AWS Network Firewall

2025/02/19 - AWS Network Firewall - 4 new3 updated api methods

Changes  This release introduces Network Firewall's Automated Domain List feature. New APIs include UpdateFirewallAnalysisSettings, StartAnalysisReport, GetAnalysisReportResults, and ListAnalysisReports. These allow customers to enable analysis on firewalls to identify and report frequently accessed domain.

GetAnalysisReportResults (new) Link ¶

The results of a COMPLETED analysis report generated with StartAnalysisReport.

For more information, see AnalysisTypeReportResult.

See also: AWS API Documentation

Request Syntax

client.get_analysis_report_results(
    FirewallName='string',
    AnalysisReportId='string',
    FirewallArn='string',
    NextToken='string',
    MaxResults=123
)
type FirewallName:

string

param FirewallName:

The descriptive name of the firewall. You can't change the name of a firewall after you create it.

You must specify the ARN or the name, and you can specify both.

type AnalysisReportId:

string

param AnalysisReportId:

[REQUIRED]

The unique ID of the query that ran when you requested an analysis report.

type FirewallArn:

string

param FirewallArn:

The Amazon Resource Name (ARN) of the firewall.

You must specify the ARN or the name, and you can specify both.

type NextToken:

string

param NextToken:

When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken value in the response. To retrieve the next batch of objects, use the token returned from the prior request in your next request.

type MaxResults:

integer

param MaxResults:

The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in a subsequent call to get the next batch of objects.

rtype:

dict

returns:

Response Syntax

{
    'Status': 'string',
    'StartTime': datetime(2015, 1, 1),
    'EndTime': datetime(2015, 1, 1),
    'ReportTime': datetime(2015, 1, 1),
    'AnalysisType': 'TLS_SNI'|'HTTP_HOST',
    'NextToken': 'string',
    'AnalysisReportResults': [
        {
            'Protocol': 'string',
            'FirstAccessed': datetime(2015, 1, 1),
            'LastAccessed': datetime(2015, 1, 1),
            'Domain': 'string',
            'Hits': {
                'Count': 123
            },
            'UniqueSources': {
                'Count': 123
            }
        },
    ]
}

Response Structure

  • (dict) --

    • Status (string) --

      The status of the analysis report you specify. Statuses include RUNNING, COMPLETED, or FAILED.

    • StartTime (datetime) --

      The date and time within the last 30 days from which to start retrieving analysis data, in UTC format (for example, YYYY-MM-DDTHH:MM:SSZ.

    • EndTime (datetime) --

      The date and time, up to the current date, from which to stop retrieving analysis data, in UTC format (for example, YYYY-MM-DDTHH:MM:SSZ).

    • ReportTime (datetime) --

      The date and time the analysis report was ran.

    • AnalysisType (string) --

      The type of traffic that will be used to generate a report.

    • NextToken (string) --

      When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken value in the response. To retrieve the next batch of objects, use the token returned from the prior request in your next request.

    • AnalysisReportResults (list) --

      Retrieves the results of a traffic analysis report.

      • (dict) --

        The results of a COMPLETED analysis report generated with StartAnalysisReport.

        For an example of traffic analysis report results, see the response syntax of GetAnalysisReportResults.

        • Protocol (string) --

          The type of traffic captured by the analysis report.

        • FirstAccessed (datetime) --

          The date and time any domain was first accessed (within the last 30 day period).

        • LastAccessed (datetime) --

          The date and time any domain was last accessed (within the last 30 day period).

        • Domain (string) --

          The most frequently accessed domains.

        • Hits (dict) --

          The number of attempts made to access a observed domain.

          • Count (integer) --

            The number of attempts made to access a domain.

        • UniqueSources (dict) --

          The number of unique source IP addresses that connected to a domain.

          • Count (integer) --

            The number of unique source IP addresses that connected to a domain.

UpdateFirewallAnalysisSettings (new) Link ¶

Enables specific types of firewall analysis on a specific firewall you define.

See also: AWS API Documentation

Request Syntax

client.update_firewall_analysis_settings(
    EnabledAnalysisTypes=[
        'TLS_SNI'|'HTTP_HOST',
    ],
    FirewallArn='string',
    FirewallName='string',
    UpdateToken='string'
)
type EnabledAnalysisTypes:

list

param EnabledAnalysisTypes:

An optional setting indicating the specific traffic analysis types to enable on the firewall.

  • (string) --

type FirewallArn:

string

param FirewallArn:

The Amazon Resource Name (ARN) of the firewall.

You must specify the ARN or the name, and you can specify both.

type FirewallName:

string

param FirewallName:

The descriptive name of the firewall. You can't change the name of a firewall after you create it.

You must specify the ARN or the name, and you can specify both.

type UpdateToken:

string

param UpdateToken:

An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request.

To make an unconditional change to the firewall, omit the token in your update request. Without the token, Network Firewall performs your updates regardless of whether the firewall has changed since you last retrieved it.

To make a conditional change to the firewall, provide the token in your update request. Network Firewall uses the token to ensure that the firewall hasn't changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the firewall again to get a current copy of it with a new token. Reapply your changes as needed, then try the operation again using the new token.

rtype:

dict

returns:

Response Syntax

{
    'EnabledAnalysisTypes': [
        'TLS_SNI'|'HTTP_HOST',
    ],
    'FirewallArn': 'string',
    'FirewallName': 'string',
    'UpdateToken': 'string'
}

Response Structure

  • (dict) --

    • EnabledAnalysisTypes (list) --

      An optional setting indicating the specific traffic analysis types to enable on the firewall.

      • (string) --

    • FirewallArn (string) --

      The Amazon Resource Name (ARN) of the firewall.

      You must specify the ARN or the name, and you can specify both.

    • FirewallName (string) --

      The descriptive name of the firewall. You can't change the name of a firewall after you create it.

      You must specify the ARN or the name, and you can specify both.

    • UpdateToken (string) --

      An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request.

      To make an unconditional change to the firewall, omit the token in your update request. Without the token, Network Firewall performs your updates regardless of whether the firewall has changed since you last retrieved it.

      To make a conditional change to the firewall, provide the token in your update request. Network Firewall uses the token to ensure that the firewall hasn't changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the firewall again to get a current copy of it with a new token. Reapply your changes as needed, then try the operation again using the new token.

ListAnalysisReports (new) Link ¶

Returns a list of all traffic analysis reports generated within the last 30 days.

See also: AWS API Documentation

Request Syntax

client.list_analysis_reports(
    FirewallName='string',
    FirewallArn='string',
    NextToken='string',
    MaxResults=123
)
type FirewallName:

string

param FirewallName:

The descriptive name of the firewall. You can't change the name of a firewall after you create it.

You must specify the ARN or the name, and you can specify both.

type FirewallArn:

string

param FirewallArn:

The Amazon Resource Name (ARN) of the firewall.

You must specify the ARN or the name, and you can specify both.

type NextToken:

string

param NextToken:

When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken value in the response. To retrieve the next batch of objects, use the token returned from the prior request in your next request.

type MaxResults:

integer

param MaxResults:

The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in a subsequent call to get the next batch of objects.

rtype:

dict

returns:

Response Syntax

{
    'AnalysisReports': [
        {
            'AnalysisReportId': 'string',
            'AnalysisType': 'TLS_SNI'|'HTTP_HOST',
            'ReportTime': datetime(2015, 1, 1),
            'Status': 'string'
        },
    ],
    'NextToken': 'string'
}

Response Structure

  • (dict) --

    • AnalysisReports (list) --

      The id and ReportTime associated with a requested analysis report. Does not provide the status of the analysis report.

      • (dict) --

        A report that captures key activity from the last 30 days of network traffic monitored by your firewall.

        You can generate up to one report per traffic type, per 30 day period. For example, when you successfully create an HTTP traffic report, you cannot create another HTTP traffic report until 30 days pass. Alternatively, if you generate a report that combines metrics on both HTTP and HTTPS traffic, you cannot create another report for either traffic type until 30 days pass.

        • AnalysisReportId (string) --

          The unique ID of the query that ran when you requested an analysis report.

        • AnalysisType (string) --

          The type of traffic that will be used to generate a report.

        • ReportTime (datetime) --

          The date and time the analysis report was ran.

        • Status (string) --

          The status of the analysis report you specify. Statuses include RUNNING, COMPLETED, or FAILED.

    • NextToken (string) --

      When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken value in the response. To retrieve the next batch of objects, use the token returned from the prior request in your next request.

StartAnalysisReport (new) Link ¶

Generates a traffic analysis report for the timeframe and traffic type you specify.

For information on the contents of a traffic analysis report, see AnalysisReport.

See also: AWS API Documentation

Request Syntax

client.start_analysis_report(
    FirewallName='string',
    FirewallArn='string',
    AnalysisType='TLS_SNI'|'HTTP_HOST'
)
type FirewallName:

string

param FirewallName:

The descriptive name of the firewall. You can't change the name of a firewall after you create it.

You must specify the ARN or the name, and you can specify both.

type FirewallArn:

string

param FirewallArn:

The Amazon Resource Name (ARN) of the firewall.

You must specify the ARN or the name, and you can specify both.

type AnalysisType:

string

param AnalysisType:

[REQUIRED]

The type of traffic that will be used to generate a report.

rtype:

dict

returns:

Response Syntax

{
    'AnalysisReportId': 'string'
}

Response Structure

  • (dict) --

    • AnalysisReportId (string) --

      The unique ID of the query that ran when you requested an analysis report.

CreateFirewall (updated) Link ¶
Changes (request, response)
Request
{'EnabledAnalysisTypes': ['TLS_SNI | HTTP_HOST']}
Response
{'Firewall': {'EnabledAnalysisTypes': ['TLS_SNI | HTTP_HOST']}}

Creates an Network Firewall Firewall and accompanying FirewallStatus for a VPC.

The firewall defines the configuration settings for an Network Firewall firewall. The settings that you can define at creation include the firewall policy, the subnets in your VPC to use for the firewall endpoints, and any tags that are attached to the firewall Amazon Web Services resource.

After you create a firewall, you can provide additional settings, like the logging configuration.

To update the settings for a firewall, you use the operations that apply to the settings themselves, for example UpdateLoggingConfiguration, AssociateSubnets, and UpdateFirewallDeleteProtection.

To manage a firewall's tags, use the standard Amazon Web Services resource tagging operations, ListTagsForResource, TagResource, and UntagResource.

To retrieve information about firewalls, use ListFirewalls and DescribeFirewall.

To generate a report on the last 30 days of traffic monitored by a firewall, use StartAnalysisReport.

See also: AWS API Documentation

Request Syntax

client.create_firewall(
    FirewallName='string',
    FirewallPolicyArn='string',
    VpcId='string',
    SubnetMappings=[
        {
            'SubnetId': 'string',
            'IPAddressType': 'DUALSTACK'|'IPV4'|'IPV6'
        },
    ],
    DeleteProtection=True|False,
    SubnetChangeProtection=True|False,
    FirewallPolicyChangeProtection=True|False,
    Description='string',
    Tags=[
        {
            'Key': 'string',
            'Value': 'string'
        },
    ],
    EncryptionConfiguration={
        'KeyId': 'string',
        'Type': 'CUSTOMER_KMS'|'AWS_OWNED_KMS_KEY'
    },
    EnabledAnalysisTypes=[
        'TLS_SNI'|'HTTP_HOST',
    ]
)
type FirewallName:

string

param FirewallName:

[REQUIRED]

The descriptive name of the firewall. You can't change the name of a firewall after you create it.

type FirewallPolicyArn:

string

param FirewallPolicyArn:

[REQUIRED]

The Amazon Resource Name (ARN) of the FirewallPolicy that you want to use for the firewall.

type VpcId:

string

param VpcId:

The unique identifier of the VPC where Network Firewall should create the firewall.

You can't change this setting after you create the firewall.

type SubnetMappings:

list

param SubnetMappings:

The public subnets to use for your Network Firewall firewalls. Each subnet must belong to a different Availability Zone in the VPC. Network Firewall creates a firewall endpoint in each subnet.

  • (dict) --

    The ID for a subnet that you want to associate with the firewall. This is used with CreateFirewall and AssociateSubnets. Network Firewall creates an instance of the associated firewall in each subnet that you specify, to filter traffic in the subnet's Availability Zone.

    • SubnetId (string) -- [REQUIRED]

      The unique identifier for the subnet.

    • IPAddressType (string) --

      The subnet's IP address type. You can't change the IP address type after you create the subnet.

type DeleteProtection:

boolean

param DeleteProtection:

A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE.

type SubnetChangeProtection:

boolean

param SubnetChangeProtection:

A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

type FirewallPolicyChangeProtection:

boolean

param FirewallPolicyChangeProtection:

A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

type Description:

string

param Description:

A description of the firewall.

type Tags:

list

param Tags:

The key:value pairs to associate with the resource.

  • (dict) --

    A key:value pair associated with an Amazon Web Services resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each Amazon Web Services resource.

    • Key (string) -- [REQUIRED]

      The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive.

    • Value (string) -- [REQUIRED]

      The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.

type EncryptionConfiguration:

dict

param EncryptionConfiguration:

A complex type that contains settings for encryption of your firewall resources.

  • KeyId (string) --

    The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide.

  • Type (string) -- [REQUIRED]

    The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.

type EnabledAnalysisTypes:

list

param EnabledAnalysisTypes:

An optional setting indicating the specific traffic analysis types to enable on the firewall.

  • (string) --

rtype:

dict

returns:

Response Syntax

{
    'Firewall': {
        'FirewallName': 'string',
        'FirewallArn': 'string',
        'FirewallPolicyArn': 'string',
        'VpcId': 'string',
        'SubnetMappings': [
            {
                'SubnetId': 'string',
                'IPAddressType': 'DUALSTACK'|'IPV4'|'IPV6'
            },
        ],
        'DeleteProtection': True|False,
        'SubnetChangeProtection': True|False,
        'FirewallPolicyChangeProtection': True|False,
        'Description': 'string',
        'FirewallId': 'string',
        'Tags': [
            {
                'Key': 'string',
                'Value': 'string'
            },
        ],
        'EncryptionConfiguration': {
            'KeyId': 'string',
            'Type': 'CUSTOMER_KMS'|'AWS_OWNED_KMS_KEY'
        },
        'EnabledAnalysisTypes': [
            'TLS_SNI'|'HTTP_HOST',
        ]
    },
    'FirewallStatus': {
        'Status': 'PROVISIONING'|'DELETING'|'READY',
        'ConfigurationSyncStateSummary': 'PENDING'|'IN_SYNC'|'CAPACITY_CONSTRAINED',
        'SyncStates': {
            'string': {
                'Attachment': {
                    'SubnetId': 'string',
                    'EndpointId': 'string',
                    'Status': 'CREATING'|'DELETING'|'FAILED'|'ERROR'|'SCALING'|'READY',
                    'StatusMessage': 'string'
                },
                'Config': {
                    'string': {
                        'SyncStatus': 'PENDING'|'IN_SYNC'|'CAPACITY_CONSTRAINED',
                        'UpdateToken': 'string'
                    }
                }
            }
        },
        'CapacityUsageSummary': {
            'CIDRs': {
                'AvailableCIDRCount': 123,
                'UtilizedCIDRCount': 123,
                'IPSetReferences': {
                    'string': {
                        'ResolvedCIDRCount': 123
                    }
                }
            }
        }
    }
}

Response Structure

  • (dict) --

    • Firewall (dict) --

      The configuration settings for the firewall. These settings include the firewall policy and the subnets in your VPC to use for the firewall endpoints.

      • FirewallName (string) --

        The descriptive name of the firewall. You can't change the name of a firewall after you create it.

      • FirewallArn (string) --

        The Amazon Resource Name (ARN) of the firewall.

      • FirewallPolicyArn (string) --

        The Amazon Resource Name (ARN) of the firewall policy.

        The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.

      • VpcId (string) --

        The unique identifier of the VPC where the firewall is in use.

      • SubnetMappings (list) --

        The public subnets that Network Firewall is using for the firewall. Each subnet must belong to a different Availability Zone.

        • (dict) --

          The ID for a subnet that you want to associate with the firewall. This is used with CreateFirewall and AssociateSubnets. Network Firewall creates an instance of the associated firewall in each subnet that you specify, to filter traffic in the subnet's Availability Zone.

          • SubnetId (string) --

            The unique identifier for the subnet.

          • IPAddressType (string) --

            The subnet's IP address type. You can't change the IP address type after you create the subnet.

      • DeleteProtection (boolean) --

        A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE.

      • SubnetChangeProtection (boolean) --

        A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

      • FirewallPolicyChangeProtection (boolean) --

        A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

      • Description (string) --

        A description of the firewall.

      • FirewallId (string) --

        The unique identifier for the firewall.

      • Tags (list) --

        • (dict) --

          A key:value pair associated with an Amazon Web Services resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each Amazon Web Services resource.

          • Key (string) --

            The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive.

          • Value (string) --

            The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.

      • EncryptionConfiguration (dict) --

        A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall.

        • KeyId (string) --

          The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide.

        • Type (string) --

          The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.

      • EnabledAnalysisTypes (list) --

        An optional setting indicating the specific traffic analysis types to enable on the firewall.

        • (string) --

    • FirewallStatus (dict) --

      Detailed information about the current status of a Firewall. You can retrieve this for a firewall by calling DescribeFirewall and providing the firewall name and ARN.

      • Status (string) --

        The readiness of the configured firewall to handle network traffic across all of the Availability Zones where you've configured it. This setting is READY only when the ConfigurationSyncStateSummary value is IN_SYNC and the Attachment Status values for all of the configured subnets are READY.

      • ConfigurationSyncStateSummary (string) --

        The configuration sync state for the firewall. This summarizes the sync states reported in the Config settings for all of the Availability Zones where you have configured the firewall.

        When you create a firewall or update its configuration, for example by adding a rule group to its firewall policy, Network Firewall distributes the configuration changes to all zones where the firewall is in use. This summary indicates whether the configuration changes have been applied everywhere.

        This status must be IN_SYNC for the firewall to be ready for use, but it doesn't indicate that the firewall is ready. The Status setting indicates firewall readiness.

      • SyncStates (dict) --

        The subnets that you've configured for use by the Network Firewall firewall. This contains one array element per Availability Zone where you've configured a subnet. These objects provide details of the information that is summarized in the ConfigurationSyncStateSummary and Status, broken down by zone and configuration object.

        • (string) --

          • (dict) --

            The status of the firewall endpoint and firewall policy configuration for a single VPC subnet.

            For each VPC subnet that you associate with a firewall, Network Firewall does the following:

            • Instantiates a firewall endpoint in the subnet, ready to take traffic.

            • Configures the endpoint with the current firewall policy settings, to provide the filtering behavior for the endpoint.

            When you update a firewall, for example to add a subnet association or change a rule group in the firewall policy, the affected sync states reflect out-of-sync or not ready status until the changes are complete.

            • Attachment (dict) --

              The attachment status of the firewall's association with a single VPC subnet. For each configured subnet, Network Firewall creates the attachment by instantiating the firewall endpoint in the subnet so that it's ready to take traffic. This is part of the FirewallStatus.

              • SubnetId (string) --

                The unique identifier of the subnet that you've specified to be used for a firewall endpoint.

              • EndpointId (string) --

                The identifier of the firewall endpoint that Network Firewall has instantiated in the subnet. You use this to identify the firewall endpoint in the VPC route tables, when you redirect the VPC traffic through the endpoint.

              • Status (string) --

                The current status of the firewall endpoint in the subnet. This value reflects both the instantiation of the endpoint in the VPC subnet and the sync states that are reported in the Config settings. When this value is READY, the endpoint is available and configured properly to handle network traffic. When the endpoint isn't available for traffic, this value will reflect its state, for example CREATING or DELETING.

              • StatusMessage (string) --

                If Network Firewall fails to create or delete the firewall endpoint in the subnet, it populates this with the reason for the error or failure and how to resolve it. A FAILED status indicates a non-recoverable state, and a ERROR status indicates an issue that you can fix. Depending on the error, it can take as many as 15 minutes to populate this field. For more information about the causes for failiure or errors and solutions available for this field, see Troubleshooting firewall endpoint failures in the Network Firewall Developer Guide.

            • Config (dict) --

              The configuration status of the firewall endpoint in a single VPC subnet. Network Firewall provides each endpoint with the rules that are configured in the firewall policy. Each time you add a subnet or modify the associated firewall policy, Network Firewall synchronizes the rules in the endpoint, so it can properly filter network traffic. This is part of the FirewallStatus.

              • (string) --

                • (dict) --

                  Provides configuration status for a single policy or rule group that is used for a firewall endpoint. Network Firewall provides each endpoint with the rules that are configured in the firewall policy. Each time you add a subnet or modify the associated firewall policy, Network Firewall synchronizes the rules in the endpoint, so it can properly filter network traffic. This is part of a SyncState for a firewall.

                  • SyncStatus (string) --

                    Indicates whether this object is in sync with the version indicated in the update token.

                  • UpdateToken (string) --

                    The current version of the object that is either in sync or pending synchronization.

      • CapacityUsageSummary (dict) --

        Describes the capacity usage of the resources contained in a firewall's reference sets. Network Firewall calclulates the capacity usage by taking an aggregated count of all of the resources used by all of the reference sets in a firewall.

        • CIDRs (dict) --

          Describes the capacity usage of the CIDR blocks used by the IP set references in a firewall.

          • AvailableCIDRCount (integer) --

            The number of CIDR blocks available for use by the IP set references in a firewall.

          • UtilizedCIDRCount (integer) --

            The number of CIDR blocks used by the IP set references in a firewall.

          • IPSetReferences (dict) --

            The list of the IP set references used by a firewall.

            • (string) --

              • (dict) --

                General information about the IP set.

                • ResolvedCIDRCount (integer) --

                  Describes the total number of CIDR blocks currently in use by the IP set references in a firewall. To determine how many CIDR blocks are available for you to use in a firewall, you can call AvailableCIDRCount.

DeleteFirewall (updated) Link ¶
Changes (response)
{'Firewall': {'EnabledAnalysisTypes': ['TLS_SNI | HTTP_HOST']}}

Deletes the specified Firewall and its FirewallStatus. This operation requires the firewall's DeleteProtection flag to be FALSE. You can't revert this operation.

You can check whether a firewall is in use by reviewing the route tables for the Availability Zones where you have firewall subnet mappings. Retrieve the subnet mappings by calling DescribeFirewall. You define and update the route tables through Amazon VPC. As needed, update the route tables for the zones to remove the firewall endpoints. When the route tables no longer use the firewall endpoints, you can remove the firewall safely.

To delete a firewall, remove the delete protection if you need to using UpdateFirewallDeleteProtection, then delete the firewall by calling DeleteFirewall.

See also: AWS API Documentation

Request Syntax

client.delete_firewall(
    FirewallName='string',
    FirewallArn='string'
)
type FirewallName:

string

param FirewallName:

The descriptive name of the firewall. You can't change the name of a firewall after you create it.

You must specify the ARN or the name, and you can specify both.

type FirewallArn:

string

param FirewallArn:

The Amazon Resource Name (ARN) of the firewall.

You must specify the ARN or the name, and you can specify both.

rtype:

dict

returns:

Response Syntax

{
    'Firewall': {
        'FirewallName': 'string',
        'FirewallArn': 'string',
        'FirewallPolicyArn': 'string',
        'VpcId': 'string',
        'SubnetMappings': [
            {
                'SubnetId': 'string',
                'IPAddressType': 'DUALSTACK'|'IPV4'|'IPV6'
            },
        ],
        'DeleteProtection': True|False,
        'SubnetChangeProtection': True|False,
        'FirewallPolicyChangeProtection': True|False,
        'Description': 'string',
        'FirewallId': 'string',
        'Tags': [
            {
                'Key': 'string',
                'Value': 'string'
            },
        ],
        'EncryptionConfiguration': {
            'KeyId': 'string',
            'Type': 'CUSTOMER_KMS'|'AWS_OWNED_KMS_KEY'
        },
        'EnabledAnalysisTypes': [
            'TLS_SNI'|'HTTP_HOST',
        ]
    },
    'FirewallStatus': {
        'Status': 'PROVISIONING'|'DELETING'|'READY',
        'ConfigurationSyncStateSummary': 'PENDING'|'IN_SYNC'|'CAPACITY_CONSTRAINED',
        'SyncStates': {
            'string': {
                'Attachment': {
                    'SubnetId': 'string',
                    'EndpointId': 'string',
                    'Status': 'CREATING'|'DELETING'|'FAILED'|'ERROR'|'SCALING'|'READY',
                    'StatusMessage': 'string'
                },
                'Config': {
                    'string': {
                        'SyncStatus': 'PENDING'|'IN_SYNC'|'CAPACITY_CONSTRAINED',
                        'UpdateToken': 'string'
                    }
                }
            }
        },
        'CapacityUsageSummary': {
            'CIDRs': {
                'AvailableCIDRCount': 123,
                'UtilizedCIDRCount': 123,
                'IPSetReferences': {
                    'string': {
                        'ResolvedCIDRCount': 123
                    }
                }
            }
        }
    }
}

Response Structure

  • (dict) --

    • Firewall (dict) --

      The firewall defines the configuration settings for an Network Firewall firewall. These settings include the firewall policy, the subnets in your VPC to use for the firewall endpoints, and any tags that are attached to the firewall Amazon Web Services resource.

      The status of the firewall, for example whether it's ready to filter network traffic, is provided in the corresponding FirewallStatus. You can retrieve both objects by calling DescribeFirewall.

      • FirewallName (string) --

        The descriptive name of the firewall. You can't change the name of a firewall after you create it.

      • FirewallArn (string) --

        The Amazon Resource Name (ARN) of the firewall.

      • FirewallPolicyArn (string) --

        The Amazon Resource Name (ARN) of the firewall policy.

        The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.

      • VpcId (string) --

        The unique identifier of the VPC where the firewall is in use.

      • SubnetMappings (list) --

        The public subnets that Network Firewall is using for the firewall. Each subnet must belong to a different Availability Zone.

        • (dict) --

          The ID for a subnet that you want to associate with the firewall. This is used with CreateFirewall and AssociateSubnets. Network Firewall creates an instance of the associated firewall in each subnet that you specify, to filter traffic in the subnet's Availability Zone.

          • SubnetId (string) --

            The unique identifier for the subnet.

          • IPAddressType (string) --

            The subnet's IP address type. You can't change the IP address type after you create the subnet.

      • DeleteProtection (boolean) --

        A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE.

      • SubnetChangeProtection (boolean) --

        A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

      • FirewallPolicyChangeProtection (boolean) --

        A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

      • Description (string) --

        A description of the firewall.

      • FirewallId (string) --

        The unique identifier for the firewall.

      • Tags (list) --

        • (dict) --

          A key:value pair associated with an Amazon Web Services resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each Amazon Web Services resource.

          • Key (string) --

            The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive.

          • Value (string) --

            The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.

      • EncryptionConfiguration (dict) --

        A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall.

        • KeyId (string) --

          The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide.

        • Type (string) --

          The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.

      • EnabledAnalysisTypes (list) --

        An optional setting indicating the specific traffic analysis types to enable on the firewall.

        • (string) --

    • FirewallStatus (dict) --

      Detailed information about the current status of a Firewall. You can retrieve this for a firewall by calling DescribeFirewall and providing the firewall name and ARN.

      • Status (string) --

        The readiness of the configured firewall to handle network traffic across all of the Availability Zones where you've configured it. This setting is READY only when the ConfigurationSyncStateSummary value is IN_SYNC and the Attachment Status values for all of the configured subnets are READY.

      • ConfigurationSyncStateSummary (string) --

        The configuration sync state for the firewall. This summarizes the sync states reported in the Config settings for all of the Availability Zones where you have configured the firewall.

        When you create a firewall or update its configuration, for example by adding a rule group to its firewall policy, Network Firewall distributes the configuration changes to all zones where the firewall is in use. This summary indicates whether the configuration changes have been applied everywhere.

        This status must be IN_SYNC for the firewall to be ready for use, but it doesn't indicate that the firewall is ready. The Status setting indicates firewall readiness.

      • SyncStates (dict) --

        The subnets that you've configured for use by the Network Firewall firewall. This contains one array element per Availability Zone where you've configured a subnet. These objects provide details of the information that is summarized in the ConfigurationSyncStateSummary and Status, broken down by zone and configuration object.

        • (string) --

          • (dict) --

            The status of the firewall endpoint and firewall policy configuration for a single VPC subnet.

            For each VPC subnet that you associate with a firewall, Network Firewall does the following:

            • Instantiates a firewall endpoint in the subnet, ready to take traffic.

            • Configures the endpoint with the current firewall policy settings, to provide the filtering behavior for the endpoint.

            When you update a firewall, for example to add a subnet association or change a rule group in the firewall policy, the affected sync states reflect out-of-sync or not ready status until the changes are complete.

            • Attachment (dict) --

              The attachment status of the firewall's association with a single VPC subnet. For each configured subnet, Network Firewall creates the attachment by instantiating the firewall endpoint in the subnet so that it's ready to take traffic. This is part of the FirewallStatus.

              • SubnetId (string) --

                The unique identifier of the subnet that you've specified to be used for a firewall endpoint.

              • EndpointId (string) --

                The identifier of the firewall endpoint that Network Firewall has instantiated in the subnet. You use this to identify the firewall endpoint in the VPC route tables, when you redirect the VPC traffic through the endpoint.

              • Status (string) --

                The current status of the firewall endpoint in the subnet. This value reflects both the instantiation of the endpoint in the VPC subnet and the sync states that are reported in the Config settings. When this value is READY, the endpoint is available and configured properly to handle network traffic. When the endpoint isn't available for traffic, this value will reflect its state, for example CREATING or DELETING.

              • StatusMessage (string) --

                If Network Firewall fails to create or delete the firewall endpoint in the subnet, it populates this with the reason for the error or failure and how to resolve it. A FAILED status indicates a non-recoverable state, and a ERROR status indicates an issue that you can fix. Depending on the error, it can take as many as 15 minutes to populate this field. For more information about the causes for failiure or errors and solutions available for this field, see Troubleshooting firewall endpoint failures in the Network Firewall Developer Guide.

            • Config (dict) --

              The configuration status of the firewall endpoint in a single VPC subnet. Network Firewall provides each endpoint with the rules that are configured in the firewall policy. Each time you add a subnet or modify the associated firewall policy, Network Firewall synchronizes the rules in the endpoint, so it can properly filter network traffic. This is part of the FirewallStatus.

              • (string) --

                • (dict) --

                  Provides configuration status for a single policy or rule group that is used for a firewall endpoint. Network Firewall provides each endpoint with the rules that are configured in the firewall policy. Each time you add a subnet or modify the associated firewall policy, Network Firewall synchronizes the rules in the endpoint, so it can properly filter network traffic. This is part of a SyncState for a firewall.

                  • SyncStatus (string) --

                    Indicates whether this object is in sync with the version indicated in the update token.

                  • UpdateToken (string) --

                    The current version of the object that is either in sync or pending synchronization.

      • CapacityUsageSummary (dict) --

        Describes the capacity usage of the resources contained in a firewall's reference sets. Network Firewall calclulates the capacity usage by taking an aggregated count of all of the resources used by all of the reference sets in a firewall.

        • CIDRs (dict) --

          Describes the capacity usage of the CIDR blocks used by the IP set references in a firewall.

          • AvailableCIDRCount (integer) --

            The number of CIDR blocks available for use by the IP set references in a firewall.

          • UtilizedCIDRCount (integer) --

            The number of CIDR blocks used by the IP set references in a firewall.

          • IPSetReferences (dict) --

            The list of the IP set references used by a firewall.

            • (string) --

              • (dict) --

                General information about the IP set.

                • ResolvedCIDRCount (integer) --

                  Describes the total number of CIDR blocks currently in use by the IP set references in a firewall. To determine how many CIDR blocks are available for you to use in a firewall, you can call AvailableCIDRCount.

DescribeFirewall (updated) Link ¶
Changes (response)
{'Firewall': {'EnabledAnalysisTypes': ['TLS_SNI | HTTP_HOST']}}

Returns the data objects for the specified firewall.

See also: AWS API Documentation

Request Syntax

client.describe_firewall(
    FirewallName='string',
    FirewallArn='string'
)
type FirewallName:

string

param FirewallName:

The descriptive name of the firewall. You can't change the name of a firewall after you create it.

You must specify the ARN or the name, and you can specify both.

type FirewallArn:

string

param FirewallArn:

The Amazon Resource Name (ARN) of the firewall.

You must specify the ARN or the name, and you can specify both.

rtype:

dict

returns:

Response Syntax

{
    'UpdateToken': 'string',
    'Firewall': {
        'FirewallName': 'string',
        'FirewallArn': 'string',
        'FirewallPolicyArn': 'string',
        'VpcId': 'string',
        'SubnetMappings': [
            {
                'SubnetId': 'string',
                'IPAddressType': 'DUALSTACK'|'IPV4'|'IPV6'
            },
        ],
        'DeleteProtection': True|False,
        'SubnetChangeProtection': True|False,
        'FirewallPolicyChangeProtection': True|False,
        'Description': 'string',
        'FirewallId': 'string',
        'Tags': [
            {
                'Key': 'string',
                'Value': 'string'
            },
        ],
        'EncryptionConfiguration': {
            'KeyId': 'string',
            'Type': 'CUSTOMER_KMS'|'AWS_OWNED_KMS_KEY'
        },
        'EnabledAnalysisTypes': [
            'TLS_SNI'|'HTTP_HOST',
        ]
    },
    'FirewallStatus': {
        'Status': 'PROVISIONING'|'DELETING'|'READY',
        'ConfigurationSyncStateSummary': 'PENDING'|'IN_SYNC'|'CAPACITY_CONSTRAINED',
        'SyncStates': {
            'string': {
                'Attachment': {
                    'SubnetId': 'string',
                    'EndpointId': 'string',
                    'Status': 'CREATING'|'DELETING'|'FAILED'|'ERROR'|'SCALING'|'READY',
                    'StatusMessage': 'string'
                },
                'Config': {
                    'string': {
                        'SyncStatus': 'PENDING'|'IN_SYNC'|'CAPACITY_CONSTRAINED',
                        'UpdateToken': 'string'
                    }
                }
            }
        },
        'CapacityUsageSummary': {
            'CIDRs': {
                'AvailableCIDRCount': 123,
                'UtilizedCIDRCount': 123,
                'IPSetReferences': {
                    'string': {
                        'ResolvedCIDRCount': 123
                    }
                }
            }
        }
    }
}

Response Structure

  • (dict) --

    • UpdateToken (string) --

      An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request.

      To make an unconditional change to the firewall, omit the token in your update request. Without the token, Network Firewall performs your updates regardless of whether the firewall has changed since you last retrieved it.

      To make a conditional change to the firewall, provide the token in your update request. Network Firewall uses the token to ensure that the firewall hasn't changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the firewall again to get a current copy of it with a new token. Reapply your changes as needed, then try the operation again using the new token.

    • Firewall (dict) --

      The configuration settings for the firewall. These settings include the firewall policy and the subnets in your VPC to use for the firewall endpoints.

      • FirewallName (string) --

        The descriptive name of the firewall. You can't change the name of a firewall after you create it.

      • FirewallArn (string) --

        The Amazon Resource Name (ARN) of the firewall.

      • FirewallPolicyArn (string) --

        The Amazon Resource Name (ARN) of the firewall policy.

        The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.

      • VpcId (string) --

        The unique identifier of the VPC where the firewall is in use.

      • SubnetMappings (list) --

        The public subnets that Network Firewall is using for the firewall. Each subnet must belong to a different Availability Zone.

        • (dict) --

          The ID for a subnet that you want to associate with the firewall. This is used with CreateFirewall and AssociateSubnets. Network Firewall creates an instance of the associated firewall in each subnet that you specify, to filter traffic in the subnet's Availability Zone.

          • SubnetId (string) --

            The unique identifier for the subnet.

          • IPAddressType (string) --

            The subnet's IP address type. You can't change the IP address type after you create the subnet.

      • DeleteProtection (boolean) --

        A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE.

      • SubnetChangeProtection (boolean) --

        A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

      • FirewallPolicyChangeProtection (boolean) --

        A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

      • Description (string) --

        A description of the firewall.

      • FirewallId (string) --

        The unique identifier for the firewall.

      • Tags (list) --

        • (dict) --

          A key:value pair associated with an Amazon Web Services resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each Amazon Web Services resource.

          • Key (string) --

            The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive.

          • Value (string) --

            The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.

      • EncryptionConfiguration (dict) --

        A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall.

        • KeyId (string) --

          The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide.

        • Type (string) --

          The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.

      • EnabledAnalysisTypes (list) --

        An optional setting indicating the specific traffic analysis types to enable on the firewall.

        • (string) --

    • FirewallStatus (dict) --

      Detailed information about the current status of a Firewall. You can retrieve this for a firewall by calling DescribeFirewall and providing the firewall name and ARN.

      • Status (string) --

        The readiness of the configured firewall to handle network traffic across all of the Availability Zones where you've configured it. This setting is READY only when the ConfigurationSyncStateSummary value is IN_SYNC and the Attachment Status values for all of the configured subnets are READY.

      • ConfigurationSyncStateSummary (string) --

        The configuration sync state for the firewall. This summarizes the sync states reported in the Config settings for all of the Availability Zones where you have configured the firewall.

        When you create a firewall or update its configuration, for example by adding a rule group to its firewall policy, Network Firewall distributes the configuration changes to all zones where the firewall is in use. This summary indicates whether the configuration changes have been applied everywhere.

        This status must be IN_SYNC for the firewall to be ready for use, but it doesn't indicate that the firewall is ready. The Status setting indicates firewall readiness.

      • SyncStates (dict) --

        The subnets that you've configured for use by the Network Firewall firewall. This contains one array element per Availability Zone where you've configured a subnet. These objects provide details of the information that is summarized in the ConfigurationSyncStateSummary and Status, broken down by zone and configuration object.

        • (string) --

          • (dict) --

            The status of the firewall endpoint and firewall policy configuration for a single VPC subnet.

            For each VPC subnet that you associate with a firewall, Network Firewall does the following:

            • Instantiates a firewall endpoint in the subnet, ready to take traffic.

            • Configures the endpoint with the current firewall policy settings, to provide the filtering behavior for the endpoint.

            When you update a firewall, for example to add a subnet association or change a rule group in the firewall policy, the affected sync states reflect out-of-sync or not ready status until the changes are complete.

            • Attachment (dict) --

              The attachment status of the firewall's association with a single VPC subnet. For each configured subnet, Network Firewall creates the attachment by instantiating the firewall endpoint in the subnet so that it's ready to take traffic. This is part of the FirewallStatus.

              • SubnetId (string) --

                The unique identifier of the subnet that you've specified to be used for a firewall endpoint.

              • EndpointId (string) --

                The identifier of the firewall endpoint that Network Firewall has instantiated in the subnet. You use this to identify the firewall endpoint in the VPC route tables, when you redirect the VPC traffic through the endpoint.

              • Status (string) --

                The current status of the firewall endpoint in the subnet. This value reflects both the instantiation of the endpoint in the VPC subnet and the sync states that are reported in the Config settings. When this value is READY, the endpoint is available and configured properly to handle network traffic. When the endpoint isn't available for traffic, this value will reflect its state, for example CREATING or DELETING.

              • StatusMessage (string) --

                If Network Firewall fails to create or delete the firewall endpoint in the subnet, it populates this with the reason for the error or failure and how to resolve it. A FAILED status indicates a non-recoverable state, and a ERROR status indicates an issue that you can fix. Depending on the error, it can take as many as 15 minutes to populate this field. For more information about the causes for failiure or errors and solutions available for this field, see Troubleshooting firewall endpoint failures in the Network Firewall Developer Guide.

            • Config (dict) --

              The configuration status of the firewall endpoint in a single VPC subnet. Network Firewall provides each endpoint with the rules that are configured in the firewall policy. Each time you add a subnet or modify the associated firewall policy, Network Firewall synchronizes the rules in the endpoint, so it can properly filter network traffic. This is part of the FirewallStatus.

              • (string) --

                • (dict) --

                  Provides configuration status for a single policy or rule group that is used for a firewall endpoint. Network Firewall provides each endpoint with the rules that are configured in the firewall policy. Each time you add a subnet or modify the associated firewall policy, Network Firewall synchronizes the rules in the endpoint, so it can properly filter network traffic. This is part of a SyncState for a firewall.

                  • SyncStatus (string) --

                    Indicates whether this object is in sync with the version indicated in the update token.

                  • UpdateToken (string) --

                    The current version of the object that is either in sync or pending synchronization.

      • CapacityUsageSummary (dict) --

        Describes the capacity usage of the resources contained in a firewall's reference sets. Network Firewall calclulates the capacity usage by taking an aggregated count of all of the resources used by all of the reference sets in a firewall.

        • CIDRs (dict) --

          Describes the capacity usage of the CIDR blocks used by the IP set references in a firewall.

          • AvailableCIDRCount (integer) --

            The number of CIDR blocks available for use by the IP set references in a firewall.

          • UtilizedCIDRCount (integer) --

            The number of CIDR blocks used by the IP set references in a firewall.

          • IPSetReferences (dict) --

            The list of the IP set references used by a firewall.

            • (string) --

              • (dict) --

                General information about the IP set.

                • ResolvedCIDRCount (integer) --

                  Describes the total number of CIDR blocks currently in use by the IP set references in a firewall. To determine how many CIDR blocks are available for you to use in a firewall, you can call AvailableCIDRCount.