@pulumi/cloudngfwaws
Version:
A Pulumi package for creating and managing Cloud NGFW for AWS resources.
419 lines • 14.8 kB
JavaScript
;
// *** WARNING: this file was generated by pulumi-language-nodejs. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***
var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
var desc = Object.getOwnPropertyDescriptor(m, k);
if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
desc = { enumerable: true, get: function() { return m[k]; } };
}
Object.defineProperty(o, k2, desc);
}) : (function(o, m, k, k2) {
if (k2 === undefined) k2 = k;
o[k2] = m[k];
}));
var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
Object.defineProperty(o, "default", { enumerable: true, value: v });
}) : function(o, v) {
o["default"] = v;
});
var __importStar = (this && this.__importStar) || function (mod) {
if (mod && mod.__esModule) return mod;
var result = {};
if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
__setModuleDefault(result, mod);
return result;
};
Object.defineProperty(exports, "__esModule", { value: true });
exports.Ngfw = void 0;
const pulumi = __importStar(require("@pulumi/pulumi"));
const utilities = __importStar(require("./utilities"));
/**
* ## <!-- This file is generated by `make docs`. Do not edit directly — edit templates/resources/ngfw.md.tmpl instead. -->
*
* ***
* ## page_title: "terraform-provider-cloudngfwaws: cloudngfwaws.Ngfw Resource"
*
* subcategory: ""
* description: |-
* Resource for NGFW manipulation.
* ---
*
* # cloudngfwaws.Ngfw
*
* Resource for NGFW manipulation.
*
* > **NOTE:** Having the `rulestack` param reference the rulestack name from `cloudngfwaws.CommitRulestack` ensures that Terraform will only try to spin up a NGFW instance if the commit is successful.
*
* ## Admin Permission Type
*
* * `Firewall`
*
* ## Configuration Guide
*
* ***
*
* ### V1 Schema — Existing Deployments Only
*
* > **Important:** V1 schema is for existing customers who already have firewalls deployed with Terraform.
* New firewalls must be created using the V2 schema.
*
* ***
*
* #### 1. Managing an Existing Firewall (no configuration changes)
*
* Use the V1 schema as-is. No steps required beyond ensuring your existing state is in sync.
*
* **Steps:**
*
* 1. Verify there is no unintended drift:
* 2. If the plan is clean, no action needed. If drift is detected, review and apply:
*
* **Full example — existing V1 firewall:**
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as cloudngfwaws from "@pulumi/cloudngfwaws";
*
* const rs = new cloudngfwaws.CommitRulestack("rs", {rulestack: "my-rulestack"});
* const example = new cloudngfwaws.Ngfw("example", {
* name: "example-instance",
* vpcId: exampleAwsVpc.id,
* accountId: "111111111111",
* description: "Example description",
* endpointMode: "ServiceManaged",
* subnetMappings: [
* {
* subnetId: subnet1.id,
* },
* {
* subnetId: subnet2.id,
* },
* ],
* rulestack: rs.rulestack,
* tags: {
* Foo: "bar",
* },
* });
* ```
*
* ***
*
* #### 2. Configuring Egress NAT on an Existing Firewall (V1)
*
* Egress NAT can be added to an existing V1 firewall without recreating the resource.
*
* > `ipPoolType` accepts `AWSService` or `BYOIP`. Use `BYOIP` together with `ipamPoolId`
* if bringing your own IP pool.
*
* **Steps:**
*
* 1. Add the `egressNat` block to your existing resource.
*
* **Full example — existing V1 firewall with Egress NAT enabled:**
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as cloudngfwaws from "@pulumi/cloudngfwaws";
*
* const example = new cloudngfwaws.Ngfw("example", {
* name: "example-instance",
* vpcId: "vpc-0a1b2c3d4e5f00001",
* accountId: "111111111111",
* description: "Example description",
* endpointMode: "CustomerManaged",
* subnetMappings: [
* {
* availabilityZone: "us-east-1a",
* },
* {
* availabilityZone: "us-east-1c",
* },
* ],
* rulestack: "my-rulestack",
* egressNats: [{
* enabled: true,
* settings: [{
* ipPoolType: "AWSService",
* }],
* }],
* tags: {
* Foo: "bar",
* },
* });
* ```
*
* **To disable Egress NAT:** set `enabled = false` and re-apply.
*
* ***
*
* #### 3. Configuring Security Zones on an Existing Firewall (V1)
*
* Security zones let you enable or disable Egress NAT per endpoint and add or remove private CIDR prefixes.
*
* > **Prerequisite:** Endpoints must be successfully created and in `ACCEPTED` state before
* security zones can be configured. Check `status.attachment[*].status` in Terraform state
* or the AWS console before proceeding.
*
* **Steps:**
*
* 1. Confirm endpoint status is `ACCEPTED`:
*
* **To remove private prefixes:** remove the CIDR entries from `cidrs` and re-apply.
* **To disable Egress NAT for a specific zone:** set `egressNatEnabled = false` and re-apply.
*
* ***
*
* ### V2 Schema — New Firewalls
*
* > **Important:** New firewalls can only be created using the V2 schema. Use `azList`
* instead of `subnetMapping`, and `endpoints` instead of `endpointMode`/`subnetMapping`.
*
* ***
*
* #### 1. Creating a New Firewall (V2)
*
* Firewall creation uses `azList` to specify availability zones.
* **Do not include `endpoints` during creation** — they must be added in a separate update after the firewall is running.
*
* **Steps:**
*
* 1. Define the resource with `azList` and no `endpoints` block.
* 2. Proceed to **Step 2** once the firewall reaches `RUNNING` state.
*
* **Full example — new V2 firewall (creation only):**
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as cloudngfwaws from "@pulumi/cloudngfwaws";
*
* const example = new cloudngfwaws.Ngfw("example", {
* name: "my-firewall",
* description: "My new firewall",
* azLists: [
* "use1-az1",
* "use1-az4",
* ],
* allowlistAccounts: ["111111111111"],
* tags: {
* Owner: "my-team",
* },
* });
* ```
*
* ***
*
* #### 2. Adding Endpoints to a V2 Firewall
*
* Endpoints connect the firewall to customer VPCs. They must be added in a separate
* a separate update after the firewall is running.
*
* **Steps:**
*
* 1. Confirm the firewall status is `RUNNING`:
*
* **Full example — V2 firewall with endpoints added:**
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as cloudngfwaws from "@pulumi/cloudngfwaws";
*
* const example = new cloudngfwaws.Ngfw("example", {
* name: "my-firewall",
* description: "My new firewall",
* azLists: [
* "use1-az1",
* "use1-az4",
* ],
* allowlistAccounts: ["111111111111"],
* endpoints: [
* {
* accountId: "111111111111",
* vpcId: "vpc-0a1b2c3d4e5f00002",
* subnetId: "subnet-0a1b2c3d4e5f00001",
* mode: "ServiceManaged",
* },
* {
* accountId: "111111111111",
* vpcId: "vpc-0a1b2c3d4e5f00003",
* subnetId: "subnet-0a1b2c3d4e5f00002",
* mode: "ServiceManaged",
* },
* ],
* tags: {
* Owner: "my-team",
* },
* });
* ```
*
* ***
*
* #### 3. Configuring Egress NAT on a V2 Firewall
*
* Egress NAT can be enabled at the firewall level once at least one endpoint is accepted.
*
* > **Prerequisite:** At least one endpoint must be in `ACCEPTED` state.
*
* **Steps:**
*
* 1. Add the `egressNat` block to the resource.
*
* **Full example — V2 firewall with Egress NAT enabled:**
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as cloudngfwaws from "@pulumi/cloudngfwaws";
*
* const example = new cloudngfwaws.Ngfw("example", {
* name: "my-firewall",
* description: "My new firewall",
* azLists: [
* "use1-az1",
* "use1-az4",
* ],
* allowlistAccounts: ["111111111111"],
* endpoints: [
* {
* accountId: "111111111111",
* vpcId: "vpc-0a1b2c3d4e5f00002",
* subnetId: "subnet-0a1b2c3d4e5f00001",
* mode: "ServiceManaged",
* },
* {
* accountId: "111111111111",
* vpcId: "vpc-0a1b2c3d4e5f00003",
* subnetId: "subnet-0a1b2c3d4e5f00002",
* mode: "ServiceManaged",
* },
* ],
* egressNats: [{
* enabled: true,
* settings: [{
* ipPoolType: "AWSService",
* }],
* }],
* tags: {
* Owner: "my-team",
* },
* });
* ```
*
* **To disable Egress NAT:** set `enabled = false` and re-apply.
*
* ***
*
* #### 4. Configuring Private Prefixes and Per-Endpoint Egress NAT (V2)
*
* Once an endpoint is accepted, you can enable or disable Egress NAT and configure private
* CIDR prefixes on a per-endpoint basis within the `endpoints` block.
*
* > **Prerequisite:** The endpoint must be in `ACCEPTED` state. The `endpointId`
* is a read-only computed value — retrieve it from Terraform state after apply:
*
* **To remove private prefixes:** remove the CIDR entries from `cidrs` and re-apply.
* **To disable per-endpoint Egress NAT:** set `egressNatEnabled = false` and re-apply.
*
* ***
*
* ## Import
*
* import name is <account_id>:<name>
*
* ```sh
* $ pulumi import cloudngfwaws:index/ngfw:Ngfw example 12345678:example-instance
* ```
*/
class Ngfw extends pulumi.CustomResource {
/**
* Get an existing Ngfw resource's state with the given name, ID, and optional extra
* properties used to qualify the lookup.
*
* @param name The _unique_ name of the resulting resource.
* @param id The _unique_ provider ID of the resource to lookup.
* @param state Any extra arguments used during the lookup.
* @param opts Optional settings to control the behavior of the CustomResource.
*/
static get(name, id, state, opts) {
return new Ngfw(name, state, { ...opts, id: id });
}
/** @internal */
static __pulumiType = 'cloudngfwaws:index/ngfw:Ngfw';
/**
* Returns true if the given object is an instance of Ngfw. This is designed to work even
* when multiple copies of the Pulumi SDK have been loaded into the same process.
*/
static isInstance(obj) {
if (obj === undefined || obj === null) {
return false;
}
return obj['__pulumiType'] === Ngfw.__pulumiType;
}
constructor(name, argsOrState, opts) {
let resourceInputs = {};
opts = opts || {};
if (opts.id) {
const state = argsOrState;
resourceInputs["accountId"] = state?.accountId;
resourceInputs["allowlistAccounts"] = state?.allowlistAccounts;
resourceInputs["appIdVersion"] = state?.appIdVersion;
resourceInputs["automaticUpgradeAppIdVersion"] = state?.automaticUpgradeAppIdVersion;
resourceInputs["azLists"] = state?.azLists;
resourceInputs["changeProtections"] = state?.changeProtections;
resourceInputs["deploymentUpdateToken"] = state?.deploymentUpdateToken;
resourceInputs["description"] = state?.description;
resourceInputs["egressNats"] = state?.egressNats;
resourceInputs["endpointMode"] = state?.endpointMode;
resourceInputs["endpointServiceName"] = state?.endpointServiceName;
resourceInputs["endpoints"] = state?.endpoints;
resourceInputs["firewallId"] = state?.firewallId;
resourceInputs["globalRulestack"] = state?.globalRulestack;
resourceInputs["linkId"] = state?.linkId;
resourceInputs["linkStatus"] = state?.linkStatus;
resourceInputs["multiVpc"] = state?.multiVpc;
resourceInputs["name"] = state?.name;
resourceInputs["privateAccesses"] = state?.privateAccesses;
resourceInputs["rulestack"] = state?.rulestack;
resourceInputs["securityZones"] = state?.securityZones;
resourceInputs["statuses"] = state?.statuses;
resourceInputs["subnetMappings"] = state?.subnetMappings;
resourceInputs["tags"] = state?.tags;
resourceInputs["updateToken"] = state?.updateToken;
resourceInputs["userIds"] = state?.userIds;
resourceInputs["vpcId"] = state?.vpcId;
}
else {
const args = argsOrState;
resourceInputs["accountId"] = args?.accountId;
resourceInputs["allowlistAccounts"] = args?.allowlistAccounts;
resourceInputs["appIdVersion"] = args?.appIdVersion;
resourceInputs["automaticUpgradeAppIdVersion"] = args?.automaticUpgradeAppIdVersion;
resourceInputs["azLists"] = args?.azLists;
resourceInputs["changeProtections"] = args?.changeProtections;
resourceInputs["description"] = args?.description;
resourceInputs["egressNats"] = args?.egressNats;
resourceInputs["endpointMode"] = args?.endpointMode;
resourceInputs["endpoints"] = args?.endpoints;
resourceInputs["firewallId"] = args?.firewallId;
resourceInputs["globalRulestack"] = args?.globalRulestack;
resourceInputs["linkId"] = args?.linkId;
resourceInputs["multiVpc"] = args?.multiVpc;
resourceInputs["name"] = args?.name;
resourceInputs["privateAccesses"] = args?.privateAccesses;
resourceInputs["rulestack"] = args?.rulestack;
resourceInputs["securityZones"] = args?.securityZones;
resourceInputs["subnetMappings"] = args?.subnetMappings;
resourceInputs["tags"] = args?.tags;
resourceInputs["userIds"] = args?.userIds;
resourceInputs["vpcId"] = args?.vpcId;
resourceInputs["deploymentUpdateToken"] = undefined /*out*/;
resourceInputs["endpointServiceName"] = undefined /*out*/;
resourceInputs["linkStatus"] = undefined /*out*/;
resourceInputs["statuses"] = undefined /*out*/;
resourceInputs["updateToken"] = undefined /*out*/;
}
opts = pulumi.mergeOptions(utilities.resourceOptsDefaults(), opts);
super(Ngfw.__pulumiType, name, resourceInputs, opts);
}
}
exports.Ngfw = Ngfw;
//# sourceMappingURL=ngfw.js.map