AWS::NetworkFirewall::Firewall - AWS CloudFormation

AWS::NetworkFirewall::Firewall

Use the AWS::NetworkFirewall::Firewall to provide stateful, managed, network firewall and intrusion detection and prevention filtering for your VPCs in Amazon VPC.

The firewall defines the configuration settings for an AWS Network Firewall firewall. The settings include the firewall policy, the subnets in your VPC to use for the firewall endpoints, and any tags that are attached to the firewall AWS resource.

Syntax

To declare this entity in your AWS CloudFormation template, use the following syntax:

JSON

{ "Type" : "AWS::NetworkFirewall::Firewall", "Properties" : { "DeleteProtection" : Boolean, "Description" : String, "FirewallName" : String, "FirewallPolicyArn" : String, "FirewallPolicyChangeProtection" : Boolean, "SubnetChangeProtection" : Boolean, "SubnetMappings" : [ SubnetMapping, ... ], "Tags" : [ Tag, ... ], "VpcId" : String } }

YAML

Type: AWS::NetworkFirewall::Firewall Properties: DeleteProtection: Boolean Description: String FirewallName: String FirewallPolicyArn: String FirewallPolicyChangeProtection: Boolean SubnetChangeProtection: Boolean SubnetMappings: - SubnetMapping Tags: - Tag VpcId: String

Properties

DeleteProtection

A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE.

Required: No

Type: Boolean

Update requires: No interruption

Description

A description of the firewall.

Required: No

Type: String

Maximum: 512

Pattern: ^.*$

Update requires: No interruption

FirewallName

The descriptive name of the firewall. You can't change the name of a firewall after you create it.

Required: Yes

Type: String

Minimum: 1

Maximum: 128

Pattern: ^[a-zA-Z0-9-]+$

Update requires: Replacement

FirewallPolicyArn

The Amazon Resource Name (ARN) of the firewall policy.

The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.

Required: Yes

Type: String

Minimum: 1

Maximum: 256

Pattern: ^arn:aws.*

Update requires: No interruption

FirewallPolicyChangeProtection

A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

Required: No

Type: Boolean

Update requires: No interruption

SubnetChangeProtection

A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

Required: No

Type: Boolean

Update requires: No interruption

SubnetMappings

The public subnets that Network Firewall is using for the firewall. Each subnet must belong to a different Availability Zone.

Required: Yes

Type: List of SubnetMapping

Update requires: No interruption

Tags

An array of key-value pairs to apply to this resource.

For more information, see Tag.

Required: No

Type: List of Tag

Update requires: No interruption

VpcId

The unique identifier of the VPC where the firewall is in use. You can't change the VPC of a firewall after you create the firewall.

Required: Yes

Type: String

Minimum: 1

Maximum: 128

Pattern: ^vpc-[0-9a-f]+$

Update requires: Replacement

Return values

Ref

When you pass the logical ID of this resource to the intrinsic Ref function, Ref returns the Amazon Resource Name (ARN) of the firewall. For example:

{ "Ref": "arn:aws:network-firewall:us-east-1:012345678901:firewall/myFirewallName" }

For more information about using the Ref function, see Ref.

Fn::GetAtt

The Fn::GetAtt intrinsic function returns a value for a specified attribute of this type. The following are the available attributes and sample return values.

For more information about using the Fn::GetAtt intrinsic function, see Fn::GetAtt.

EndpointIds

The unique IDs of the firewall endpoints for all of the subnets that you attached to the firewall. The subnets are not listed in any particular order. For example: ["us-west-2c:vpce-111122223333", "us-west-2a:vpce-987654321098", "us-west-2b:vpce-012345678901"].

FirewallArn

The Amazon Resource Name (ARN) of the AWS::NetworkFirewall::Firewall.

FirewallId

The name of the AWS::NetworkFirewall::Firewall resource.

Examples

Create a firewall

The following shows example firewall specifications.

JSON

"SampleFirewall": { "Type": "AWS::NetworkFirewall::Firewall", "Properties": { "FirewallName": "SampleFirewallName", "FirewallPolicyArn": { "Ref": "SampleFirewallPolicy" }, "VpcId": { "Ref": "SampleVPC" }, "SubnetMappings": [ { "SubnetId": { "Ref": "SampleSubnet1" } }, { "SubnetId": { "Ref": "SampleSubnet2" } } ], "Description": "Firewall description goes here", "Tags": [ { "Key": "Foo", "Value": "Bar" } ] }

YAML

SampleFirewall: Type: AWS::NetworkFirewall::Firewall Properties: FirewallName: SampleFirewallName FirewallPolicyArn: !Ref SampleFirewallPolicy VpcId: !Ref SampleVPC SubnetMappings: - SubnetId: !Ref SampleSubnet1 - SubnetId: !Ref SampleSubnet2 Description: Firewall description goes here Tags: - Key: Foo Value: Bar