Terrablox
GitHubStart
Module library

Network Firewall

Terraform module to create AWS Network Firewall resources

Version
v2.3.0
Repository
terrablox-aws-network-firewall
Submodules
firewallpolicyrule-group

Inputs

40
availability_zone_change_protectionoptionalbool

A setting indicating whether the firewall is protected against changes to its Availability Zone configuration. When set to true, you must first disable this protection before adding or removing Availability Zones

Defaultnull
availability_zone_mappingoptionallist(object({ availability_zone_id = string }))

Required when creating a transit gateway-attached firewall. Set of configuration blocks describing the avaiability availability where you want to create firewall endpoints for a transit gateway-attached firewall

Defaultnull
createoptionalbool

Controls if resources should be created

Defaulttrue
create_logging_configurationoptionalbool

Controls if a Logging Configuration should be created

Defaultnull
create_policyoptionalbool

Controls if policy should be created

Defaulttrue
create_policy_resource_policyoptionalbool

Controls if a resource policy should be created

Defaultnull
delete_protectionoptionalbool

A boolean flag indicating whether it is possible to delete the firewall. Defaults to `true`

Defaulttrue
descriptionoptionalstring

A friendly description of the firewall

Default""
enable_monitoring_dashboardoptionalbool

Whether to enable monitoring dashboard for the logging configuration

Defaultnull
enabled_analysis_typesoptionallist(string)

Set of types for which to collect analysis metrics. Valid values: `TLS_SNI`, `HTTP_HOST`. Defaults to `[]`

Defaultnull
encryption_configurationoptionalobject({ key_id = optional(string) type = string })

KMS encryption configuration settings

Defaultnull
firewall_policy_arnoptionalstring

The ARN of the Firewall Policy to use

Default""
firewall_policy_change_protectionoptionalbool

A boolean flag indicating whether it is possible to change the associated firewall policy. Defaults to `false`

Defaultnull
logging_configuration_destination_configoptionallist(object({ log_destination = map(string) log_destination_type = string log_ty…

A list of min 1, max 2 configuration blocks describing the destination for the logging configuration

Defaultnull
nameoptionalstring

A friendly name of the firewall

Default""
policy_attach_resource_policyoptionalbool

Controls if a resource policy should be attached to the firewall policy

Defaultnull
policy_descriptionoptionalstring

A friendly description of the firewall policy

Defaultnull
policy_enable_tls_session_holdingoptionalbool

Whether to allow the firewall to hold TLS sessions to allow TLS traffic processing before downstream connection establishment. When set to `true`, adds latency — enable only if TLS.SNI rule groups are active in the policy

Defaultnull
policy_encryption_configurationoptionalobject({ key_id = optional(string) type = string })

KMS encryption configuration settings

Defaultnull
policy_nameoptionalstring

A friendly name of the firewall policy

Default""
policy_ram_resource_associationsoptionalmap(string)

A map of RAM resource associations for the created firewall policy

Defaultnull
policy_resource_policyoptionalstring

The policy JSON to use for the resource policy; required when `create_resource_policy` is `false`

Default""
policy_resource_policy_actionsoptionallist(string)

A list of IAM actions allowed in the resource policy

Defaultnull
policy_resource_policy_principalsoptionallist(string)

A list of IAM principals allowed in the resource policy

Defaultnull
policy_stateful_default_actionsoptionallist(string)

Set of actions to take on a packet if it does not match any stateful rules in the policy. This can only be specified if the policy has a `stateful_engine_options` block with a rule_order value of `STRICT_ORDER`. You can specify one of either or neither values of `aws:drop_strict` or `aws:drop_establ…

Defaultnull
policy_stateful_engine_optionsoptionalobject({ flow_timeouts = optional(object({ tcp_idle_timeout_seconds = optional(n…

A configuration block that defines options on how the policy handles stateful rules. See [Stateful Engine Options](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall_policy#stateful-engine-options) for details

Defaultnull
policy_stateful_rule_group_referenceoptionalmap(object({ deep_threat_inspection = optional(bool) override = optional(object(…

Set of configuration blocks containing references to the stateful rule groups that are used in the policy. See [Stateful Rule Group Reference](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall_policy#stateful-rule-group-reference) for details

Defaultnull
policy_stateless_custom_actionoptionalmap(object({ action_definition = object({ publish_metric_action = optional(objec…

Set of configuration blocks describing the custom action definitions that are available for use in the firewall policy's `stateless_default_actions`

Defaultnull
policy_stateless_default_actionsoptionallist(string)

Set of actions to take on a packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: `aws:drop`, `aws:pass`, or `aws:forward_to_sfe`

Defaultnull
policy_stateless_fragment_default_actionsoptionallist(string)

Set of actions to take on a fragmented packet if it does not match any of the stateless rules in the policy. You must specify one of the standard actions including: `aws:drop`, `aws:pass`, or `aws:forward_to_sfe`

Defaultnull
policy_stateless_rule_group_referenceoptionalmap(object({ priority = number resource_arn = string }))

Set of configuration blocks containing references to the stateless rule groups that are used in the policy. See [Stateless Rule Group Reference](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/networkfirewall_firewall_policy#stateless-rule-group-reference) for details

Defaultnull
policy_tagsoptionalmap(string)

A map of tags to add to all resources

Default{}
policy_tls_inspection_configuration_arnoptionalstring

The ARN of the TLS inspection configuration to associate with the firewall policy

Defaultnull
policy_variablesoptionalobject({ rule_variables = list(object({ ip_set = optional(object({ definition = …

Contains variables that you can use to override default Suricata settings in your firewall policy

Defaultnull
regionoptionalstring

Region where the resource(s) will be managed. Defaults to the Region set in the provider configuration

Defaultnull
subnet_change_protectionoptionalbool

A boolean flag indicating whether it is possible to change the associated subnet(s). Defaults to `true`

Defaulttrue
subnet_mappingoptionalmap(object({ ip_address_type = optional(string) subnet_id = string }))

Set of configuration blocks describing the public subnets. Each subnet must belong to a different Availability Zone in the VPC. AWS Network Firewall creates a firewall endpoint in each subnet

Defaultnull
tagsoptionalmap(string)

A map of tags to add to all resources

Default{}
transit_gateway_idoptionalstring

The ID of the transit gateway to which the firewall is attached. Required when creating a transit gateway-attached firewall

Defaultnull
vpc_idoptionalstring

The unique identifier of the VPC where AWS Network Firewall should create the firewall

Defaultnull

All 40 are optional — the module deploys with none of them set.

Outputs

9
arn

The Amazon Resource Name (ARN) that identifies the firewall

id

The Amazon Resource Name (ARN) that identifies the firewall

logging_configuration_id

The Amazon Resource Name (ARN) of the associated firewall

policy_arn

The Amazon Resource Name (ARN) that identifies the firewall policy

policy_id

The Amazon Resource Name (ARN) that identifies the firewall policy

policy_resource_policy_id

The Amazon Resource Name (ARN) of the firewall policy associated with the resource policy

policy_update_token

A string token used when updating a firewall policy

status

Nested list of information about the current status of the firewall

update_token

A string token used when updating a firewall

What the agent wires into the next module. An edge on the architecture diagram is one of these consumed by something else.