AWS CLI Command Reference

[ aws . network-firewall ]

delete-firewall-policy

Description

Deletes the specified FirewallPolicy .

See also: AWS API Documentation

Synopsis

  delete-firewall-policy
[--firewall-policy-name <value>]
[--firewall-policy-arn <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]
[--cli-error-format <value>]

Options

--firewall-policy-name (string)

The descriptive name of the firewall policy. You can’t change the name of a firewall policy after you create it.

You must specify the ARN or the name, and you can specify both.

Constraints:

  • min: 1
  • max: 128
  • pattern: ^[a-zA-Z0-9-]+$

--firewall-policy-arn (string)

The Amazon Resource Name (ARN) of the firewall policy.

You must specify the ARN or the name, and you can specify both.

Constraints:

  • min: 1
  • max: 256
  • pattern: ^arn:aws.*

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

Global Options

--debug (boolean)

Turn on debug logging.

--endpoint-url (string)

Override command’s default URL with the given URL.

--no-verify-ssl (boolean)

By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.

--no-paginate (boolean)

Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.

--output (string)

The formatting style for command output.

  • json
  • text
  • table
  • yaml
  • yaml-stream
  • off

--query (string)

A JMESPath query to use in filtering the response data.

--profile (string)

Use a specific profile from your credential file.

--region (string)

The region to use. Overrides config/env settings.

--version (string)

Display the version of this tool.

--color (string)

Turn on/off color output.

  • on
  • off
  • auto

--no-sign-request (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

--ca-bundle (string)

The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.

--cli-read-timeout (int)

The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.

--cli-connect-timeout (int)

The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.

--cli-binary-format (string)

The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob fileb:// will always be treated as binary and use the file contents directly regardless of the cli-binary-format setting. When using file:// the file contents will need to properly formatted for the configured cli-binary-format.

  • base64
  • raw-in-base64-out

--no-cli-pager (boolean)

Disable cli pager for output.

--cli-auto-prompt (boolean)

Automatically prompt for CLI input parameters.

--no-cli-auto-prompt (boolean)

Disable automatically prompt for CLI input parameters.

--cli-error-format (string)

The formatting style for error output. By default, errors are displayed in enhanced format.

  • legacy
  • json
  • yaml
  • text
  • table
  • enhanced

Output

FirewallPolicyResponse -> (structure)

The object containing the definition of the FirewallPolicyResponse that you asked to delete.

FirewallPolicyName -> (string) [required]

The descriptive name of the firewall policy. You can’t change the name of a firewall policy after you create it.

Constraints:

  • min: 1
  • max: 128
  • pattern: ^[a-zA-Z0-9-]+$

FirewallPolicyArn -> (string) [required]

The Amazon Resource Name (ARN) of the firewall policy.

Note

If this response is for a create request that had DryRun set to TRUE , then this ARN is a placeholder that isn’t attached to a valid resource.

Constraints:

  • min: 1
  • max: 256
  • pattern: ^arn:aws.*

FirewallPolicyId -> (string) [required]

The unique identifier for the firewall policy.

Constraints:

  • min: 36
  • max: 36
  • pattern: ^([0-9a-f]{8})-([0-9a-f]{4}-){3}([0-9a-f]{12})$

Description -> (string)

A description of the firewall policy.

Constraints:

  • max: 512
  • pattern: ^.*$

FirewallPolicyStatus -> (string)

The current status of the firewall policy. You can retrieve this for a firewall policy by calling DescribeFirewallPolicy and providing the firewall policy’s name or ARN.

Possible values:

  • ACTIVE
  • DELETING
  • ERROR
  • UPDATING

StatusMessage -> (string)

Additional detail about the firewall policy’s current status, when applicable. For example, while an Amazon Route 53 Resolver DNS Firewall rule group change is in progress, the status is UPDATING and this message is “A DNS Firewall rule group change is in progress.”

Constraints:

  • min: 1
  • max: 8192

Tags -> (list)

The key:value pairs to associate with the resource.

Constraints:

  • min: 1
  • max: 200

(structure)

A key:value pair associated with an Amazon Web Services resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as “environment”) and the tag value represents a specific value within that category (such as “test,” “development,” or “production”). You can add up to 50 tags to each Amazon Web Services resource.

Key -> (string) [required]

The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as “customer.” Tag keys are case-sensitive.

Constraints:

  • min: 1
  • max: 128
  • pattern: ^.*$

Value -> (string) [required]

The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as “companyA” or “companyB.” Tag values are case-sensitive.

Constraints:

  • min: 0
  • max: 256
  • pattern: ^.*$

ConsumedStatelessRuleCapacity -> (integer)

The number of capacity units currently consumed by the policy’s stateless rules.

ConsumedStatefulRuleCapacity -> (integer)

The number of capacity units currently consumed by the policy’s stateful rules.

ConsumedStatefulDomainCapacity -> (integer)

The total number of domain name specifications across all domain list rule groups in the firewall policy that use the stateful-domain-rulegroup resource type.

NumberOfAssociations -> (integer)

The number of firewalls that are associated with this firewall policy.

EncryptionConfiguration -> (structure)

A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall policy.

KeyId -> (string)

The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you’re using a key that’s managed by another account. If you’re using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide .

Constraints:

  • min: 1
  • max: 2048
  • pattern: .*\S.*

Type -> (string) [required]

The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.

Possible values:

  • CUSTOMER_KMS
  • AWS_OWNED_KMS_KEY

Errors -> (list)

Any configuration errors that apply to the firewall policy. Network Firewall detects these errors asynchronously, after you create or update the policy, so an error can appear after the request that caused it has already succeeded. Each entry describes the problem and how to resolve it, and Network Firewall clears it automatically after you resolve the problem.

Constraints:

  • min: 0
  • max: 10

(structure)

A configuration error that Network Firewall detected for a firewall policy.

Code -> (string) [required]

The error code identifies the type of error. Valid values are the following:

  • DNS_FIREWALL_RULE_GROUP_UNAVAILABLE – The Amazon Route 53 Resolver DNS Firewall rule group that resolved IP validation references is unavailable, for example, because it was deleted or is no longer accessible from your account. Update the rule group ID or remove the resolved IP validation configuration.
  • ROUTE53_RESOLVED_IP_VALIDATION_MISSING – An associated stateful rule group uses the aws_route_53_resolved_domain keyword, but the policy doesn’t have resolved IP validation configured. The affected rules are inactive until you add resolved IP validation to the policy or remove the keyword rules.

Possible values:

  • DNS_FIREWALL_RULE_GROUP_UNAVAILABLE
  • ROUTE53_RESOLVED_IP_VALIDATION_MISSING

Message -> (string) [required]

A description of the error and how to resolve it.

Constraints:

  • min: 1
  • max: 256
  • pattern: ^[a-zA-Z0-9- ]+$

ResourceId -> (string)

The ID of the resource that the error relates to, when applicable. For example, for DNS_FIREWALL_RULE_GROUP_UNAVAILABLE this is the Amazon Route 53 Resolver DNS Firewall rule group ID.

Constraints:

  • min: 1
  • max: 2048
  • pattern: ^[a-zA-Z0-9:/_.-]+$

LastModifiedTime -> (timestamp)

The last time that the firewall policy was changed.
© Copyright 2026, Amazon Web Services. Created using Sphinx.