Class: Aws::NetworkFirewall::Types::CreateFirewallRequest

Inherits:
Struct
  • Object
show all
Includes:
Structure
Defined in:
lib/aws-sdk-networkfirewall/types.rb

Overview

See Also:

Constant Summary collapse

SENSITIVE = 
[]

Instance Attribute Summary collapse

Instance Attribute Details

#availability_zone_change_protection ⇒ Boolean

Optional. A setting indicating whether the firewall is protected against changes to its Availability Zone configuration. When set to TRUE, you cannot add or remove Availability Zones without first disabling this protection using UpdateAvailabilityZoneChangeProtection.

Default value: FALSE

Returns:

  • (Boolean) 


1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#availability_zone_mappings ⇒ Array<Types::AvailabilityZoneMapping>

Required. The Availability Zones where you want to create firewall endpoints for a transit gateway-attached firewall. You must specify at least one Availability Zone. Consider enabling the firewall in every Availability Zone where you have workloads to maintain Availability Zone isolation.

You can modify Availability Zones later using AssociateAvailabilityZones or DisassociateAvailabilityZones, but this may briefly disrupt traffic. The AvailabilityZoneChangeProtection setting controls whether you can make these modifications.

Returns:



1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#delete_protection ⇒ Boolean

A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE.

Returns:

  • (Boolean) 


1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#description ⇒ String

A description of the firewall.

Returns:

  • (String) 


1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#enabled_analysis_types ⇒ Array<String>

An optional setting indicating the specific traffic analysis types to enable on the firewall.

Returns:

  • (Array<String>) 


1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#encryption_configuration ⇒ Types::EncryptionConfiguration

A complex type that contains settings for encryption of your firewall resources.

Returns:



1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#firewall_name ⇒ String

The descriptive name of the firewall. You can't change the name of a firewall after you create it.

Returns:

  • (String) 


1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#firewall_policy_arn ⇒ String

The Amazon Resource Name (ARN) of the FirewallPolicy that you want to use for the firewall.

Returns:

  • (String) 


1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#firewall_policy_change_protection ⇒ Boolean

A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

Returns:

  • (Boolean) 


1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#nat_gateway_mappings ⇒ Array<Types::NatGatewayMapping>

The NAT gateways that the firewall uses to proxy traffic when NoSourcePreservation is TRUE. Network Firewall attaches the firewall to each NAT gateway that you specify, so that egress traffic is proxied through the NAT gateway.

Returns:



1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#no_source_preservation ⇒ Boolean

Optional. Indicates whether the firewall operates in proxy mode, in which the source IP address of the traffic is not preserved. When set to TRUE, the firewall proxies traffic through a NAT gateway and the traffic reaching the destination uses the NAT gateway's IP address as the source.

When you set this to TRUE, you must specify NatGatewayMappings and VpcEndpoint instead of a top-level VpcId and SubnetMappings.

You can't change this setting after you create the firewall.

Default value: FALSE

Returns:

  • (Boolean) 


1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#proxy_settings ⇒ Types::ProxySettings

The listener configuration for a proxy mode firewall, used when NoSourcePreservation is TRUE. This specifies the ports and protocols on which the firewall's proxy listens for traffic.

Returns:



1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#subnet_change_protection ⇒ Boolean

A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

Returns:

  • (Boolean) 


1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#subnet_mappings ⇒ Array<Types::SubnetMapping>

The public subnets to use for your Network Firewall firewalls. Each subnet must belong to a different Availability Zone in the VPC. Network Firewall creates a firewall endpoint in each subnet.

Returns:



1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#tags ⇒ Array<Types::Tag>

The key:value pairs to associate with the resource.

Returns:



1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#transit_gateway_id ⇒ String

Required when creating a transit gateway-attached firewall. The unique identifier of the transit gateway to attach to this firewall. You can provide either a transit gateway from your account or one that has been shared with you through Resource Access Manager.

After creating the firewall, you cannot change the transit gateway association. To use a different transit gateway, you must create a new firewall.

For information about creating firewalls, see CreateFirewall. For specific guidance about transit gateway-attached firewalls, see Considerations for transit gateway-attached firewalls in the Network Firewall Developer Guide.

Returns:

  • (String) 


1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#vpc_endpoint ⇒ Types::VpcEndpoint

The VPC and subnets for the firewall endpoint, used when NoSourcePreservation is TRUE. Network Firewall creates the firewall endpoint in the subnets that you specify here.

For proxy mode firewalls, provide the firewall's VPC and endpoint subnets through this parameter instead of the top-level VpcId and SubnetMappings.

Returns:



1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end

#vpc_id ⇒ String

The unique identifier of the VPC where Network Firewall should create the firewall.

You can't change this setting after you create the firewall.

Returns:

  • (String) 


1263
1264
1265
1266
1267
1268
1269
1270
1271
1272
1273
1274
1275
1276
1277
1278
1279
1280
1281
1282
1283
1284
 
# File 'lib/aws-sdk-networkfirewall/types.rb', line 1263

class CreateFirewallRequest < Struct.new(
  :firewall_name,
  :firewall_policy_arn,
  :vpc_id,
  :subnet_mappings,
  :delete_protection,
  :subnet_change_protection,
  :firewall_policy_change_protection,
  :description,
  :tags,
  :encryption_configuration,
  :enabled_analysis_types,
  :transit_gateway_id,
  :availability_zone_mappings,
  :availability_zone_change_protection,
  :nat_gateway_mappings,
  :proxy_settings,
  :no_source_preservation,
  :vpc_endpoint)
  SENSITIVE = []
  include Aws::Structure
end