@pulumi/cloudngfwaws
Version:
A Pulumi package for creating and managing Cloud NGFW for AWS resources.
593 lines • 18.3 kB
TypeScript
import * as pulumi from "@pulumi/pulumi";
import * as inputs from "./types/input";
import * as outputs from "./types/output";
/**
* ## <!-- This file is generated by `make docs`. Do not edit directly — edit templates/resources/ngfw.md.tmpl instead. -->
*
* ***
* ## page_title: "terraform-provider-cloudngfwaws: cloudngfwaws.Ngfw Resource"
*
* subcategory: ""
* description: |-
* Resource for NGFW manipulation.
* ---
*
* # cloudngfwaws.Ngfw
*
* Resource for NGFW manipulation.
*
* > **NOTE:** Having the `rulestack` param reference the rulestack name from `cloudngfwaws.CommitRulestack` ensures that Terraform will only try to spin up a NGFW instance if the commit is successful.
*
* ## Admin Permission Type
*
* * `Firewall`
*
* ## Configuration Guide
*
* ***
*
* ### V1 Schema — Existing Deployments Only
*
* > **Important:** V1 schema is for existing customers who already have firewalls deployed with Terraform.
* New firewalls must be created using the V2 schema.
*
* ***
*
* #### 1. Managing an Existing Firewall (no configuration changes)
*
* Use the V1 schema as-is. No steps required beyond ensuring your existing state is in sync.
*
* **Steps:**
*
* 1. Verify there is no unintended drift:
* 2. If the plan is clean, no action needed. If drift is detected, review and apply:
*
* **Full example — existing V1 firewall:**
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as cloudngfwaws from "@pulumi/cloudngfwaws";
*
* const rs = new cloudngfwaws.CommitRulestack("rs", {rulestack: "my-rulestack"});
* const example = new cloudngfwaws.Ngfw("example", {
* name: "example-instance",
* vpcId: exampleAwsVpc.id,
* accountId: "111111111111",
* description: "Example description",
* endpointMode: "ServiceManaged",
* subnetMappings: [
* {
* subnetId: subnet1.id,
* },
* {
* subnetId: subnet2.id,
* },
* ],
* rulestack: rs.rulestack,
* tags: {
* Foo: "bar",
* },
* });
* ```
*
* ***
*
* #### 2. Configuring Egress NAT on an Existing Firewall (V1)
*
* Egress NAT can be added to an existing V1 firewall without recreating the resource.
*
* > `ipPoolType` accepts `AWSService` or `BYOIP`. Use `BYOIP` together with `ipamPoolId`
* if bringing your own IP pool.
*
* **Steps:**
*
* 1. Add the `egressNat` block to your existing resource.
*
* **Full example — existing V1 firewall with Egress NAT enabled:**
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as cloudngfwaws from "@pulumi/cloudngfwaws";
*
* const example = new cloudngfwaws.Ngfw("example", {
* name: "example-instance",
* vpcId: "vpc-0a1b2c3d4e5f00001",
* accountId: "111111111111",
* description: "Example description",
* endpointMode: "CustomerManaged",
* subnetMappings: [
* {
* availabilityZone: "us-east-1a",
* },
* {
* availabilityZone: "us-east-1c",
* },
* ],
* rulestack: "my-rulestack",
* egressNats: [{
* enabled: true,
* settings: [{
* ipPoolType: "AWSService",
* }],
* }],
* tags: {
* Foo: "bar",
* },
* });
* ```
*
* **To disable Egress NAT:** set `enabled = false` and re-apply.
*
* ***
*
* #### 3. Configuring Security Zones on an Existing Firewall (V1)
*
* Security zones let you enable or disable Egress NAT per endpoint and add or remove private CIDR prefixes.
*
* > **Prerequisite:** Endpoints must be successfully created and in `ACCEPTED` state before
* security zones can be configured. Check `status.attachment[*].status` in Terraform state
* or the AWS console before proceeding.
*
* **Steps:**
*
* 1. Confirm endpoint status is `ACCEPTED`:
*
* **To remove private prefixes:** remove the CIDR entries from `cidrs` and re-apply.
* **To disable Egress NAT for a specific zone:** set `egressNatEnabled = false` and re-apply.
*
* ***
*
* ### V2 Schema — New Firewalls
*
* > **Important:** New firewalls can only be created using the V2 schema. Use `azList`
* instead of `subnetMapping`, and `endpoints` instead of `endpointMode`/`subnetMapping`.
*
* ***
*
* #### 1. Creating a New Firewall (V2)
*
* Firewall creation uses `azList` to specify availability zones.
* **Do not include `endpoints` during creation** — they must be added in a separate update after the firewall is running.
*
* **Steps:**
*
* 1. Define the resource with `azList` and no `endpoints` block.
* 2. Proceed to **Step 2** once the firewall reaches `RUNNING` state.
*
* **Full example — new V2 firewall (creation only):**
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as cloudngfwaws from "@pulumi/cloudngfwaws";
*
* const example = new cloudngfwaws.Ngfw("example", {
* name: "my-firewall",
* description: "My new firewall",
* azLists: [
* "use1-az1",
* "use1-az4",
* ],
* allowlistAccounts: ["111111111111"],
* tags: {
* Owner: "my-team",
* },
* });
* ```
*
* ***
*
* #### 2. Adding Endpoints to a V2 Firewall
*
* Endpoints connect the firewall to customer VPCs. They must be added in a separate
* a separate update after the firewall is running.
*
* **Steps:**
*
* 1. Confirm the firewall status is `RUNNING`:
*
* **Full example — V2 firewall with endpoints added:**
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as cloudngfwaws from "@pulumi/cloudngfwaws";
*
* const example = new cloudngfwaws.Ngfw("example", {
* name: "my-firewall",
* description: "My new firewall",
* azLists: [
* "use1-az1",
* "use1-az4",
* ],
* allowlistAccounts: ["111111111111"],
* endpoints: [
* {
* accountId: "111111111111",
* vpcId: "vpc-0a1b2c3d4e5f00002",
* subnetId: "subnet-0a1b2c3d4e5f00001",
* mode: "ServiceManaged",
* },
* {
* accountId: "111111111111",
* vpcId: "vpc-0a1b2c3d4e5f00003",
* subnetId: "subnet-0a1b2c3d4e5f00002",
* mode: "ServiceManaged",
* },
* ],
* tags: {
* Owner: "my-team",
* },
* });
* ```
*
* ***
*
* #### 3. Configuring Egress NAT on a V2 Firewall
*
* Egress NAT can be enabled at the firewall level once at least one endpoint is accepted.
*
* > **Prerequisite:** At least one endpoint must be in `ACCEPTED` state.
*
* **Steps:**
*
* 1. Add the `egressNat` block to the resource.
*
* **Full example — V2 firewall with Egress NAT enabled:**
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as cloudngfwaws from "@pulumi/cloudngfwaws";
*
* const example = new cloudngfwaws.Ngfw("example", {
* name: "my-firewall",
* description: "My new firewall",
* azLists: [
* "use1-az1",
* "use1-az4",
* ],
* allowlistAccounts: ["111111111111"],
* endpoints: [
* {
* accountId: "111111111111",
* vpcId: "vpc-0a1b2c3d4e5f00002",
* subnetId: "subnet-0a1b2c3d4e5f00001",
* mode: "ServiceManaged",
* },
* {
* accountId: "111111111111",
* vpcId: "vpc-0a1b2c3d4e5f00003",
* subnetId: "subnet-0a1b2c3d4e5f00002",
* mode: "ServiceManaged",
* },
* ],
* egressNats: [{
* enabled: true,
* settings: [{
* ipPoolType: "AWSService",
* }],
* }],
* tags: {
* Owner: "my-team",
* },
* });
* ```
*
* **To disable Egress NAT:** set `enabled = false` and re-apply.
*
* ***
*
* #### 4. Configuring Private Prefixes and Per-Endpoint Egress NAT (V2)
*
* Once an endpoint is accepted, you can enable or disable Egress NAT and configure private
* CIDR prefixes on a per-endpoint basis within the `endpoints` block.
*
* > **Prerequisite:** The endpoint must be in `ACCEPTED` state. The `endpointId`
* is a read-only computed value — retrieve it from Terraform state after apply:
*
* **To remove private prefixes:** remove the CIDR entries from `cidrs` and re-apply.
* **To disable per-endpoint Egress NAT:** set `egressNatEnabled = false` and re-apply.
*
* ***
*
* ## Import
*
* import name is <account_id>:<name>
*
* ```sh
* $ pulumi import cloudngfwaws:index/ngfw:Ngfw example 12345678:example-instance
* ```
*/
export declare class Ngfw extends pulumi.CustomResource {
/**
* Get an existing Ngfw resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name: string, id: pulumi.Input<pulumi.ID>, state?: NgfwState, opts?: pulumi.CustomResourceOptions): Ngfw;
/**
* Returns true if the given object is an instance of Ngfw. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj: any): obj is Ngfw;
/**
* The Account Id.
*/
readonly accountId: pulumi.Output<string | undefined>;
/**
* The list of allowed accounts for this NGFW.
*/
readonly allowlistAccounts: pulumi.Output<string[] | undefined>;
/**
* App-ID version number.
*/
readonly appIdVersion: pulumi.Output<string>;
/**
* Automatic App-ID upgrade version number. Defaults to `true`.
*/
readonly automaticUpgradeAppIdVersion: pulumi.Output<boolean | undefined>;
/**
* The list of availability zone IDs for this NGFW.
*/
readonly azLists: pulumi.Output<string[] | undefined>;
/**
* Enables or disables change protection for the NGFW.
*/
readonly changeProtections: pulumi.Output<string[]>;
/**
* The update token.
*/
readonly deploymentUpdateToken: pulumi.Output<string>;
/**
* The NGFW description.
*/
readonly description: pulumi.Output<string | undefined>;
readonly egressNats: pulumi.Output<outputs.NgfwEgressNat[]>;
/**
* Set endpoint mode from the following options. Valid values are `ServiceManaged` or `CustomerManaged`.
*/
readonly endpointMode: pulumi.Output<string | undefined>;
/**
* The endpoint service name.
*/
readonly endpointServiceName: pulumi.Output<string>;
readonly endpoints: pulumi.Output<outputs.NgfwEndpoint[] | undefined>;
/**
* The Firewall ID.
*/
readonly firewallId: pulumi.Output<string>;
/**
* The global rulestack for this NGFW.
*/
readonly globalRulestack: pulumi.Output<string | undefined>;
/**
* The link ID.
*/
readonly linkId: pulumi.Output<string>;
/**
* The link status.
*/
readonly linkStatus: pulumi.Output<string>;
/**
* Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
*/
readonly multiVpc: pulumi.Output<boolean>;
/**
* The NGFW name.
*/
readonly name: pulumi.Output<string>;
readonly privateAccesses: pulumi.Output<outputs.NgfwPrivateAccess[]>;
/**
* The rulestack for this NGFW.
*/
readonly rulestack: pulumi.Output<string | undefined>;
readonly securityZones: pulumi.Output<outputs.NgfwSecurityZone[] | undefined>;
readonly statuses: pulumi.Output<outputs.NgfwStatus[]>;
/**
* Subnet mappings.
*/
readonly subnetMappings: pulumi.Output<outputs.NgfwSubnetMapping[] | undefined>;
/**
* The tags.
*/
readonly tags: pulumi.Output<{
[key: string]: string;
}>;
/**
* The update token.
*/
readonly updateToken: pulumi.Output<string>;
readonly userIds: pulumi.Output<outputs.NgfwUserId[]>;
/**
* The VPC ID for the NGFW.
*/
readonly vpcId: pulumi.Output<string | undefined>;
/**
* Create a Ngfw resource with the given unique name, arguments, and options.
*
* @param name The _unique_ name of the resource.
* @param args The arguments to use to populate this resource's properties.
* @param opts A bag of options that control this resource's behavior.
*/
constructor(name: string, args?: NgfwArgs, opts?: pulumi.CustomResourceOptions);
}
/**
* Input properties used for looking up and filtering Ngfw resources.
*/
export interface NgfwState {
/**
* The Account Id.
*/
accountId?: pulumi.Input<string | undefined>;
/**
* The list of allowed accounts for this NGFW.
*/
allowlistAccounts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
/**
* App-ID version number.
*/
appIdVersion?: pulumi.Input<string | undefined>;
/**
* Automatic App-ID upgrade version number. Defaults to `true`.
*/
automaticUpgradeAppIdVersion?: pulumi.Input<boolean | undefined>;
/**
* The list of availability zone IDs for this NGFW.
*/
azLists?: pulumi.Input<pulumi.Input<string>[] | undefined>;
/**
* Enables or disables change protection for the NGFW.
*/
changeProtections?: pulumi.Input<pulumi.Input<string>[] | undefined>;
/**
* The update token.
*/
deploymentUpdateToken?: pulumi.Input<string | undefined>;
/**
* The NGFW description.
*/
description?: pulumi.Input<string | undefined>;
egressNats?: pulumi.Input<pulumi.Input<inputs.NgfwEgressNat>[] | undefined>;
/**
* Set endpoint mode from the following options. Valid values are `ServiceManaged` or `CustomerManaged`.
*/
endpointMode?: pulumi.Input<string | undefined>;
/**
* The endpoint service name.
*/
endpointServiceName?: pulumi.Input<string | undefined>;
endpoints?: pulumi.Input<pulumi.Input<inputs.NgfwEndpoint>[] | undefined>;
/**
* The Firewall ID.
*/
firewallId?: pulumi.Input<string | undefined>;
/**
* The global rulestack for this NGFW.
*/
globalRulestack?: pulumi.Input<string | undefined>;
/**
* The link ID.
*/
linkId?: pulumi.Input<string | undefined>;
/**
* The link status.
*/
linkStatus?: pulumi.Input<string | undefined>;
/**
* Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
*/
multiVpc?: pulumi.Input<boolean | undefined>;
/**
* The NGFW name.
*/
name?: pulumi.Input<string | undefined>;
privateAccesses?: pulumi.Input<pulumi.Input<inputs.NgfwPrivateAccess>[] | undefined>;
/**
* The rulestack for this NGFW.
*/
rulestack?: pulumi.Input<string | undefined>;
securityZones?: pulumi.Input<pulumi.Input<inputs.NgfwSecurityZone>[] | undefined>;
statuses?: pulumi.Input<pulumi.Input<inputs.NgfwStatus>[] | undefined>;
/**
* Subnet mappings.
*/
subnetMappings?: pulumi.Input<pulumi.Input<inputs.NgfwSubnetMapping>[] | undefined>;
/**
* The tags.
*/
tags?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
} | undefined>;
/**
* The update token.
*/
updateToken?: pulumi.Input<string | undefined>;
userIds?: pulumi.Input<pulumi.Input<inputs.NgfwUserId>[] | undefined>;
/**
* The VPC ID for the NGFW.
*/
vpcId?: pulumi.Input<string | undefined>;
}
/**
* The set of arguments for constructing a Ngfw resource.
*/
export interface NgfwArgs {
/**
* The Account Id.
*/
accountId?: pulumi.Input<string | undefined>;
/**
* The list of allowed accounts for this NGFW.
*/
allowlistAccounts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
/**
* App-ID version number.
*/
appIdVersion?: pulumi.Input<string | undefined>;
/**
* Automatic App-ID upgrade version number. Defaults to `true`.
*/
automaticUpgradeAppIdVersion?: pulumi.Input<boolean | undefined>;
/**
* The list of availability zone IDs for this NGFW.
*/
azLists?: pulumi.Input<pulumi.Input<string>[] | undefined>;
/**
* Enables or disables change protection for the NGFW.
*/
changeProtections?: pulumi.Input<pulumi.Input<string>[] | undefined>;
/**
* The NGFW description.
*/
description?: pulumi.Input<string | undefined>;
egressNats?: pulumi.Input<pulumi.Input<inputs.NgfwEgressNat>[] | undefined>;
/**
* Set endpoint mode from the following options. Valid values are `ServiceManaged` or `CustomerManaged`.
*/
endpointMode?: pulumi.Input<string | undefined>;
endpoints?: pulumi.Input<pulumi.Input<inputs.NgfwEndpoint>[] | undefined>;
/**
* The Firewall ID.
*/
firewallId?: pulumi.Input<string | undefined>;
/**
* The global rulestack for this NGFW.
*/
globalRulestack?: pulumi.Input<string | undefined>;
/**
* The link ID.
*/
linkId?: pulumi.Input<string | undefined>;
/**
* Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
*/
multiVpc?: pulumi.Input<boolean | undefined>;
/**
* The NGFW name.
*/
name?: pulumi.Input<string | undefined>;
privateAccesses?: pulumi.Input<pulumi.Input<inputs.NgfwPrivateAccess>[] | undefined>;
/**
* The rulestack for this NGFW.
*/
rulestack?: pulumi.Input<string | undefined>;
securityZones?: pulumi.Input<pulumi.Input<inputs.NgfwSecurityZone>[] | undefined>;
/**
* Subnet mappings.
*/
subnetMappings?: pulumi.Input<pulumi.Input<inputs.NgfwSubnetMapping>[] | undefined>;
/**
* The tags.
*/
tags?: pulumi.Input<{
[key: string]: pulumi.Input<string>;
} | undefined>;
userIds?: pulumi.Input<pulumi.Input<inputs.NgfwUserId>[] | undefined>;
/**
* The VPC ID for the NGFW.
*/
vpcId?: pulumi.Input<string | undefined>;
}
//# sourceMappingURL=ngfw.d.ts.map