This is the API Reference for Network Firewall. This guide is for developers who need detailed information about the Network Firewall API actions, data types, and errors.
The REST API requires you to handle connection details, such as calculating signatures, handling request retries, and error handling. For general information about using the Amazon Web Services REST APIs, see Amazon Web Services APIs.
To access Network Firewall using the REST API endpoint: https://network-firewall.<region>.amazonaws.com
Alternatively, you can use one of the Amazon Web Services SDKs to access an API that''s tailored to the programming language or platform that you''re using. For more information, see Amazon Web Services SDKs.
For descriptions of Network Firewall features, including and step-by-step instructions on how to use them through the Network Firewall console, see the Network Firewall Developer Guide.
Network Firewall is a stateful, managed, network firewall and intrusion detection and prevention service for Amazon Virtual Private Cloud (Amazon VPC). With Network Firewall, you can filter traffic at the perimeter of your VPC. This includes filtering traffic going to and coming from an internet gateway, NAT gateway, or over VPN or Direct Connect. Network Firewall uses rules that are compatible with Suricata, a free, open source network analysis and threat detection engine. Network Firewall supports Suricata version 6.0.9. For information about Suricata, see the Suricata website.
You can use Network Firewall to monitor and protect your VPC traffic in a number of ways. The following are just a few examples:
Allow domains or IP addresses for known Amazon Web Services service endpoints, such as Amazon S3, and block all other forms of traffic.
Use custom lists of known bad domains to limit the types of domain names that your applications can access.
Perform deep packet inspection on traffic entering or leaving your VPC.
Use stateful protocol detection to filter protocols like HTTPS, regardless of the port used.
To enable Network Firewall for your VPCs, you perform steps in both Amazon VPC and in Network Firewall. For information about using Amazon VPC, see Amazon VPC User Guide.
To start using Network Firewall, do the following:
(Optional) If you don''t already have a VPC that you want to protect, create it in Amazon VPC.
In Amazon VPC, in each Availability Zone where you want to have a firewall endpoint, create a subnet for the sole use of Network Firewall.
In Network Firewall, create stateless and stateful rule groups, to define the components of the network traffic filtering behavior that you want your firewall to have.
In Network Firewall, create a firewall policy that uses your rule groups and specifies additional default traffic filtering behavior.
In Network Firewall, create a firewall and specify your new firewall policy and VPC subnets. Network Firewall creates a firewall endpoint in each subnet that you specify, with the behavior that''s defined in the firewall policy.
In Amazon VPC, use ingress routing enhancements to route traffic through the new firewall endpoints.
An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of the request.
To make an unconditional change to the firewall, omit the token in your update request. Without the token, Network Firewall performs your updates regardless of whether the firewall has changed since you last retrieved it.
To make a conditional change to the firewall, provide the token in your update request. Network Firewall uses the token to ensure that the firewall hasn't changed since you last retrieved it. If it has changed, the operation fails with an InvalidTokenException. If this happens, retrieve the firewall again to get a current copy of it with a new token. Reapply your changes as needed, then try the operation again using the new token.
The descriptive name of the firewall. You can't change the name of a firewall after you create it.
You must specify the ARN or the name, and you can specify both.
FirewallArn: allOf: - $ref: '#/components/schemas/ResourceArn' - description:The Amazon Resource Name (ARN) of the firewall.
You must specify the ARN or the name, and you can specify both.
Description: type: string pattern: ^.*$ maxLength: 512 Firewall: type: object required: - FirewallPolicyArn - VpcId - SubnetMappings - FirewallId properties: FirewallName: allOf: - $ref: '#/components/schemas/ResourceName' - description: The descriptive name of the firewall. You can't change the name of a firewall after you create it. FirewallArn: allOf: - $ref: '#/components/schemas/ResourceArn' - description: The Amazon Resource Name (ARN) of the firewall. FirewallPolicyArn: allOf: - $ref: '#/components/schemas/ResourceArn' - description:The Amazon Resource Name (ARN) of the firewall policy.
The relationship of firewall to firewall policy is many to one. Each firewall requires one firewall policy association, and you can use the same firewall policy for multiple firewalls.
VpcId: allOf: - $ref: '#/components/schemas/VpcId' - description: 'The unique identifier of the VPC where the firewall is in use. ' SubnetMappings: allOf: - $ref: '#/components/schemas/SubnetMappings' - description: 'The public subnets that Network Firewall is using for the firewall. Each subnet must belong to a different Availability Zone. ' DeleteProtection: allOf: - $ref: '#/components/schemas/Boolean' - description: A flag indicating whether it is possible to delete the firewall. A setting ofTRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE.
SubnetChangeProtection:
allOf:
- $ref: '#/components/schemas/Boolean'
- description: A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.
FirewallPolicyChangeProtection:
allOf:
- $ref: '#/components/schemas/Boolean'
- description: A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.
Description:
allOf:
- $ref: '#/components/schemas/Description'
- description: A description of the firewall.
FirewallId:
allOf:
- $ref: '#/components/schemas/ResourceId'
- description: 'The unique identifier for the firewall. '
Tags:
allOf:
- $ref: '#/components/schemas/TagList'
- description:
EncryptionConfiguration:
allOf:
- $ref: '#/components/schemas/EncryptionConfiguration'
- description: A complex type that contains the Amazon Web Services KMS encryption configuration settings for your firewall.
description: The firewall defines the configuration settings for an Network Firewall firewall. These settings include the firewall policy, the subnets in your VPC to use for the firewall endpoints, and any tags that are attached to the firewall Amazon Web Services resource.
The status of the firewall, for example whether it's ready to filter network traffic, is provided in the corresponding FirewallStatus. You can retrieve both objects by calling DescribeFirewall.
CapacityUsageSummary: type: object properties: CIDRs: allOf: - $ref: '#/components/schemas/CIDRSummary' - description: Describes the capacity usage of the CIDR blocks used by the IP set references in a firewall. description: The capacity usage summary of the resources used by the ReferenceSets in a firewall. InvalidRequestException: {} CIDRSummary: type: object properties: AvailableCIDRCount: allOf: - $ref: '#/components/schemas/CIDRCount' - description: The number of CIDR blocks available for use by the IP set references in a firewall. UtilizedCIDRCount: allOf: - $ref: '#/components/schemas/CIDRCount' - description: The number of CIDR blocks used by the IP set references in a firewall. IPSetReferences: allOf: - $ref: '#/components/schemas/IPSetMetadataMap' - description: The list of the IP set references used by a firewall. description: Summarizes the CIDR blocks used by the IP set references in a firewall. Network Firewall calculates the number of CIDRs by taking an aggregated count of all CIDRs used by the IP sets you are referencing. CollectionMember_String: type: string ResourceId: type: string pattern: ^([0-9a-f]{8})-([0-9a-f]{4}-){3}([0-9a-f]{12})$ minLength: 36 maxLength: 36 InternalServerError: {} EncryptionConfiguration: type: object required: - Type properties: KeyId: allOf: - $ref: '#/components/schemas/KeyId' - description: The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another account. If you're using a key managed by another account, then specify the key ARN. For more information, see Key ID in the Amazon Web Services KMS Developer Guide. Type: allOf: - $ref: '#/components/schemas/EncryptionType' - description: The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources. description: A complex type that contains optional Amazon Web Services Key Management Service (KMS) encryption settings for your Network Firewall resources. Your data is encrypted by default with an Amazon Web Services owned key that Amazon Web Services owns and manages for you. You can use either the Amazon Web Services owned key, or provide your own customer managed key. To learn more about KMS encryption of your Network Firewall resources, see Encryption at rest with Amazon Web Services Key Managment Service in the Network Firewall Developer Guide. Boolean: type: boolean StatusMessage: type: string KeyId: type: string pattern: .*\S.* minLength: 1 maxLength: 2048 EncryptionType: type: string enum: - CUSTOMER_KMS - AWS_OWNED_KMS_KEY AttachmentStatus: type: string enum: - CREATING - DELETING - SCALING - READY UpdateToken: type: string pattern: ^([0-9a-f]{8})-([0-9a-f]{4}-){3}([0-9a-f]{12})$ minLength: 1 maxLength: 1024 IPAddressType: type: string enum: - DUALSTACK - IPV4 - IPV6 ResourceName: type: string pattern: ^[a-zA-Z0-9-]+$ minLength: 1 maxLength: 128 IPSetMetadataMap: type: object additionalProperties: $ref: '#/components/schemas/IPSetMetadata' ResourceArn: type: string pattern: ^arn:aws.* minLength: 1 maxLength: 256 PerObjectSyncStatus: type: string enum: - PENDING - IN_SYNC - CAPACITY_CONSTRAINED Attachment: type: object properties: SubnetId: allOf: - $ref: '#/components/schemas/AzSubnet' - description: 'The unique identifier of the subnet that you''ve specified to be used for a firewall endpoint. ' EndpointId: allOf: - $ref: '#/components/schemas/EndpointId' - description: 'The identifier of the firewall endpoint that Network Firewall has instantiated in the subnet. You use this to identify the firewall endpoint in the VPC route tables, when you redirect the VPC traffic through the endpoint. ' Status: allOf: - $ref: '#/components/schemas/AttachmentStatus' - description: The current status of the firewall endpoint in the subnet. This value reflects both the instantiation of the endpoint in the VPC subnet and the sync states that are reported in theConfig settings. When this value is READY, the endpoint is available and configured properly to handle network traffic. When the endpoint isn't available for traffic, this value will reflect its state, for example CREATING or DELETING.
StatusMessage:
allOf:
- $ref: '#/components/schemas/StatusMessage'
- description: If Network Firewall fails to create or delete the firewall endpoint in the subnet, it populates this with the reason for the failure and how to resolve it. Depending on the error, it can take as many as 15 minutes to populate this field. For more information about the errors and solutions available for this field, see Troubleshooting firewall endpoint failures in the Network Firewall Developer Guide.
description: The configuration and status for a single subnet that you've specified for use by the Network Firewall firewall. This is part of the FirewallStatus.
CIDRCount:
type: integer
minimum: 0
maximum: 1000000
SubnetMappings:
type: array
items:
$ref: '#/components/schemas/SubnetMapping'
Tag:
type: object
required:
- Key
- Value
properties:
Key:
allOf:
- $ref: '#/components/schemas/TagKey'
- description: The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive.
Value:
allOf:
- $ref: '#/components/schemas/TagValue'
- description: The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive.
description: 'A key:value pair associated with an Amazon Web Services resource. The key:value pair can be anything you define. Typically, the tag key represents a category (such as "environment") and the tag value represents a specific value within that category (such as "test," "development," or "production"). You can add up to 50 tags to each Amazon Web Services resource. '
IPSetMetadata:
type: object
properties:
ResolvedCIDRCount:
allOf:
- $ref: '#/components/schemas/CIDRCount'
- description: Describes the total number of CIDR blocks currently in use by the IP set references in a firewall. To determine how many CIDR blocks are available for you to use in a firewall, you can call AvailableCIDRCount.
description: General information about the IP set.
TagValue:
type: string
pattern: ^.*$
minLength: 0
maxLength: 256
TagList:
type: array
items:
$ref: '#/components/schemas/Tag'
minItems: 1
maxItems: 200
SyncStates:
type: object
additionalProperties:
$ref: '#/components/schemas/SyncState'
ConfigurationSyncState:
type: string
enum:
- PENDING
- IN_SYNC
- CAPACITY_CONSTRAINED
SubnetMapping:
type: object
required:
- SubnetId
properties:
SubnetId:
allOf:
- $ref: '#/components/schemas/CollectionMember_String'
- description: 'The unique identifier for the subnet. '
IPAddressType:
allOf:
- $ref: '#/components/schemas/IPAddressType'
- description: The subnet's IP address type. You can't change the IP address type after you create the subnet.
description: The ID for a subnet that you want to associate with the firewall. This is used with CreateFirewall and AssociateSubnets. Network Firewall creates an instance of the associated firewall in each subnet that you specify, to filter traffic in the subnet's Availability Zone.
FirewallStatus:
type: object
required:
- Status
- ConfigurationSyncStateSummary
properties:
Status:
allOf:
- $ref: '#/components/schemas/FirewallStatusValue'
- description: 'The readiness of the configured firewall to handle network traffic across all of the Availability Zones where you''ve configured it. This setting is READY only when the ConfigurationSyncStateSummary value is IN_SYNC and the Attachment Status values for all of the configured subnets are READY. '
ConfigurationSyncStateSummary:
allOf:
- $ref: '#/components/schemas/ConfigurationSyncState'
- description: The configuration sync state for the firewall. This summarizes the sync states reported in the Config settings for all of the Availability Zones where you have configured the firewall.
When you create a firewall or update its configuration, for example by adding a rule group to its firewall policy, Network Firewall distributes the configuration changes to all zones where the firewall is in use. This summary indicates whether the configuration changes have been applied everywhere.
This status must be IN_SYNC for the firewall to be ready for use, but it doesn't indicate that the firewall is ready. The Status setting indicates firewall readiness.
ConfigurationSyncStateSummary and Status, broken down by zone and configuration object. '
CapacityUsageSummary:
allOf:
- $ref: '#/components/schemas/CapacityUsageSummary'
- description: Describes the capacity usage of the resources contained in a firewall's reference sets. Network Firewall calclulates the capacity usage by taking an aggregated count of all of the resources used by all of the reference sets in a firewall.
description: Detailed information about the current status of a Firewall. You can retrieve this for a firewall by calling DescribeFirewall and providing the firewall name and ARN.
SyncState:
type: object
properties:
Attachment:
allOf:
- $ref: '#/components/schemas/Attachment'
- description: The attachment status of the firewall's association with a single VPC subnet. For each configured subnet, Network Firewall creates the attachment by instantiating the firewall endpoint in the subnet so that it's ready to take traffic. This is part of the FirewallStatus.
Config:
allOf:
- $ref: '#/components/schemas/SyncStateConfig'
- description: The configuration status of the firewall endpoint in a single VPC subnet. Network Firewall provides each endpoint with the rules that are configured in the firewall policy. Each time you add a subnet or modify the associated firewall policy, Network Firewall synchronizes the rules in the endpoint, so it can properly filter network traffic. This is part of the FirewallStatus.
description: 'The status of the firewall endpoint and firewall policy configuration for a single VPC subnet.
For each VPC subnet that you associate with a firewall, Network Firewall does the following:
Instantiates a firewall endpoint in the subnet, ready to take traffic.
Configures the endpoint with the current firewall policy settings, to provide the filtering behavior for the endpoint.
When you update a firewall, for example to add a subnet association or change a rule group in the firewall policy, the affected sync states reflect out-of-sync or not ready status until the changes are complete.
' VpcId: type: string pattern: ^vpc-[0-9a-f]+$ minLength: 1 maxLength: 128 AzSubnet: type: string pattern: ^subnet-[0-9a-f]+$ minLength: 1 maxLength: 128 FirewallStatusValue: type: string enum: - PROVISIONING - DELETING - READY PerObjectStatus: type: object properties: SyncStatus: allOf: - $ref: '#/components/schemas/PerObjectSyncStatus' - description: Indicates whether this object is in sync with the version indicated in the update token. UpdateToken: allOf: - $ref: '#/components/schemas/UpdateToken' - description: 'The current version of the object that is either in sync or pending synchronization. ' description: Provides configuration status for a single policy or rule group that is used for a firewall endpoint. Network Firewall provides each endpoint with the rules that are configured in the firewall policy. Each time you add a subnet or modify the associated firewall policy, Network Firewall synchronizes the rules in the endpoint, so it can properly filter network traffic. This is part of a SyncState for a firewall. parameters: X-Amz-Credential: name: X-Amz-Credential in: header schema: type: string required: false X-Amz-Date: name: X-Amz-Date in: header schema: type: string required: false X-Amz-Signature: name: X-Amz-Signature in: header schema: type: string required: false X-Amz-Algorithm: name: X-Amz-Algorithm in: header schema: type: string required: false X-Amz-Security-Token: name: X-Amz-Security-Token in: header schema: type: string required: false X-Amz-SignedHeaders: name: X-Amz-SignedHeaders in: header schema: type: string required: false X-Amz-Content-Sha256: name: X-Amz-Content-Sha256 in: header schema: type: string required: false securitySchemes: hmac: type: apiKey name: Authorization in: header description: Amazon Signature authorization v4 x-amazon-apigateway-authtype: awsSigv4 externalDocs: description: Amazon Web Services documentation url: https://docs.aws.amazon.com/network-firewall/ x-hasEquivalentPaths: true