| Column Name | Column Data Type |
|---|
firewall_arn Input Column
The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. | VARCHAR |
firewall_name Input Column
The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. | VARCHAR |
_aws_profile Input Column
The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role. | STRUCT(
"type" VARCHAR,
"name" VARCHAR,
"account_id" VARCHAR,
"via_profile_name" VARCHAR,
"assumed_role_arn" VARCHAR,
"organization" STRUCT(
"account_name" VARCHAR,
"id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"master_account" STRUCT(
"id" VARCHAR,
"email" VARCHAR
),
"parents" STRUCT(
"type" VARCHAR,
"id" VARCHAR,
"name" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[]
)[]
)
) |
Show child fields- _aws_profile.account_id
The AWS account id - _aws_profile.assumed_role_arn
The ARN of the assumed role - _aws_profile.name
The unique name of the profile. - _aws_profile.organization
Information about this profile's membership in the AWS organization. Show child fields- _aws_profile.organization.account_name
The name of account speciifed by the organization - _aws_profile.organization.id
The organization id - _aws_profile.organization.master_account
Show child fields- _aws_profile.organization.master_account.email
The organization master account email address - _aws_profile.organization.master_account.id
The organization master account id
- _aws_profile.organization.parents[]
Show child fields- _aws_profile.organization.parents[].id
The id of the parent - _aws_profile.organization.parents[].name
The name of the parent - _aws_profile.organization.parents[].tags[]
Show child fields- _aws_profile.organization.parents[].tags[].key
- _aws_profile.organization.parents[].tags[].value
- _aws_profile.organization.parents[].type
The type of parent can be an organization unit or a root
- _aws_profile.organization.tags[]
Show child fields- _aws_profile.organization.tags[].key
- _aws_profile.organization.tags[].value
- _aws_profile.type
The type of profile, either 'credentials' or 'assumed_role' - _aws_profile.via_profile_name
This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.
|
_aws_region Input Column
The AWS region to use. | VARCHAR |
firewall
The configuration settings for the firewall. These settings include the firewall policy and the subnets in your VPC to use for the firewall endpoints. | STRUCT(
"firewall_name" VARCHAR,
"firewall_arn" VARCHAR,
"firewall_policy_arn" VARCHAR,
"vpc_id" VARCHAR,
"subnet_mappings" STRUCT(
"subnet_id" VARCHAR,
"ip_address_type" VARCHAR
)[],
"delete_protection" BOOLEAN,
"subnet_change_protection" BOOLEAN,
"firewall_policy_change_protection" BOOLEAN,
"description" VARCHAR,
"firewall_id" VARCHAR,
"tags" STRUCT(
"key" VARCHAR,
"value" VARCHAR
)[],
"encryption_configuration" STRUCT(
"key_id" VARCHAR,
"type" VARCHAR
)
) |
Show child fields- firewall.delete_protection
A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE. - firewall.description
A description of the firewall. - firewall.encryption_configuration
A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall. Show child fields- firewall.encryption_configuration.key_id
The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide. - firewall.encryption_configuration.type
The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources.
- firewall.firewall_arn
The Amazon Resource Name (ARN) of the firewall. - firewall.firewall_id
The unique identifier for the firewall. - firewall.firewall_name
The descriptive name of the firewall. You can't change the name of a firewall after you create it. - firewall.firewall_policy_arn
The Amazon Resource Name (ARN) of the firewall policy. The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls. - firewall.firewall_policy_change_protection
A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE. - firewall.subnet_change_protection
A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE. - firewall.subnet_mappings[]
Show child fields- firewall.subnet_mappings[].ip_address_type
The subnet's IP address type. You can't change the IP address type after you create the subnet. - firewall.subnet_mappings[].subnet_id
The unique identifier for the subnet.
- firewall.tags[]
Show child fields- firewall.tags[].key
The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive. - firewall.tags[].value
The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.
- firewall.vpc_id
The unique identifier of the VPC where the firewall is in use.
|
firewall_status
Detailed information about the current status of a Firewall. You can retrieve this for a firewall by calling DescribeFirewall and providing the firewall name and ARN. | STRUCT(
"status" VARCHAR,
"configuration_sync_state_summary" VARCHAR,
"sync_states" MAP(VARCHAR, STRUCT(
"attachment" STRUCT(
"subnet_id" VARCHAR,
"endpoint_id" VARCHAR,
"status" VARCHAR,
"status_message" VARCHAR
),
"config" MAP(VARCHAR, STRUCT(
"sync_status" VARCHAR,
"update_token" VARCHAR
))
)),
"capacity_usage_summary" STRUCT(
"cid_rs" STRUCT(
"available_cidr_count" BIGINT,
"utilized_cidr_count" BIGINT,
"ip_set_references" MAP(VARCHAR, STRUCT(
"resolved_cidr_count" BIGINT
))
)
)
) |
Show child fields- firewall_status.capacity_usage_summary
Describes the capacity usage of the resources contained in a firewall's reference sets. Network Firewall calclulates the capacity usage by taking an aggregated count of all of the resources used by all of the reference sets in a firewall. Show child fields- firewall_status.capacity_usage_summary.cid_rs
Describes the capacity usage of the CIDR blocks used by the IP set references in a firewall. Show child fields- firewall_status.capacity_usage_summary.cid_rs.available_cidr_count
The number of CIDR blocks available for use by the IP set references in a firewall. - firewall_status.capacity_usage_summary.cid_rs.ip_set_references
The list of the IP set references used by a firewall. - firewall_status.capacity_usage_summary.cid_rs.utilized_cidr_count
The number of CIDR blocks used by the IP set references in a firewall.
- firewall_status.configuration_sync_state_summary
The configuration sync state for the firewall. This summarizes the sync states reported in the Config settings for all of the Availability Zones where you have configured the firewall. When you create a firewall or update its configuration, for example by adding a rule group to its firewall policy, Network Firewall distributes the configuration changes to all zones where the firewall is in use. This summary indicates whether the configuration changes have been applied everywhere. This status must be IN_SYNC for the firewall to be ready for use, but it doesn't indicate that the firewall is ready. The Status setting indicates firewall readiness. - firewall_status.status
The readiness of the configured firewall to handle network traffic across all of the Availability Zones where you've configured it. This setting is READY only when the ConfigurationSyncStateSummary value is IN_SYNC and the Attachment Status values for all of the configured subnets are READY. - firewall_status.sync_states
The subnets that you've configured for use by the Network Firewall firewall. This contains one array element per Availability Zone where you've configured a subnet. These objects provide details of the information that is summarized in the ConfigurationSyncStateSummary and Status, broken down by zone and configuration object.
|
update_token
An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request. To make an unconditional change to the firewall, omit the token in your update request. Without the token, Network Firewall performs your updates regardless of whether the firewall has changed since you last retrieved it. To make a conditional change to the firewall, provide the token in your update request. Network Firewall uses the token to ensure that the firewall hasn't changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the firewall again to get a current copy of it with a new token. Reapply your changes as needed, then try the operation again using the new token. | VARCHAR |