Class: Aws::NetworkFirewall::Types::Firewall

Inherits:
Struct
  • Object
show all
Defined in:
gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb

Overview

A firewall defines the behavior of a firewall, the main VPC where the firewall is used, the Availability Zones where the firewall can be used, and one subnet to use for a firewall endpoint within each of the Availability Zones. The Availability Zones are defined implicitly in the subnet specifications.

In addition to the firewall endpoints that you define in this Firewall specification, you can create firewall endpoints in VpcEndpointAssociation resources for any VPC, in any Availability Zone where the firewall is already in use.

The status of the firewall, for example whether it's ready to filter network traffic, is provided in the corresponding FirewallStatus. You can retrieve both the firewall and firewall status by calling DescribeFirewall.

See Also:

Constant Summary collapse

SENSITIVE = 
[]

Instance Attribute Summary collapse

Instance Attribute Details

#availability_zone_change_protection ⇒ Boolean

A setting indicating whether the firewall is protected against changes to its Availability Zone configuration. When set to TRUE, you must first disable this protection before adding or removing Availability Zones.

Returns:

  • (Boolean) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#availability_zone_mappings ⇒ Array<Types::AvailabilityZoneMapping>

The Availability Zones where the firewall endpoints are created for a transit gateway-attached firewall. Each mapping specifies an Availability Zone where the firewall processes traffic.

Returns:



3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#delete_protection ⇒ Boolean

A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE.

Returns:

  • (Boolean) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#description ⇒ String

A description of the firewall.

Returns:

  • (String) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#enabled_analysis_types ⇒ Array<String>

An optional setting indicating the specific traffic analysis types to enable on the firewall.

Returns:

  • (Array<String>) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#encryption_configuration ⇒ Types::EncryptionConfiguration

A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall.

Returns:



3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#firewall_arn ⇒ String

The Amazon Resource Name (ARN) of the firewall.

Returns:

  • (String) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#firewall_id ⇒ String

The unique identifier for the firewall.

Returns:

  • (String) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#firewall_name ⇒ String

The descriptive name of the firewall. You can't change the name of a firewall after you create it.

Returns:

  • (String) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#firewall_policy_arn ⇒ String

The Amazon Resource Name (ARN) of the firewall policy.

The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.

Returns:

  • (String) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#firewall_policy_change_protection ⇒ Boolean

A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

Returns:

  • (Boolean) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#number_of_associations ⇒ Integer

The number of VpcEndpointAssociation resources that use this firewall.

Returns:

  • (Integer) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#subnet_change_protection ⇒ Boolean

A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

Returns:

  • (Boolean) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#subnet_mappings ⇒ Array<Types::SubnetMapping>

The primary public subnets that Network Firewall is using for the firewall. Network Firewall creates a firewall endpoint in each subnet. Create a subnet mapping for each Availability Zone where you want to use the firewall.

These subnets are all defined for a single, primary VPC, and each must belong to a different Availability Zone. Each of these subnets establishes the availability of the firewall in its Availability Zone.

In addition to these subnets, you can define other endpoints for the firewall in VpcEndpointAssociation resources. You can define these additional endpoints for any VPC, and for any of the Availability Zones where the firewall resource already has a subnet mapping. VPC endpoint associations give you the ability to protect multiple VPCs using a single firewall, and to define multiple firewall endpoints for a VPC in a single Availability Zone.

Returns:



3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#tags ⇒ Array<Types::Tag>

Returns:



3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#transit_gateway_id ⇒ String

The unique identifier of the transit gateway associated with this firewall. This field is only present for transit gateway-attached firewalls.

Returns:

  • (String) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#transit_gateway_owner_account_id ⇒ String

The Amazon Web Services account ID that owns the transit gateway. This may be different from the firewall owner's account ID when using a shared transit gateway.

Returns:

  • (String) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end

#vpc_id ⇒ String

The unique identifier of the VPC where the firewall is in use.

Returns:

  • (String) 


3793
3794
3795
3796
3797
3798
3799
3800
3801
3802
3803
3804
3805
3806
3807
3808
3809
3810
3811
3812
3813
3814
 
# File 'gems/aws-sdk-networkfirewall/lib/aws-sdk-networkfirewall/types.rb', line 3793

class Firewall < Struct.new(
  :firewall_name,
  :firewall_arn,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :firewall_id,
  :tags,
  :encryption_configuration,
  :number_of_associations,
  :enabled_analysis_types,
  :transit_gateway_id,
  :transit_gateway_owner_account_id,
  :availability_zone_mappings,
  :availability_zone_change_protection)
  SENSITIVE = []
  include Aws::Structure
end