CfnFirewallProps

class aws_cdk.aws_networkfirewall.CfnFirewallProps(*, firewall_name, firewall_policy_arn, availability_zone_change_protection=None, availability_zone_mappings=None, delete_protection=None, description=None, enabled_analysis_types=None, firewall_policy_change_protection=None, subnet_change_protection=None, subnet_mappings=None, tags=None, transit_gateway_id=None, vpc_id=None)

Bases: object

Properties for defining a CfnFirewall.

Parameters:

firewall_name (str) – The descriptive name of the firewall. You can’t change the name of a firewall after you create it.
firewall_policy_arn (str) – The Amazon Resource Name (ARN) of the firewall policy. The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.
availability_zone_change_protection (Union[bool, IResolvable, None]) – A setting indicating whether the firewall is protected against changes to its Availability Zone configuration. When set to TRUE , you must first disable this protection before adding or removing Availability Zones.
availability_zone_mappings (Union[IResolvable, Sequence[Union[IResolvable, AvailabilityZoneMappingProperty, Dict[str, Any]]], None]) – The Availability Zones where the firewall endpoints are created for a transit gateway-attached firewall. Each mapping specifies an Availability Zone where the firewall processes traffic.
delete_protection (Union[bool, IResolvable, None]) – A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE .
description (Optional[str]) – A description of the firewall.
enabled_analysis_types (Optional[Sequence[str]]) – An optional setting indicating the specific traffic analysis types to enable on the firewall.
firewall_policy_change_protection (Union[bool, IResolvable, None]) – A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE .
subnet_change_protection (Union[bool, IResolvable, None]) – A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE .
subnet_mappings (Union[IResolvable, Sequence[Union[IResolvable, SubnetMappingProperty, Dict[str, Any]]], None]) – The primary public subnets that Network Firewall is using for the firewall. Network Firewall creates a firewall endpoint in each subnet. Create a subnet mapping for each Availability Zone where you want to use the firewall. These subnets are all defined for a single, primary VPC, and each must belong to a different Availability Zone. Each of these subnets establishes the availability of the firewall in its Availability Zone. In addition to these subnets, you can define other endpoints for the firewall in VpcEndpointAssociation resources. You can define these additional endpoints for any VPC, and for any of the Availability Zones where the firewall resource already has a subnet mapping. VPC endpoint associations give you the ability to protect multiple VPCs using a single firewall, and to define multiple firewall endpoints for a VPC in a single Availability Zone.
tags (Optional[Sequence[Union[CfnTag, Dict[str, Any]]]]) – An array of key-value pairs to apply to this resource. For more information, see Tag .
transit_gateway_id (Optional[str]) – The unique identifier of the transit gateway associated with this firewall. This field is only present for transit gateway-attached firewalls.
vpc_id (Optional[str]) – The unique identifier of the VPC where the firewall is in use. You can’t change the VPC of a firewall after you create the firewall.

See:

http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html

ExampleMetadata:

fixture=_generated

Example:

# The code below shows an example of how to instantiate this type.
# The values are placeholders you should change.
from aws_cdk import aws_networkfirewall as networkfirewall

cfn_firewall_props = networkfirewall.CfnFirewallProps(
    firewall_name="firewallName",
    firewall_policy_arn="firewallPolicyArn",

    # the properties below are optional
    availability_zone_change_protection=False,
    availability_zone_mappings=[networkfirewall.CfnFirewall.AvailabilityZoneMappingProperty(
        availability_zone="availabilityZone"
    )],
    delete_protection=False,
    description="description",
    enabled_analysis_types=["enabledAnalysisTypes"],
    firewall_policy_change_protection=False,
    subnet_change_protection=False,
    subnet_mappings=[networkfirewall.CfnFirewall.SubnetMappingProperty(
        subnet_id="subnetId",

        # the properties below are optional
        ip_address_type="ipAddressType"
    )],
    tags=[CfnTag(
        key="key",
        value="value"
    )],
    transit_gateway_id="transitGatewayId",
    vpc_id="vpcId"
)

Attributes

availability_zone_change_protection

A setting indicating whether the firewall is protected against changes to its Availability Zone configuration.

When set to TRUE , you must first disable this protection before adding or removing Availability Zones.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html#cfn-networkfirewall-firewall-availabilityzonechangeprotection

availability_zone_mappings

The Availability Zones where the firewall endpoints are created for a transit gateway-attached firewall.

Each mapping specifies an Availability Zone where the firewall processes traffic.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html#cfn-networkfirewall-firewall-availabilityzonemappings

delete_protection

A flag indicating whether it is possible to delete the firewall.

A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html#cfn-networkfirewall-firewall-deleteprotection

description

A description of the firewall.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html#cfn-networkfirewall-firewall-description

enabled_analysis_types

An optional setting indicating the specific traffic analysis types to enable on the firewall.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html#cfn-networkfirewall-firewall-enabledanalysistypes

firewall_name

The descriptive name of the firewall.

You can’t change the name of a firewall after you create it.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html#cfn-networkfirewall-firewall-firewallname

firewall_policy_arn

The Amazon Resource Name (ARN) of the firewall policy.

The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html#cfn-networkfirewall-firewall-firewallpolicyarn

firewall_policy_change_protection

A setting indicating whether the firewall is protected against a change to the firewall policy association.

Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html#cfn-networkfirewall-firewall-firewallpolicychangeprotection

subnet_change_protection

A setting indicating whether the firewall is protected against changes to the subnet associations.

Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html#cfn-networkfirewall-firewall-subnetchangeprotection

subnet_mappings

The primary public subnets that Network Firewall is using for the firewall.

Network Firewall creates a firewall endpoint in each subnet. Create a subnet mapping for each Availability Zone where you want to use the firewall.

These subnets are all defined for a single, primary VPC, and each must belong to a different Availability Zone. Each of these subnets establishes the availability of the firewall in its Availability Zone.

In addition to these subnets, you can define other endpoints for the firewall in VpcEndpointAssociation resources. You can define these additional endpoints for any VPC, and for any of the Availability Zones where the firewall resource already has a subnet mapping. VPC endpoint associations give you the ability to protect multiple VPCs using a single firewall, and to define multiple firewall endpoints for a VPC in a single Availability Zone.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html#cfn-networkfirewall-firewall-subnetmappings

tags

An array of key-value pairs to apply to this resource.

For more information, see Tag .

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html#cfn-networkfirewall-firewall-tags

transit_gateway_id

The unique identifier of the transit gateway associated with this firewall.

This field is only present for transit gateway-attached firewalls.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html#cfn-networkfirewall-firewall-transitgatewayid

vpc_id

The unique identifier of the VPC where the firewall is in use.

You can’t change the VPC of a firewall after you create the firewall.

See:: http://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-firewall.html#cfn-networkfirewall-firewall-vpcid