firewalls

Creates, updates, deletes or gets a firewall resource or lists firewalls in a region

Overview

Name	firewalls
Type	Resource
Description	Resource type definition for AWS::NetworkFirewall::Firewall
Id	awscc.networkfirewall.firewalls

Fields

get (all properties)

Name	Datatype	Description
firewall_name	string
firewall_arn	string	A resource ARN.
firewall_id	string
vpc_id	string
▶subnet_mappings	array
▶availability_zone_mappings	array
delete_protection	boolean
subnet_change_protection	boolean
availability_zone_change_protection	boolean
firewall_policy_change_protection	boolean
transit_gateway_id	string
description	string
endpoint_ids	array
enabled_analysis_types	array	The types of analysis to enable for the firewall. Can be TLS_SNI, HTTP_HOST, or both.
▶tags	array
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
firewall_arn	string	A resource ARN.
region	string	AWS region.

For more information, see AWS::NetworkFirewall::Firewall.

Methods

Name	Resource	Accessible by	Required Params
create_resource	firewalls	INSERT	FirewallName, FirewallPolicyArn, region
delete_resource	firewalls	DELETE	Identifier, region
update_resource	firewalls	UPDATE	Identifier, PatchDocument, region
list_resources	firewalls_list_only	SELECT	region
get_resource	firewalls	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual firewall.

SELECT
  region,
  firewall_name,
  firewall_arn,
  firewall_id,
  firewall_policy_arn,
  vpc_id,
  subnet_mappings,
  availability_zone_mappings,
  delete_protection,
  subnet_change_protection,
  availability_zone_change_protection,
  firewall_policy_change_protection,
  transit_gateway_id,
  description,
  endpoint_ids,
  enabled_analysis_types,
  tags
FROM awscc.networkfirewall.firewalls
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ firewall_arn }}';

list (identifiers only)

Lists all firewalls in a region.

SELECT
  region,
  firewall_arn
FROM awscc.networkfirewall.firewalls_list_only
WHERE
  region = 'us-east-1';

INSERT example

Use the following StackQL query and manifest file to create a new firewall resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.networkfirewall.firewalls (
  FirewallName,
  FirewallPolicyArn,
  region
)
SELECT
  '{{ firewall_name }}',
  '{{ firewall_policy_arn }}',
  '{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.networkfirewall.firewalls (
  FirewallName,
  FirewallPolicyArn,
  VpcId,
  SubnetMappings,
  AvailabilityZoneMappings,
  DeleteProtection,
  SubnetChangeProtection,
  AvailabilityZoneChangeProtection,
  FirewallPolicyChangeProtection,
  TransitGatewayId,
  Description,
  EnabledAnalysisTypes,
  Tags,
  region
)
SELECT
  '{{ firewall_name }}',
  '{{ firewall_policy_arn }}',
  '{{ vpc_id }}',
  '{{ subnet_mappings }}',
  '{{ availability_zone_mappings }}',
  '{{ delete_protection }}',
  '{{ subnet_change_protection }}',
  '{{ availability_zone_change_protection }}',
  '{{ firewall_policy_change_protection }}',
  '{{ transit_gateway_id }}',
  '{{ description }}',
  '{{ enabled_analysis_types }}',
  '{{ tags }}',
  '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: firewall
    props:
      - name: firewall_name
        value: '{{ firewall_name }}'
      - name: firewall_policy_arn
        value: '{{ firewall_policy_arn }}'
      - name: vpc_id
        value: '{{ vpc_id }}'
      - name: subnet_mappings
        value:
          - subnet_id: '{{ subnet_id }}'
            ip_address_type: '{{ ip_address_type }}'
      - name: availability_zone_mappings
        value:
          - availability_zone: '{{ availability_zone }}'
      - name: delete_protection
        value: '{{ delete_protection }}'
      - name: subnet_change_protection
        value: '{{ subnet_change_protection }}'
      - name: availability_zone_change_protection
        value: '{{ availability_zone_change_protection }}'
      - name: firewall_policy_change_protection
        value: '{{ firewall_policy_change_protection }}'
      - name: transit_gateway_id
        value: '{{ transit_gateway_id }}'
      - name: description
        value: '{{ description }}'
      - name: enabled_analysis_types
        value:
          - '{{ enabled_analysis_types[0] }}'
      - name: tags
        value:
          - key: '{{ key }}'
            value: '{{ value }}'

UPDATE example

Use the following StackQL query and manifest file to update a firewall resource, using stack-deploy.

/*+ update */
UPDATE awscc.networkfirewall.firewalls
SET PatchDocument = string('{{ {
    "FirewallPolicyArn": firewall_policy_arn,
    "SubnetMappings": subnet_mappings,
    "AvailabilityZoneMappings": availability_zone_mappings,
    "DeleteProtection": delete_protection,
    "SubnetChangeProtection": subnet_change_protection,
    "AvailabilityZoneChangeProtection": availability_zone_change_protection,
    "FirewallPolicyChangeProtection": firewall_policy_change_protection,
    "TransitGatewayId": transit_gateway_id,
    "Description": description,
    "EnabledAnalysisTypes": enabled_analysis_types,
    "Tags": tags
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ firewall_arn }}';

DELETE example

/*+ delete */
DELETE FROM awscc.networkfirewall.firewalls
WHERE
  Identifier = '{{ firewall_arn }}' AND
  region = 'us-east-1';

Permissions

To operate on the firewalls resource, the following permissions are required:

Create

ec2:CreateVpcEndpoint,
ec2:DescribeVpcEndpoints,
ec2:DescribeSubnets,
ec2:DescribeVpcs,
iam:CreateServiceLinkedRole,
network-firewall:CreateFirewall,
network-firewall:DescribeFirewallPolicy,
network-firewall:DescribeRuleGroup,
network-firewall:TagResource,
network-firewall:AssociateSubnets,
network-firewall:AssociateAvailabilityZones,
network-firewall:AssociateFirewallPolicy,
network-firewall:DescribeFirewall

Read

network-firewall:DescribeFirewall,
network-firewall:ListTagsForResource

Update

network-firewall:AssociateSubnets,
network-firewall:DisassociateSubnets,
network-firewall:UpdateFirewallDescription,
network-firewall:UpdateFirewallDeleteProtection,
network-firewall:UpdateSubnetChangeProtection,
network-firewall:UpdateFirewallPolicyChangeProtection,
network-firewall:AssociateFirewallPolicy,
network-firewall:TagResource,
network-firewall:UntagResource,
network-firewall:DescribeFirewall,
network-firewall:UpdateFirewallAnalysisSettings,
network-firewall:DisassociateAvailabilityZones,
network-firewall:AssociateAvailabilityZones,
network-firewall:UpdateAvailabilityZoneChangeProtection

Delete

ec2:DeleteVpcEndpoints,
ec2:DescribeRouteTables,
logs:DescribeLogGroups,
logs:DescribeResourcePolicies,
logs:GetLogDelivery,
logs:ListLogDeliveries,
network-firewall:DeleteFirewall,
network-firewall:UntagResource,
network-firewall:DescribeFirewall

List

network-firewall:ListFirewalls