<a id="cli-aws-network-firewall-update-proxy-settings"></a>

# update-proxy-settings

## Description

Modifies the proxy settings of a proxy mode firewall. Use this operation to change the ports and protocols on which the firewall’s proxy listens for traffic. The new listeners take effect without recreating the firewall.

The `ProxySettings` that you provide replace the firewall’s current proxy settings. If you created the firewall with your own `CertificateArn` and `DomainName` , you must specify the same values in every request. You can’t change or remove them.

See also: [AWS API Documentation](https://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/UpdateProxySettings)

## Synopsis

```
  update-proxy-settings
[--firewall-arn <value>]
[--firewall-name <value>]
[--update-token <value>]
[--proxy-settings <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]
[--cli-error-format <value>]
[--help]
```

## Options

`--firewall-arn` (string)

> The Amazon Resource Name (ARN) of the firewall.

> You must specify the ARN or the name, and you can specify both.

> Constraints:

> * min: `1`
> * max: `256`
> * pattern: `^arn:aws.*`

`--firewall-name` (string)

> The descriptive name of the firewall. You can’t change the name of a firewall after you create it.

> You must specify the ARN or the name, and you can specify both.

> Constraints:

> * min: `1`
> * max: `128`
> * pattern: `^[a-zA-Z0-9-]+$`

`--update-token` (string)

> An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request.

> To make an unconditional change to the firewall, omit the token in your update request. Without the token, Network Firewall performs your updates regardless of whether the firewall has changed since you last retrieved it.

> To make a conditional change to the firewall, provide the token in your update request. Network Firewall uses the token to ensure that the firewall hasn’t changed since you last retrieved it. If it has changed, the operation fails with an `InvalidTokenException` . If this happens, retrieve the firewall again to get a current copy of it with a new token. Reapply your changes as needed, then try the operation again using the new token.

> Constraints:

> * min: `1`
> * max: `1024`
> * pattern: `^([0-9a-f]{8})-([0-9a-f]{4}-){3}([0-9a-f]{12})$`

`--proxy-settings` (structure)

> The proxy settings to set on the firewall. These replace the current proxy settings. Specify at least one listener, and at most one HTTP listener and one HTTPS listener, on different ports. If the firewall uses your own `CertificateArn` and `DomainName` , specify the same values that you used to create the firewall.

> ListenerProperties -> (list) [required]

> > The listeners of the firewall’s proxy. Specify at least one listener, and at most one HTTP listener and one HTTPS listener. Each listener needs a port from 1 to 65535, and the two listeners must use different ports.

> > If you don’t specify listeners when you create the firewall, the firewall listens for HTTP on port 3128 and HTTPS on port 8443.

> > (structure)

> > > Open port for taking HTTP or HTTPS traffic.

> > > Port -> (integer)

> > > > Port for processing traffic.

> > > Type -> (string)

> > > > Selection of HTTP or HTTPS traffic.

> > > > Possible values:

> > > > * `HTTP`
> > > > * `HTTPS`

> CertificateArn -> (string)

> > The Amazon Resource Name (ARN) of the certificate that the firewall’s HTTPS proxy listener presents to clients. The certificate must be an Certificate Manager (ACM) certificate in the same account and Region as the firewall. Its subject alternative names must cover `DomainName` , either exactly or with a wildcard that matches exactly one label. For example, `*.example.com` covers `proxy.example.com` . If you don’t specify this, Network Firewall uses a certificate that it manages for a domain name that it generates.

> > You manage and renew the certificate in ACM, and Network Firewall uses renewed certificates automatically. While the firewall uses the certificate, you can’t delete it from ACM. Your clients must trust the certificate’s certificate authority.

> > If you specify `CertificateArn` , you must also specify `DomainName` . You can set them only when you create the firewall. When you call `UpdateProxySettings` , specify the same values.

> > Constraints:

> > * min: `1`
> > * max: `256`
> > * pattern: `^arn:aws.*`

> DomainName -> (string)

> > The domain name that your clients use to reach the firewall’s proxy. The name must have at least two labels and at most 253 characters. It can’t contain a wildcard or use the `proxy-*id* .nfw.*region* .amazonaws.com` format, and the certificate in `CertificateArn` must cover it. If you don’t specify this, Network Firewall generates a domain name.

> > Network Firewall creates the Route 53 private hosted zones that resolve this name to the firewall endpoints, so you don’t need to configure DNS. A VPC can have only one private hosted zone with a given name. If a VPC that the firewall serves already has one with this name, Network Firewall can’t set up the Availability Zones in that VPC.

> > If you specify `DomainName` , you must also specify `CertificateArn` . You can set them only when you create the firewall. When you call `UpdateProxySettings` , specify the same values.

> > Constraints:

> > * min: `1`
> > * max: `253`
> > * pattern: `^[A-Za-z0-9][A-Za-z0-9.-]*$`

Shorthand Syntax:

```
ListenerProperties=[{Port=integer,Type=string},{Port=integer,Type=string}],CertificateArn=string,DomainName=string
```

JSON Syntax:

```json
{
  "ListenerProperties": [
    {
      "Port": integer,
      "Type": "HTTP"|"HTTPS"
    }
    ...
  ],
  "CertificateArn": "string",
  "DomainName": "string"
}
```

`--cli-input-json` | `--cli-input-yaml` (string)
Reads arguments from the JSON string provided. The JSON string follows the format provided by `--generate-cli-skeleton`. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with `--cli-input-yaml`.

`--generate-cli-skeleton` (string)
Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value `input`, prints a sample input JSON that can be used as an argument for `--cli-input-json`. Similarly, if provided `yaml-input` it will print a sample input YAML that can be used with `--cli-input-yaml`. If provided with the value `output`, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

## Global Options

`--debug` (boolean)

Turn on debug logging.

`--endpoint-url` (string)

Override command’s default URL with the given URL.

`--no-verify-ssl` (boolean)

By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.

`--no-paginate` (boolean)

Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.

`--output` (string)

The formatting style for command output.

* json
* text
* table
* yaml
* yaml-stream
* off

`--query` (string)

A JMESPath query to use in filtering the response data.

`--profile` (string)

Use a specific profile from your credential file.

`--region` (string)

The region to use. Overrides config/env settings.

`--version` (string)

Display the version of this tool.

`--color` (string)

Turn on/off color output.

* on
* off
* auto

`--no-sign-request` (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

`--ca-bundle` (string)

The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.

`--cli-read-timeout` (int)

The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.

`--cli-connect-timeout` (int)

The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.

`--cli-binary-format` (string)

The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob `fileb://` will always be treated as binary and use the file contents directly regardless of the `cli-binary-format` setting. When using `file://` the file contents will need to properly formatted for the configured `cli-binary-format`.

* base64
* raw-in-base64-out

`--no-cli-pager` (boolean)

Disable cli pager for output.

`--cli-auto-prompt` (boolean)

Automatically prompt for CLI input parameters.

`--no-cli-auto-prompt` (boolean)

Disable automatically prompt for CLI input parameters.

`--cli-error-format` (string)

The formatting style for error output. By default, errors are displayed in enhanced format.

* legacy
* json
* yaml
* text
* table
* enhanced

`--help` (boolean)

Display help for the command/subcommand.

## Output

FirewallArn -> (string)

> The Amazon Resource Name (ARN) of the firewall.

> Constraints:

> * min: `1`
> * max: `256`
> * pattern: `^arn:aws.*`

FirewallName -> (string)

> The descriptive name of the firewall. You can’t change the name of a firewall after you create it.

> Constraints:

> * min: `1`
> * max: `128`
> * pattern: `^[a-zA-Z0-9-]+$`

UpdateToken -> (string)

> An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request.

> To make an unconditional change to the firewall, omit the token in your update request. Without the token, Network Firewall performs your updates regardless of whether the firewall has changed since you last retrieved it.

> To make a conditional change to the firewall, provide the token in your update request. Network Firewall uses the token to ensure that the firewall hasn’t changed since you last retrieved it. If it has changed, the operation fails with an `InvalidTokenException` . If this happens, retrieve the firewall again to get a current copy of it with a new token. Reapply your changes as needed, then try the operation again using the new token.

> Constraints:

> * min: `1`
> * max: `1024`
> * pattern: `^([0-9a-f]{8})-([0-9a-f]{4}-){3}([0-9a-f]{12})$`

ProxySettings -> (structure)

> The updated proxy settings for the firewall.

> ListenerProperties -> (list) [required]

> > The listeners of the firewall’s proxy. Specify at least one listener, and at most one HTTP listener and one HTTPS listener. Each listener needs a port from 1 to 65535, and the two listeners must use different ports.

> > If you don’t specify listeners when you create the firewall, the firewall listens for HTTP on port 3128 and HTTPS on port 8443.

> > (structure)

> > > Open port for taking HTTP or HTTPS traffic.

> > > Port -> (integer)

> > > > Port for processing traffic.

> > > Type -> (string)

> > > > Selection of HTTP or HTTPS traffic.

> > > > Possible values:

> > > > * `HTTP`
> > > > * `HTTPS`

> CertificateArn -> (string)

> > The Amazon Resource Name (ARN) of the certificate that the firewall’s HTTPS proxy listener presents to clients. The certificate must be an Certificate Manager (ACM) certificate in the same account and Region as the firewall. Its subject alternative names must cover `DomainName` , either exactly or with a wildcard that matches exactly one label. For example, `*.example.com` covers `proxy.example.com` . If you don’t specify this, Network Firewall uses a certificate that it manages for a domain name that it generates.

> > You manage and renew the certificate in ACM, and Network Firewall uses renewed certificates automatically. While the firewall uses the certificate, you can’t delete it from ACM. Your clients must trust the certificate’s certificate authority.

> > If you specify `CertificateArn` , you must also specify `DomainName` . You can set them only when you create the firewall. When you call `UpdateProxySettings` , specify the same values.

> > Constraints:

> > * min: `1`
> > * max: `256`
> > * pattern: `^arn:aws.*`

> DomainName -> (string)

> > The domain name that your clients use to reach the firewall’s proxy. The name must have at least two labels and at most 253 characters. It can’t contain a wildcard or use the `proxy-*id* .nfw.*region* .amazonaws.com` format, and the certificate in `CertificateArn` must cover it. If you don’t specify this, Network Firewall generates a domain name.

> > Network Firewall creates the Route 53 private hosted zones that resolve this name to the firewall endpoints, so you don’t need to configure DNS. A VPC can have only one private hosted zone with a given name. If a VPC that the firewall serves already has one with this name, Network Firewall can’t set up the Availability Zones in that VPC.

> > If you specify `DomainName` , you must also specify `CertificateArn` . You can set them only when you create the firewall. When you call `UpdateProxySettings` , specify the same values.

> > Constraints:

> > * min: `1`
> > * max: `253`
> > * pattern: `^[A-Za-z0-9][A-Za-z0-9.-]*$`