration
    KMS encryption configuration settings. See Encryption Configuration below for details.
    name String
    A friendly name of the firewall policy.
    tags Map<String,String>
    Map of resource tags to associate with the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    firewallPolicy FirewallPolicyFirewallPolicy
    A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
    description string
    A friendly description of the firewall policy.
    encryptionConfiguration FirewallPolicyEncryptionConfiguration
    KMS encryption configuration settings. See Encryption Configuration below for details.
    name string
    A friendly name of the firewall policy.
    tags {[key: string]: string}
    Map of resource tags to associate with the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    firewall_policy FirewallPolicyFirewallPolicyArgs
    A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
    description str
    A friendly description of the firewall policy.
    encryption_configuration FirewallPolicyEncryptionConfigurationArgs
    KMS encryption configuration settings. See Encryption Configuration below for details.
    name str
    A friendly name of the firewall policy.
    tags Mapping[str, str]
    Map of resource tags to associate with the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    firewallPolicy Property Map
    A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
    description String
    A friendly description of the firewall policy.
    encryptionConfiguration Property Map
    KMS encryption configuration settings. See Encryption Configuration below for details.
    name String
    A friendly name of the firewall policy.
    tags Map<String>
    Map of resource tags to associate with the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the FirewallPolicy resource produces the following output properties:

    Arn string
    The Amazon Resource Name (ARN) that identifies the firewall policy.
    Id string
    The provider-assigned unique ID for this managed resource.
    TagsAll Dictionary<string, string>
    A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    UpdateToken string
    A string token used when updating a firewall policy.
    Arn string
    The Amazon Resource Name (ARN) that identifies the firewall policy.
    Id string
    The provider-assigned unique ID for this managed resource.
    TagsAll map[string]string
    A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    UpdateToken string
    A string token used when updating a firewall policy.
    arn String
    The Amazon Resource Name (ARN) that identifies the firewall policy.
    id String
    The provider-assigned unique ID for this managed resource.
    tagsAll Map<String,String>
    A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    updateToken String
    A string token used when updating a firewall policy.
    arn string
    The Amazon Resource Name (ARN) that identifies the firewall policy.
    id string
    The provider-assigned unique ID for this managed resource.
    tagsAll {[key: string]: string}
    A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    updateToken string
    A string token used when updating a firewall policy.
    arn str
    The Amazon Resource Name (ARN) that identifies the firewall policy.
    id str
    The provider-assigned unique ID for this managed resource.
    tags_all Mapping[str, str]
    A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    update_token str
    A string token used when updating a firewall policy.
    arn String
    The Amazon Resource Name (ARN) that identifies the firewall policy.
    id String
    The provider-assigned unique ID for this managed resource.
    tagsAll Map<String>
    A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    updateToken String
    A string token used when updating a firewall policy.

    Look up Existing FirewallPolicy Resource

    Get an existing FirewallPolicy resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: FirewallPolicyState, opts?: CustomResourceOptions): FirewallPolicy
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        arn: Optional[str] = None,
        description: Optional[str] = None,
        encryption_configuration: Optional[FirewallPolicyEncryptionConfigurationArgs] = None,
        firewall_policy: Optional[FirewallPolicyFirewallPolicyArgs] = None,
        name: Optional[str] = None,
        tags: Optional[Mapping[str, str]] = None,
        tags_all: Optional[Mapping[str, str]] = None,
        update_token: Optional[str] = None) -> FirewallPolicy
    func GetFirewallPolicy(ctx *Context, name string, id IDInput, state *FirewallPolicyState, opts ...ResourceOption) (*FirewallPolicy, error)
    public static FirewallPolicy Get(string name, Input<string> id, FirewallPolicyState? state, CustomResourceOptions? opts = null)
    public static FirewallPolicy get(String name, Output<String> id, FirewallPolicyState state, CustomResourceOptions options)
    resources:  _:    type: aws:networkfirewall:FirewallPolicy    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Arn string
    The Amazon Resource Name (ARN) that identifies the firewall policy.
    Description string
    A friendly description of the firewall policy.
    EncryptionConfiguration FirewallPolicyEncryptionConfiguration
    KMS encryption configuration settings. See Encryption Configuration below for details.
    FirewallPolicyConfiguration FirewallPolicyFirewallPolicy
    A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
    Name string
    A friendly name of the firewall policy.
    Tags Dictionary<string, string>
    Map of resource tags to associate with the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    TagsAll Dictionary<string, string>
    A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    UpdateToken string
    A string token used when updating a firewall policy.
    Arn string
    The Amazon Resource Name (ARN) that identifies the firewall policy.
    Description string
    A friendly description of the firewall policy.
    EncryptionConfiguration FirewallPolicyEncryptionConfigurationArgs
    KMS encryption configuration settings. See Encryption Configuration below for details.
    FirewallPolicy FirewallPolicyFirewallPolicyArgs
    A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
    Name string
    A friendly name of the firewall policy.
    Tags map[string]string
    Map of resource tags to associate with the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    TagsAll map[string]string
    A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    UpdateToken string
    A string token used when updating a firewall policy.
    arn String
    The Amazon Resource Name (ARN) that identifies the firewall policy.
    description String
    A friendly description of the firewall policy.
    encryptionConfiguration FirewallPolicyEncryptionConfiguration
    KMS encryption configuration settings. See Encryption Configuration below for details.
    firewallPolicy FirewallPolicyFirewallPolicy
    A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
    name String
    A friendly name of the firewall policy.
    tags Map<String,String>
    Map of resource tags to associate with the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll Map<String,String>
    A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    updateToken String
    A string token used when updating a firewall policy.
    arn string
    The Amazon Resource Name (ARN) that identifies the firewall policy.
    description string
    A friendly description of the firewall policy.
    encryptionConfiguration FirewallPolicyEncryptionConfiguration
    KMS encryption configuration settings. See Encryption Configuration below for details.
    firewallPolicy FirewallPolicyFirewallPolicy
    A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
    name string
    A friendly name of the firewall policy.
    tags {[key: string]: string}
    Map of resource tags to associate with the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll {[key: string]: string}
    A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    updateToken string
    A string token used when updating a firewall policy.
    arn str
    The Amazon Resource Name (ARN) that identifies the firewall policy.
    description str
    A friendly description of the firewall policy.
    encryption_configuration FirewallPolicyEncryptionConfigurationArgs
    KMS encryption configuration settings. See Encryption Configuration below for details.
    firewall_policy FirewallPolicyFirewallPolicyArgs
    A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
    name str
    A friendly name of the firewall policy.
    tags Mapping[str, str]
    Map of resource tags to associate with the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tags_all Mapping[str, str]
    A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    update_token str
    A string token used when updating a firewall policy.
    arn String
    The Amazon Resource Name (ARN) that identifies the firewall policy.
    description String
    A friendly description of the firewall policy.
    encryptionConfiguration Property Map
    KMS encryption configuration settings. See Encryption Configuration below for details.
    firewallPolicy Property Map
    A configuration block describing the rule groups and policy actions to use in the firewall policy. See Firewall Policy below for details.
    name String
    A friendly name of the firewall policy.
    tags Map<String>
    Map of resource tags to associate with the resource. If configured with a provider default_tags configuration block present, tags with matching keys will overwrite those defined at the provider-level.
    tagsAll Map<String>
    A map of tags assigned to the resource, including those inherited from the provider default_tags configuration block.
    updateToken String
    A string token used when updating a firewall policy.

    Supporting Types

    FirewallPolicyEncryptionConfiguration, FirewallPolicyEncryptionConfigurationArgs

    Type string
    The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are CUSTOMER_KMS and AWS_OWNED_KMS_KEY.
    KeyId string
    The ID of the customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
    Type string
    The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are CUSTOMER_KMS and AWS_OWNED_KMS_KEY.
    KeyId string
    The ID of the customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
    type String
    The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are CUSTOMER_KMS and AWS_OWNED_KMS_KEY.
    keyId String
    The ID of the customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
    type string
    The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are CUSTOMER_KMS and AWS_OWNED_KMS_KEY.
    keyId string
    The ID of the customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
    type str
    The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are CUSTOMER_KMS and AWS_OWNED_KMS_KEY.
    key_id str
    The ID of the customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.
    type String
    The type of AWS KMS key to use for encryption of your Network Firewall resources. Valid values are CUSTOMER_KMS and AWS_OWNED_KMS_KEY.
    keyId String
    The ID of the customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN.

    FirewallPolicyFirewallPolicy, FirewallPolicyFirewallPolicyArgs

    StatelessDefaultActions List<string>
    Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    StatelessFragmentDefaultActions List<string>
    Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    StatefulDefaultActions List<string>
    Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a stateful_engine_options block with a rule_order value of STRICT_ORDER. You can specify one of either or neither values of aws:drop_strict or aws:drop_established, as well as any combination of aws:alert_strict and aws:alert_established.
    StatefulEngineOptions FirewallPolicyFirewallPolicyStatefulEngineOptions
    A configuration block that defines options on how the policy handles stateful rules. See Stateful Engine Options below for details.
    StatefulRuleGroupReferences List<FirewallPolicyFirewallPolicyStatefulRuleGroupReference>
    Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See Stateful Rule Group Reference below for details.
    StatelessCustomActions List<FirewallPolicyFirewallPolicyStatelessCustomAction>
    Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's stateless_default_actions. See Stateless Custom Action below for details.
    StatelessRuleGroupReferences List<FirewallPolicyFirewallPolicyStatelessRuleGroupReference>
    Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See Stateless Rule Group Reference below for details.
    StatelessDefaultActions []string
    Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    StatelessFragmentDefaultActions []string
    Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    StatefulDefaultActions []string
    Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a stateful_engine_options block with a rule_order value of STRICT_ORDER. You can specify one of either or neither values of aws:drop_strict or aws:drop_established, as well as any combination of aws:alert_strict and aws:alert_established.
    StatefulEngineOptions FirewallPolicyFirewallPolicyStatefulEngineOptions
    A configuration block that defines options on how the policy handles stateful rules. See Stateful Engine Options below for details.
    StatefulRuleGroupReferences []FirewallPolicyFirewallPolicyStatefulRuleGroupReference
    Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See Stateful Rule Group Reference below for details.
    StatelessCustomActions []FirewallPolicyFirewallPolicyStatelessCustomAction
    Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's stateless_default_actions. See Stateless Custom Action below for details.
    StatelessRuleGroupReferences []FirewallPolicyFirewallPolicyStatelessRuleGroupReference
    Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See Stateless Rule Group Reference below for details.
    statelessDefaultActions List<String>
    Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    statelessFragmentDefaultActions List<String>
    Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    statefulDefaultActions List<String>
    Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a stateful_engine_options block with a rule_order value of STRICT_ORDER. You can specify one of either or neither values of aws:drop_strict or aws:drop_established, as well as any combination of aws:alert_strict and aws:alert_established.
    statefulEngineOptions FirewallPolicyFirewallPolicyStatefulEngineOptions
    A configuration block that defines options on how the policy handles stateful rules. See Stateful Engine Options below for details.
    statefulRuleGroupReferences List<FirewallPolicyFirewallPolicyStatefulRuleGroupReference>
    Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See Stateful Rule Group Reference below for details.
    statelessCustomActions List<FirewallPolicyFirewallPolicyStatelessCustomAction>
    Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's stateless_default_actions. See Stateless Custom Action below for details.
    statelessRuleGroupReferences List<FirewallPolicyFirewallPolicyStatelessRuleGroupReference>
    Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See Stateless Rule Group Reference below for details.
    statelessDefaultActions string[]
    Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    statelessFragmentDefaultActions string[]
    Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    statefulDefaultActions string[]
    Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a stateful_engine_options block with a rule_order value of STRICT_ORDER. You can specify one of either or neither values of aws:drop_strict or aws:drop_established, as well as any combination of aws:alert_strict and aws:alert_established.
    statefulEngineOptions FirewallPolicyFirewallPolicyStatefulEngineOptions
    A configuration block that defines options on how the policy handles stateful rules. See Stateful Engine Options below for details.
    statefulRuleGroupReferences FirewallPolicyFirewallPolicyStatefulRuleGroupReference[]
    Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See Stateful Rule Group Reference below for details.
    statelessCustomActions FirewallPolicyFirewallPolicyStatelessCustomAction[]
    Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's stateless_default_actions. See Stateless Custom Action below for details.
    statelessRuleGroupReferences FirewallPolicyFirewallPolicyStatelessRuleGroupReference[]
    Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See Stateless Rule Group Reference below for details.
    stateless_default_actions Sequence[str]
    Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    stateless_fragment_default_actions Sequence[str]
    Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    stateful_default_actions Sequence[str]
    Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a stateful_engine_options block with a rule_order value of STRICT_ORDER. You can specify one of either or neither values of aws:drop_strict or aws:drop_established, as well as any combination of aws:alert_strict and aws:alert_established.
    stateful_engine_options FirewallPolicyFirewallPolicyStatefulEngineOptions
    A configuration block that defines options on how the policy handles stateful rules. See Stateful Engine Options below for details.
    stateful_rule_group_references Sequence[FirewallPolicyFirewallPolicyStatefulRuleGroupReference]
    Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See Stateful Rule Group Reference below for details.
    stateless_custom_actions Sequence[FirewallPolicyFirewallPolicyStatelessCustomAction]
    Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's stateless_default_actions. See Stateless Custom Action below for details.
    stateless_rule_group_references Sequence[FirewallPolicyFirewallPolicyStatelessRuleGroupReference]
    Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See Stateless Rule Group Reference below for details.
    statelessDefaultActions List<String>
    Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    statelessFragmentDefaultActions List<String>
    Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe. In addition, you can specify custom actions that are compatible with your standard action choice. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe.
    statefulDefaultActions List<String>
    Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a stateful_engine_options block with a rule_order value of STRICT_ORDER. You can specify one of either or neither values of aws:drop_strict or aws:drop_established, as well as any combination of aws:alert_strict and aws:alert_established.
    statefulEngineOptions Property Map
    A configuration block that defines options on how the policy handles stateful rules. See Stateful Engine Options below for details.
    statefulRuleGroupReferences List<Property Map>
    Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See Stateful Rule Group Reference below for details.
    statelessCustomActions List<Property Map>
    Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's stateless_default_actions. See Stateless Custom Action below for details.
    statelessRuleGroupReferences List<Property Map>
    Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See Stateless Rule Group Reference below for details.

    FirewallPolicyFirewallPolicyStatefulEngineOptions, FirewallPolicyFirewallPolicyStatefulEngineOptionsArgs

    RuleOrder string
    Indicates how to manage the order of stateful rule evaluation for the policy. Default value: DEFAULT_ACTION_ORDER. Valid values: DEFAULT_ACTION_ORDER, STRICT_ORDER.
    RuleOrder string
    Indicates how to manage the order of stateful rule evaluation for the policy. Default value: DEFAULT_ACTION_ORDER. Valid values: DEFAULT_ACTION_ORDER, STRICT_ORDER.
    ruleOrder String
    Indicates how to manage the order of stateful rule evaluation for the policy. Default value: DEFAULT_ACTION_ORDER. Valid values: DEFAULT_ACTION_ORDER, STRICT_ORDER.
    ruleOrder string
    Indicates how to manage the order of stateful rule evaluation for the policy. Default value: DEFAULT_ACTION_ORDER. Valid values: DEFAULT_ACTION_ORDER, STRICT_ORDER.
    rule_order str
    Indicates how to manage the order of stateful rule evaluation for the policy. Default value: DEFAULT_ACTION_ORDER. Valid values: DEFAULT_ACTION_ORDER, STRICT_ORDER.
    ruleOrder String
    Indicates how to manage the order of stateful rule evaluation for the policy. Default value: DEFAULT_ACTION_ORDER. Valid values: DEFAULT_ACTION_ORDER, STRICT_ORDER.

    FirewallPolicyFirewallPolicyStatefulRuleGroupReference, FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceArgs

    ResourceArn string
    The Amazon Resource Name (ARN) of the stateful rule group.
    Override FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceOverride
    Configuration block for override values
    Priority int
    An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a stateful_engine_options block with a rule_order value of STRICT_ORDER. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.
    ResourceArn string
    The Amazon Resource Name (ARN) of the stateful rule group.
    Override FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceOverride
    Configuration block for override values
    Priority int
    An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a stateful_engine_options block with a rule_order value of STRICT_ORDER. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.
    resourceArn String
    The Amazon Resource Name (ARN) of the stateful rule group.
    override FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceOverride
    Configuration block for override values
    priority Integer
    An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a stateful_engine_options block with a rule_order value of STRICT_ORDER. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.
    resourceArn string
    The Amazon Resource Name (ARN) of the stateful rule group.
    override FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceOverride
    Configuration block for override values
    priority number
    An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a stateful_engine_options block with a rule_order value of STRICT_ORDER. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.
    resource_arn str
    The Amazon Resource Name (ARN) of the stateful rule group.
    override FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceOverride
    Configuration block for override values
    priority int
    An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a stateful_engine_options block with a rule_order value of STRICT_ORDER. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.
    resourceArn String
    The Amazon Resource Name (ARN) of the stateful rule group.
    override Property Map
    Configuration block for override values
    priority Number
    An integer setting that indicates the order in which to apply the stateful rule groups in a single policy. This argument must be specified if the policy has a stateful_engine_options block with a rule_order value of STRICT_ORDER. AWS Network Firewall applies each stateful rule group to a packet starting with the group that has the lowest priority setting.

    FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceOverride, FirewallPolicyFirewallPolicyStatefulRuleGroupReferenceOverrideArgs

    Action string
    The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
    Action string
    The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
    action String
    The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
    action string
    The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
    action str
    The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.
    action String
    The action that changes the rule group from DROP to ALERT . This only applies to managed rule groups.

    FirewallPolicyFirewallPolicyStatelessCustomAction, FirewallPolicyFirewallPolicyStatelessCustomActionArgs

    ActionDefinition FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinition
    A configuration block describing the custom action associated with the action_name. See Action Definition below for details.
    ActionName string
    A friendly name of the custom action.
    ActionDefinition FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinition
    A configuration block describing the custom action associated with the action_name. See Action Definition below for details.
    ActionName string
    A friendly name of the custom action.
    actionDefinition FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinition
    A configuration block describing the custom action associated with the action_name. See Action Definition below for details.
    actionName String
    A friendly name of the custom action.
    actionDefinition FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinition
    A configuration block describing the custom action associated with the action_name. See Action Definition below for details.
    actionName string
    A friendly name of the custom action.
    action_definition FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinition
    A configuration block describing the custom action associated with the action_name. See Action Definition below for details.
    action_name str
    A friendly name of the custom action.
    actionDefinition Property Map
    A configuration block describing the custom action associated with the action_name. See Action Definition below for details.
    actionName String
    A friendly name of the custom action.

    FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinition, FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionArgs

    PublishMetricAction FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricAction
    A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See Publish Metric Action below for details.
    PublishMetricAction FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricAction
    A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See Publish Metric Action below for details.
    publishMetricAction FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricAction
    A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See Publish Metric Action below for details.
    publishMetricAction FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricAction
    A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See Publish Metric Action below for details.
    publish_metric_action FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricAction
    A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See Publish Metric Action below for details.
    publishMetricAction Property Map
    A configuration block describing the stateless inspection criteria that publishes the specified metrics to Amazon CloudWatch for the matching packet. You can pair this custom action with any of the standard stateless rule actions. See Publish Metric Action below for details.

    FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricAction, FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionArgs

    Dimensions List<FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionDimension>
    Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See Dimension below for more details.
    Dimensions []FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionDimension
    Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See Dimension below for more details.
    dimensions List<FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionDimension>
    Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See Dimension below for more details.
    dimensions FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionDimension[]
    Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See Dimension below for more details.
    dimensions Sequence[FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionDimension]
    Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See Dimension below for more details.
    dimensions List<Property Map>
    Set of configuration blocks describing dimension settings to use for Amazon CloudWatch custom metrics. See Dimension below for more details.

    FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionDimension, FirewallPolicyFirewallPolicyStatelessCustomActionActionDefinitionPublishMetricActionDimensionArgs

    Value string
    The string value to use in the custom metric dimension.
    Value string
    The string value to use in the custom metric dimension.
    value String
    The string value to use in the custom metric dimension.
    value string
    The string value to use in the custom metric dimension.
    value str
    The string value to use in the custom metric dimension.
    value String
    The string value to use in the custom metric dimension.

    FirewallPolicyFirewallPolicyStatelessRuleGroupReference, FirewallPolicyFirewallPolicyStatelessRuleGroupReferenceArgs

    Priority int
    An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
    ResourceArn string
    The Amazon Resource Name (ARN) of the stateless rule group.
    Priority int
    An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
    ResourceArn string
    The Amazon Resource Name (ARN) of the stateless rule group.
    priority Integer
    An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
    resourceArn String
    The Amazon Resource Name (ARN) of the stateless rule group.
    priority number
    An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
    resourceArn string
    The Amazon Resource Name (ARN) of the stateless rule group.
    priority int
    An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
    resource_arn str
    The Amazon Resource Name (ARN) of the stateless rule group.
    priority Number
    An integer setting that indicates the order in which to run the stateless rule groups in a single policy. AWS Network Firewall applies each stateless rule group to a packet starting with the group that has the lowest priority setting.
    resourceArn String
    The Amazon Resource Name (ARN) of the stateless rule group.

    Import

    Network Firewall Policies can be imported using their ARN.

     $ pulumi import aws:networkfirewall/firewallPolicy:FirewallPolicy example arn:aws:network-firewall:us-west-1:123456789012:firewall-policy/example

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    AWS Classic pulumi/pulumi-aws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the aws Terraform Provider.
    aws logo
    Viewing docs for AWS v5.43.0 (Older version)
    published on Tuesday, Mar 10, 2026 by Pulumi
    Go to latest version
    Schema (JSON)
    pulumi/pulumi-aws

      Try Pulumi Cloud free.
      Your team will thank you.

      Start free trial