firewall_policies

Creates, updates, deletes, gets or lists a firewall_policies resource.

Overview

Name	firewall_policies
Type	Resource
Id	aws.network_firewall.firewall_policies

Fields

The following fields are returned by SELECT queries:

describe_firewall_policy

Name	Datatype	Description
firewall_policy	object	The policy for the specified firewall policy.
firewall_policy_response	object	The high-level properties of a firewall policy. This, along with the FirewallPolicy, define the policy. You can retrieve all objects for a firewall policy by calling DescribeFirewallPolicy.
update_token	string	A token used for optimistic locking. Network Firewall returns a token to your requests that access the firewall policy. The token marks the state of the policy resource at the time of the request. To make changes to the policy, you provide the token in your request. Network Firewall uses the token to ensure that the policy hasn't changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the firewall policy again to get a current copy of it with current token. Reapply your changes as needed, then try the operation again using the new token. (pattern: <code>^([0-9a-f]{8})-([0-9a-f]{4}-){3}([0-9a-f]{12})$</code>)

list_firewall_policies

Name	Datatype	Description
arn	string	The Amazon Resource Name (ARN) of the firewall policy. (pattern: <code>^arn:aws.*</code>)
name	string	The descriptive name of the firewall policy. You can't change the name of a firewall policy after you create it. (pattern: <code>^[a-zA-Z0-9-]+$</code>)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
describe_firewall_policy	select	region		Returns the data objects for the specified firewall policy.
list_firewall_policies	select	region		Retrieves the metadata for the firewall policies that you have defined. Depending on your setting for max results and the number of firewall policies, a single call might not return the full list.
create_firewall_policy	insert	region, FirewallPolicyName, FirewallPolicy		Creates the firewall policy for the firewall according to the specifications. An Network Firewall firewall policy defines the behavior of a firewall, in a collection of stateless and stateful rule groups and other settings. You can use one firewall policy for multiple firewalls.
update_firewall_policy	update	region, UpdateToken, FirewallPolicy		Updates the properties of the specified firewall policy.
associate_firewall_policy	update	region, FirewallPolicyArn		Associates a FirewallPolicy to a Firewall. A firewall policy defines how to monitor and manage your VPC network traffic, using a collection of inspection rule groups and other settings. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.
update_firewall_policy_change_protection	update	region, FirewallPolicyChangeProtection		Modifies the flag, ChangeProtection, which indicates whether it is possible to change the firewall. If the flag is set to TRUE, the firewall is protected from changes. This setting helps protect against accidentally changing a firewall that's in use.
delete_firewall_policy	delete	region		Deletes the specified FirewallPolicy.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
region	string	AWS region (default: us-east-1)

SELECT examples

describe_firewall_policy

Returns the data objects for the specified firewall policy.

SELECT
firewall_policy,
firewall_policy_response,
update_token
FROM aws.network_firewall.firewall_policies
WHERE region = '{{ region }}' -- required
;

list_firewall_policies

Retrieves the metadata for the firewall policies that you have defined. Depending on your setting for max results and the number of firewall policies, a single call might not return the full list.

SELECT
arn,
name
FROM aws.network_firewall.firewall_policies
WHERE region = '{{ region }}' -- required
;

INSERT examples

create_firewall_policy

Creates the firewall policy for the firewall according to the specifications. An Network Firewall firewall policy defines the behavior of a firewall, in a collection of stateless and stateful rule groups and other settings. You can use one firewall policy for multiple firewalls.

INSERT INTO aws.network_firewall.firewall_policies (
FirewallPolicyName,
FirewallPolicy,
Description,
Tags,
DryRun,
EncryptionConfiguration,
region
)
SELECT 
'{{ FirewallPolicyName }}' /* required */,
'{{ FirewallPolicy }}' /* required */,
'{{ Description }}',
'{{ Tags }}',
{{ DryRun }},
'{{ EncryptionConfiguration }}',
'{{ region }}'
RETURNING
firewall_policy_response,
update_token
;

Manifest

# Description fields are for documentation purposes
- name: firewall_policies
props:
  - name: region
    value: "{{ region }}"
    description: Required parameter for the firewall_policies resource.
  - name: FirewallPolicyName
    value: "{{ FirewallPolicyName }}"
    description: |
      The descriptive name of the firewall policy. You can't change the name of a firewall policy after you create it.
  - name: FirewallPolicy
    description: |
      The rule groups and policy actions to use in the firewall policy.
    value:
      StatelessRuleGroupReferences:
        - ResourceArn: "{{ ResourceArn }}"
          Priority: {{ Priority }}
      StatelessDefaultActions:
        - "{{ StatelessDefaultActions }}"
      StatelessFragmentDefaultActions:
        - "{{ StatelessFragmentDefaultActions }}"
      StatelessCustomActions:
        - ActionName: "{{ ActionName }}"
          ActionDefinition:
            PublishMetricAction:
              Dimensions:
                - Value: "{{ Value }}"
      StatefulRuleGroupReferences:
        - ResourceArn: "{{ ResourceArn }}"
          Priority: {{ Priority }}
          Override:
            Action: "{{ Action }}"
          DeepThreatInspection: {{ DeepThreatInspection }}
      StatefulDefaultActions:
        - "{{ StatefulDefaultActions }}"
      StatefulEngineOptions:
        RuleOrder: "{{ RuleOrder }}"
        StreamExceptionPolicy: "{{ StreamExceptionPolicy }}"
        FlowTimeouts:
          TcpIdleTimeoutSeconds: {{ TcpIdleTimeoutSeconds }}
      TLSInspectionConfigurationArn: "{{ TLSInspectionConfigurationArn }}"
      PolicyVariables:
        RuleVariables: "{{ RuleVariables }}"
      EnableTLSSessionHolding: {{ EnableTLSSessionHolding }}
  - name: Description
    value: "{{ Description }}"
    description: |
      A description of the firewall policy.
  - name: Tags
    description: |
      The key:value pairs to associate with the resource.
    value:
      - Key: "{{ Key }}"
        Value: "{{ Value }}"
  - name: DryRun
    value: {{ DryRun }}
    description: |
      Indicates whether you want Network Firewall to just check the validity of the request, rather than run the request. If set to TRUE, Network Firewall checks whether the request can run successfully, but doesn't actually make the requested changes. The call returns the value that the request would return if you ran it with dry run set to FALSE, but doesn't make additions or changes to your resources. This option allows you to make sure that you have the required permissions to run the request and that your request parameters are valid. If set to FALSE, Network Firewall makes the requested changes to your resources.
  - name: EncryptionConfiguration
    description: |
      A complex type that contains settings for encryption of your firewall policy resources.
    value:
      KeyId: "{{ KeyId }}"
      Type: "{{ Type }}"

UPDATE examples

update_firewall_policy

Updates the properties of the specified firewall policy.

UPDATE aws.network_firewall.firewall_policies
SET 
UpdateToken = '{{ UpdateToken }}',
FirewallPolicyArn = '{{ FirewallPolicyArn }}',
FirewallPolicyName = '{{ FirewallPolicyName }}',
FirewallPolicy = '{{ FirewallPolicy }}',
Description = '{{ Description }}',
DryRun = {{ DryRun }},
EncryptionConfiguration = '{{ EncryptionConfiguration }}'
WHERE 
region = '{{ region }}' --required
AND UpdateToken = '{{ UpdateToken }}' --required
AND FirewallPolicy = '{{ FirewallPolicy }}' --required
RETURNING
firewall_policy_response,
update_token;

associate_firewall_policy

Associates a FirewallPolicy to a Firewall. A firewall policy defines how to monitor and manage your VPC network traffic, using a collection of inspection rule groups and other settings. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.

UPDATE aws.network_firewall.firewall_policies
SET 
UpdateToken = '{{ UpdateToken }}',
FirewallArn = '{{ FirewallArn }}',
FirewallName = '{{ FirewallName }}',
FirewallPolicyArn = '{{ FirewallPolicyArn }}'
WHERE 
region = '{{ region }}' --required
AND FirewallPolicyArn = '{{ FirewallPolicyArn }}' --required
RETURNING
firewall_arn,
firewall_name,
firewall_policy_arn,
update_token;

update_firewall_policy_change_protection

Modifies the flag, ChangeProtection, which indicates whether it is possible to change the firewall. If the flag is set to TRUE, the firewall is protected from changes. This setting helps protect against accidentally changing a firewall that's in use.

UPDATE aws.network_firewall.firewall_policies
SET 
UpdateToken = '{{ UpdateToken }}',
FirewallArn = '{{ FirewallArn }}',
FirewallName = '{{ FirewallName }}',
FirewallPolicyChangeProtection = {{ FirewallPolicyChangeProtection }}
WHERE 
region = '{{ region }}' --required
AND FirewallPolicyChangeProtection = {{ FirewallPolicyChangeProtection }} --required
RETURNING
firewall_arn,
firewall_name,
firewall_policy_change_protection,
update_token;

DELETE examples

delete_firewall_policy

Deletes the specified FirewallPolicy.

DELETE FROM aws.network_firewall.firewall_policies
WHERE region = '{{ region }}' --required
;