Class: AWSCDK::NetworkFirewall::CfnFirewallProps

Inherits:
Jsii::Struct
  • Object
show all
Defined in:
network_firewall/cfn_firewall_props.rb

Overview

Properties for defining a CfnFirewall.

See Also:

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(firewall_name:, firewall_policy_arn:, availability_zone_change_protection: nil, availability_zone_mappings: nil, delete_protection: nil, description: nil, enabled_analysis_types: nil, firewall_policy_change_protection: nil, subnet_change_protection: nil, subnet_mappings: nil, tags: nil, transit_gateway_id: nil, vpc_id: nil) ⇒ CfnFirewallProps

Returns a new instance of CfnFirewallProps.

Parameters:

  • firewall_name (String) —

    The descriptive name of the firewall.

  • firewall_policy_arn (String, AWSCDK::Interfaces::AWSNetworkfirewall::IFirewallPolicyRef) —

    The Amazon Resource Name (ARN) of the firewall policy.

  • availability_zone_change_protection (Boolean, AWSCDK::IResolvable, nil) (defaults to: nil) —

    A setting indicating whether the firewall is protected against changes to its Availability Zone configuration.

  • availability_zone_mappings (AWSCDK::IResolvable, Array<AWSCDK::IResolvable, AWSCDK::NetworkFirewall::CfnFirewall::AvailabilityZoneMappingProperty>, nil) (defaults to: nil) —

    The Availability Zones where the firewall endpoints are created for a transit gateway-attached firewall.

  • delete_protection (Boolean, AWSCDK::IResolvable, nil) (defaults to: nil) —

    A flag indicating whether it is possible to delete the firewall.

  • description (String, nil) (defaults to: nil) —

    A description of the firewall.

  • enabled_analysis_types (Array<String>, nil) (defaults to: nil) —

    An optional setting indicating the specific traffic analysis types to enable on the firewall.

  • firewall_policy_change_protection (Boolean, AWSCDK::IResolvable, nil) (defaults to: nil) —

    A setting indicating whether the firewall is protected against a change to the firewall policy association.

  • subnet_change_protection (Boolean, AWSCDK::IResolvable, nil) (defaults to: nil) —

    A setting indicating whether the firewall is protected against changes to the subnet associations.

  • subnet_mappings (AWSCDK::IResolvable, Array<AWSCDK::IResolvable, AWSCDK::NetworkFirewall::CfnFirewall::SubnetMappingProperty>, nil) (defaults to: nil) —

    The primary public subnets that Network Firewall is using for the firewall.

  • tags (Array<AWSCDK::CfnTag>, nil) (defaults to: nil) —

    An array of key-value pairs to apply to this resource.

  • transit_gateway_id (String, nil) (defaults to: nil) —

    The unique identifier of the transit gateway associated with this firewall.

  • vpc_id (String, AWSCDK::Interfaces::AWSEC2::IVPCRef, nil) (defaults to: nil) —

    The unique identifier of the VPC where the firewall is in use.



22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
 
# File 'network_firewall/cfn_firewall_props.rb', line 22

def initialize(firewall_name:, firewall_policy_arn:, availability_zone_change_protection: nil, availability_zone_mappings: nil, delete_protection: nil, description: nil, enabled_analysis_types: nil, firewall_policy_change_protection: nil, subnet_change_protection: nil, subnet_mappings: nil, tags: nil, transit_gateway_id: nil, vpc_id: nil)
  @firewall_name = firewall_name
  Jsii::Type.check_type(@firewall_name, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "firewallName")
  @firewall_policy_arn = firewall_policy_arn
  Jsii::Type.check_type(@firewall_policy_arn, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3sicHJpbWl0aXZlIjoic3RyaW5nIn0seyJmcW4iOiJhd3MtY2RrLWxpYi5pbnRlcmZhY2VzLmF3c19uZXR3b3JrZmlyZXdhbGwuSUZpcmV3YWxsUG9saWN5UmVmIn1dfX0=")), "firewallPolicyArn")
  @availability_zone_change_protection = availability_zone_change_protection
  Jsii::Type.check_type(@availability_zone_change_protection, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3sicHJpbWl0aXZlIjoiYm9vbGVhbiJ9LHsiZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifV19fQ==")), "availabilityZoneChangeProtection") unless @availability_zone_change_protection.nil?
  @availability_zone_mappings = availability_zone_mappings
  Jsii::Type.check_type(@availability_zone_mappings, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImNvbGxlY3Rpb24iOnsiZWxlbWVudHR5cGUiOnsidW5pb24iOnsidHlwZXMiOlt7ImZxbiI6ImF3cy1jZGstbGliLklSZXNvbHZhYmxlIn0seyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfbmV0d29ya2ZpcmV3YWxsLkNmbkZpcmV3YWxsLkF2YWlsYWJpbGl0eVpvbmVNYXBwaW5nUHJvcGVydHkifV19fSwia2luZCI6ImFycmF5In19XX19")), "availabilityZoneMappings") unless @availability_zone_mappings.nil?
  @delete_protection = delete_protection
  Jsii::Type.check_type(@delete_protection, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3sicHJpbWl0aXZlIjoiYm9vbGVhbiJ9LHsiZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifV19fQ==")), "deleteProtection") unless @delete_protection.nil?
  @description = description
  Jsii::Type.check_type(@description, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "description") unless @description.nil?
  @enabled_analysis_types = enabled_analysis_types
  Jsii::Type.check_type(@enabled_analysis_types, JSON.parse(Base64.strict_decode64("eyJjb2xsZWN0aW9uIjp7ImVsZW1lbnR0eXBlIjp7InByaW1pdGl2ZSI6InN0cmluZyJ9LCJraW5kIjoiYXJyYXkifX0=")), "enabledAnalysisTypes") unless @enabled_analysis_types.nil?
  @firewall_policy_change_protection = firewall_policy_change_protection
  Jsii::Type.check_type(@firewall_policy_change_protection, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3sicHJpbWl0aXZlIjoiYm9vbGVhbiJ9LHsiZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifV19fQ==")), "firewallPolicyChangeProtection") unless @firewall_policy_change_protection.nil?
  @subnet_change_protection = subnet_change_protection
  Jsii::Type.check_type(@subnet_change_protection, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3sicHJpbWl0aXZlIjoiYm9vbGVhbiJ9LHsiZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifV19fQ==")), "subnetChangeProtection") unless @subnet_change_protection.nil?
  @subnet_mappings = subnet_mappings
  Jsii::Type.check_type(@subnet_mappings, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3siZnFuIjoiYXdzLWNkay1saWIuSVJlc29sdmFibGUifSx7ImNvbGxlY3Rpb24iOnsiZWxlbWVudHR5cGUiOnsidW5pb24iOnsidHlwZXMiOlt7ImZxbiI6ImF3cy1jZGstbGliLklSZXNvbHZhYmxlIn0seyJmcW4iOiJhd3MtY2RrLWxpYi5hd3NfbmV0d29ya2ZpcmV3YWxsLkNmbkZpcmV3YWxsLlN1Ym5ldE1hcHBpbmdQcm9wZXJ0eSJ9XX19LCJraW5kIjoiYXJyYXkifX1dfX0=")), "subnetMappings") unless @subnet_mappings.nil?
  @tags = tags.is_a?(Array) ? tags.map { |jsii_v0| jsii_v0.is_a?(Hash) ? ::AWSCDK::CfnTag.new(**jsii_v0.transform_keys(&:to_sym)) : jsii_v0 } : tags
  Jsii::Type.check_type(@tags, JSON.parse(Base64.strict_decode64("eyJjb2xsZWN0aW9uIjp7ImVsZW1lbnR0eXBlIjp7ImZxbiI6ImF3cy1jZGstbGliLkNmblRhZyJ9LCJraW5kIjoiYXJyYXkifX0=")), "tags") unless @tags.nil?
  @transit_gateway_id = transit_gateway_id
  Jsii::Type.check_type(@transit_gateway_id, JSON.parse(Base64.strict_decode64("eyJwcmltaXRpdmUiOiJzdHJpbmcifQ==")), "transitGatewayId") unless @transit_gateway_id.nil?
  @vpc_id = vpc_id
  Jsii::Type.check_type(@vpc_id, JSON.parse(Base64.strict_decode64("eyJ1bmlvbiI6eyJ0eXBlcyI6W3sicHJpbWl0aXZlIjoic3RyaW5nIn0seyJmcW4iOiJhd3MtY2RrLWxpYi5pbnRlcmZhY2VzLmF3c19lYzIuSVZQQ1JlZiJ9XX19")), "vpcId") unless @vpc_id.nil?
end

Instance Attribute Details

#availability_zone_change_protection ⇒ Boolean, ... (readonly)

A setting indicating whether the firewall is protected against changes to its Availability Zone configuration.

When set to TRUE , you must first disable this protection before adding or removing Availability Zones.

Returns:

See Also:



71
72
73
 
# File 'network_firewall/cfn_firewall_props.rb', line 71

def availability_zone_change_protection
  @availability_zone_change_protection
end

#availability_zone_mappings ⇒ AWSCDK::IResolvable, ... (readonly)

The Availability Zones where the firewall endpoints are created for a transit gateway-attached firewall.

Each mapping specifies an Availability Zone where the firewall processes traffic.

Returns:

See Also:



78
79
80
 
# File 'network_firewall/cfn_firewall_props.rb', line 78

def availability_zone_mappings
  @availability_zone_mappings
end

#delete_protection ⇒ Boolean, ... (readonly)

A flag indicating whether it is possible to delete the firewall.

A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE .

Returns:

See Also:



85
86
87
 
# File 'network_firewall/cfn_firewall_props.rb', line 85

def delete_protection
  @delete_protection
end

#description ⇒ String? (readonly)

A description of the firewall.

Returns:

  • (String, nil)

See Also:



90
91
92
 
# File 'network_firewall/cfn_firewall_props.rb', line 90

def description
  @description
end

#enabled_analysis_types ⇒ Array<String>? (readonly)

An optional setting indicating the specific traffic analysis types to enable on the firewall.

Returns:

  • (Array<String>, nil)

See Also:



95
96
97
 
# File 'network_firewall/cfn_firewall_props.rb', line 95

def enabled_analysis_types
  @enabled_analysis_types
end

#firewall_name ⇒ String (readonly)

The descriptive name of the firewall.

You can't change the name of a firewall after you create it.

Returns:

  • (String)

See Also:



57
58
59
 
# File 'network_firewall/cfn_firewall_props.rb', line 57

def firewall_name
  @firewall_name
end

#firewall_policy_arn ⇒ String, AWSCDK::Interfaces::AWSNetworkfirewall::IFirewallPolicyRef (readonly)

The Amazon Resource Name (ARN) of the firewall policy.

The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.

Returns:

See Also:



64
65
66
 
# File 'network_firewall/cfn_firewall_props.rb', line 64

def firewall_policy_arn
  @firewall_policy_arn
end

#firewall_policy_change_protection ⇒ Boolean, ... (readonly)

A setting indicating whether the firewall is protected against a change to the firewall policy association.

Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE .

Returns:

See Also:



102
103
104
 
# File 'network_firewall/cfn_firewall_props.rb', line 102

def firewall_policy_change_protection
  @firewall_policy_change_protection
end

#subnet_change_protection ⇒ Boolean, ... (readonly)

A setting indicating whether the firewall is protected against changes to the subnet associations.

Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE .

Returns:

See Also:



109
110
111
 
# File 'network_firewall/cfn_firewall_props.rb', line 109

def subnet_change_protection
  @subnet_change_protection
end

#subnet_mappings ⇒ AWSCDK::IResolvable, ... (readonly)

The primary public subnets that Network Firewall is using for the firewall.

Network Firewall creates a firewall endpoint in each subnet. Create a subnet mapping for each Availability Zone where you want to use the firewall.

These subnets are all defined for a single, primary VPC, and each must belong to a different Availability Zone. Each of these subnets establishes the availability of the firewall in its Availability Zone.

In addition to these subnets, you can define other endpoints for the firewall in VpcEndpointAssociation resources. You can define these additional endpoints for any VPC, and for any of the Availability Zones where the firewall resource already has a subnet mapping. VPC endpoint associations give you the ability to protect multiple VPCs using a single firewall, and to define multiple firewall endpoints for a VPC in a single Availability Zone.

Returns:

See Also:



120
121
122
 
# File 'network_firewall/cfn_firewall_props.rb', line 120

def subnet_mappings
  @subnet_mappings
end

#tags ⇒ Array<AWSCDK::CfnTag>? (readonly)

An array of key-value pairs to apply to this resource.

For more information, see Tag .

Returns:

See Also:



127
128
129
 
# File 'network_firewall/cfn_firewall_props.rb', line 127

def tags
  @tags
end

#transit_gateway_id ⇒ String? (readonly)

The unique identifier of the transit gateway associated with this firewall.

This field is only present for transit gateway-attached firewalls.

Returns:

  • (String, nil)

See Also:



134
135
136
 
# File 'network_firewall/cfn_firewall_props.rb', line 134

def transit_gateway_id
  @transit_gateway_id
end

#vpc_id ⇒ String, ... (readonly)

The unique identifier of the VPC where the firewall is in use.

You can't change the VPC of a firewall after you create the firewall.

Returns:

See Also:



141
142
143
 
# File 'network_firewall/cfn_firewall_props.rb', line 141

def vpc_id
  @vpc_id
end

Class Method Details

.jsii_properties ⇒ Object 



143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
 
# File 'network_firewall/cfn_firewall_props.rb', line 143

def self.jsii_properties
  {
    :firewall_name => "firewallName",
    :firewall_policy_arn => "firewallPolicyArn",
    :availability_zone_change_protection => "availabilityZoneChangeProtection",
    :availability_zone_mappings => "availabilityZoneMappings",
    :delete_protection => "deleteProtection",
    :description => "description",
    :enabled_analysis_types => "enabledAnalysisTypes",
    :firewall_policy_change_protection => "firewallPolicyChangeProtection",
    :subnet_change_protection => "subnetChangeProtection",
    :subnet_mappings => "subnetMappings",
    :tags => "tags",
    :transit_gateway_id => "transitGatewayId",
    :vpc_id => "vpcId",
  }
end

Instance Method Details

#to_jsii ⇒ Object 



161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
 
# File 'network_firewall/cfn_firewall_props.rb', line 161

def to_jsii
  result = {}
  result.merge!({
    "firewallName" => @firewall_name,
    "firewallPolicyArn" => @firewall_policy_arn,
    "availabilityZoneChangeProtection" => @availability_zone_change_protection,
    "availabilityZoneMappings" => @availability_zone_mappings,
    "deleteProtection" => @delete_protection,
    "description" => @description,
    "enabledAnalysisTypes" => @enabled_analysis_types,
    "firewallPolicyChangeProtection" => @firewall_policy_change_protection,
    "subnetChangeProtection" => @subnet_change_protection,
    "subnetMappings" => @subnet_mappings,
    "tags" => @tags,
    "transitGatewayId" => @transit_gateway_id,
    "vpcId" => @vpc_id,
  })
  result.compact
end