This is the new *CloudFormation Template Reference Guide*. Please update your bookmarks and links. For help getting started with CloudFormation, see the [AWS CloudFormation User Guide](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html). # AWS::NetworkFirewall::LoggingConfiguration Use the logging configuration to define the destinations and logging options for an firewall. You must change the logging configuration by changing one `LogDestinationConfig` setting at a time in your `LogDestinationConfigs`. You can make only one of the following changes to your logging configuration resource: + Create a new log destination object by adding a single `LogDestinationConfig` array element to `LogDestinationConfigs`. + Delete a log destination object by removing a single `LogDestinationConfig` array element from `LogDestinationConfigs`. + Change the `LogDestination` setting in a single `LogDestinationConfig` array element. You can't change the `LogDestinationType` or `LogType` in a `LogDestinationConfig`. To change these settings, delete the existing `LogDestinationConfig` object and create a new one, in two separate modifications. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "Type" : "AWS::NetworkFirewall::LoggingConfiguration", "Properties" : { "[EnableMonitoringDashboard](#cfn-networkfirewall-loggingconfiguration-enablemonitoringdashboard)" : Boolean, "[FirewallArn](#cfn-networkfirewall-loggingconfiguration-firewallarn)" : String, "[FirewallName](#cfn-networkfirewall-loggingconfiguration-firewallname)" : String, "[LoggingConfiguration](#cfn-networkfirewall-loggingconfiguration-loggingconfiguration)" : LoggingConfiguration } } ``` ### YAML ``` Type: AWS::NetworkFirewall::LoggingConfiguration Properties: [EnableMonitoringDashboard](#cfn-networkfirewall-loggingconfiguration-enablemonitoringdashboard): Boolean [FirewallArn](#cfn-networkfirewall-loggingconfiguration-firewallarn): String [FirewallName](#cfn-networkfirewall-loggingconfiguration-firewallname): String [LoggingConfiguration](#cfn-networkfirewall-loggingconfiguration-loggingconfiguration): LoggingConfiguration ``` ## Properties `EnableMonitoringDashboard` Property description not available. *Required*: No *Type*: Boolean *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `FirewallArn` The Amazon Resource Name (ARN) of the firewallthat the logging configuration is associated with. You can't change the firewall specification after you create the logging configuration. *Required*: Yes *Type*: String *Pattern*: `^arn:aws.*$` *Minimum*: `1` *Maximum*: `256` *Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) `FirewallName` The name of the firewall that the logging configuration is associated with. You can't change the firewall specification after you create the logging configuration. *Required*: No *Type*: String *Pattern*: `^[a-zA-Z0-9-]+$` *Minimum*: `1` *Maximum*: `128` *Update requires*: [Replacement](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-replacement) `LoggingConfiguration` Defines how AWS Network Firewall performs logging for a firewall. *Required*: Yes *Type*: [LoggingConfiguration](aws-properties-networkfirewall-loggingconfiguration-loggingconfiguration.md) *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) ## Return values ### Ref When you pass the logical ID of this resource to the intrinsic `Ref` function, `Ref` returns the Amazon Resource Name (ARN) of the firewall that the logging configuration is associated with. For example: `{ "Ref": "arn:aws:network-firewall:us-east-1:012345678901:firewall/myFirewallName" }` For more information about using the `Ref` function, see [https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/intrinsic-function-reference-ref.html). ## Examples **Topics** + [Create a logging configuration for CloudWatch Logs and Kinesis Data Firehose](#aws-resource-networkfirewall-loggingconfiguration--examples--Create_a_logging_configuration_for_and_Kinesis_Data_Firehose) + [Create a logging configuration for Amazon S3](#aws-resource-networkfirewall-loggingconfiguration--examples--Create_a_logging_configuration_for_Amazon_S3) ### Create a logging configuration for CloudWatch Logs and Kinesis Data Firehose The following shows example logging configuration specifications for alert logs that go to an Amazon CloudWatch Logs log group and flow logs that go to an Amazon Kinesis Data Firehose delivery stream. #### JSON ``` "SampleLoggingConfiguration": { "Type": "AWS::NetworkFirewall::LoggingConfiguration", "Properties": { "FirewallArn": { "Ref": "SampleFirewallArn" }, "LoggingConfiguration": { "LogDestinationConfigs": [ { "LogType": "ALERT", "LogDestinationType": "CloudWatchLogs", "LogDestination": { "logGroup": "SampleLogGroup" } }, { "LogType": "FLOW", "LogDestinationType": "KinesisDataFirehose", "LogDestination": { "deliveryStream": "SampleStream" } } ] } } } ``` #### YAML ``` SampleLoggingConfiguration: Type: 'AWS::NetworkFirewall::LoggingConfiguration' Properties: FirewallArn: !Ref SampleFirewallArn LoggingConfiguration: LogDestinationConfigs: - LogType: ALERT LogDestinationType: CloudWatchLogs LogDestination: logGroup: SampleLogGroup - LogType: FLOW LogDestinationType: KinesisDataFirehose LogDestination: deliveryStream: SampleStream ``` ### Create a logging configuration for Amazon S3 The following shows example logging configuration specifications for flow logs that go to an Amazon S3 bucket. #### JSON ``` "SampleLoggingConfiguration": { "Type": "AWS::NetworkFirewall::LoggingConfiguration", "Properties": { "FirewallArn": { "Ref": "SampleFirewallArn" }, "LoggingConfiguration": { "LogDestinationConfigs": [ { "LogType": "FLOW", "LogDestinationType": "S3", "LogDestination": { "bucketName": "sample-bucket-name", "prefix": "sample/s3/prefix" } } ] } } } ``` #### YAML ``` SampleLoggingConfiguration: Type: 'AWS::NetworkFirewall::LoggingConfiguration' Properties: FirewallArn: !Ref SampleFirewallArn LoggingConfiguration: LogDestinationConfigs: - LogType: FLOW LogDestinationType: S3 LogDestination: bucketName: sample-bucket-name prefix: sample/s3/prefix ``` # AWS::NetworkFirewall::LoggingConfiguration LogDestinationConfig Defines where AWS Network Firewall sends logs for the firewall for one log type. This is used in logging configuration. You can send each type of log to an Amazon S3 bucket, a CloudWatch log group, or a Kinesis Data Firehose delivery stream. Network Firewall generates logs for stateful rule groups. You can save alert and flow log types. The stateful rules engine records flow logs for all network traffic that it receives. It records alert logs for traffic that matches stateful rules that have the rule action set to `DROP` or `ALERT`. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[LogDestination](#cfn-networkfirewall-loggingconfiguration-logdestinationconfig-logdestination)" : {Key: Value, ...}, "[LogDestinationType](#cfn-networkfirewall-loggingconfiguration-logdestinationconfig-logdestinationtype)" : String, "[LogType](#cfn-networkfirewall-loggingconfiguration-logdestinationconfig-logtype)" : String } ``` ### YAML ``` [LogDestination](#cfn-networkfirewall-loggingconfiguration-logdestinationconfig-logdestination): Key: Value [LogDestinationType](#cfn-networkfirewall-loggingconfiguration-logdestinationconfig-logdestinationtype): String [LogType](#cfn-networkfirewall-loggingconfiguration-logdestinationconfig-logtype): String ``` ## Properties `LogDestination` The named location for the logs, provided in a key:value mapping that is specific to the chosen destination type. + For an Amazon S3 bucket, provide the name of the bucket, with key `bucketName`, and optionally provide a prefix, with key `prefix`. The following example specifies an Amazon S3 bucket named `DOC-EXAMPLE-BUCKET` and the prefix `alerts`: `"LogDestination": { "bucketName": "DOC-EXAMPLE-BUCKET", "prefix": "alerts" }` + For a CloudWatch log group, provide the name of the CloudWatch log group, with key `logGroup`. The following example specifies a log group named `alert-log-group`: `"LogDestination": { "logGroup": "alert-log-group" }` + For a Firehose delivery stream, provide the name of the delivery stream, with key `deliveryStream`. The following example specifies a delivery stream named `alert-delivery-stream`: `"LogDestination": { "deliveryStream": "alert-delivery-stream" }` *Required*: Yes *Type*: Object of String *Pattern*: `^[0-9A-Za-z.\-_@\/]+$` *Minimum*: `1` *Maximum*: `1024` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `LogDestinationType` The type of storage destination to send these logs to. You can send logs to an Amazon S3 bucket, a CloudWatch log group, or a Firehose delivery stream. *Required*: Yes *Type*: String *Allowed values*: `S3 | CloudWatchLogs | KinesisDataFirehose` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) `LogType` The type of log to record. You can record the following types of logs from your Network Firewall stateful engine. + `ALERT` - Logs for traffic that matches your stateful rules and that have an action that sends an alert. A stateful rule sends alerts for the rule actions DROP, ALERT, and REJECT. For more information, see the `StatefulRule` property. + `FLOW` - Standard network traffic flow logs. The stateful rules engine records flow logs for all network traffic that it receives. Each flow log record captures the network flow for a specific standard stateless rule group. + `TLS` - Logs for events that are related to TLS inspection. For more information, see [Inspecting SSL/TLS traffic with TLS inspection configurations](https://docs.aws.amazon.com/network-firewall/latest/developerguide/tls-inspection-configurations.html) in the *Network Firewall Developer Guide*. *Required*: Yes *Type*: String *Allowed values*: `ALERT | FLOW | TLS` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt) # AWS::NetworkFirewall::LoggingConfiguration LoggingConfiguration Defines how AWS Network Firewall performs logging for a firewall. ## Syntax To declare this entity in your CloudFormation template, use the following syntax: ### JSON ``` { "[LogDestinationConfigs](#cfn-networkfirewall-loggingconfiguration-loggingconfiguration-logdestinationconfigs)" : [ LogDestinationConfig, ... ] } ``` ### YAML ``` [LogDestinationConfigs](#cfn-networkfirewall-loggingconfiguration-loggingconfiguration-logdestinationconfigs): - LogDestinationConfig ``` ## Properties `LogDestinationConfigs` Defines the logging destinations for the logs for a firewall. Network Firewall generates logs for stateful rule groups. *Required*: Yes *Type*: Array of [LogDestinationConfig](aws-properties-networkfirewall-loggingconfiguration-logdestinationconfig.md) *Minimum*: `1` *Update requires*: [No interruption](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-update-behaviors.html#update-no-interrupt)