AWS Fundamentals Logo
AWS Fundamentals
L1 ConstructAWS::NetworkFirewall::Firewall

CfnFirewall

Use the firewall to provide stateful, managed, network firewall and intrusion detection and prevention filtering for your VPCs in Amazon VPC . The firewall defines the configuration settings for an AWS Network Firewall firewall. The settings include the firewall policy, the subnets in your VPC to use for the firewall endpoints, and any tags that are attached to the firewall AWS resource.

Import

import { CfnFirewall } from 'aws-cdk-lib/aws-networkfirewall';

Or use the module namespace:

import * as networkfirewall from 'aws-cdk-lib/aws-networkfirewall';
// networkfirewall.CfnFirewall

Properties

Configuration passed to the constructor as CfnFirewallProps.

firewallNameRequired
string

The descriptive name of the firewall. You can't change the name of a firewall after you create it.

firewallPolicyArnRequired
string | IFirewallPolicyRef

The Amazon Resource Name (ARN) of the firewall policy. The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.

availabilityZoneChangeProtectionOptional
boolean | IResolvable

A setting indicating whether the firewall is protected against changes to its Availability Zone configuration. When set to `TRUE` , you must first disable this protection before adding or removing Availability Zones.

availabilityZoneMappingsOptional
IResolvable | IResolvable | AvailabilityZoneMappingProperty[]

The Availability Zones where the firewall endpoints are created for a transit gateway-attached firewall. Each mapping specifies an Availability Zone where the firewall processes traffic.

deleteProtectionOptional
boolean | IResolvable

A flag indicating whether it is possible to delete the firewall. A setting of `TRUE` indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to `TRUE` .

descriptionOptional
string

A description of the firewall.

enabledAnalysisTypesOptional
string[]

An optional setting indicating the specific traffic analysis types to enable on the firewall.

firewallPolicyChangeProtectionOptional
boolean | IResolvable

A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to `TRUE` .

subnetChangeProtectionOptional
boolean | IResolvable

A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to `TRUE` .

subnetMappingsOptional
IResolvable | IResolvable | SubnetMappingProperty[]

The primary public subnets that Network Firewall is using for the firewall. Network Firewall creates a firewall endpoint in each subnet. Create a subnet mapping for each Availability Zone where you want to use the firewall. These subnets are all defined for a single, primary VPC, and each must belong to a different Availability Zone. Each of these subnets establishes the availability of the firewall in its Availability Zone. In addition to these subnets, you can define other endpoints for the firewall in `VpcEndpointAssociation` resources. You can define these additional endpoints for any VPC, and for any of the Availability Zones where the firewall resource already has a subnet mapping. VPC endpoint associations give you the ability to protect multiple VPCs using a single firewall, and to define multiple firewall endpoints for a VPC in a single Availability Zone.

tagsOptional
CfnTag[]

An array of key-value pairs to apply to this resource. For more information, see [Tag](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-resource-tags.html) .

transitGatewayIdOptional
string

The unique identifier of the transit gateway associated with this firewall. This field is only present for transit gateway-attached firewalls.

vpcIdOptional
string | IVPCRef

The unique identifier of the VPC where the firewall is in use. You can't change the VPC of a firewall after you create the firewall.

CloudFormation Resource

This L1 construct maps directly to the following CloudFormation resource type.

AWS::NetworkFirewall::FirewallView in CloudFormation Explorer

Learn AWS the Practical Way

Our bi-weekly newsletter teaches hands-on AWS fundamentals. No certification fluff - just practical knowledge.

Subscribe to Newsletter

Quick Facts

LevelL1 (CloudFormation)
Moduleaws-networkfirewall
CFN TypeAWS::NetworkFirewall::Firewall
Properties13

Related Constructs

Explore This Service

External Links