1. Packages
  2. Packages
  3. Palo Alto Networks Cloud NGFW for AWS Provider
  4. API Docs
  5. Ngfw
Viewing docs for Palo Alto Networks Cloud NGFW for AWS v2.0.0
published on Friday, Apr 24, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-cloudngfwaws

cloudngfwaws.Ngfw

cloudngfwaws logo
Viewing docs for Palo Alto Networks Cloud NGFW for AWS v2.0.0
published on Friday, Apr 24, 2026 by Pulumi
Schema (JSON)
pulumi/pulumi-cloudngfwaws

    Resource for NGFW manipulation.

    NOTE: Having the rulestack param reference the rulestack name from cloudngfwaws.CommitRulestack ensures that Terraform will only try to spin up a NGFW instance if the commit is successful.

    Admin Permission Type

    • Firewall

    Configuration Guide

    V1 Schema — Existing Deployments Only

    Important: V1 schema is for existing customers who already have firewalls deployed with Terraform. New firewalls must be created using the V2 schema.

    1. Managing an Existing Firewall (no configuration changes)

    Use the V1 schema as-is. No steps required beyond ensuring your existing state is in sync.

    Steps:

    1. Verify there is no unintended drift: 2. If the plan is clean, no action needed. If drift is detected, review and apply:

    Full example — existing V1 firewall:

    import * as pulumi from "@pulumi/pulumi";
import * as cloudngfwaws from "@pulumi/cloudngfwaws";

const rs = new cloudngfwaws.CommitRulestack("rs", {rulestack: "my-rulestack"});
const example = new cloudngfwaws.Ngfw("example", {
    name: "example-instance",
    vpcId: exampleAwsVpc.id,
    accountId: "111111111111",
    description: "Example description",
    endpointMode: "ServiceManaged",
    subnetMappings: [
        {
            subnetId: subnet1.id,
        },
        {
            subnetId: subnet2.id,
        },
    ],
    rulestack: rs.rulestack,
    tags: {
        Foo: "bar",
    },
});

    import pulumi
import pulumi_cloudngfwaws as cloudngfwaws

rs = cloudngfwaws.CommitRulestack("rs", rulestack="my-rulestack")
example = cloudngfwaws.Ngfw("example",
    name="example-instance",
    vpc_id=example_aws_vpc["id"],
    account_id="111111111111",
    description="Example description",
    endpoint_mode="ServiceManaged",
    subnet_mappings=[
        {
            "subnet_id": subnet1["id"],
        },
        {
            "subnet_id": subnet2["id"],
        },
    ],
    rulestack=rs.rulestack,
    tags={
        "Foo": "bar",
    })

    package main

import (
	"github.com/pulumi/pulumi-cloudngfwaws/sdk/v2/go/cloudngfwaws"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		rs, err := cloudngfwaws.NewCommitRulestack(ctx, "rs", &cloudngfwaws.CommitRulestackArgs{
			Rulestack: pulumi.String("my-rulestack"),
		})
		if err != nil {
			return err
		}
		_, err = cloudngfwaws.NewNgfw(ctx, "example", &cloudngfwaws.NgfwArgs{
			Name:         pulumi.String("example-instance"),
			VpcId:        pulumi.Any(exampleAwsVpc.Id),
			AccountId:    pulumi.String("111111111111"),
			Description:  pulumi.String("Example description"),
			EndpointMode: pulumi.String("ServiceManaged"),
			SubnetMappings: cloudngfwaws.NgfwSubnetMappingArray{
				&cloudngfwaws.NgfwSubnetMappingArgs{
					SubnetId: pulumi.Any(subnet1.Id),
				},
				&cloudngfwaws.NgfwSubnetMappingArgs{
					SubnetId: pulumi.Any(subnet2.Id),
				},
			},
			Rulestack: rs.Rulestack,
			Tags: pulumi.StringMap{
				"Foo": pulumi.String("bar"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using CloudNgfwAws = Pulumi.CloudNgfwAws;

return await Deployment.RunAsync(() => 
{
    var rs = new CloudNgfwAws.Index.CommitRulestack("rs", new()
    {
        Rulestack = "my-rulestack",
    });

    var example = new CloudNgfwAws.Index.Ngfw("example", new()
    {
        Name = "example-instance",
        VpcId = exampleAwsVpc.Id,
        AccountId = "111111111111",
        Description = "Example description",
        EndpointMode = "ServiceManaged",
        SubnetMappings = new[]
        {
            new CloudNgfwAws.Inputs.NgfwSubnetMappingArgs
            {
                SubnetId = subnet1.Id,
            },
            new CloudNgfwAws.Inputs.NgfwSubnetMappingArgs
            {
                SubnetId = subnet2.Id,
            },
        },
        Rulestack = rs.Rulestack,
        Tags = 
        {
            { "Foo", "bar" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudngfwaws.CommitRulestack;
import com.pulumi.cloudngfwaws.CommitRulestackArgs;
import com.pulumi.cloudngfwaws.Ngfw;
import com.pulumi.cloudngfwaws.NgfwArgs;
import com.pulumi.cloudngfwaws.inputs.NgfwSubnetMappingArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var rs = new CommitRulestack("rs", CommitRulestackArgs.builder()
            .rulestack("my-rulestack")
            .build());

        var example = new Ngfw("example", NgfwArgs.builder()
            .name("example-instance")
            .vpcId(exampleAwsVpc.id())
            .accountId("111111111111")
            .description("Example description")
            .endpointMode("ServiceManaged")
            .subnetMappings(            
                NgfwSubnetMappingArgs.builder()
                    .subnetId(subnet1.id())
                    .build(),
                NgfwSubnetMappingArgs.builder()
                    .subnetId(subnet2.id())
                    .build())
            .rulestack(rs.rulestack())
            .tags(Map.of("Foo", "bar"))
            .build());

    }
}

    resources:
  example:
    type: cloudngfwaws:Ngfw
    properties:
      name: example-instance
      vpcId: ${exampleAwsVpc.id}
      accountId: '111111111111'
      description: Example description
      endpointMode: ServiceManaged
      subnetMappings:
        - subnetId: ${subnet1.id}
        - subnetId: ${subnet2.id}
      rulestack: ${rs.rulestack}
      tags:
        Foo: bar
  rs:
    type: cloudngfwaws:CommitRulestack
    properties:
      rulestack: my-rulestack

    2. Configuring Egress NAT on an Existing Firewall (V1)

    Egress NAT can be added to an existing V1 firewall without recreating the resource.

    ipPoolType accepts AWSService or BYOIP. Use BYOIP together with ipamPoolId if bringing your own IP pool.

    Steps:

    1. Add the egressNat block to your existing resource.

    Full example — existing V1 firewall with Egress NAT enabled:

    import * as pulumi from "@pulumi/pulumi";
import * as cloudngfwaws from "@pulumi/cloudngfwaws";

const example = new cloudngfwaws.Ngfw("example", {
    name: "example-instance",
    vpcId: "vpc-0a1b2c3d4e5f00001",
    accountId: "111111111111",
    description: "Example description",
    endpointMode: "CustomerManaged",
    subnetMappings: [
        {
            availabilityZone: "us-east-1a",
        },
        {
            availabilityZone: "us-east-1c",
        },
    ],
    rulestack: "my-rulestack",
    egressNats: [{
        enabled: true,
        settings: [{
            ipPoolType: "AWSService",
        }],
    }],
    tags: {
        Foo: "bar",
    },
});

    import pulumi
import pulumi_cloudngfwaws as cloudngfwaws

example = cloudngfwaws.Ngfw("example",
    name="example-instance",
    vpc_id="vpc-0a1b2c3d4e5f00001",
    account_id="111111111111",
    description="Example description",
    endpoint_mode="CustomerManaged",
    subnet_mappings=[
        {
            "availability_zone": "us-east-1a",
        },
        {
            "availability_zone": "us-east-1c",
        },
    ],
    rulestack="my-rulestack",
    egress_nats=[{
        "enabled": True,
        "settings": [{
            "ip_pool_type": "AWSService",
        }],
    }],
    tags={
        "Foo": "bar",
    })

    package main

import (
	"github.com/pulumi/pulumi-cloudngfwaws/sdk/v2/go/cloudngfwaws"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudngfwaws.NewNgfw(ctx, "example", &cloudngfwaws.NgfwArgs{
			Name:         pulumi.String("example-instance"),
			VpcId:        pulumi.String("vpc-0a1b2c3d4e5f00001"),
			AccountId:    pulumi.String("111111111111"),
			Description:  pulumi.String("Example description"),
			EndpointMode: pulumi.String("CustomerManaged"),
			SubnetMappings: cloudngfwaws.NgfwSubnetMappingArray{
				&cloudngfwaws.NgfwSubnetMappingArgs{
					AvailabilityZone: pulumi.String("us-east-1a"),
				},
				&cloudngfwaws.NgfwSubnetMappingArgs{
					AvailabilityZone: pulumi.String("us-east-1c"),
				},
			},
			Rulestack: pulumi.String("my-rulestack"),
			EgressNats: cloudngfwaws.NgfwEgressNatArray{
				&cloudngfwaws.NgfwEgressNatArgs{
					Enabled: pulumi.Bool(true),
					Settings: cloudngfwaws.NgfwEgressNatSettingArray{
						&cloudngfwaws.NgfwEgressNatSettingArgs{
							IpPoolType: pulumi.String("AWSService"),
						},
					},
				},
			},
			Tags: pulumi.StringMap{
				"Foo": pulumi.String("bar"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using CloudNgfwAws = Pulumi.CloudNgfwAws;

return await Deployment.RunAsync(() => 
{
    var example = new CloudNgfwAws.Index.Ngfw("example", new()
    {
        Name = "example-instance",
        VpcId = "vpc-0a1b2c3d4e5f00001",
        AccountId = "111111111111",
        Description = "Example description",
        EndpointMode = "CustomerManaged",
        SubnetMappings = new[]
        {
            new CloudNgfwAws.Inputs.NgfwSubnetMappingArgs
            {
                AvailabilityZone = "us-east-1a",
            },
            new CloudNgfwAws.Inputs.NgfwSubnetMappingArgs
            {
                AvailabilityZone = "us-east-1c",
            },
        },
        Rulestack = "my-rulestack",
        EgressNats = new[]
        {
            new CloudNgfwAws.Inputs.NgfwEgressNatArgs
            {
                Enabled = true,
                Settings = new[]
                {
                    new CloudNgfwAws.Inputs.NgfwEgressNatSettingArgs
                    {
                        IpPoolType = "AWSService",
                    },
                },
            },
        },
        Tags = 
        {
            { "Foo", "bar" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudngfwaws.Ngfw;
import com.pulumi.cloudngfwaws.NgfwArgs;
import com.pulumi.cloudngfwaws.inputs.NgfwSubnetMappingArgs;
import com.pulumi.cloudngfwaws.inputs.NgfwEgressNatArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Ngfw("example", NgfwArgs.builder()
            .name("example-instance")
            .vpcId("vpc-0a1b2c3d4e5f00001")
            .accountId("111111111111")
            .description("Example description")
            .endpointMode("CustomerManaged")
            .subnetMappings(            
                NgfwSubnetMappingArgs.builder()
                    .availabilityZone("us-east-1a")
                    .build(),
                NgfwSubnetMappingArgs.builder()
                    .availabilityZone("us-east-1c")
                    .build())
            .rulestack("my-rulestack")
            .egressNats(NgfwEgressNatArgs.builder()
                .enabled(true)
                .settings(NgfwEgressNatSettingArgs.builder()
                    .ipPoolType("AWSService")
                    .build())
                .build())
            .tags(Map.of("Foo", "bar"))
            .build());

    }
}

    resources:
  example:
    type: cloudngfwaws:Ngfw
    properties:
      name: example-instance
      vpcId: vpc-0a1b2c3d4e5f00001
      accountId: '111111111111'
      description: Example description
      endpointMode: CustomerManaged
      subnetMappings:
        - availabilityZone: us-east-1a
        - availabilityZone: us-east-1c
      rulestack: my-rulestack
      egressNats:
        - enabled: true
          settings:
            - ipPoolType: AWSService
      tags:
        Foo: bar

    To disable Egress NAT: set enabled = false and re-apply.

    3. Configuring Security Zones on an Existing Firewall (V1)

    Security zones let you enable or disable Egress NAT per endpoint and add or remove private CIDR prefixes.

    Prerequisite: Endpoints must be successfully created and in ACCEPTED state before security zones can be configured. Check status.attachment[*].status in Terraform state or the AWS console before proceeding.

    Steps:

    1. Confirm endpoint status is ACCEPTED:
      terraform show | grep -A 10 "attachment"

    2. Copy the `endpointId` value from the `status.attachment` output.
3. Add the `securityZones` block to your existing resource referencing that endpoint ID.

**Full example — existing V1 firewall with Egress NAT and security zones:**

<div>
<pulumi-chooser type="language" options="csharp,go,typescript,python,yaml,java"></pulumi-chooser>
</div>
<div>
<pulumi-choosable type="language" values="javascript,typescript">

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as cloudngfwaws from "@pulumi/cloudngfwaws";

const example = new cloudngfwaws.Ngfw("example", {
    name: "example-instance",
    vpcId: "vpc-0a1b2c3d4e5f00001",
    accountId: "111111111111",
    description: "Example description",
    endpointMode: "CustomerManaged",
    subnetMappings: [
        {
            availabilityZone: "us-east-1a",
        },
        {
            availabilityZone: "us-east-1c",
        },
    ],
    rulestack: "my-rulestack",
    egressNats: [{
        enabled: true,
        settings: [{
            ipPoolType: "AWSService",
        }],
    }],
    securityZones: [{
        endpointId: "vpce-0a1b2c3d4e5f00001",
        egressNatEnabled: true,
        prefixes: [{
            privatePrefixes: [{
                cidrs: [
                    "10.0.0.0/8",
                    "172.16.0.0/12",
                    "192.168.0.0/16",
                    "100.64.0.0/10",
                ],
            }],
        }],
    }],
    tags: {
        Foo: "bar",
    },
});

    import pulumi
import pulumi_cloudngfwaws as cloudngfwaws

example = cloudngfwaws.Ngfw("example",
    name="example-instance",
    vpc_id="vpc-0a1b2c3d4e5f00001",
    account_id="111111111111",
    description="Example description",
    endpoint_mode="CustomerManaged",
    subnet_mappings=[
        {
            "availability_zone": "us-east-1a",
        },
        {
            "availability_zone": "us-east-1c",
        },
    ],
    rulestack="my-rulestack",
    egress_nats=[{
        "enabled": True,
        "settings": [{
            "ip_pool_type": "AWSService",
        }],
    }],
    security_zones=[{
        "endpoint_id": "vpce-0a1b2c3d4e5f00001",
        "egress_nat_enabled": True,
        "prefixes": [{
            "private_prefixes": [{
                "cidrs": [
                    "10.0.0.0/8",
                    "172.16.0.0/12",
                    "192.168.0.0/16",
                    "100.64.0.0/10",
                ],
            }],
        }],
    }],
    tags={
        "Foo": "bar",
    })

    package main

import (
	"github.com/pulumi/pulumi-cloudngfwaws/sdk/v2/go/cloudngfwaws"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudngfwaws.NewNgfw(ctx, "example", &cloudngfwaws.NgfwArgs{
			Name:         pulumi.String("example-instance"),
			VpcId:        pulumi.String("vpc-0a1b2c3d4e5f00001"),
			AccountId:    pulumi.String("111111111111"),
			Description:  pulumi.String("Example description"),
			EndpointMode: pulumi.String("CustomerManaged"),
			SubnetMappings: cloudngfwaws.NgfwSubnetMappingArray{
				&cloudngfwaws.NgfwSubnetMappingArgs{
					AvailabilityZone: pulumi.String("us-east-1a"),
				},
				&cloudngfwaws.NgfwSubnetMappingArgs{
					AvailabilityZone: pulumi.String("us-east-1c"),
				},
			},
			Rulestack: pulumi.String("my-rulestack"),
			EgressNats: cloudngfwaws.NgfwEgressNatArray{
				&cloudngfwaws.NgfwEgressNatArgs{
					Enabled: pulumi.Bool(true),
					Settings: cloudngfwaws.NgfwEgressNatSettingArray{
						&cloudngfwaws.NgfwEgressNatSettingArgs{
							IpPoolType: pulumi.String("AWSService"),
						},
					},
				},
			},
			SecurityZones: cloudngfwaws.NgfwSecurityZoneArray{
				&cloudngfwaws.NgfwSecurityZoneArgs{
					EndpointId:       pulumi.String("vpce-0a1b2c3d4e5f00001"),
					EgressNatEnabled: pulumi.Bool(true),
					Prefixes: cloudngfwaws.NgfwSecurityZonePrefixArray{
						&cloudngfwaws.NgfwSecurityZonePrefixArgs{
							PrivatePrefixes: cloudngfwaws.NgfwSecurityZonePrefixPrivatePrefixArray{
								&cloudngfwaws.NgfwSecurityZonePrefixPrivatePrefixArgs{
									Cidrs: pulumi.StringArray{
										pulumi.String("10.0.0.0/8"),
										pulumi.String("172.16.0.0/12"),
										pulumi.String("192.168.0.0/16"),
										pulumi.String("100.64.0.0/10"),
									},
								},
							},
						},
					},
				},
			},
			Tags: pulumi.StringMap{
				"Foo": pulumi.String("bar"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using CloudNgfwAws = Pulumi.CloudNgfwAws;

return await Deployment.RunAsync(() => 
{
    var example = new CloudNgfwAws.Index.Ngfw("example", new()
    {
        Name = "example-instance",
        VpcId = "vpc-0a1b2c3d4e5f00001",
        AccountId = "111111111111",
        Description = "Example description",
        EndpointMode = "CustomerManaged",
        SubnetMappings = new[]
        {
            new CloudNgfwAws.Inputs.NgfwSubnetMappingArgs
            {
                AvailabilityZone = "us-east-1a",
            },
            new CloudNgfwAws.Inputs.NgfwSubnetMappingArgs
            {
                AvailabilityZone = "us-east-1c",
            },
        },
        Rulestack = "my-rulestack",
        EgressNats = new[]
        {
            new CloudNgfwAws.Inputs.NgfwEgressNatArgs
            {
                Enabled = true,
                Settings = new[]
                {
                    new CloudNgfwAws.Inputs.NgfwEgressNatSettingArgs
                    {
                        IpPoolType = "AWSService",
                    },
                },
            },
        },
        SecurityZones = new[]
        {
            new CloudNgfwAws.Inputs.NgfwSecurityZoneArgs
            {
                EndpointId = "vpce-0a1b2c3d4e5f00001",
                EgressNatEnabled = true,
                Prefixes = new[]
                {
                    new CloudNgfwAws.Inputs.NgfwSecurityZonePrefixArgs
                    {
                        PrivatePrefixes = new[]
                        {
                            new CloudNgfwAws.Inputs.NgfwSecurityZonePrefixPrivatePrefixArgs
                            {
                                Cidrs = new[]
                                {
                                    "10.0.0.0/8",
                                    "172.16.0.0/12",
                                    "192.168.0.0/16",
                                    "100.64.0.0/10",
                                },
                            },
                        },
                    },
                },
            },
        },
        Tags = 
        {
            { "Foo", "bar" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudngfwaws.Ngfw;
import com.pulumi.cloudngfwaws.NgfwArgs;
import com.pulumi.cloudngfwaws.inputs.NgfwSubnetMappingArgs;
import com.pulumi.cloudngfwaws.inputs.NgfwEgressNatArgs;
import com.pulumi.cloudngfwaws.inputs.NgfwSecurityZoneArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Ngfw("example", NgfwArgs.builder()
            .name("example-instance")
            .vpcId("vpc-0a1b2c3d4e5f00001")
            .accountId("111111111111")
            .description("Example description")
            .endpointMode("CustomerManaged")
            .subnetMappings(            
                NgfwSubnetMappingArgs.builder()
                    .availabilityZone("us-east-1a")
                    .build(),
                NgfwSubnetMappingArgs.builder()
                    .availabilityZone("us-east-1c")
                    .build())
            .rulestack("my-rulestack")
            .egressNats(NgfwEgressNatArgs.builder()
                .enabled(true)
                .settings(NgfwEgressNatSettingArgs.builder()
                    .ipPoolType("AWSService")
                    .build())
                .build())
            .securityZones(NgfwSecurityZoneArgs.builder()
                .endpointId("vpce-0a1b2c3d4e5f00001")
                .egressNatEnabled(true)
                .prefixes(NgfwSecurityZonePrefixArgs.builder()
                    .privatePrefixes(NgfwSecurityZonePrefixPrivatePrefixArgs.builder()
                        .cidrs(                        
                            "10.0.0.0/8",
                            "172.16.0.0/12",
                            "192.168.0.0/16",
                            "100.64.0.0/10")
                        .build())
                    .build())
                .build())
            .tags(Map.of("Foo", "bar"))
            .build());

    }
}

    resources:
  example:
    type: cloudngfwaws:Ngfw
    properties:
      name: example-instance
      vpcId: vpc-0a1b2c3d4e5f00001
      accountId: '111111111111'
      description: Example description
      endpointMode: CustomerManaged
      subnetMappings:
        - availabilityZone: us-east-1a
        - availabilityZone: us-east-1c
      rulestack: my-rulestack
      egressNats:
        - enabled: true
          settings:
            - ipPoolType: AWSService
      securityZones:
        - endpointId: vpce-0a1b2c3d4e5f00001
          egressNatEnabled: true
          prefixes:
            - privatePrefixes:
                - cidrs:
                    - 10.0.0.0/8
                    - 172.16.0.0/12
                    - 192.168.0.0/16
                    - 100.64.0.0/10
      tags:
        Foo: bar

    To remove private prefixes: remove the CIDR entries from cidrs and re-apply. To disable Egress NAT for a specific zone: set egressNatEnabled = false and re-apply.

    V2 Schema — New Firewalls

    Important: New firewalls can only be created using the V2 schema. Use azList instead of subnetMapping, and endpoints instead of endpointMode/subnetMapping.

    1. Creating a New Firewall (V2)

    Firewall creation uses azList to specify availability zones. Do not include endpoints during creation — they must be added in a separate update after the firewall is running.

    Steps:

    1. Define the resource with azList and no endpoints block.
    2. Proceed to Step 2 once the firewall reaches RUNNING state.

    Full example — new V2 firewall (creation only):

    import * as pulumi from "@pulumi/pulumi";
import * as cloudngfwaws from "@pulumi/cloudngfwaws";

const example = new cloudngfwaws.Ngfw("example", {
    name: "my-firewall",
    description: "My new firewall",
    azLists: [
        "use1-az1",
        "use1-az4",
    ],
    allowlistAccounts: ["111111111111"],
    tags: {
        Owner: "my-team",
    },
});

    import pulumi
import pulumi_cloudngfwaws as cloudngfwaws

example = cloudngfwaws.Ngfw("example",
    name="my-firewall",
    description="My new firewall",
    az_lists=[
        "use1-az1",
        "use1-az4",
    ],
    allowlist_accounts=["111111111111"],
    tags={
        "Owner": "my-team",
    })

    package main

import (
	"github.com/pulumi/pulumi-cloudngfwaws/sdk/v2/go/cloudngfwaws"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudngfwaws.NewNgfw(ctx, "example", &cloudngfwaws.NgfwArgs{
			Name:        pulumi.String("my-firewall"),
			Description: pulumi.String("My new firewall"),
			AzLists: pulumi.StringArray{
				pulumi.String("use1-az1"),
				pulumi.String("use1-az4"),
			},
			AllowlistAccounts: pulumi.StringArray{
				pulumi.String("111111111111"),
			},
			Tags: pulumi.StringMap{
				"Owner": pulumi.String("my-team"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using CloudNgfwAws = Pulumi.CloudNgfwAws;

return await Deployment.RunAsync(() => 
{
    var example = new CloudNgfwAws.Index.Ngfw("example", new()
    {
        Name = "my-firewall",
        Description = "My new firewall",
        AzLists = new[]
        {
            "use1-az1",
            "use1-az4",
        },
        AllowlistAccounts = new[]
        {
            "111111111111",
        },
        Tags = 
        {
            { "Owner", "my-team" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudngfwaws.Ngfw;
import com.pulumi.cloudngfwaws.NgfwArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Ngfw("example", NgfwArgs.builder()
            .name("my-firewall")
            .description("My new firewall")
            .azLists(            
                "use1-az1",
                "use1-az4")
            .allowlistAccounts("111111111111")
            .tags(Map.of("Owner", "my-team"))
            .build());

    }
}

    resources:
  example:
    type: cloudngfwaws:Ngfw
    properties:
      name: my-firewall
      description: My new firewall
      azLists:
        - use1-az1
        - use1-az4
      allowlistAccounts:
        - '111111111111'
      tags:
        Owner: my-team

    2. Adding Endpoints to a V2 Firewall

    Endpoints connect the firewall to customer VPCs. They must be added in a separate a separate update after the firewall is running.

    Steps:

    1. Confirm the firewall status is RUNNING:
      terraform show | grep firewall_status

    2. Add one or more `endpoints` blocks to the existing resource.
5. Wait for each endpoint's `status` to reach `ACCEPTED` before proceeding to configure
   Egress NAT or private prefixes:
   ```shell
   terraform show | grep -A 10 "endpoints"

    Full example — V2 firewall with endpoints added:

    import * as pulumi from "@pulumi/pulumi";
import * as cloudngfwaws from "@pulumi/cloudngfwaws";

const example = new cloudngfwaws.Ngfw("example", {
    name: "my-firewall",
    description: "My new firewall",
    azLists: [
        "use1-az1",
        "use1-az4",
    ],
    allowlistAccounts: ["111111111111"],
    endpoints: [
        {
            accountId: "111111111111",
            vpcId: "vpc-0a1b2c3d4e5f00002",
            subnetId: "subnet-0a1b2c3d4e5f00001",
            mode: "ServiceManaged",
        },
        {
            accountId: "111111111111",
            vpcId: "vpc-0a1b2c3d4e5f00003",
            subnetId: "subnet-0a1b2c3d4e5f00002",
            mode: "ServiceManaged",
        },
    ],
    tags: {
        Owner: "my-team",
    },
});

    import pulumi
import pulumi_cloudngfwaws as cloudngfwaws

example = cloudngfwaws.Ngfw("example",
    name="my-firewall",
    description="My new firewall",
    az_lists=[
        "use1-az1",
        "use1-az4",
    ],
    allowlist_accounts=["111111111111"],
    endpoints=[
        {
            "account_id": "111111111111",
            "vpc_id": "vpc-0a1b2c3d4e5f00002",
            "subnet_id": "subnet-0a1b2c3d4e5f00001",
            "mode": "ServiceManaged",
        },
        {
            "account_id": "111111111111",
            "vpc_id": "vpc-0a1b2c3d4e5f00003",
            "subnet_id": "subnet-0a1b2c3d4e5f00002",
            "mode": "ServiceManaged",
        },
    ],
    tags={
        "Owner": "my-team",
    })

    package main

import (
	"github.com/pulumi/pulumi-cloudngfwaws/sdk/v2/go/cloudngfwaws"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudngfwaws.NewNgfw(ctx, "example", &cloudngfwaws.NgfwArgs{
			Name:        pulumi.String("my-firewall"),
			Description: pulumi.String("My new firewall"),
			AzLists: pulumi.StringArray{
				pulumi.String("use1-az1"),
				pulumi.String("use1-az4"),
			},
			AllowlistAccounts: pulumi.StringArray{
				pulumi.String("111111111111"),
			},
			Endpoints: cloudngfwaws.NgfwEndpointArray{
				&cloudngfwaws.NgfwEndpointArgs{
					AccountId: pulumi.String("111111111111"),
					VpcId:     pulumi.String("vpc-0a1b2c3d4e5f00002"),
					SubnetId:  pulumi.String("subnet-0a1b2c3d4e5f00001"),
					Mode:      pulumi.String("ServiceManaged"),
				},
				&cloudngfwaws.NgfwEndpointArgs{
					AccountId: pulumi.String("111111111111"),
					VpcId:     pulumi.String("vpc-0a1b2c3d4e5f00003"),
					SubnetId:  pulumi.String("subnet-0a1b2c3d4e5f00002"),
					Mode:      pulumi.String("ServiceManaged"),
				},
			},
			Tags: pulumi.StringMap{
				"Owner": pulumi.String("my-team"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using CloudNgfwAws = Pulumi.CloudNgfwAws;

return await Deployment.RunAsync(() => 
{
    var example = new CloudNgfwAws.Index.Ngfw("example", new()
    {
        Name = "my-firewall",
        Description = "My new firewall",
        AzLists = new[]
        {
            "use1-az1",
            "use1-az4",
        },
        AllowlistAccounts = new[]
        {
            "111111111111",
        },
        Endpoints = new[]
        {
            new CloudNgfwAws.Inputs.NgfwEndpointArgs
            {
                AccountId = "111111111111",
                VpcId = "vpc-0a1b2c3d4e5f00002",
                SubnetId = "subnet-0a1b2c3d4e5f00001",
                Mode = "ServiceManaged",
            },
            new CloudNgfwAws.Inputs.NgfwEndpointArgs
            {
                AccountId = "111111111111",
                VpcId = "vpc-0a1b2c3d4e5f00003",
                SubnetId = "subnet-0a1b2c3d4e5f00002",
                Mode = "ServiceManaged",
            },
        },
        Tags = 
        {
            { "Owner", "my-team" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudngfwaws.Ngfw;
import com.pulumi.cloudngfwaws.NgfwArgs;
import com.pulumi.cloudngfwaws.inputs.NgfwEndpointArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Ngfw("example", NgfwArgs.builder()
            .name("my-firewall")
            .description("My new firewall")
            .azLists(            
                "use1-az1",
                "use1-az4")
            .allowlistAccounts("111111111111")
            .endpoints(            
                NgfwEndpointArgs.builder()
                    .accountId("111111111111")
                    .vpcId("vpc-0a1b2c3d4e5f00002")
                    .subnetId("subnet-0a1b2c3d4e5f00001")
                    .mode("ServiceManaged")
                    .build(),
                NgfwEndpointArgs.builder()
                    .accountId("111111111111")
                    .vpcId("vpc-0a1b2c3d4e5f00003")
                    .subnetId("subnet-0a1b2c3d4e5f00002")
                    .mode("ServiceManaged")
                    .build())
            .tags(Map.of("Owner", "my-team"))
            .build());

    }
}

    resources:
  example:
    type: cloudngfwaws:Ngfw
    properties:
      name: my-firewall
      description: My new firewall
      azLists:
        - use1-az1
        - use1-az4
      allowlistAccounts:
        - '111111111111'
      endpoints:
        - accountId: '111111111111'
          vpcId: vpc-0a1b2c3d4e5f00002
          subnetId: subnet-0a1b2c3d4e5f00001
          mode: ServiceManaged
        - accountId: '111111111111'
          vpcId: vpc-0a1b2c3d4e5f00003
          subnetId: subnet-0a1b2c3d4e5f00002
          mode: ServiceManaged
      tags:
        Owner: my-team

    3. Configuring Egress NAT on a V2 Firewall

    Egress NAT can be enabled at the firewall level once at least one endpoint is accepted.

    Prerequisite: At least one endpoint must be in ACCEPTED state.

    Steps:

    1. Add the egressNat block to the resource.

    Full example — V2 firewall with Egress NAT enabled:

    import * as pulumi from "@pulumi/pulumi";
import * as cloudngfwaws from "@pulumi/cloudngfwaws";

const example = new cloudngfwaws.Ngfw("example", {
    name: "my-firewall",
    description: "My new firewall",
    azLists: [
        "use1-az1",
        "use1-az4",
    ],
    allowlistAccounts: ["111111111111"],
    endpoints: [
        {
            accountId: "111111111111",
            vpcId: "vpc-0a1b2c3d4e5f00002",
            subnetId: "subnet-0a1b2c3d4e5f00001",
            mode: "ServiceManaged",
        },
        {
            accountId: "111111111111",
            vpcId: "vpc-0a1b2c3d4e5f00003",
            subnetId: "subnet-0a1b2c3d4e5f00002",
            mode: "ServiceManaged",
        },
    ],
    egressNats: [{
        enabled: true,
        settings: [{
            ipPoolType: "AWSService",
        }],
    }],
    tags: {
        Owner: "my-team",
    },
});

    import pulumi
import pulumi_cloudngfwaws as cloudngfwaws

example = cloudngfwaws.Ngfw("example",
    name="my-firewall",
    description="My new firewall",
    az_lists=[
        "use1-az1",
        "use1-az4",
    ],
    allowlist_accounts=["111111111111"],
    endpoints=[
        {
            "account_id": "111111111111",
            "vpc_id": "vpc-0a1b2c3d4e5f00002",
            "subnet_id": "subnet-0a1b2c3d4e5f00001",
            "mode": "ServiceManaged",
        },
        {
            "account_id": "111111111111",
            "vpc_id": "vpc-0a1b2c3d4e5f00003",
            "subnet_id": "subnet-0a1b2c3d4e5f00002",
            "mode": "ServiceManaged",
        },
    ],
    egress_nats=[{
        "enabled": True,
        "settings": [{
            "ip_pool_type": "AWSService",
        }],
    }],
    tags={
        "Owner": "my-team",
    })

    package main

import (
	"github.com/pulumi/pulumi-cloudngfwaws/sdk/v2/go/cloudngfwaws"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudngfwaws.NewNgfw(ctx, "example", &cloudngfwaws.NgfwArgs{
			Name:        pulumi.String("my-firewall"),
			Description: pulumi.String("My new firewall"),
			AzLists: pulumi.StringArray{
				pulumi.String("use1-az1"),
				pulumi.String("use1-az4"),
			},
			AllowlistAccounts: pulumi.StringArray{
				pulumi.String("111111111111"),
			},
			Endpoints: cloudngfwaws.NgfwEndpointArray{
				&cloudngfwaws.NgfwEndpointArgs{
					AccountId: pulumi.String("111111111111"),
					VpcId:     pulumi.String("vpc-0a1b2c3d4e5f00002"),
					SubnetId:  pulumi.String("subnet-0a1b2c3d4e5f00001"),
					Mode:      pulumi.String("ServiceManaged"),
				},
				&cloudngfwaws.NgfwEndpointArgs{
					AccountId: pulumi.String("111111111111"),
					VpcId:     pulumi.String("vpc-0a1b2c3d4e5f00003"),
					SubnetId:  pulumi.String("subnet-0a1b2c3d4e5f00002"),
					Mode:      pulumi.String("ServiceManaged"),
				},
			},
			EgressNats: cloudngfwaws.NgfwEgressNatArray{
				&cloudngfwaws.NgfwEgressNatArgs{
					Enabled: pulumi.Bool(true),
					Settings: cloudngfwaws.NgfwEgressNatSettingArray{
						&cloudngfwaws.NgfwEgressNatSettingArgs{
							IpPoolType: pulumi.String("AWSService"),
						},
					},
				},
			},
			Tags: pulumi.StringMap{
				"Owner": pulumi.String("my-team"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using CloudNgfwAws = Pulumi.CloudNgfwAws;

return await Deployment.RunAsync(() => 
{
    var example = new CloudNgfwAws.Index.Ngfw("example", new()
    {
        Name = "my-firewall",
        Description = "My new firewall",
        AzLists = new[]
        {
            "use1-az1",
            "use1-az4",
        },
        AllowlistAccounts = new[]
        {
            "111111111111",
        },
        Endpoints = new[]
        {
            new CloudNgfwAws.Inputs.NgfwEndpointArgs
            {
                AccountId = "111111111111",
                VpcId = "vpc-0a1b2c3d4e5f00002",
                SubnetId = "subnet-0a1b2c3d4e5f00001",
                Mode = "ServiceManaged",
            },
            new CloudNgfwAws.Inputs.NgfwEndpointArgs
            {
                AccountId = "111111111111",
                VpcId = "vpc-0a1b2c3d4e5f00003",
                SubnetId = "subnet-0a1b2c3d4e5f00002",
                Mode = "ServiceManaged",
            },
        },
        EgressNats = new[]
        {
            new CloudNgfwAws.Inputs.NgfwEgressNatArgs
            {
                Enabled = true,
                Settings = new[]
                {
                    new CloudNgfwAws.Inputs.NgfwEgressNatSettingArgs
                    {
                        IpPoolType = "AWSService",
                    },
                },
            },
        },
        Tags = 
        {
            { "Owner", "my-team" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudngfwaws.Ngfw;
import com.pulumi.cloudngfwaws.NgfwArgs;
import com.pulumi.cloudngfwaws.inputs.NgfwEndpointArgs;
import com.pulumi.cloudngfwaws.inputs.NgfwEgressNatArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Ngfw("example", NgfwArgs.builder()
            .name("my-firewall")
            .description("My new firewall")
            .azLists(            
                "use1-az1",
                "use1-az4")
            .allowlistAccounts("111111111111")
            .endpoints(            
                NgfwEndpointArgs.builder()
                    .accountId("111111111111")
                    .vpcId("vpc-0a1b2c3d4e5f00002")
                    .subnetId("subnet-0a1b2c3d4e5f00001")
                    .mode("ServiceManaged")
                    .build(),
                NgfwEndpointArgs.builder()
                    .accountId("111111111111")
                    .vpcId("vpc-0a1b2c3d4e5f00003")
                    .subnetId("subnet-0a1b2c3d4e5f00002")
                    .mode("ServiceManaged")
                    .build())
            .egressNats(NgfwEgressNatArgs.builder()
                .enabled(true)
                .settings(NgfwEgressNatSettingArgs.builder()
                    .ipPoolType("AWSService")
                    .build())
                .build())
            .tags(Map.of("Owner", "my-team"))
            .build());

    }
}

    resources:
  example:
    type: cloudngfwaws:Ngfw
    properties:
      name: my-firewall
      description: My new firewall
      azLists:
        - use1-az1
        - use1-az4
      allowlistAccounts:
        - '111111111111'
      endpoints:
        - accountId: '111111111111'
          vpcId: vpc-0a1b2c3d4e5f00002
          subnetId: subnet-0a1b2c3d4e5f00001
          mode: ServiceManaged
        - accountId: '111111111111'
          vpcId: vpc-0a1b2c3d4e5f00003
          subnetId: subnet-0a1b2c3d4e5f00002
          mode: ServiceManaged
      egressNats:
        - enabled: true
          settings:
            - ipPoolType: AWSService
      tags:
        Owner: my-team

    To disable Egress NAT: set enabled = false and re-apply.

    4. Configuring Private Prefixes and Per-Endpoint Egress NAT (V2)

    Once an endpoint is accepted, you can enable or disable Egress NAT and configure private CIDR prefixes on a per-endpoint basis within the endpoints block.

    Prerequisite: The endpoint must be in ACCEPTED state. The endpointId is a read-only computed value — retrieve it from Terraform state after apply:

    terraform show | grep -A 15 "endpoints"

    
**Steps:**

1. Update the relevant `endpoints` block with `egressNatEnabled` and `prefixes`.
   The `endpointId` field is read-only and is populated automatically by the provider
   once the endpoint is accepted — do not set it manually.

**Full example — V2 firewall with per-endpoint Egress NAT and private prefixes:**

<div>
<pulumi-chooser type="language" options="csharp,go,typescript,python,yaml,java"></pulumi-chooser>
</div>
<div>
<pulumi-choosable type="language" values="javascript,typescript">

```typescript
import * as pulumi from "@pulumi/pulumi";
import * as cloudngfwaws from "@pulumi/cloudngfwaws";

const example = new cloudngfwaws.Ngfw("example", {
    name: "my-firewall",
    description: "My new firewall",
    azLists: [
        "use1-az1",
        "use1-az4",
    ],
    allowlistAccounts: ["111111111111"],
    endpoints: [
        {
            accountId: "111111111111",
            vpcId: "vpc-0a1b2c3d4e5f00002",
            subnetId: "subnet-0a1b2c3d4e5f00001",
            mode: "ServiceManaged",
            egressNatEnabled: true,
            prefixes: [{
                privatePrefixes: [{
                    cidrs: [
                        "10.0.0.0/8",
                        "172.16.0.0/12",
                        "192.168.0.0/16",
                        "100.64.0.0/10",
                    ],
                }],
            }],
        },
        {
            accountId: "111111111111",
            vpcId: "vpc-0a1b2c3d4e5f00003",
            subnetId: "subnet-0a1b2c3d4e5f00002",
            mode: "ServiceManaged",
            egressNatEnabled: false,
        },
    ],
    egressNats: [{
        enabled: true,
        settings: [{
            ipPoolType: "AWSService",
        }],
    }],
    tags: {
        Owner: "my-team",
    },
});

    import pulumi
import pulumi_cloudngfwaws as cloudngfwaws

example = cloudngfwaws.Ngfw("example",
    name="my-firewall",
    description="My new firewall",
    az_lists=[
        "use1-az1",
        "use1-az4",
    ],
    allowlist_accounts=["111111111111"],
    endpoints=[
        {
            "account_id": "111111111111",
            "vpc_id": "vpc-0a1b2c3d4e5f00002",
            "subnet_id": "subnet-0a1b2c3d4e5f00001",
            "mode": "ServiceManaged",
            "egress_nat_enabled": True,
            "prefixes": [{
                "private_prefixes": [{
                    "cidrs": [
                        "10.0.0.0/8",
                        "172.16.0.0/12",
                        "192.168.0.0/16",
                        "100.64.0.0/10",
                    ],
                }],
            }],
        },
        {
            "account_id": "111111111111",
            "vpc_id": "vpc-0a1b2c3d4e5f00003",
            "subnet_id": "subnet-0a1b2c3d4e5f00002",
            "mode": "ServiceManaged",
            "egress_nat_enabled": False,
        },
    ],
    egress_nats=[{
        "enabled": True,
        "settings": [{
            "ip_pool_type": "AWSService",
        }],
    }],
    tags={
        "Owner": "my-team",
    })

    package main

import (
	"github.com/pulumi/pulumi-cloudngfwaws/sdk/v2/go/cloudngfwaws"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := cloudngfwaws.NewNgfw(ctx, "example", &cloudngfwaws.NgfwArgs{
			Name:        pulumi.String("my-firewall"),
			Description: pulumi.String("My new firewall"),
			AzLists: pulumi.StringArray{
				pulumi.String("use1-az1"),
				pulumi.String("use1-az4"),
			},
			AllowlistAccounts: pulumi.StringArray{
				pulumi.String("111111111111"),
			},
			Endpoints: cloudngfwaws.NgfwEndpointArray{
				&cloudngfwaws.NgfwEndpointArgs{
					AccountId:        pulumi.String("111111111111"),
					VpcId:            pulumi.String("vpc-0a1b2c3d4e5f00002"),
					SubnetId:         pulumi.String("subnet-0a1b2c3d4e5f00001"),
					Mode:             pulumi.String("ServiceManaged"),
					EgressNatEnabled: pulumi.Bool(true),
					Prefixes: cloudngfwaws.NgfwEndpointPrefixArray{
						&cloudngfwaws.NgfwEndpointPrefixArgs{
							PrivatePrefixes: cloudngfwaws.NgfwEndpointPrefixPrivatePrefixArray{
								&cloudngfwaws.NgfwEndpointPrefixPrivatePrefixArgs{
									Cidrs: pulumi.StringArray{
										pulumi.String("10.0.0.0/8"),
										pulumi.String("172.16.0.0/12"),
										pulumi.String("192.168.0.0/16"),
										pulumi.String("100.64.0.0/10"),
									},
								},
							},
						},
					},
				},
				&cloudngfwaws.NgfwEndpointArgs{
					AccountId:        pulumi.String("111111111111"),
					VpcId:            pulumi.String("vpc-0a1b2c3d4e5f00003"),
					SubnetId:         pulumi.String("subnet-0a1b2c3d4e5f00002"),
					Mode:             pulumi.String("ServiceManaged"),
					EgressNatEnabled: pulumi.Bool(false),
				},
			},
			EgressNats: cloudngfwaws.NgfwEgressNatArray{
				&cloudngfwaws.NgfwEgressNatArgs{
					Enabled: pulumi.Bool(true),
					Settings: cloudngfwaws.NgfwEgressNatSettingArray{
						&cloudngfwaws.NgfwEgressNatSettingArgs{
							IpPoolType: pulumi.String("AWSService"),
						},
					},
				},
			},
			Tags: pulumi.StringMap{
				"Owner": pulumi.String("my-team"),
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using CloudNgfwAws = Pulumi.CloudNgfwAws;

return await Deployment.RunAsync(() => 
{
    var example = new CloudNgfwAws.Index.Ngfw("example", new()
    {
        Name = "my-firewall",
        Description = "My new firewall",
        AzLists = new[]
        {
            "use1-az1",
            "use1-az4",
        },
        AllowlistAccounts = new[]
        {
            "111111111111",
        },
        Endpoints = new[]
        {
            new CloudNgfwAws.Inputs.NgfwEndpointArgs
            {
                AccountId = "111111111111",
                VpcId = "vpc-0a1b2c3d4e5f00002",
                SubnetId = "subnet-0a1b2c3d4e5f00001",
                Mode = "ServiceManaged",
                EgressNatEnabled = true,
                Prefixes = new[]
                {
                    new CloudNgfwAws.Inputs.NgfwEndpointPrefixArgs
                    {
                        PrivatePrefixes = new[]
                        {
                            new CloudNgfwAws.Inputs.NgfwEndpointPrefixPrivatePrefixArgs
                            {
                                Cidrs = new[]
                                {
                                    "10.0.0.0/8",
                                    "172.16.0.0/12",
                                    "192.168.0.0/16",
                                    "100.64.0.0/10",
                                },
                            },
                        },
                    },
                },
            },
            new CloudNgfwAws.Inputs.NgfwEndpointArgs
            {
                AccountId = "111111111111",
                VpcId = "vpc-0a1b2c3d4e5f00003",
                SubnetId = "subnet-0a1b2c3d4e5f00002",
                Mode = "ServiceManaged",
                EgressNatEnabled = false,
            },
        },
        EgressNats = new[]
        {
            new CloudNgfwAws.Inputs.NgfwEgressNatArgs
            {
                Enabled = true,
                Settings = new[]
                {
                    new CloudNgfwAws.Inputs.NgfwEgressNatSettingArgs
                    {
                        IpPoolType = "AWSService",
                    },
                },
            },
        },
        Tags = 
        {
            { "Owner", "my-team" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudngfwaws.Ngfw;
import com.pulumi.cloudngfwaws.NgfwArgs;
import com.pulumi.cloudngfwaws.inputs.NgfwEndpointArgs;
import com.pulumi.cloudngfwaws.inputs.NgfwEgressNatArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var example = new Ngfw("example", NgfwArgs.builder()
            .name("my-firewall")
            .description("My new firewall")
            .azLists(            
                "use1-az1",
                "use1-az4")
            .allowlistAccounts("111111111111")
            .endpoints(            
                NgfwEndpointArgs.builder()
                    .accountId("111111111111")
                    .vpcId("vpc-0a1b2c3d4e5f00002")
                    .subnetId("subnet-0a1b2c3d4e5f00001")
                    .mode("ServiceManaged")
                    .egressNatEnabled(true)
                    .prefixes(NgfwEndpointPrefixArgs.builder()
                        .privatePrefixes(NgfwEndpointPrefixPrivatePrefixArgs.builder()
                            .cidrs(                            
                                "10.0.0.0/8",
                                "172.16.0.0/12",
                                "192.168.0.0/16",
                                "100.64.0.0/10")
                            .build())
                        .build())
                    .build(),
                NgfwEndpointArgs.builder()
                    .accountId("111111111111")
                    .vpcId("vpc-0a1b2c3d4e5f00003")
                    .subnetId("subnet-0a1b2c3d4e5f00002")
                    .mode("ServiceManaged")
                    .egressNatEnabled(false)
                    .build())
            .egressNats(NgfwEgressNatArgs.builder()
                .enabled(true)
                .settings(NgfwEgressNatSettingArgs.builder()
                    .ipPoolType("AWSService")
                    .build())
                .build())
            .tags(Map.of("Owner", "my-team"))
            .build());

    }
}

    resources:
  example:
    type: cloudngfwaws:Ngfw
    properties:
      name: my-firewall
      description: My new firewall
      azLists:
        - use1-az1
        - use1-az4
      allowlistAccounts:
        - '111111111111'
      endpoints:
        - accountId: '111111111111'
          vpcId: vpc-0a1b2c3d4e5f00002
          subnetId: subnet-0a1b2c3d4e5f00001
          mode: ServiceManaged
          egressNatEnabled: true
          prefixes:
            - privatePrefixes:
                - cidrs:
                    - 10.0.0.0/8
                    - 172.16.0.0/12
                    - 192.168.0.0/16
                    - 100.64.0.0/10
        - accountId: '111111111111'
          vpcId: vpc-0a1b2c3d4e5f00003
          subnetId: subnet-0a1b2c3d4e5f00002
          mode: ServiceManaged
          egressNatEnabled: false
      egressNats:
        - enabled: true
          settings:
            - ipPoolType: AWSService
      tags:
        Owner: my-team

    To remove private prefixes: remove the CIDR entries from cidrs and re-apply. To disable per-endpoint Egress NAT: set egressNatEnabled = false and re-apply.

    Create Ngfw Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Ngfw(name: string, args?: NgfwArgs, opts?: CustomResourceOptions);
    @overload
def Ngfw(resource_name: str,
         args: Optional[NgfwArgs] = None,
         opts: Optional[ResourceOptions] = None)

@overload
def Ngfw(resource_name: str,
         opts: Optional[ResourceOptions] = None,
         account_id: Optional[str] = None,
         allowlist_accounts: Optional[Sequence[str]] = None,
         app_id_version: Optional[str] = None,
         automatic_upgrade_app_id_version: Optional[bool] = None,
         az_lists: Optional[Sequence[str]] = None,
         change_protections: Optional[Sequence[str]] = None,
         description: Optional[str] = None,
         egress_nats: Optional[Sequence[NgfwEgressNatArgs]] = None,
         endpoint_mode: Optional[str] = None,
         endpoints: Optional[Sequence[NgfwEndpointArgs]] = None,
         firewall_id: Optional[str] = None,
         global_rulestack: Optional[str] = None,
         link_id: Optional[str] = None,
         multi_vpc: Optional[bool] = None,
         name: Optional[str] = None,
         private_accesses: Optional[Sequence[NgfwPrivateAccessArgs]] = None,
         rulestack: Optional[str] = None,
         security_zones: Optional[Sequence[NgfwSecurityZoneArgs]] = None,
         subnet_mappings: Optional[Sequence[NgfwSubnetMappingArgs]] = None,
         tags: Optional[Mapping[str, str]] = None,
         tier: Optional[str] = None,
         user_ids: Optional[Sequence[NgfwUserIdArgs]] = None,
         vpc_id: Optional[str] = None)
    func NewNgfw(ctx *Context, name string, args *NgfwArgs, opts ...ResourceOption) (*Ngfw, error)
    public Ngfw(string name, NgfwArgs? args = null, CustomResourceOptions? opts = null)
    public Ngfw(String name, NgfwArgs args)
public Ngfw(String name, NgfwArgs args, CustomResourceOptions options)

    type: cloudngfwaws:Ngfw
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args NgfwArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args NgfwArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args NgfwArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args NgfwArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args NgfwArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Ngfw Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Ngfw resource accepts the following input properties:

    AccountId string
    The Account Id.
    AllowlistAccounts List<string>
    The list of allowed accounts for this NGFW.
    AppIdVersion string
    App-ID version number.
    AutomaticUpgradeAppIdVersion bool
    Automatic App-ID upgrade version number. Defaults to true.
    AzLists List<string>
    The list of availability zone IDs for this NGFW.
    ChangeProtections List<string>
    Enables or disables change protection for the NGFW.
    Description string
    The NGFW description.
    EgressNats List<Pulumi.CloudNgfwAws.Inputs.NgfwEgressNat>
    EndpointMode string
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    Endpoints List<Pulumi.CloudNgfwAws.Inputs.NgfwEndpoint>
    FirewallId string
    The Firewall ID.
    GlobalRulestack string
    The global rulestack for this NGFW.
    LinkId string
    The link ID.
    MultiVpc bool
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
    Name string
    The NGFW name.
    PrivateAccesses List<Pulumi.CloudNgfwAws.Inputs.NgfwPrivateAccess>
    Rulestack string
    The rulestack for this NGFW.
    SecurityZones List<Pulumi.CloudNgfwAws.Inputs.NgfwSecurityZone>
    SubnetMappings List<Pulumi.CloudNgfwAws.Inputs.NgfwSubnetMapping>
    Subnet mappings.
    Tags Dictionary<string, string>
    The tags.
    Tier string
    Firewall Instance Tier. Allowed values are 'base', 'standard', or 'premium'.
    UserIds List<Pulumi.CloudNgfwAws.Inputs.NgfwUserId>
    VpcId string
    The VPC ID for the NGFW.
    AccountId string
    The Account Id.
    AllowlistAccounts []string
    The list of allowed accounts for this NGFW.
    AppIdVersion string
    App-ID version number.
    AutomaticUpgradeAppIdVersion bool
    Automatic App-ID upgrade version number. Defaults to true.
    AzLists []string
    The list of availability zone IDs for this NGFW.
    ChangeProtections []string
    Enables or disables change protection for the NGFW.
    Description string
    The NGFW description.
    EgressNats []NgfwEgressNatArgs
    EndpointMode string
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    Endpoints []NgfwEndpointArgs
    FirewallId string
    The Firewall ID.
    GlobalRulestack string
    The global rulestack for this NGFW.
    LinkId string
    The link ID.
    MultiVpc bool
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
    Name string
    The NGFW name.
    PrivateAccesses []NgfwPrivateAccessArgs
    Rulestack string
    The rulestack for this NGFW.
    SecurityZones []NgfwSecurityZoneArgs
    SubnetMappings []NgfwSubnetMappingArgs
    Subnet mappings.
    Tags map[string]string
    The tags.
    Tier string
    Firewall Instance Tier. Allowed values are 'base', 'standard', or 'premium'.
    UserIds []NgfwUserIdArgs
    VpcId string
    The VPC ID for the NGFW.
    accountId String
    The Account Id.
    allowlistAccounts List<String>
    The list of allowed accounts for this NGFW.
    appIdVersion String
    App-ID version number.
    automaticUpgradeAppIdVersion Boolean
    Automatic App-ID upgrade version number. Defaults to true.
    azLists List<String>
    The list of availability zone IDs for this NGFW.
    changeProtections List<String>
    Enables or disables change protection for the NGFW.
    description String
    The NGFW description.
    egressNats List<NgfwEgressNat>
    endpointMode String
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpoints List<NgfwEndpoint>
    firewallId String
    The Firewall ID.
    globalRulestack String
    The global rulestack for this NGFW.
    linkId String
    The link ID.
    multiVpc Boolean
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
    name String
    The NGFW name.
    privateAccesses List<NgfwPrivateAccess>
    rulestack String
    The rulestack for this NGFW.
    securityZones List<NgfwSecurityZone>
    subnetMappings List<NgfwSubnetMapping>
    Subnet mappings.
    tags Map<String,String>
    The tags.
    tier String
    Firewall Instance Tier. Allowed values are 'base', 'standard', or 'premium'.
    userIds List<NgfwUserId>
    vpcId String
    The VPC ID for the NGFW.
    accountId string
    The Account Id.
    allowlistAccounts string[]
    The list of allowed accounts for this NGFW.
    appIdVersion string
    App-ID version number.
    automaticUpgradeAppIdVersion boolean
    Automatic App-ID upgrade version number. Defaults to true.
    azLists string[]
    The list of availability zone IDs for this NGFW.
    changeProtections string[]
    Enables or disables change protection for the NGFW.
    description string
    The NGFW description.
    egressNats NgfwEgressNat[]
    endpointMode string
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpoints NgfwEndpoint[]
    firewallId string
    The Firewall ID.
    globalRulestack string
    The global rulestack for this NGFW.
    linkId string
    The link ID.
    multiVpc boolean
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
    name string
    The NGFW name.
    privateAccesses NgfwPrivateAccess[]
    rulestack string
    The rulestack for this NGFW.
    securityZones NgfwSecurityZone[]
    subnetMappings NgfwSubnetMapping[]
    Subnet mappings.
    tags {[key: string]: string}
    The tags.
    tier string
    Firewall Instance Tier. Allowed values are 'base', 'standard', or 'premium'.
    userIds NgfwUserId[]
    vpcId string
    The VPC ID for the NGFW.
    account_id str
    The Account Id.
    allowlist_accounts Sequence[str]
    The list of allowed accounts for this NGFW.
    app_id_version str
    App-ID version number.
    automatic_upgrade_app_id_version bool
    Automatic App-ID upgrade version number. Defaults to true.
    az_lists Sequence[str]
    The list of availability zone IDs for this NGFW.
    change_protections Sequence[str]
    Enables or disables change protection for the NGFW.
    description str
    The NGFW description.
    egress_nats Sequence[NgfwEgressNatArgs]
    endpoint_mode str
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpoints Sequence[NgfwEndpointArgs]
    firewall_id str
    The Firewall ID.
    global_rulestack str
    The global rulestack for this NGFW.
    link_id str
    The link ID.
    multi_vpc bool
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
    name str
    The NGFW name.
    private_accesses Sequence[NgfwPrivateAccessArgs]
    rulestack str
    The rulestack for this NGFW.
    security_zones Sequence[NgfwSecurityZoneArgs]
    subnet_mappings Sequence[NgfwSubnetMappingArgs]
    Subnet mappings.
    tags Mapping[str, str]
    The tags.
    tier str
    Firewall Instance Tier. Allowed values are 'base', 'standard', or 'premium'.
    user_ids Sequence[NgfwUserIdArgs]
    vpc_id str
    The VPC ID for the NGFW.
    accountId String
    The Account Id.
    allowlistAccounts List<String>
    The list of allowed accounts for this NGFW.
    appIdVersion String
    App-ID version number.
    automaticUpgradeAppIdVersion Boolean
    Automatic App-ID upgrade version number. Defaults to true.
    azLists List<String>
    The list of availability zone IDs for this NGFW.
    changeProtections List<String>
    Enables or disables change protection for the NGFW.
    description String
    The NGFW description.
    egressNats List<Property Map>
    endpointMode String
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpoints List<Property Map>
    firewallId String
    The Firewall ID.
    globalRulestack String
    The global rulestack for this NGFW.
    linkId String
    The link ID.
    multiVpc Boolean
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
    name String
    The NGFW name.
    privateAccesses List<Property Map>
    rulestack String
    The rulestack for this NGFW.
    securityZones List<Property Map>
    subnetMappings List<Property Map>
    Subnet mappings.
    tags Map<String>
    The tags.
    tier String
    Firewall Instance Tier. Allowed values are 'base', 'standard', or 'premium'.
    userIds List<Property Map>
    vpcId String
    The VPC ID for the NGFW.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Ngfw resource produces the following output properties:

    DeploymentUpdateToken string
    The update token.
    EndpointServiceName string
    The endpoint service name.
    Id string
    The provider-assigned unique ID for this managed resource.
    LinkStatus string
    The link status.
    Statuses List<Pulumi.CloudNgfwAws.Outputs.NgfwStatus>
    UpdateToken string
    The update token.
    DeploymentUpdateToken string
    The update token.
    EndpointServiceName string
    The endpoint service name.
    Id string
    The provider-assigned unique ID for this managed resource.
    LinkStatus string
    The link status.
    Statuses []NgfwStatus
    UpdateToken string
    The update token.
    deploymentUpdateToken String
    The update token.
    endpointServiceName String
    The endpoint service name.
    id String
    The provider-assigned unique ID for this managed resource.
    linkStatus String
    The link status.
    statuses List<NgfwStatus>
    updateToken String
    The update token.
    deploymentUpdateToken string
    The update token.
    endpointServiceName string
    The endpoint service name.
    id string
    The provider-assigned unique ID for this managed resource.
    linkStatus string
    The link status.
    statuses NgfwStatus[]
    updateToken string
    The update token.
    deployment_update_token str
    The update token.
    endpoint_service_name str
    The endpoint service name.
    id str
    The provider-assigned unique ID for this managed resource.
    link_status str
    The link status.
    statuses Sequence[NgfwStatus]
    update_token str
    The update token.
    deploymentUpdateToken String
    The update token.
    endpointServiceName String
    The endpoint service name.
    id String
    The provider-assigned unique ID for this managed resource.
    linkStatus String
    The link status.
    statuses List<Property Map>
    updateToken String
    The update token.

    Look up Existing Ngfw Resource

    Get an existing Ngfw resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: NgfwState, opts?: CustomResourceOptions): Ngfw
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_id: Optional[str] = None,
        allowlist_accounts: Optional[Sequence[str]] = None,
        app_id_version: Optional[str] = None,
        automatic_upgrade_app_id_version: Optional[bool] = None,
        az_lists: Optional[Sequence[str]] = None,
        change_protections: Optional[Sequence[str]] = None,
        deployment_update_token: Optional[str] = None,
        description: Optional[str] = None,
        egress_nats: Optional[Sequence[NgfwEgressNatArgs]] = None,
        endpoint_mode: Optional[str] = None,
        endpoint_service_name: Optional[str] = None,
        endpoints: Optional[Sequence[NgfwEndpointArgs]] = None,
        firewall_id: Optional[str] = None,
        global_rulestack: Optional[str] = None,
        link_id: Optional[str] = None,
        link_status: Optional[str] = None,
        multi_vpc: Optional[bool] = None,
        name: Optional[str] = None,
        private_accesses: Optional[Sequence[NgfwPrivateAccessArgs]] = None,
        rulestack: Optional[str] = None,
        security_zones: Optional[Sequence[NgfwSecurityZoneArgs]] = None,
        statuses: Optional[Sequence[NgfwStatusArgs]] = None,
        subnet_mappings: Optional[Sequence[NgfwSubnetMappingArgs]] = None,
        tags: Optional[Mapping[str, str]] = None,
        tier: Optional[str] = None,
        update_token: Optional[str] = None,
        user_ids: Optional[Sequence[NgfwUserIdArgs]] = None,
        vpc_id: Optional[str] = None) -> Ngfw
    func GetNgfw(ctx *Context, name string, id IDInput, state *NgfwState, opts ...ResourceOption) (*Ngfw, error)
    public static Ngfw Get(string name, Input<string> id, NgfwState? state, CustomResourceOptions? opts = null)
    public static Ngfw get(String name, Output<String> id, NgfwState state, CustomResourceOptions options)
    resources:  _:    type: cloudngfwaws:Ngfw    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccountId string
    The Account Id.
    AllowlistAccounts List<string>
    The list of allowed accounts for this NGFW.
    AppIdVersion string
    App-ID version number.
    AutomaticUpgradeAppIdVersion bool
    Automatic App-ID upgrade version number. Defaults to true.
    AzLists List<string>
    The list of availability zone IDs for this NGFW.
    ChangeProtections List<string>
    Enables or disables change protection for the NGFW.
    DeploymentUpdateToken string
    The update token.
    Description string
    The NGFW description.
    EgressNats List<Pulumi.CloudNgfwAws.Inputs.NgfwEgressNat>
    EndpointMode string
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    EndpointServiceName string
    The endpoint service name.
    Endpoints List<Pulumi.CloudNgfwAws.Inputs.NgfwEndpoint>
    FirewallId string
    The Firewall ID.
    GlobalRulestack string
    The global rulestack for this NGFW.
    LinkId string
    The link ID.
    LinkStatus string
    The link status.
    MultiVpc bool
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
    Name string
    The NGFW name.
    PrivateAccesses List<Pulumi.CloudNgfwAws.Inputs.NgfwPrivateAccess>
    Rulestack string
    The rulestack for this NGFW.
    SecurityZones List<Pulumi.CloudNgfwAws.Inputs.NgfwSecurityZone>
    Statuses List<Pulumi.CloudNgfwAws.Inputs.NgfwStatus>
    SubnetMappings List<Pulumi.CloudNgfwAws.Inputs.NgfwSubnetMapping>
    Subnet mappings.
    Tags Dictionary<string, string>
    The tags.
    Tier string
    Firewall Instance Tier. Allowed values are 'base', 'standard', or 'premium'.
    UpdateToken string
    The update token.
    UserIds List<Pulumi.CloudNgfwAws.Inputs.NgfwUserId>
    VpcId string
    The VPC ID for the NGFW.
    AccountId string
    The Account Id.
    AllowlistAccounts []string
    The list of allowed accounts for this NGFW.
    AppIdVersion string
    App-ID version number.
    AutomaticUpgradeAppIdVersion bool
    Automatic App-ID upgrade version number. Defaults to true.
    AzLists []string
    The list of availability zone IDs for this NGFW.
    ChangeProtections []string
    Enables or disables change protection for the NGFW.
    DeploymentUpdateToken string
    The update token.
    Description string
    The NGFW description.
    EgressNats []NgfwEgressNatArgs
    EndpointMode string
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    EndpointServiceName string
    The endpoint service name.
    Endpoints []NgfwEndpointArgs
    FirewallId string
    The Firewall ID.
    GlobalRulestack string
    The global rulestack for this NGFW.
    LinkId string
    The link ID.
    LinkStatus string
    The link status.
    MultiVpc bool
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
    Name string
    The NGFW name.
    PrivateAccesses []NgfwPrivateAccessArgs
    Rulestack string
    The rulestack for this NGFW.
    SecurityZones []NgfwSecurityZoneArgs
    Statuses []NgfwStatusArgs
    SubnetMappings []NgfwSubnetMappingArgs
    Subnet mappings.
    Tags map[string]string
    The tags.
    Tier string
    Firewall Instance Tier. Allowed values are 'base', 'standard', or 'premium'.
    UpdateToken string
    The update token.
    UserIds []NgfwUserIdArgs
    VpcId string
    The VPC ID for the NGFW.
    accountId String
    The Account Id.
    allowlistAccounts List<String>
    The list of allowed accounts for this NGFW.
    appIdVersion String
    App-ID version number.
    automaticUpgradeAppIdVersion Boolean
    Automatic App-ID upgrade version number. Defaults to true.
    azLists List<String>
    The list of availability zone IDs for this NGFW.
    changeProtections List<String>
    Enables or disables change protection for the NGFW.
    deploymentUpdateToken String
    The update token.
    description String
    The NGFW description.
    egressNats List<NgfwEgressNat>
    endpointMode String
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpointServiceName String
    The endpoint service name.
    endpoints List<NgfwEndpoint>
    firewallId String
    The Firewall ID.
    globalRulestack String
    The global rulestack for this NGFW.
    linkId String
    The link ID.
    linkStatus String
    The link status.
    multiVpc Boolean
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
    name String
    The NGFW name.
    privateAccesses List<NgfwPrivateAccess>
    rulestack String
    The rulestack for this NGFW.
    securityZones List<NgfwSecurityZone>
    statuses List<NgfwStatus>
    subnetMappings List<NgfwSubnetMapping>
    Subnet mappings.
    tags Map<String,String>
    The tags.
    tier String
    Firewall Instance Tier. Allowed values are 'base', 'standard', or 'premium'.
    updateToken String
    The update token.
    userIds List<NgfwUserId>
    vpcId String
    The VPC ID for the NGFW.
    accountId string
    The Account Id.
    allowlistAccounts string[]
    The list of allowed accounts for this NGFW.
    appIdVersion string
    App-ID version number.
    automaticUpgradeAppIdVersion boolean
    Automatic App-ID upgrade version number. Defaults to true.
    azLists string[]
    The list of availability zone IDs for this NGFW.
    changeProtections string[]
    Enables or disables change protection for the NGFW.
    deploymentUpdateToken string
    The update token.
    description string
    The NGFW description.
    egressNats NgfwEgressNat[]
    endpointMode string
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpointServiceName string
    The endpoint service name.
    endpoints NgfwEndpoint[]
    firewallId string
    The Firewall ID.
    globalRulestack string
    The global rulestack for this NGFW.
    linkId string
    The link ID.
    linkStatus string
    The link status.
    multiVpc boolean
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
    name string
    The NGFW name.
    privateAccesses NgfwPrivateAccess[]
    rulestack string
    The rulestack for this NGFW.
    securityZones NgfwSecurityZone[]
    statuses NgfwStatus[]
    subnetMappings NgfwSubnetMapping[]
    Subnet mappings.
    tags {[key: string]: string}
    The tags.
    tier string
    Firewall Instance Tier. Allowed values are 'base', 'standard', or 'premium'.
    updateToken string
    The update token.
    userIds NgfwUserId[]
    vpcId string
    The VPC ID for the NGFW.
    account_id str
    The Account Id.
    allowlist_accounts Sequence[str]
    The list of allowed accounts for this NGFW.
    app_id_version str
    App-ID version number.
    automatic_upgrade_app_id_version bool
    Automatic App-ID upgrade version number. Defaults to true.
    az_lists Sequence[str]
    The list of availability zone IDs for this NGFW.
    change_protections Sequence[str]
    Enables or disables change protection for the NGFW.
    deployment_update_token str
    The update token.
    description str
    The NGFW description.
    egress_nats Sequence[NgfwEgressNatArgs]
    endpoint_mode str
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpoint_service_name str
    The endpoint service name.
    endpoints Sequence[NgfwEndpointArgs]
    firewall_id str
    The Firewall ID.
    global_rulestack str
    The global rulestack for this NGFW.
    link_id str
    The link ID.
    link_status str
    The link status.
    multi_vpc bool
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
    name str
    The NGFW name.
    private_accesses Sequence[NgfwPrivateAccessArgs]
    rulestack str
    The rulestack for this NGFW.
    security_zones Sequence[NgfwSecurityZoneArgs]
    statuses Sequence[NgfwStatusArgs]
    subnet_mappings Sequence[NgfwSubnetMappingArgs]
    Subnet mappings.
    tags Mapping[str, str]
    The tags.
    tier str
    Firewall Instance Tier. Allowed values are 'base', 'standard', or 'premium'.
    update_token str
    The update token.
    user_ids Sequence[NgfwUserIdArgs]
    vpc_id str
    The VPC ID for the NGFW.
    accountId String
    The Account Id.
    allowlistAccounts List<String>
    The list of allowed accounts for this NGFW.
    appIdVersion String
    App-ID version number.
    automaticUpgradeAppIdVersion Boolean
    Automatic App-ID upgrade version number. Defaults to true.
    azLists List<String>
    The list of availability zone IDs for this NGFW.
    changeProtections List<String>
    Enables or disables change protection for the NGFW.
    deploymentUpdateToken String
    The update token.
    description String
    The NGFW description.
    egressNats List<Property Map>
    endpointMode String
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpointServiceName String
    The endpoint service name.
    endpoints List<Property Map>
    firewallId String
    The Firewall ID.
    globalRulestack String
    The global rulestack for this NGFW.
    linkId String
    The link ID.
    linkStatus String
    The link status.
    multiVpc Boolean
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
    name String
    The NGFW name.
    privateAccesses List<Property Map>
    rulestack String
    The rulestack for this NGFW.
    securityZones List<Property Map>
    statuses List<Property Map>
    subnetMappings List<Property Map>
    Subnet mappings.
    tags Map<String>
    The tags.
    tier String
    Firewall Instance Tier. Allowed values are 'base', 'standard', or 'premium'.
    updateToken String
    The update token.
    userIds List<Property Map>
    vpcId String
    The VPC ID for the NGFW.

    Supporting Types

    NgfwEgressNat, NgfwEgressNatArgs

    Enabled bool
    Enable egress NAT
    Settings List<Pulumi.CloudNgfwAws.Inputs.NgfwEgressNatSetting>
    Enabled bool
    Enable egress NAT
    Settings []NgfwEgressNatSetting
    enabled Boolean
    Enable egress NAT
    settings List<NgfwEgressNatSetting>
    enabled boolean
    Enable egress NAT
    settings NgfwEgressNatSetting[]
    enabled bool
    Enable egress NAT
    settings Sequence[NgfwEgressNatSetting]
    enabled Boolean
    Enable egress NAT
    settings List<Property Map>

    NgfwEgressNatSetting, NgfwEgressNatSettingArgs

    IpPoolType string
    Set ip pool type from the following options. Valid values are AWSService or BYOIP.
    IpamPoolId string
    The IP pool ID
    IpPoolType string
    Set ip pool type from the following options. Valid values are AWSService or BYOIP.
    IpamPoolId string
    The IP pool ID
    ipPoolType String
    Set ip pool type from the following options. Valid values are AWSService or BYOIP.
    ipamPoolId String
    The IP pool ID
    ipPoolType string
    Set ip pool type from the following options. Valid values are AWSService or BYOIP.
    ipamPoolId string
    The IP pool ID
    ip_pool_type str
    Set ip pool type from the following options. Valid values are AWSService or BYOIP.
    ipam_pool_id str
    The IP pool ID
    ipPoolType String
    Set ip pool type from the following options. Valid values are AWSService or BYOIP.
    ipamPoolId String
    The IP pool ID

    NgfwEndpoint, NgfwEndpointArgs

    Mode string
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    AccountId string
    The account id.
    EgressNatEnabled bool
    Enable egress NAT
    EndpointId string
    Endpoint ID of the security zone
    Prefixes List<Pulumi.CloudNgfwAws.Inputs.NgfwEndpointPrefix>
    RejectedReason string
    The rejected reason.
    Status string
    The attachment status.
    SubnetId string
    The subnet id.
    VpcId string
    The vpc id.
    ZoneId string
    The AZ id.
    Mode string
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    AccountId string
    The account id.
    EgressNatEnabled bool
    Enable egress NAT
    EndpointId string
    Endpoint ID of the security zone
    Prefixes []NgfwEndpointPrefix
    RejectedReason string
    The rejected reason.
    Status string
    The attachment status.
    SubnetId string
    The subnet id.
    VpcId string
    The vpc id.
    ZoneId string
    The AZ id.
    mode String
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    accountId String
    The account id.
    egressNatEnabled Boolean
    Enable egress NAT
    endpointId String
    Endpoint ID of the security zone
    prefixes List<NgfwEndpointPrefix>
    rejectedReason String
    The rejected reason.
    status String
    The attachment status.
    subnetId String
    The subnet id.
    vpcId String
    The vpc id.
    zoneId String
    The AZ id.
    mode string
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    accountId string
    The account id.
    egressNatEnabled boolean
    Enable egress NAT
    endpointId string
    Endpoint ID of the security zone
    prefixes NgfwEndpointPrefix[]
    rejectedReason string
    The rejected reason.
    status string
    The attachment status.
    subnetId string
    The subnet id.
    vpcId string
    The vpc id.
    zoneId string
    The AZ id.
    mode str
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    account_id str
    The account id.
    egress_nat_enabled bool
    Enable egress NAT
    endpoint_id str
    Endpoint ID of the security zone
    prefixes Sequence[NgfwEndpointPrefix]
    rejected_reason str
    The rejected reason.
    status str
    The attachment status.
    subnet_id str
    The subnet id.
    vpc_id str
    The vpc id.
    zone_id str
    The AZ id.
    mode String
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    accountId String
    The account id.
    egressNatEnabled Boolean
    Enable egress NAT
    endpointId String
    Endpoint ID of the security zone
    prefixes List<Property Map>
    rejectedReason String
    The rejected reason.
    status String
    The attachment status.
    subnetId String
    The subnet id.
    vpcId String
    The vpc id.
    zoneId String
    The AZ id.

    NgfwEndpointPrefix, NgfwEndpointPrefixArgs

    PrivatePrefixes List<Pulumi.CloudNgfwAws.Inputs.NgfwEndpointPrefixPrivatePrefix>
    PrivatePrefixes []NgfwEndpointPrefixPrivatePrefix
    privatePrefixes List<NgfwEndpointPrefixPrivatePrefix>
    privatePrefixes NgfwEndpointPrefixPrivatePrefix[]
    private_prefixes Sequence[NgfwEndpointPrefixPrivatePrefix]
    privatePrefixes List<Property Map>

    NgfwEndpointPrefixPrivatePrefix, NgfwEndpointPrefixPrivatePrefixArgs

    Cidrs List<string>
    Cidrs []string
    cidrs List<String>
    cidrs string[]
    cidrs Sequence[str]
    cidrs List<String>

    NgfwPrivateAccess, NgfwPrivateAccessArgs

    ResourceId string
    AWS ResourceID
    Type string
    Type of Private Access
    ResourceId string
    AWS ResourceID
    Type string
    Type of Private Access
    resourceId String
    AWS ResourceID
    type String
    Type of Private Access
    resourceId string
    AWS ResourceID
    type string
    Type of Private Access
    resource_id str
    AWS ResourceID
    type str
    Type of Private Access
    resourceId String
    AWS ResourceID
    type String
    Type of Private Access

    NgfwSecurityZone, NgfwSecurityZoneArgs

    EndpointId string
    Endpoint ID of the security zone
    AccountId string
    The account id.
    EgressNatEnabled bool
    Enable egress NAT
    Mode string
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    Prefixes List<Pulumi.CloudNgfwAws.Inputs.NgfwSecurityZonePrefix>
    RejectedReason string
    The rejected reason.
    Status string
    The attachment status.
    SubnetId string
    The subnet id.
    VpcId string
    The vpc id.
    ZoneId string
    The AZ id.
    EndpointId string
    Endpoint ID of the security zone
    AccountId string
    The account id.
    EgressNatEnabled bool
    Enable egress NAT
    Mode string
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    Prefixes []NgfwSecurityZonePrefix
    RejectedReason string
    The rejected reason.
    Status string
    The attachment status.
    SubnetId string
    The subnet id.
    VpcId string
    The vpc id.
    ZoneId string
    The AZ id.
    endpointId String
    Endpoint ID of the security zone
    accountId String
    The account id.
    egressNatEnabled Boolean
    Enable egress NAT
    mode String
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    prefixes List<NgfwSecurityZonePrefix>
    rejectedReason String
    The rejected reason.
    status String
    The attachment status.
    subnetId String
    The subnet id.
    vpcId String
    The vpc id.
    zoneId String
    The AZ id.
    endpointId string
    Endpoint ID of the security zone
    accountId string
    The account id.
    egressNatEnabled boolean
    Enable egress NAT
    mode string
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    prefixes NgfwSecurityZonePrefix[]
    rejectedReason string
    The rejected reason.
    status string
    The attachment status.
    subnetId string
    The subnet id.
    vpcId string
    The vpc id.
    zoneId string
    The AZ id.
    endpoint_id str
    Endpoint ID of the security zone
    account_id str
    The account id.
    egress_nat_enabled bool
    Enable egress NAT
    mode str
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    prefixes Sequence[NgfwSecurityZonePrefix]
    rejected_reason str
    The rejected reason.
    status str
    The attachment status.
    subnet_id str
    The subnet id.
    vpc_id str
    The vpc id.
    zone_id str
    The AZ id.
    endpointId String
    Endpoint ID of the security zone
    accountId String
    The account id.
    egressNatEnabled Boolean
    Enable egress NAT
    mode String
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    prefixes List<Property Map>
    rejectedReason String
    The rejected reason.
    status String
    The attachment status.
    subnetId String
    The subnet id.
    vpcId String
    The vpc id.
    zoneId String
    The AZ id.

    NgfwSecurityZonePrefix, NgfwSecurityZonePrefixArgs

    PrivatePrefixes List<Pulumi.CloudNgfwAws.Inputs.NgfwSecurityZonePrefixPrivatePrefix>
    PrivatePrefixes []NgfwSecurityZonePrefixPrivatePrefix
    privatePrefixes List<NgfwSecurityZonePrefixPrivatePrefix>
    privatePrefixes NgfwSecurityZonePrefixPrivatePrefix[]
    private_prefixes Sequence[NgfwSecurityZonePrefixPrivatePrefix]
    privatePrefixes List<Property Map>

    NgfwSecurityZonePrefixPrivatePrefix, NgfwSecurityZonePrefixPrivatePrefixArgs

    Cidrs List<string>
    Cidrs []string
    cidrs List<String>
    cidrs string[]
    cidrs Sequence[str]
    cidrs List<String>

    NgfwStatus, NgfwStatusArgs

    Attachments List<Pulumi.CloudNgfwAws.Inputs.NgfwStatusAttachment>
    The firewall attachments.
    DeviceRulestackCommitStatus string
    The device rulestack commit status.
    FailureReason string
    The firewall failure reason.
    FirewallStatus string
    The firewall status.
    RulestackStatus string
    The rulestack status.
    Attachments []NgfwStatusAttachment
    The firewall attachments.
    DeviceRulestackCommitStatus string
    The device rulestack commit status.
    FailureReason string
    The firewall failure reason.
    FirewallStatus string
    The firewall status.
    RulestackStatus string
    The rulestack status.
    attachments List<NgfwStatusAttachment>
    The firewall attachments.
    deviceRulestackCommitStatus String
    The device rulestack commit status.
    failureReason String
    The firewall failure reason.
    firewallStatus String
    The firewall status.
    rulestackStatus String
    The rulestack status.
    attachments NgfwStatusAttachment[]
    The firewall attachments.
    deviceRulestackCommitStatus string
    The device rulestack commit status.
    failureReason string
    The firewall failure reason.
    firewallStatus string
    The firewall status.
    rulestackStatus string
    The rulestack status.
    attachments Sequence[NgfwStatusAttachment]
    The firewall attachments.
    device_rulestack_commit_status str
    The device rulestack commit status.
    failure_reason str
    The firewall failure reason.
    firewall_status str
    The firewall status.
    rulestack_status str
    The rulestack status.
    attachments List<Property Map>
    The firewall attachments.
    deviceRulestackCommitStatus String
    The device rulestack commit status.
    failureReason String
    The firewall failure reason.
    firewallStatus String
    The firewall status.
    rulestackStatus String
    The rulestack status.

    NgfwStatusAttachment, NgfwStatusAttachmentArgs

    EndpointId string
    The endpoint id.
    RejectedReason string
    The reject reason.
    Status string
    The attachment status.
    SubnetId string
    The subnet id.
    EndpointId string
    The endpoint id.
    RejectedReason string
    The reject reason.
    Status string
    The attachment status.
    SubnetId string
    The subnet id.
    endpointId String
    The endpoint id.
    rejectedReason String
    The reject reason.
    status String
    The attachment status.
    subnetId String
    The subnet id.
    endpointId string
    The endpoint id.
    rejectedReason string
    The reject reason.
    status string
    The attachment status.
    subnetId string
    The subnet id.
    endpoint_id str
    The endpoint id.
    rejected_reason str
    The reject reason.
    status str
    The attachment status.
    subnet_id str
    The subnet id.
    endpointId String
    The endpoint id.
    rejectedReason String
    The reject reason.
    status String
    The attachment status.
    subnetId String
    The subnet id.

    NgfwSubnetMapping, NgfwSubnetMappingArgs

    AvailabilityZone string
    The availability zone, for when the endpoint mode is customer managed.
    AvailabilityZoneId string
    The availability zone ID, for when the endpoint mode is customer managed.
    SubnetId string
    The subnet id, for when the endpoint mode is service managed.
    AvailabilityZone string
    The availability zone, for when the endpoint mode is customer managed.
    AvailabilityZoneId string
    The availability zone ID, for when the endpoint mode is customer managed.
    SubnetId string
    The subnet id, for when the endpoint mode is service managed.
    availabilityZone String
    The availability zone, for when the endpoint mode is customer managed.
    availabilityZoneId String
    The availability zone ID, for when the endpoint mode is customer managed.
    subnetId String
    The subnet id, for when the endpoint mode is service managed.
    availabilityZone string
    The availability zone, for when the endpoint mode is customer managed.
    availabilityZoneId string
    The availability zone ID, for when the endpoint mode is customer managed.
    subnetId string
    The subnet id, for when the endpoint mode is service managed.
    availability_zone str
    The availability zone, for when the endpoint mode is customer managed.
    availability_zone_id str
    The availability zone ID, for when the endpoint mode is customer managed.
    subnet_id str
    The subnet id, for when the endpoint mode is service managed.
    availabilityZone String
    The availability zone, for when the endpoint mode is customer managed.
    availabilityZoneId String
    The availability zone ID, for when the endpoint mode is customer managed.
    subnetId String
    The subnet id, for when the endpoint mode is service managed.

    NgfwUserId, NgfwUserIdArgs

    Enabled bool
    Enable UserID Config
    Port int
    The Port
    AgentName string
    Agent Name for UserID
    CollectorName string
    The Collector Name
    CustomIncludeExcludeNetworks List<Pulumi.CloudNgfwAws.Inputs.NgfwUserIdCustomIncludeExcludeNetwork>
    List of Custom Include Exclude Networks
    SecretKeyArn string
    AWS Secret Key ARN
    UserIdStatus string
    Status and State of UserID Configuration
    Enabled bool
    Enable UserID Config
    Port int
    The Port
    AgentName string
    Agent Name for UserID
    CollectorName string
    The Collector Name
    CustomIncludeExcludeNetworks []NgfwUserIdCustomIncludeExcludeNetwork
    List of Custom Include Exclude Networks
    SecretKeyArn string
    AWS Secret Key ARN
    UserIdStatus string
    Status and State of UserID Configuration
    enabled Boolean
    Enable UserID Config
    port Integer
    The Port
    agentName String
    Agent Name for UserID
    collectorName String
    The Collector Name
    customIncludeExcludeNetworks List<NgfwUserIdCustomIncludeExcludeNetwork>
    List of Custom Include Exclude Networks
    secretKeyArn String
    AWS Secret Key ARN
    userIdStatus String
    Status and State of UserID Configuration
    enabled boolean
    Enable UserID Config
    port number
    The Port
    agentName string
    Agent Name for UserID
    collectorName string
    The Collector Name
    customIncludeExcludeNetworks NgfwUserIdCustomIncludeExcludeNetwork[]
    List of Custom Include Exclude Networks
    secretKeyArn string
    AWS Secret Key ARN
    userIdStatus string
    Status and State of UserID Configuration
    enabled bool
    Enable UserID Config
    port int
    The Port
    agent_name str
    Agent Name for UserID
    collector_name str
    The Collector Name
    custom_include_exclude_networks Sequence[NgfwUserIdCustomIncludeExcludeNetwork]
    List of Custom Include Exclude Networks
    secret_key_arn str
    AWS Secret Key ARN
    user_id_status str
    Status and State of UserID Configuration
    enabled Boolean
    Enable UserID Config
    port Number
    The Port
    agentName String
    Agent Name for UserID
    collectorName String
    The Collector Name
    customIncludeExcludeNetworks List<Property Map>
    List of Custom Include Exclude Networks
    secretKeyArn String
    AWS Secret Key ARN
    userIdStatus String
    Status and State of UserID Configuration

    NgfwUserIdCustomIncludeExcludeNetwork, NgfwUserIdCustomIncludeExcludeNetworkArgs

    DiscoveryInclude bool
    Include or exclude this subnet from user-id configuration
    Enabled bool
    Enable this specific custom include/exclude network
    Name string
    Name of subnet filter
    NetworkAddress string
    Network IP address of the subnet filter
    DiscoveryInclude bool
    Include or exclude this subnet from user-id configuration
    Enabled bool
    Enable this specific custom include/exclude network
    Name string
    Name of subnet filter
    NetworkAddress string
    Network IP address of the subnet filter
    discoveryInclude Boolean
    Include or exclude this subnet from user-id configuration
    enabled Boolean
    Enable this specific custom include/exclude network
    name String
    Name of subnet filter
    networkAddress String
    Network IP address of the subnet filter
    discoveryInclude boolean
    Include or exclude this subnet from user-id configuration
    enabled boolean
    Enable this specific custom include/exclude network
    name string
    Name of subnet filter
    networkAddress string
    Network IP address of the subnet filter
    discovery_include bool
    Include or exclude this subnet from user-id configuration
    enabled bool
    Enable this specific custom include/exclude network
    name str
    Name of subnet filter
    network_address str
    Network IP address of the subnet filter
    discoveryInclude Boolean
    Include or exclude this subnet from user-id configuration
    enabled Boolean
    Enable this specific custom include/exclude network
    name String
    Name of subnet filter
    networkAddress String
    Network IP address of the subnet filter

    Import

    import name is <account_id>:

    $ pulumi import cloudngfwaws:index/ngfw:Ngfw example 12345678:example-instance

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    cloudngfwaws pulumi/pulumi-cloudngfwaws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the cloudngfwaws Terraform Provider.
    cloudngfwaws logo
    Viewing docs for Palo Alto Networks Cloud NGFW for AWS v2.0.0
    published on Friday, Apr 24, 2026 by Pulumi
    Schema (JSON)
    pulumi/pulumi-cloudngfwaws
      Try Pulumi Cloud free. Your team will thank you.