Use the firewall to provide stateful, managed, network firewall and intrusion detection and prevention filtering for your VPCs in Amazon VPC .

The firewall defines the configuration settings for an AWS Network Firewall firewall. The settings include the firewall policy, the subnets in your VPC to use for the firewall endpoints, and any tags that are attached to the firewall AWS resource.

CfnFirewall

The descriptive name of the firewall.

You can't change the name of a firewall after you create it.

firewallName

The Amazon Resource Name (ARN) of the firewall policy.

The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.

firewallPolicyArn

A setting indicating whether the firewall is protected against changes to its Availability Zone configuration.

When set to `TRUE` , you must first disable this protection before adding or removing Availability Zones.

availabilityZoneChangeProtection

The Availability Zones where the firewall endpoints are created for a transit gateway-attached firewall.

Each mapping specifies an Availability Zone where the firewall processes traffic.

availabilityZoneMappings

A flag indicating whether it is possible to delete the firewall.

A setting of `TRUE` indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to `TRUE` .

deleteProtection

description

An optional setting indicating the specific traffic analysis types to enable on the firewall.

enabledAnalysisTypes

A setting indicating whether the firewall is protected against a change to the firewall policy association.

Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to `TRUE` .

firewallPolicyChangeProtection

A setting indicating whether the firewall is protected against changes to the subnet associations.

Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to `TRUE` .

subnetChangeProtection

The primary public subnets that Network Firewall is using for the firewall.

Network Firewall creates a firewall endpoint in each subnet. Create a subnet mapping for each Availability Zone where you want to use the firewall.

These subnets are all defined for a single, primary VPC, and each must belong to a different Availability Zone. Each of these subnets establishes the availability of the firewall in its Availability Zone.

In addition to these subnets, you can define other endpoints for the firewall in `VpcEndpointAssociation` resources. You can define these additional endpoints for any VPC, and for any of the Availability Zones where the firewall resource already has a subnet mapping. VPC endpoint associations give you the ability to protect multiple VPCs using a single firewall, and to define multiple firewall endpoints for a VPC in a single Availability Zone.

subnetMappings

An array of key-value pairs to apply to this resource.

For more information, see [Tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) .

transitGatewayId

The unique identifier of the VPC where the firewall is in use.

You can't change the VPC of a firewall after you create the firewall.

vpcId

Use the firewall policy to define the stateless and stateful network traffic filtering behavior for your firewall.

You can use one firewall policy for multiple firewalls.

CfnFirewallPolicy

The traffic filtering behavior of a firewall policy, defined in a collection of stateless and stateful rule groups and other settings.

firewallPolicy

The descriptive name of the firewall policy.

You can't change the name of a firewall policy after you create it.

firewallPolicyName

Use the logging configuration to define the destinations and logging options for an firewall.

You must change the logging configuration by changing one `LogDestinationConfig` setting at a time in your `LogDestinationConfigs` .

You can make only one of the following changes to your logging configuration resource:

- Create a new log destination object by adding a single `LogDestinationConfig` array element to `LogDestinationConfigs` .
- Delete a log destination object by removing a single `LogDestinationConfig` array element from `LogDestinationConfigs` .
- Change the `LogDestination` setting in a single `LogDestinationConfig` array element.

You can't change the `LogDestinationType` or `LogType` in a `LogDestinationConfig` . To change these settings, delete the existing `LogDestinationConfig` object and create a new one, in two separate modifications.

CfnLoggingConfiguration

The Amazon Resource Name (ARN) of the firewallthat the logging configuration is associated with.

You can't change the firewall specification after you create the logging configuration.

firewallArn

Defines how AWS Network Firewall performs logging for a firewall.

loggingConfiguration

enableMonitoringDashboard

The name of the firewall that the logging configuration is associated with.

You can't change the firewall specification after you create the logging configuration.

Use the [](https://docs.aws.amazon.com/RuleGroup) to define a reusable collection of stateless or stateful network traffic filtering rules. You use rule groups in an firewall policy to specify the filtering behavior of an firewall.

CfnRuleGroup

The maximum operating resources that this rule group can use.

You can't change a rule group's capacity setting after you create the rule group. When you update a rule group, you are limited to this capacity. When you reference a rule group from a firewall policy, Network Firewall reserves this capacity for the rule group.

capacity

The descriptive name of the rule group.

You can't change the name of a rule group after you create it.

ruleGroupName

Indicates whether the rule group is stateless or stateful.

If the rule group is stateless, it contains
stateless rules. If it is stateful, it contains stateful rules.

type

An object that defines the rule group rules.

ruleGroup

A complex type containing the currently selected rule option fields that will be displayed for rule summarization returned by `DescribeRuleGroupSummary` .

- The `RuleOptions` specified in `SummaryConfiguration`
- Rule metadata organization preferences

summaryConfiguration

The object that defines a TLS inspection configuration.

AWS Network Firewall uses a TLS inspection configuration to decrypt traffic. Network Firewall re-encrypts the traffic before sending it to its destination.

To use a TLS inspection configuration, you add it to a new Network Firewall firewall policy, then you apply the firewall policy to a firewall. Network Firewall acts as a proxy service to decrypt and inspect the traffic traveling through your firewalls. You can reference a TLS inspection configuration from more than one firewall policy, and you can use a firewall policy in more than one firewall. For more information about using TLS inspection configurations, see [Inspecting SSL/TLS traffic with TLS inspection configurations](https://docs.aws.amazon.com/network-firewall/latest/developerguide/tls-inspection.html) in the *AWS Network Firewall Developer Guide* .

CfnTLSInspectionConfiguration

The object that defines a TLS inspection configuration.

AWS Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, AWS Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using Certificate Manager , create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. For more information about using TLS inspection configurations, see [Inspecting SSL/TLS traffic with TLS inspection configurations](https://docs.aws.amazon.com/network-firewall/latest/developerguide/tls-inspection.html) in the *AWS Network Firewall Developer Guide* .

tlsInspectionConfiguration

The descriptive name of the TLS inspection configuration.

You can't change the name of a TLS inspection configuration after you create it.

tlsInspectionConfigurationName

A description of the TLS inspection configuration.

The key:value pairs to associate with the resource.

A VPC endpoint association defines a single subnet to use for a firewall endpoint for a `Firewall` .

You can define VPC endpoint associations only in the Availability Zones that already have a subnet mapping defined in the `Firewall` resource.

> You can retrieve the list of Availability Zones that are available for use by calling `DescribeFirewallMetadata` .

To manage firewall endpoints, first, in the `Firewall` specification, you specify a single VPC and one subnet for each of the Availability Zones where you want to use the firewall. Then you can define additional endpoints as VPC endpoint associations.

You can use VPC endpoint associations to expand the protections of the firewall as follows:

- *Protect multiple VPCs with a single firewall* - You can use the firewall to protect other VPCs, either in your account or in accounts where the firewall is shared. You can only specify Availability Zones that already have a firewall endpoint defined in the `Firewall` subnet mappings.
- *Define multiple firewall endpoints for a VPC in an Availability Zone* - You can create additional firewall endpoints for the VPC that you have defined in the firewall, in any Availability Zone that already has an endpoint defined in the `Firewall` subnet mappings. You can create multiple VPC endpoint associations for any other VPC where you use the firewall.

You can use AWS Resource Access Manager to share a `Firewall` that you own with other accounts, which gives them the ability to use the firewall to create VPC endpoint associations. For information about sharing a firewall, see `PutResourcePolicy` in this guide and see [Sharing Network Firewall resources](https://docs.aws.amazon.com/network-firewall/latest/developerguide/sharing.html) in the *AWS Network Firewall Developer Guide* .

The status of the VPC endpoint association, which indicates whether it's ready to filter network traffic, is provided in the corresponding VPC endpoint association status. You can retrieve both the association and its status by calling `DescribeVpcEndpointAssociation` .

CfnVpcEndpointAssociation

The Amazon Resource Name (ARN) of the firewall.

The ID for a subnet that's used in an association with a firewall.

This is used in `CreateFirewall` , `AssociateSubnets` , and `CreateVpcEndpointAssociation` . AWS Network Firewall creates an instance of the associated firewall in each subnet that you specify, to filter traffic in the subnet's Availability Zone.

subnetMapping

The unique identifier of the VPC for the endpoint association.

A description of the VPC endpoint association.

AWS networkfirewall

L1 Constructs6

CfnFirewall

CfnFirewallPolicy

CfnLoggingConfiguration

CfnRuleGroup

CfnTLSInspectionConfiguration

CfnVpcEndpointAssociation

Learn AWS the Practical Way

Quick Facts

Related Links

More AWS networkfirewall deep dives