Optional 37

• availability_zone_change_protectionbool, default null A setting indicating whether the firewall is protected against changes to its Availability Zone configuration. When set to true, you must first disable this protection before adding or removing Availability Zones
• availability_zone_mappinglist({...}), default nullRequired when creating a transit gateway-attached firewall. Set of configuration blocks describing the avaiability availability where you want to create firewall endpoints for a transit gateway-attached firewall
• createbool, default trueControls if resources should be created
• create_logging_configurationbool, default nullControls if a Logging Configuration should be created
• create_policybool, default trueControls if policy should be created
• create_policy_resource_policybool, default nullControls if a resource policy should be created
• delete_protectionbool, default trueA boolean flag indicating whether it is possible to delete the firewall. Defaults to true
• descriptionstring, default ""A friendly description of the firewall
• enabled_analysis_typeslist(string), default nullSet of types for which to collect analysis metrics. Valid values: TLS_SNI, HTTP_HOST. Defaults to []
• encryption_configurationobject({...}), default nullKMS encryption configuration settings
• firewall_policy_arnstring, default ""The ARN of the Firewall Policy to use
• firewall_policy_change_protectionbool, default nullA boolean flag indicating whether it is possible to change the associated firewall policy. Defaults to false
• logging_configuration_destination_configlist({...}), default nullA list of min 1, max 2 configuration blocks describing the destination for the logging configuration
• namestring, default ""A friendly name of the firewall
• policy_attach_resource_policybool, default nullControls if a resource policy should be attached to the firewall policy
• policy_descriptionstring, default nullA friendly description of the firewall policy
• policy_encryption_configurationobject({...}), default nullKMS encryption configuration settings
• policy_namestring, default ""A friendly name of the firewall policy
• policy_ram_resource_associationsmap(string), default nullA map of RAM resource associations for the created firewall policy
• policy_resource_policystring, default ""The policy JSON to use for the resource policy; required when create_resource_policy is false
• policy_resource_policy_actionslist(string), default nullA list of IAM actions allowed in the resource policy
• policy_resource_policy_principalslist(string), default nullA list of IAM principals allowed in the resource policy
• policy_stateful_default_actionslist(string), default nullSet of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a stateful_engine_options block with a rule_order value of STRICT_ORDER. You can specify one of either or neither values of aws:drop_strict or aws:drop_established, as well as any combination of aws:alert_strict and aws:alert_established
• policy_stateful_engine_optionsobject({...}), default nullA configuration block that defines options on how the policy handles stateful rules. See [Stateful Engine Options](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall_policy#stateful-engine-options) for details
• policy_stateful_rule_group_referencemap({...}), default nullSet of configuration blocks containing references to the stateful rule groups that are used in the policy. See [Stateful Rule Group Reference](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall_policy#stateful-rule-group-reference) for details
• policy_stateless_custom_actionmap({...}), default nullSet of configuration blocks describing the custom action definitions that are available for use in the firewall policy's stateless_default_actions
• policy_stateless_default_actionslist(string), default nullSet of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe
• policy_stateless_fragment_default_actionslist(string), default nullSet of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: aws:drop, aws:pass, or aws:forward_to_sfe
• policy_stateless_rule_group_referencemap({...}), default nullSet of configuration blocks containing references to the stateless rule groups that are used in the policy. See [Stateless Rule Group Reference](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall_policy#stateless-rule-group-reference) for details
• policy_tagsmap(string), default {}A map of tags to add to all resources
• policy_variablesobject({...}), default nullContains variables that you can use to override default Suricata settings in your firewall policy
• regionstring, default nullRegion where the resource(s) will be managed. Defaults to the Region set in the provider configuration
• subnet_change_protectionbool, default trueA boolean flag indicating whether it is possible to change the associated subnet(s). Defaults to true
• subnet_mappingmap({...}), default nullSet of configuration blocks describing the public subnets. Each subnet must belong to a different Availability Zone in the VPC. AWS Network Firewall creates a firewall endpoint in each subnet
• tagsmap(string), default {}A map of tags to add to all resources
• transit_gateway_idstring, default nullThe ID of the transit gateway to which the firewall is attached. Required when creating a transit gateway-attached firewall
• vpc_idstring, default nullThe unique identifier of the VPC where AWS Network Firewall should create the firewall