1. Packages
  2. Palo Alto Networks Cloud NGFW for AWS Provider
  3. API Docs
  4. Ngfw
Palo Alto Networks Cloud NGFW for AWS v1.0.0 published on Wednesday, Oct 8, 2025 by Pulumi
pulumi/pulumi-cloudngfwaws

cloudngfwaws.Ngfw

Get Started
cloudngfwaws logo
Palo Alto Networks Cloud NGFW for AWS v1.0.0 published on Wednesday, Oct 8, 2025 by Pulumi
pulumi/pulumi-cloudngfwaws

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";
import * as cloudngfwaws from "@pulumi/cloudngfwaws";

const rs = new cloudngfwaws.CommitRulestack("rs", {rulestack: "my-rulestack"});
const exampleVpc = new aws.index.Vpc("example", {
    cidrBlock: "172.16.0.0/16",
    tags: {
        name: "tf-example",
    },
});
const subnet1 = new aws.index.Subnet("subnet1", {
    vpcId: myVpc.id,
    cidrBlock: "172.16.10.0/24",
    availabilityZone: "us-west-2a",
    tags: {
        name: "tf-example",
    },
});
const example = new cloudngfwaws.Ngfw("example", {
    name: "example-instance",
    description: "Example description",
    endpoints: [{
        subnetId: subnet1.id,
        mode: "ServiceManaged",
        vpcId: exampleVpc.id,
        accountId: "12345678",
    }],
    rulestack: rs.rulestack,
    tags: {
        Foo: "bar",
    },
});
const subnet2 = new aws.index.Subnet("subnet2", {
    vpcId: myVpc.id,
    cidrBlock: "172.16.20.0/24",
    availabilityZone: "us-west-2b",
    tags: {
        name: "tf-example",
    },
});

    import pulumi
import pulumi_aws as aws
import pulumi_cloudngfwaws as cloudngfwaws

rs = cloudngfwaws.CommitRulestack("rs", rulestack="my-rulestack")
example_vpc = aws.index.Vpc("example",
    cidr_block=172.16.0.0/16,
    tags={
        name: tf-example,
    })
subnet1 = aws.index.Subnet("subnet1",
    vpc_id=my_vpc.id,
    cidr_block=172.16.10.0/24,
    availability_zone=us-west-2a,
    tags={
        name: tf-example,
    })
example = cloudngfwaws.Ngfw("example",
    name="example-instance",
    description="Example description",
    endpoints=[{
        "subnet_id": subnet1["id"],
        "mode": "ServiceManaged",
        "vpc_id": example_vpc["id"],
        "account_id": "12345678",
    }],
    rulestack=rs.rulestack,
    tags={
        "Foo": "bar",
    })
subnet2 = aws.index.Subnet("subnet2",
    vpc_id=my_vpc.id,
    cidr_block=172.16.20.0/24,
    availability_zone=us-west-2b,
    tags={
        name: tf-example,
    })

    package main

import (
	"github.com/pulumi/pulumi-aws/sdk/go/aws"
	"github.com/pulumi/pulumi-cloudngfwaws/sdk/go/cloudngfwaws"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		rs, err := cloudngfwaws.NewCommitRulestack(ctx, "rs", &cloudngfwaws.CommitRulestackArgs{
			Rulestack: pulumi.String("my-rulestack"),
		})
		if err != nil {
			return err
		}
		exampleVpc, err := aws.NewVpc(ctx, "example", &aws.VpcArgs{
			CidrBlock: "172.16.0.0/16",
			Tags: map[string]interface{}{
				"name": "tf-example",
			},
		})
		if err != nil {
			return err
		}
		subnet1, err := aws.NewSubnet(ctx, "subnet1", &aws.SubnetArgs{
			VpcId:            myVpc.Id,
			CidrBlock:        "172.16.10.0/24",
			AvailabilityZone: "us-west-2a",
			Tags: map[string]interface{}{
				"name": "tf-example",
			},
		})
		if err != nil {
			return err
		}
		_, err = cloudngfwaws.NewNgfw(ctx, "example", &cloudngfwaws.NgfwArgs{
			Name:        pulumi.String("example-instance"),
			Description: pulumi.String("Example description"),
			Endpoints: cloudngfwaws.NgfwEndpointArray{
				&cloudngfwaws.NgfwEndpointArgs{
					SubnetId:  subnet1.Id,
					Mode:      pulumi.String("ServiceManaged"),
					VpcId:     exampleVpc.Id,
					AccountId: pulumi.String("12345678"),
				},
			},
			Rulestack: rs.Rulestack,
			Tags: pulumi.StringMap{
				"Foo": pulumi.String("bar"),
			},
		})
		if err != nil {
			return err
		}
		_, err = aws.NewSubnet(ctx, "subnet2", &aws.SubnetArgs{
			VpcId:            myVpc.Id,
			CidrBlock:        "172.16.20.0/24",
			AvailabilityZone: "us-west-2b",
			Tags: map[string]interface{}{
				"name": "tf-example",
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Aws = Pulumi.Aws;
using CloudNgfwAws = Pulumi.CloudNgfwAws;

return await Deployment.RunAsync(() => 
{
    var rs = new CloudNgfwAws.CommitRulestack("rs", new()
    {
        Rulestack = "my-rulestack",
    });

    var exampleVpc = new Aws.Index.Vpc("example", new()
    {
        CidrBlock = "172.16.0.0/16",
        Tags = 
        {
            { "name", "tf-example" },
        },
    });

    var subnet1 = new Aws.Index.Subnet("subnet1", new()
    {
        VpcId = myVpc.Id,
        CidrBlock = "172.16.10.0/24",
        AvailabilityZone = "us-west-2a",
        Tags = 
        {
            { "name", "tf-example" },
        },
    });

    var example = new CloudNgfwAws.Ngfw("example", new()
    {
        Name = "example-instance",
        Description = "Example description",
        Endpoints = new[]
        {
            new CloudNgfwAws.Inputs.NgfwEndpointArgs
            {
                SubnetId = subnet1.Id,
                Mode = "ServiceManaged",
                VpcId = exampleVpc.Id,
                AccountId = "12345678",
            },
        },
        Rulestack = rs.Rulestack,
        Tags = 
        {
            { "Foo", "bar" },
        },
    });

    var subnet2 = new Aws.Index.Subnet("subnet2", new()
    {
        VpcId = myVpc.Id,
        CidrBlock = "172.16.20.0/24",
        AvailabilityZone = "us-west-2b",
        Tags = 
        {
            { "name", "tf-example" },
        },
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudngfwaws.CommitRulestack;
import com.pulumi.cloudngfwaws.CommitRulestackArgs;
import com.pulumi.aws.vpc;
import com.pulumi.aws.vpcArgs;
import com.pulumi.aws.subnet;
import com.pulumi.aws.subnetArgs;
import com.pulumi.cloudngfwaws.Ngfw;
import com.pulumi.cloudngfwaws.NgfwArgs;
import com.pulumi.cloudngfwaws.inputs.NgfwEndpointArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var rs = new CommitRulestack("rs", CommitRulestackArgs.builder()
            .rulestack("my-rulestack")
            .build());

        var exampleVpc = new Vpc("exampleVpc", VpcArgs.builder()
            .cidrBlock("172.16.0.0/16")
            .tags(Map.of("name", "tf-example"))
            .build());

        var subnet1 = new Subnet("subnet1", SubnetArgs.builder()
            .vpcId(myVpc.id())
            .cidrBlock("172.16.10.0/24")
            .availabilityZone("us-west-2a")
            .tags(Map.of("name", "tf-example"))
            .build());

        var example = new Ngfw("example", NgfwArgs.builder()
            .name("example-instance")
            .description("Example description")
            .endpoints(NgfwEndpointArgs.builder()
                .subnetId(subnet1.id())
                .mode("ServiceManaged")
                .vpcId(exampleVpc.id())
                .accountId("12345678")
                .build())
            .rulestack(rs.rulestack())
            .tags(Map.of("Foo", "bar"))
            .build());

        var subnet2 = new Subnet("subnet2", SubnetArgs.builder()
            .vpcId(myVpc.id())
            .cidrBlock("172.16.20.0/24")
            .availabilityZone("us-west-2b")
            .tags(Map.of("name", "tf-example"))
            .build());

    }
}

    resources:
  example:
    type: cloudngfwaws:Ngfw
    properties:
      name: example-instance
      description: Example description
      endpoints:
        - subnetId: ${subnet1.id}
          mode: ServiceManaged
          vpcId: ${exampleVpc.id}
          accountId: '12345678'
      rulestack: ${rs.rulestack}
      tags:
        Foo: bar
  rs:
    type: cloudngfwaws:CommitRulestack
    properties:
      rulestack: my-rulestack
  exampleVpc:
    type: aws:vpc
    name: example
    properties:
      cidrBlock: 172.16.0.0/16
      tags:
        name: tf-example
  subnet1:
    type: aws:subnet
    properties:
      vpcId: ${myVpc.id}
      cidrBlock: 172.16.10.0/24
      availabilityZone: us-west-2a
      tags:
        name: tf-example
  subnet2:
    type: aws:subnet
    properties:
      vpcId: ${myVpc.id}
      cidrBlock: 172.16.20.0/24
      availabilityZone: us-west-2b
      tags:
        name: tf-example

    Create Ngfw Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new Ngfw(name: string, args: NgfwArgs, opts?: CustomResourceOptions);
    @overload
def Ngfw(resource_name: str,
         args: NgfwArgs,
         opts: Optional[ResourceOptions] = None)

@overload
def Ngfw(resource_name: str,
         opts: Optional[ResourceOptions] = None,
         az_lists: Optional[Sequence[str]] = None,
         global_rulestack: Optional[str] = None,
         link_id: Optional[str] = None,
         automatic_upgrade_app_id_version: Optional[bool] = None,
         account_id: Optional[str] = None,
         change_protections: Optional[Sequence[str]] = None,
         description: Optional[str] = None,
         egress_nats: Optional[Sequence[NgfwEgressNatArgs]] = None,
         endpoint_mode: Optional[str] = None,
         app_id_version: Optional[str] = None,
         endpoints: Optional[Sequence[NgfwEndpointArgs]] = None,
         allowlist_accounts: Optional[Sequence[str]] = None,
         multi_vpc: Optional[bool] = None,
         name: Optional[str] = None,
         private_accesses: Optional[Sequence[NgfwPrivateAccessArgs]] = None,
         rulestack: Optional[str] = None,
         subnet_mappings: Optional[Sequence[NgfwSubnetMappingArgs]] = None,
         tags: Optional[Mapping[str, str]] = None,
         user_ids: Optional[Sequence[NgfwUserIdArgs]] = None,
         vpc_id: Optional[str] = None)
    func NewNgfw(ctx *Context, name string, args NgfwArgs, opts ...ResourceOption) (*Ngfw, error)
    public Ngfw(string name, NgfwArgs args, CustomResourceOptions? opts = null)
    public Ngfw(String name, NgfwArgs args)
public Ngfw(String name, NgfwArgs args, CustomResourceOptions options)

    type: cloudngfwaws:Ngfw
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args NgfwArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args NgfwArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args NgfwArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args NgfwArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args NgfwArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var ngfwResource = new CloudNgfwAws.Ngfw("ngfwResource", new()
{
    AzLists = new[]
    {
        "string",
    },
    GlobalRulestack = "string",
    LinkId = "string",
    AutomaticUpgradeAppIdVersion = false,
    AccountId = "string",
    ChangeProtections = new[]
    {
        "string",
    },
    Description = "string",
    EgressNats = new[]
    {
        new CloudNgfwAws.Inputs.NgfwEgressNatArgs
        {
            Enabled = false,
            Settings = new[]
            {
                new CloudNgfwAws.Inputs.NgfwEgressNatSettingArgs
                {
                    IpPoolType = "string",
                    IpamPoolId = "string",
                },
            },
        },
    },
    EndpointMode = "string",
    AppIdVersion = "string",
    Endpoints = new[]
    {
        new CloudNgfwAws.Inputs.NgfwEndpointArgs
        {
            Mode = "string",
            AccountId = "string",
            EgressNatEnabled = false,
            EndpointId = "string",
            Prefixes = new[]
            {
                new CloudNgfwAws.Inputs.NgfwEndpointPrefixArgs
                {
                    PrivatePrefixes = new[]
                    {
                        new CloudNgfwAws.Inputs.NgfwEndpointPrefixPrivatePrefixArgs
                        {
                            Cidrs = new[]
                            {
                                "string",
                            },
                        },
                    },
                },
            },
            RejectedReason = "string",
            Status = "string",
            SubnetId = "string",
            VpcId = "string",
            ZoneId = "string",
        },
    },
    AllowlistAccounts = new[]
    {
        "string",
    },
    MultiVpc = false,
    Name = "string",
    PrivateAccesses = new[]
    {
        new CloudNgfwAws.Inputs.NgfwPrivateAccessArgs
        {
            ResourceId = "string",
            Type = "string",
        },
    },
    Rulestack = "string",
    SubnetMappings = new[]
    {
        new CloudNgfwAws.Inputs.NgfwSubnetMappingArgs
        {
            AvailabilityZone = "string",
            AvailabilityZoneId = "string",
            SubnetId = "string",
        },
    },
    Tags = 
    {
        { "string", "string" },
    },
    UserIds = new[]
    {
        new CloudNgfwAws.Inputs.NgfwUserIdArgs
        {
            Enabled = false,
            Port = 0,
            AgentName = "string",
            CollectorName = "string",
            CustomIncludeExcludeNetworks = new[]
            {
                new CloudNgfwAws.Inputs.NgfwUserIdCustomIncludeExcludeNetworkArgs
                {
                    DiscoveryInclude = false,
                    Enabled = false,
                    Name = "string",
                    NetworkAddress = "string",
                },
            },
            SecretKeyArn = "string",
            UserIdStatus = "string",
        },
    },
    VpcId = "string",
});

    example, err := cloudngfwaws.NewNgfw(ctx, "ngfwResource", &cloudngfwaws.NgfwArgs{
	AzLists: pulumi.StringArray{
		pulumi.String("string"),
	},
	GlobalRulestack:              pulumi.String("string"),
	LinkId:                       pulumi.String("string"),
	AutomaticUpgradeAppIdVersion: pulumi.Bool(false),
	AccountId:                    pulumi.String("string"),
	ChangeProtections: pulumi.StringArray{
		pulumi.String("string"),
	},
	Description: pulumi.String("string"),
	EgressNats: cloudngfwaws.NgfwEgressNatArray{
		&cloudngfwaws.NgfwEgressNatArgs{
			Enabled: pulumi.Bool(false),
			Settings: cloudngfwaws.NgfwEgressNatSettingArray{
				&cloudngfwaws.NgfwEgressNatSettingArgs{
					IpPoolType: pulumi.String("string"),
					IpamPoolId: pulumi.String("string"),
				},
			},
		},
	},
	EndpointMode: pulumi.String("string"),
	AppIdVersion: pulumi.String("string"),
	Endpoints: cloudngfwaws.NgfwEndpointArray{
		&cloudngfwaws.NgfwEndpointArgs{
			Mode:             pulumi.String("string"),
			AccountId:        pulumi.String("string"),
			EgressNatEnabled: pulumi.Bool(false),
			EndpointId:       pulumi.String("string"),
			Prefixes: cloudngfwaws.NgfwEndpointPrefixArray{
				&cloudngfwaws.NgfwEndpointPrefixArgs{
					PrivatePrefixes: cloudngfwaws.NgfwEndpointPrefixPrivatePrefixArray{
						&cloudngfwaws.NgfwEndpointPrefixPrivatePrefixArgs{
							Cidrs: pulumi.StringArray{
								pulumi.String("string"),
							},
						},
					},
				},
			},
			RejectedReason: pulumi.String("string"),
			Status:         pulumi.String("string"),
			SubnetId:       pulumi.String("string"),
			VpcId:          pulumi.String("string"),
			ZoneId:         pulumi.String("string"),
		},
	},
	AllowlistAccounts: pulumi.StringArray{
		pulumi.String("string"),
	},
	MultiVpc: pulumi.Bool(false),
	Name:     pulumi.String("string"),
	PrivateAccesses: cloudngfwaws.NgfwPrivateAccessArray{
		&cloudngfwaws.NgfwPrivateAccessArgs{
			ResourceId: pulumi.String("string"),
			Type:       pulumi.String("string"),
		},
	},
	Rulestack: pulumi.String("string"),
	SubnetMappings: cloudngfwaws.NgfwSubnetMappingArray{
		&cloudngfwaws.NgfwSubnetMappingArgs{
			AvailabilityZone:   pulumi.String("string"),
			AvailabilityZoneId: pulumi.String("string"),
			SubnetId:           pulumi.String("string"),
		},
	},
	Tags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
	UserIds: cloudngfwaws.NgfwUserIdArray{
		&cloudngfwaws.NgfwUserIdArgs{
			Enabled:       pulumi.Bool(false),
			Port:          pulumi.Int(0),
			AgentName:     pulumi.String("string"),
			CollectorName: pulumi.String("string"),
			CustomIncludeExcludeNetworks: cloudngfwaws.NgfwUserIdCustomIncludeExcludeNetworkArray{
				&cloudngfwaws.NgfwUserIdCustomIncludeExcludeNetworkArgs{
					DiscoveryInclude: pulumi.Bool(false),
					Enabled:          pulumi.Bool(false),
					Name:             pulumi.String("string"),
					NetworkAddress:   pulumi.String("string"),
				},
			},
			SecretKeyArn: pulumi.String("string"),
			UserIdStatus: pulumi.String("string"),
		},
	},
	VpcId: pulumi.String("string"),
})

    var ngfwResource = new Ngfw("ngfwResource", NgfwArgs.builder()
    .azLists("string")
    .globalRulestack("string")
    .linkId("string")
    .automaticUpgradeAppIdVersion(false)
    .accountId("string")
    .changeProtections("string")
    .description("string")
    .egressNats(NgfwEgressNatArgs.builder()
        .enabled(false)
        .settings(NgfwEgressNatSettingArgs.builder()
            .ipPoolType("string")
            .ipamPoolId("string")
            .build())
        .build())
    .endpointMode("string")
    .appIdVersion("string")
    .endpoints(NgfwEndpointArgs.builder()
        .mode("string")
        .accountId("string")
        .egressNatEnabled(false)
        .endpointId("string")
        .prefixes(NgfwEndpointPrefixArgs.builder()
            .privatePrefixes(NgfwEndpointPrefixPrivatePrefixArgs.builder()
                .cidrs("string")
                .build())
            .build())
        .rejectedReason("string")
        .status("string")
        .subnetId("string")
        .vpcId("string")
        .zoneId("string")
        .build())
    .allowlistAccounts("string")
    .multiVpc(false)
    .name("string")
    .privateAccesses(NgfwPrivateAccessArgs.builder()
        .resourceId("string")
        .type("string")
        .build())
    .rulestack("string")
    .subnetMappings(NgfwSubnetMappingArgs.builder()
        .availabilityZone("string")
        .availabilityZoneId("string")
        .subnetId("string")
        .build())
    .tags(Map.of("string", "string"))
    .userIds(NgfwUserIdArgs.builder()
        .enabled(false)
        .port(0)
        .agentName("string")
        .collectorName("string")
        .customIncludeExcludeNetworks(NgfwUserIdCustomIncludeExcludeNetworkArgs.builder()
            .discoveryInclude(false)
            .enabled(false)
            .name("string")
            .networkAddress("string")
            .build())
        .secretKeyArn("string")
        .userIdStatus("string")
        .build())
    .vpcId("string")
    .build());

    ngfw_resource = cloudngfwaws.Ngfw("ngfwResource",
    az_lists=["string"],
    global_rulestack="string",
    link_id="string",
    automatic_upgrade_app_id_version=False,
    account_id="string",
    change_protections=["string"],
    description="string",
    egress_nats=[{
        "enabled": False,
        "settings": [{
            "ip_pool_type": "string",
            "ipam_pool_id": "string",
        }],
    }],
    endpoint_mode="string",
    app_id_version="string",
    endpoints=[{
        "mode": "string",
        "account_id": "string",
        "egress_nat_enabled": False,
        "endpoint_id": "string",
        "prefixes": [{
            "private_prefixes": [{
                "cidrs": ["string"],
            }],
        }],
        "rejected_reason": "string",
        "status": "string",
        "subnet_id": "string",
        "vpc_id": "string",
        "zone_id": "string",
    }],
    allowlist_accounts=["string"],
    multi_vpc=False,
    name="string",
    private_accesses=[{
        "resource_id": "string",
        "type": "string",
    }],
    rulestack="string",
    subnet_mappings=[{
        "availability_zone": "string",
        "availability_zone_id": "string",
        "subnet_id": "string",
    }],
    tags={
        "string": "string",
    },
    user_ids=[{
        "enabled": False,
        "port": 0,
        "agent_name": "string",
        "collector_name": "string",
        "custom_include_exclude_networks": [{
            "discovery_include": False,
            "enabled": False,
            "name": "string",
            "network_address": "string",
        }],
        "secret_key_arn": "string",
        "user_id_status": "string",
    }],
    vpc_id="string")

    const ngfwResource = new cloudngfwaws.Ngfw("ngfwResource", {
    azLists: ["string"],
    globalRulestack: "string",
    linkId: "string",
    automaticUpgradeAppIdVersion: false,
    accountId: "string",
    changeProtections: ["string"],
    description: "string",
    egressNats: [{
        enabled: false,
        settings: [{
            ipPoolType: "string",
            ipamPoolId: "string",
        }],
    }],
    endpointMode: "string",
    appIdVersion: "string",
    endpoints: [{
        mode: "string",
        accountId: "string",
        egressNatEnabled: false,
        endpointId: "string",
        prefixes: [{
            privatePrefixes: [{
                cidrs: ["string"],
            }],
        }],
        rejectedReason: "string",
        status: "string",
        subnetId: "string",
        vpcId: "string",
        zoneId: "string",
    }],
    allowlistAccounts: ["string"],
    multiVpc: false,
    name: "string",
    privateAccesses: [{
        resourceId: "string",
        type: "string",
    }],
    rulestack: "string",
    subnetMappings: [{
        availabilityZone: "string",
        availabilityZoneId: "string",
        subnetId: "string",
    }],
    tags: {
        string: "string",
    },
    userIds: [{
        enabled: false,
        port: 0,
        agentName: "string",
        collectorName: "string",
        customIncludeExcludeNetworks: [{
            discoveryInclude: false,
            enabled: false,
            name: "string",
            networkAddress: "string",
        }],
        secretKeyArn: "string",
        userIdStatus: "string",
    }],
    vpcId: "string",
});

    type: cloudngfwaws:Ngfw
properties:
    accountId: string
    allowlistAccounts:
        - string
    appIdVersion: string
    automaticUpgradeAppIdVersion: false
    azLists:
        - string
    changeProtections:
        - string
    description: string
    egressNats:
        - enabled: false
          settings:
            - ipPoolType: string
              ipamPoolId: string
    endpointMode: string
    endpoints:
        - accountId: string
          egressNatEnabled: false
          endpointId: string
          mode: string
          prefixes:
            - privatePrefixes:
                - cidrs:
                    - string
          rejectedReason: string
          status: string
          subnetId: string
          vpcId: string
          zoneId: string
    globalRulestack: string
    linkId: string
    multiVpc: false
    name: string
    privateAccesses:
        - resourceId: string
          type: string
    rulestack: string
    subnetMappings:
        - availabilityZone: string
          availabilityZoneId: string
          subnetId: string
    tags:
        string: string
    userIds:
        - agentName: string
          collectorName: string
          customIncludeExcludeNetworks:
            - discoveryInclude: false
              enabled: false
              name: string
              networkAddress: string
          enabled: false
          port: 0
          secretKeyArn: string
          userIdStatus: string
    vpcId: string

    Ngfw Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The Ngfw resource accepts the following input properties:

    AzLists List<string>
    The list of availability zones for this NGFW.
    AccountId string
    The description.
    AllowlistAccounts List<string>
    The list of allowed accounts for this NGFW.
    AppIdVersion string
    App-ID version number.
    AutomaticUpgradeAppIdVersion bool
    Automatic App-ID upgrade version number. Defaults to true.
    ChangeProtections List<string>
    Enables or disables change protection for the NGFW.
    Description string
    The NGFW description.
    EgressNats List<Pulumi.CloudNgfwAws.Inputs.NgfwEgressNat>
    EndpointMode string
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    Endpoints List<Pulumi.CloudNgfwAws.Inputs.NgfwEndpoint>
    GlobalRulestack string
    The global rulestack for this NGFW.
    LinkId string
    The link ID.
    MultiVpc bool
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpoint_mode is CustomerManaged.
    Name string
    The NGFW name.
    PrivateAccesses List<Pulumi.CloudNgfwAws.Inputs.NgfwPrivateAccess>
    Rulestack string
    The rulestack for this NGFW.
    SubnetMappings List<Pulumi.CloudNgfwAws.Inputs.NgfwSubnetMapping>
    Subnet mappings.
    Tags Dictionary<string, string>
    The tags.
    UserIds List<Pulumi.CloudNgfwAws.Inputs.NgfwUserId>
    VpcId string
    The VPC ID for the NGFW.
    AzLists []string
    The list of availability zones for this NGFW.
    AccountId string
    The description.
    AllowlistAccounts []string
    The list of allowed accounts for this NGFW.
    AppIdVersion string
    App-ID version number.
    AutomaticUpgradeAppIdVersion bool
    Automatic App-ID upgrade version number. Defaults to true.
    ChangeProtections []string
    Enables or disables change protection for the NGFW.
    Description string
    The NGFW description.
    EgressNats []NgfwEgressNatArgs
    EndpointMode string
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    Endpoints []NgfwEndpointArgs
    GlobalRulestack string
    The global rulestack for this NGFW.
    LinkId string
    The link ID.
    MultiVpc bool
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpoint_mode is CustomerManaged.
    Name string
    The NGFW name.
    PrivateAccesses []NgfwPrivateAccessArgs
    Rulestack string
    The rulestack for this NGFW.
    SubnetMappings []NgfwSubnetMappingArgs
    Subnet mappings.
    Tags map[string]string
    The tags.
    UserIds []NgfwUserIdArgs
    VpcId string
    The VPC ID for the NGFW.
    azLists List<String>
    The list of availability zones for this NGFW.
    accountId String
    The description.
    allowlistAccounts List<String>
    The list of allowed accounts for this NGFW.
    appIdVersion String
    App-ID version number.
    automaticUpgradeAppIdVersion Boolean
    Automatic App-ID upgrade version number. Defaults to true.
    changeProtections List<String>
    Enables or disables change protection for the NGFW.
    description String
    The NGFW description.
    egressNats List<NgfwEgressNat>
    endpointMode String
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpoints List<NgfwEndpoint>
    globalRulestack String
    The global rulestack for this NGFW.
    linkId String
    The link ID.
    multiVpc Boolean
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpoint_mode is CustomerManaged.
    name String
    The NGFW name.
    privateAccesses List<NgfwPrivateAccess>
    rulestack String
    The rulestack for this NGFW.
    subnetMappings List<NgfwSubnetMapping>
    Subnet mappings.
    tags Map<String,String>
    The tags.
    userIds List<NgfwUserId>
    vpcId String
    The VPC ID for the NGFW.
    azLists string[]
    The list of availability zones for this NGFW.
    accountId string
    The description.
    allowlistAccounts string[]
    The list of allowed accounts for this NGFW.
    appIdVersion string
    App-ID version number.
    automaticUpgradeAppIdVersion boolean
    Automatic App-ID upgrade version number. Defaults to true.
    changeProtections string[]
    Enables or disables change protection for the NGFW.
    description string
    The NGFW description.
    egressNats NgfwEgressNat[]
    endpointMode string
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpoints NgfwEndpoint[]
    globalRulestack string
    The global rulestack for this NGFW.
    linkId string
    The link ID.
    multiVpc boolean
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpoint_mode is CustomerManaged.
    name string
    The NGFW name.
    privateAccesses NgfwPrivateAccess[]
    rulestack string
    The rulestack for this NGFW.
    subnetMappings NgfwSubnetMapping[]
    Subnet mappings.
    tags {[key: string]: string}
    The tags.
    userIds NgfwUserId[]
    vpcId string
    The VPC ID for the NGFW.
    az_lists Sequence[str]
    The list of availability zones for this NGFW.
    account_id str
    The description.
    allowlist_accounts Sequence[str]
    The list of allowed accounts for this NGFW.
    app_id_version str
    App-ID version number.
    automatic_upgrade_app_id_version bool
    Automatic App-ID upgrade version number. Defaults to true.
    change_protections Sequence[str]
    Enables or disables change protection for the NGFW.
    description str
    The NGFW description.
    egress_nats Sequence[NgfwEgressNatArgs]
    endpoint_mode str
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpoints Sequence[NgfwEndpointArgs]
    global_rulestack str
    The global rulestack for this NGFW.
    link_id str
    The link ID.
    multi_vpc bool
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpoint_mode is CustomerManaged.
    name str
    The NGFW name.
    private_accesses Sequence[NgfwPrivateAccessArgs]
    rulestack str
    The rulestack for this NGFW.
    subnet_mappings Sequence[NgfwSubnetMappingArgs]
    Subnet mappings.
    tags Mapping[str, str]
    The tags.
    user_ids Sequence[NgfwUserIdArgs]
    vpc_id str
    The VPC ID for the NGFW.
    azLists List<String>
    The list of availability zones for this NGFW.
    accountId String
    The description.
    allowlistAccounts List<String>
    The list of allowed accounts for this NGFW.
    appIdVersion String
    App-ID version number.
    automaticUpgradeAppIdVersion Boolean
    Automatic App-ID upgrade version number. Defaults to true.
    changeProtections List<String>
    Enables or disables change protection for the NGFW.
    description String
    The NGFW description.
    egressNats List<Property Map>
    endpointMode String
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpoints List<Property Map>
    globalRulestack String
    The global rulestack for this NGFW.
    linkId String
    The link ID.
    multiVpc Boolean
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpoint_mode is CustomerManaged.
    name String
    The NGFW name.
    privateAccesses List<Property Map>
    rulestack String
    The rulestack for this NGFW.
    subnetMappings List<Property Map>
    Subnet mappings.
    tags Map<String>
    The tags.
    userIds List<Property Map>
    vpcId String
    The VPC ID for the NGFW.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the Ngfw resource produces the following output properties:

    DeploymentUpdateToken string
    The update token.
    EndpointServiceName string
    The endpoint service name.
    FirewallId string
    The Firewall ID.
    Id string
    The provider-assigned unique ID for this managed resource.
    LinkStatus string
    The link status.
    Statuses List<Pulumi.CloudNgfwAws.Outputs.NgfwStatus>
    UpdateToken string
    The update token.
    DeploymentUpdateToken string
    The update token.
    EndpointServiceName string
    The endpoint service name.
    FirewallId string
    The Firewall ID.
    Id string
    The provider-assigned unique ID for this managed resource.
    LinkStatus string
    The link status.
    Statuses []NgfwStatus
    UpdateToken string
    The update token.
    deploymentUpdateToken String
    The update token.
    endpointServiceName String
    The endpoint service name.
    firewallId String
    The Firewall ID.
    id String
    The provider-assigned unique ID for this managed resource.
    linkStatus String
    The link status.
    statuses List<NgfwStatus>
    updateToken String
    The update token.
    deploymentUpdateToken string
    The update token.
    endpointServiceName string
    The endpoint service name.
    firewallId string
    The Firewall ID.
    id string
    The provider-assigned unique ID for this managed resource.
    linkStatus string
    The link status.
    statuses NgfwStatus[]
    updateToken string
    The update token.
    deployment_update_token str
    The update token.
    endpoint_service_name str
    The endpoint service name.
    firewall_id str
    The Firewall ID.
    id str
    The provider-assigned unique ID for this managed resource.
    link_status str
    The link status.
    statuses Sequence[NgfwStatus]
    update_token str
    The update token.
    deploymentUpdateToken String
    The update token.
    endpointServiceName String
    The endpoint service name.
    firewallId String
    The Firewall ID.
    id String
    The provider-assigned unique ID for this managed resource.
    linkStatus String
    The link status.
    statuses List<Property Map>
    updateToken String
    The update token.

    Look up Existing Ngfw Resource

    Get an existing Ngfw resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: NgfwState, opts?: CustomResourceOptions): Ngfw
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_id: Optional[str] = None,
        allowlist_accounts: Optional[Sequence[str]] = None,
        app_id_version: Optional[str] = None,
        automatic_upgrade_app_id_version: Optional[bool] = None,
        az_lists: Optional[Sequence[str]] = None,
        change_protections: Optional[Sequence[str]] = None,
        deployment_update_token: Optional[str] = None,
        description: Optional[str] = None,
        egress_nats: Optional[Sequence[NgfwEgressNatArgs]] = None,
        endpoint_mode: Optional[str] = None,
        endpoint_service_name: Optional[str] = None,
        endpoints: Optional[Sequence[NgfwEndpointArgs]] = None,
        firewall_id: Optional[str] = None,
        global_rulestack: Optional[str] = None,
        link_id: Optional[str] = None,
        link_status: Optional[str] = None,
        multi_vpc: Optional[bool] = None,
        name: Optional[str] = None,
        private_accesses: Optional[Sequence[NgfwPrivateAccessArgs]] = None,
        rulestack: Optional[str] = None,
        statuses: Optional[Sequence[NgfwStatusArgs]] = None,
        subnet_mappings: Optional[Sequence[NgfwSubnetMappingArgs]] = None,
        tags: Optional[Mapping[str, str]] = None,
        update_token: Optional[str] = None,
        user_ids: Optional[Sequence[NgfwUserIdArgs]] = None,
        vpc_id: Optional[str] = None) -> Ngfw
    func GetNgfw(ctx *Context, name string, id IDInput, state *NgfwState, opts ...ResourceOption) (*Ngfw, error)
    public static Ngfw Get(string name, Input<string> id, NgfwState? state, CustomResourceOptions? opts = null)
    public static Ngfw get(String name, Output<String> id, NgfwState state, CustomResourceOptions options)
    resources:  _:    type: cloudngfwaws:Ngfw    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    AccountId string
    The description.
    AllowlistAccounts List<string>
    The list of allowed accounts for this NGFW.
    AppIdVersion string
    App-ID version number.
    AutomaticUpgradeAppIdVersion bool
    Automatic App-ID upgrade version number. Defaults to true.
    AzLists List<string>
    The list of availability zones for this NGFW.
    ChangeProtections List<string>
    Enables or disables change protection for the NGFW.
    DeploymentUpdateToken string
    The update token.
    Description string
    The NGFW description.
    EgressNats List<Pulumi.CloudNgfwAws.Inputs.NgfwEgressNat>
    EndpointMode string
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    EndpointServiceName string
    The endpoint service name.
    Endpoints List<Pulumi.CloudNgfwAws.Inputs.NgfwEndpoint>
    FirewallId string
    The Firewall ID.
    GlobalRulestack string
    The global rulestack for this NGFW.
    LinkId string
    The link ID.
    LinkStatus string
    The link status.
    MultiVpc bool
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpoint_mode is CustomerManaged.
    Name string
    The NGFW name.
    PrivateAccesses List<Pulumi.CloudNgfwAws.Inputs.NgfwPrivateAccess>
    Rulestack string
    The rulestack for this NGFW.
    Statuses List<Pulumi.CloudNgfwAws.Inputs.NgfwStatus>
    SubnetMappings List<Pulumi.CloudNgfwAws.Inputs.NgfwSubnetMapping>
    Subnet mappings.
    Tags Dictionary<string, string>
    The tags.
    UpdateToken string
    The update token.
    UserIds List<Pulumi.CloudNgfwAws.Inputs.NgfwUserId>
    VpcId string
    The VPC ID for the NGFW.
    AccountId string
    The description.
    AllowlistAccounts []string
    The list of allowed accounts for this NGFW.
    AppIdVersion string
    App-ID version number.
    AutomaticUpgradeAppIdVersion bool
    Automatic App-ID upgrade version number. Defaults to true.
    AzLists []string
    The list of availability zones for this NGFW.
    ChangeProtections []string
    Enables or disables change protection for the NGFW.
    DeploymentUpdateToken string
    The update token.
    Description string
    The NGFW description.
    EgressNats []NgfwEgressNatArgs
    EndpointMode string
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    EndpointServiceName string
    The endpoint service name.
    Endpoints []NgfwEndpointArgs
    FirewallId string
    The Firewall ID.
    GlobalRulestack string
    The global rulestack for this NGFW.
    LinkId string
    The link ID.
    LinkStatus string
    The link status.
    MultiVpc bool
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpoint_mode is CustomerManaged.
    Name string
    The NGFW name.
    PrivateAccesses []NgfwPrivateAccessArgs
    Rulestack string
    The rulestack for this NGFW.
    Statuses []NgfwStatusArgs
    SubnetMappings []NgfwSubnetMappingArgs
    Subnet mappings.
    Tags map[string]string
    The tags.
    UpdateToken string
    The update token.
    UserIds []NgfwUserIdArgs
    VpcId string
    The VPC ID for the NGFW.
    accountId String
    The description.
    allowlistAccounts List<String>
    The list of allowed accounts for this NGFW.
    appIdVersion String
    App-ID version number.
    automaticUpgradeAppIdVersion Boolean
    Automatic App-ID upgrade version number. Defaults to true.
    azLists List<String>
    The list of availability zones for this NGFW.
    changeProtections List<String>
    Enables or disables change protection for the NGFW.
    deploymentUpdateToken String
    The update token.
    description String
    The NGFW description.
    egressNats List<NgfwEgressNat>
    endpointMode String
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpointServiceName String
    The endpoint service name.
    endpoints List<NgfwEndpoint>
    firewallId String
    The Firewall ID.
    globalRulestack String
    The global rulestack for this NGFW.
    linkId String
    The link ID.
    linkStatus String
    The link status.
    multiVpc Boolean
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpoint_mode is CustomerManaged.
    name String
    The NGFW name.
    privateAccesses List<NgfwPrivateAccess>
    rulestack String
    The rulestack for this NGFW.
    statuses List<NgfwStatus>
    subnetMappings List<NgfwSubnetMapping>
    Subnet mappings.
    tags Map<String,String>
    The tags.
    updateToken String
    The update token.
    userIds List<NgfwUserId>
    vpcId String
    The VPC ID for the NGFW.
    accountId string
    The description.
    allowlistAccounts string[]
    The list of allowed accounts for this NGFW.
    appIdVersion string
    App-ID version number.
    automaticUpgradeAppIdVersion boolean
    Automatic App-ID upgrade version number. Defaults to true.
    azLists string[]
    The list of availability zones for this NGFW.
    changeProtections string[]
    Enables or disables change protection for the NGFW.
    deploymentUpdateToken string
    The update token.
    description string
    The NGFW description.
    egressNats NgfwEgressNat[]
    endpointMode string
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpointServiceName string
    The endpoint service name.
    endpoints NgfwEndpoint[]
    firewallId string
    The Firewall ID.
    globalRulestack string
    The global rulestack for this NGFW.
    linkId string
    The link ID.
    linkStatus string
    The link status.
    multiVpc boolean
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpoint_mode is CustomerManaged.
    name string
    The NGFW name.
    privateAccesses NgfwPrivateAccess[]
    rulestack string
    The rulestack for this NGFW.
    statuses NgfwStatus[]
    subnetMappings NgfwSubnetMapping[]
    Subnet mappings.
    tags {[key: string]: string}
    The tags.
    updateToken string
    The update token.
    userIds NgfwUserId[]
    vpcId string
    The VPC ID for the NGFW.
    account_id str
    The description.
    allowlist_accounts Sequence[str]
    The list of allowed accounts for this NGFW.
    app_id_version str
    App-ID version number.
    automatic_upgrade_app_id_version bool
    Automatic App-ID upgrade version number. Defaults to true.
    az_lists Sequence[str]
    The list of availability zones for this NGFW.
    change_protections Sequence[str]
    Enables or disables change protection for the NGFW.
    deployment_update_token str
    The update token.
    description str
    The NGFW description.
    egress_nats Sequence[NgfwEgressNatArgs]
    endpoint_mode str
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpoint_service_name str
    The endpoint service name.
    endpoints Sequence[NgfwEndpointArgs]
    firewall_id str
    The Firewall ID.
    global_rulestack str
    The global rulestack for this NGFW.
    link_id str
    The link ID.
    link_status str
    The link status.
    multi_vpc bool
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpoint_mode is CustomerManaged.
    name str
    The NGFW name.
    private_accesses Sequence[NgfwPrivateAccessArgs]
    rulestack str
    The rulestack for this NGFW.
    statuses Sequence[NgfwStatusArgs]
    subnet_mappings Sequence[NgfwSubnetMappingArgs]
    Subnet mappings.
    tags Mapping[str, str]
    The tags.
    update_token str
    The update token.
    user_ids Sequence[NgfwUserIdArgs]
    vpc_id str
    The VPC ID for the NGFW.
    accountId String
    The description.
    allowlistAccounts List<String>
    The list of allowed accounts for this NGFW.
    appIdVersion String
    App-ID version number.
    automaticUpgradeAppIdVersion Boolean
    Automatic App-ID upgrade version number. Defaults to true.
    azLists List<String>
    The list of availability zones for this NGFW.
    changeProtections List<String>
    Enables or disables change protection for the NGFW.
    deploymentUpdateToken String
    The update token.
    description String
    The NGFW description.
    egressNats List<Property Map>
    endpointMode String
    Set endpoint mode from the following options. Valid values are ServiceManaged or CustomerManaged.
    endpointServiceName String
    The endpoint service name.
    endpoints List<Property Map>
    firewallId String
    The Firewall ID.
    globalRulestack String
    The global rulestack for this NGFW.
    linkId String
    The link ID.
    linkStatus String
    The link status.
    multiVpc Boolean
    Share NGFW with Multiple VPCs. This feature can be enabled only if the endpoint_mode is CustomerManaged.
    name String
    The NGFW name.
    privateAccesses List<Property Map>
    rulestack String
    The rulestack for this NGFW.
    statuses List<Property Map>
    subnetMappings List<Property Map>
    Subnet mappings.
    tags Map<String>
    The tags.
    updateToken String
    The update token.
    userIds List<Property Map>
    vpcId String
    The VPC ID for the NGFW.

    Supporting Types

    NgfwEgressNat, NgfwEgressNatArgs

    enabled boolean
    Enable egress NAT
    settings NgfwEgressNatSetting[]
    enabled Boolean
    Enable egress NAT
    settings List<Property Map>

    NgfwEgressNatSetting, NgfwEgressNatSettingArgs

    IpPoolType string
    Set ip pool type from the following options. Valid values are AWSService or BYOIP.
    IpamPoolId string
    The IP pool ID
    IpPoolType string
    Set ip pool type from the following options. Valid values are AWSService or BYOIP.
    IpamPoolId string
    The IP pool ID
    ipPoolType String
    Set ip pool type from the following options. Valid values are AWSService or BYOIP.
    ipamPoolId String
    The IP pool ID
    ipPoolType string
    Set ip pool type from the following options. Valid values are AWSService or BYOIP.
    ipamPoolId string
    The IP pool ID
    ip_pool_type str
    Set ip pool type from the following options. Valid values are AWSService or BYOIP.
    ipam_pool_id str
    The IP pool ID
    ipPoolType String
    Set ip pool type from the following options. Valid values are AWSService or BYOIP.
    ipamPoolId String
    The IP pool ID

    NgfwEndpoint, NgfwEndpointArgs

    Mode string
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    AccountId string
    The account id.
    EgressNatEnabled bool
    Enable egress NAT
    EndpointId string
    Endpoint ID of the security zone
    Prefixes List<Pulumi.CloudNgfwAws.Inputs.NgfwEndpointPrefix>
    RejectedReason string
    The rejected reason.
    Status string
    The attachment status.
    SubnetId string
    The subnet id.
    VpcId string
    The vpc id.
    ZoneId string
    The AZ id.
    Mode string
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    AccountId string
    The account id.
    EgressNatEnabled bool
    Enable egress NAT
    EndpointId string
    Endpoint ID of the security zone
    Prefixes []NgfwEndpointPrefix
    RejectedReason string
    The rejected reason.
    Status string
    The attachment status.
    SubnetId string
    The subnet id.
    VpcId string
    The vpc id.
    ZoneId string
    The AZ id.
    mode String
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    accountId String
    The account id.
    egressNatEnabled Boolean
    Enable egress NAT
    endpointId String
    Endpoint ID of the security zone
    prefixes List<NgfwEndpointPrefix>
    rejectedReason String
    The rejected reason.
    status String
    The attachment status.
    subnetId String
    The subnet id.
    vpcId String
    The vpc id.
    zoneId String
    The AZ id.
    mode string
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    accountId string
    The account id.
    egressNatEnabled boolean
    Enable egress NAT
    endpointId string
    Endpoint ID of the security zone
    prefixes NgfwEndpointPrefix[]
    rejectedReason string
    The rejected reason.
    status string
    The attachment status.
    subnetId string
    The subnet id.
    vpcId string
    The vpc id.
    zoneId string
    The AZ id.
    mode str
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    account_id str
    The account id.
    egress_nat_enabled bool
    Enable egress NAT
    endpoint_id str
    Endpoint ID of the security zone
    prefixes Sequence[NgfwEndpointPrefix]
    rejected_reason str
    The rejected reason.
    status str
    The attachment status.
    subnet_id str
    The subnet id.
    vpc_id str
    The vpc id.
    zone_id str
    The AZ id.
    mode String
    The endpoint mode. Valid values are ServiceManaged or CustomerManaged.
    accountId String
    The account id.
    egressNatEnabled Boolean
    Enable egress NAT
    endpointId String
    Endpoint ID of the security zone
    prefixes List<Property Map>
    rejectedReason String
    The rejected reason.
    status String
    The attachment status.
    subnetId String
    The subnet id.
    vpcId String
    The vpc id.
    zoneId String
    The AZ id.

    NgfwEndpointPrefix, NgfwEndpointPrefixArgs

    NgfwEndpointPrefixPrivatePrefix, NgfwEndpointPrefixPrivatePrefixArgs

    Cidrs List<string>
    Cidrs []string
    cidrs List<String>
    cidrs string[]
    cidrs Sequence[str]
    cidrs List<String>

    NgfwPrivateAccess, NgfwPrivateAccessArgs

    ResourceId string
    AWS ResourceID
    Type string
    Type of Private Access
    ResourceId string
    AWS ResourceID
    Type string
    Type of Private Access
    resourceId String
    AWS ResourceID
    type String
    Type of Private Access
    resourceId string
    AWS ResourceID
    type string
    Type of Private Access
    resource_id str
    AWS ResourceID
    type str
    Type of Private Access
    resourceId String
    AWS ResourceID
    type String
    Type of Private Access

    NgfwStatus, NgfwStatusArgs

    DeviceRulestackCommitStatus string
    The device rulestack commit status.
    FailureReason string
    The firewall failure reason.
    FirewallStatus string
    The firewall status.
    RulestackStatus string
    The rulestack status.
    DeviceRulestackCommitStatus string
    The device rulestack commit status.
    FailureReason string
    The firewall failure reason.
    FirewallStatus string
    The firewall status.
    RulestackStatus string
    The rulestack status.
    deviceRulestackCommitStatus String
    The device rulestack commit status.
    failureReason String
    The firewall failure reason.
    firewallStatus String
    The firewall status.
    rulestackStatus String
    The rulestack status.
    deviceRulestackCommitStatus string
    The device rulestack commit status.
    failureReason string
    The firewall failure reason.
    firewallStatus string
    The firewall status.
    rulestackStatus string
    The rulestack status.
    device_rulestack_commit_status str
    The device rulestack commit status.
    failure_reason str
    The firewall failure reason.
    firewall_status str
    The firewall status.
    rulestack_status str
    The rulestack status.
    deviceRulestackCommitStatus String
    The device rulestack commit status.
    failureReason String
    The firewall failure reason.
    firewallStatus String
    The firewall status.
    rulestackStatus String
    The rulestack status.

    NgfwSubnetMapping, NgfwSubnetMappingArgs

    AvailabilityZone string
    The availability zone, for when the endpoint mode is customer managed.
    AvailabilityZoneId string
    The availability zone ID, for when the endpoint mode is customer managed.
    SubnetId string
    The subnet id, for when the endpoint mode is service managed.
    AvailabilityZone string
    The availability zone, for when the endpoint mode is customer managed.
    AvailabilityZoneId string
    The availability zone ID, for when the endpoint mode is customer managed.
    SubnetId string
    The subnet id, for when the endpoint mode is service managed.
    availabilityZone String
    The availability zone, for when the endpoint mode is customer managed.
    availabilityZoneId String
    The availability zone ID, for when the endpoint mode is customer managed.
    subnetId String
    The subnet id, for when the endpoint mode is service managed.
    availabilityZone string
    The availability zone, for when the endpoint mode is customer managed.
    availabilityZoneId string
    The availability zone ID, for when the endpoint mode is customer managed.
    subnetId string
    The subnet id, for when the endpoint mode is service managed.
    availability_zone str
    The availability zone, for when the endpoint mode is customer managed.
    availability_zone_id str
    The availability zone ID, for when the endpoint mode is customer managed.
    subnet_id str
    The subnet id, for when the endpoint mode is service managed.
    availabilityZone String
    The availability zone, for when the endpoint mode is customer managed.
    availabilityZoneId String
    The availability zone ID, for when the endpoint mode is customer managed.
    subnetId String
    The subnet id, for when the endpoint mode is service managed.

    NgfwUserId, NgfwUserIdArgs

    Enabled bool
    Enable UserID Config
    Port int
    The Port
    AgentName string
    Agent Name for UserID
    CollectorName string
    The Collector Name
    CustomIncludeExcludeNetworks List<Pulumi.CloudNgfwAws.Inputs.NgfwUserIdCustomIncludeExcludeNetwork>
    List of Custom Include Exclude Networks
    SecretKeyArn string
    AWS Secret Key ARN
    UserIdStatus string
    Status and State of UserID Configuration
    Enabled bool
    Enable UserID Config
    Port int
    The Port
    AgentName string
    Agent Name for UserID
    CollectorName string
    The Collector Name
    CustomIncludeExcludeNetworks []NgfwUserIdCustomIncludeExcludeNetwork
    List of Custom Include Exclude Networks
    SecretKeyArn string
    AWS Secret Key ARN
    UserIdStatus string
    Status and State of UserID Configuration
    enabled Boolean
    Enable UserID Config
    port Integer
    The Port
    agentName String
    Agent Name for UserID
    collectorName String
    The Collector Name
    customIncludeExcludeNetworks List<NgfwUserIdCustomIncludeExcludeNetwork>
    List of Custom Include Exclude Networks
    secretKeyArn String
    AWS Secret Key ARN
    userIdStatus String
    Status and State of UserID Configuration
    enabled boolean
    Enable UserID Config
    port number
    The Port
    agentName string
    Agent Name for UserID
    collectorName string
    The Collector Name
    customIncludeExcludeNetworks NgfwUserIdCustomIncludeExcludeNetwork[]
    List of Custom Include Exclude Networks
    secretKeyArn string
    AWS Secret Key ARN
    userIdStatus string
    Status and State of UserID Configuration
    enabled bool
    Enable UserID Config
    port int
    The Port
    agent_name str
    Agent Name for UserID
    collector_name str
    The Collector Name
    custom_include_exclude_networks Sequence[NgfwUserIdCustomIncludeExcludeNetwork]
    List of Custom Include Exclude Networks
    secret_key_arn str
    AWS Secret Key ARN
    user_id_status str
    Status and State of UserID Configuration
    enabled Boolean
    Enable UserID Config
    port Number
    The Port
    agentName String
    Agent Name for UserID
    collectorName String
    The Collector Name
    customIncludeExcludeNetworks List<Property Map>
    List of Custom Include Exclude Networks
    secretKeyArn String
    AWS Secret Key ARN
    userIdStatus String
    Status and State of UserID Configuration

    NgfwUserIdCustomIncludeExcludeNetwork, NgfwUserIdCustomIncludeExcludeNetworkArgs

    DiscoveryInclude bool
    Include or exclude this subnet from user-id configuration
    Enabled bool
    Enable this specific custom include/exclude network
    Name string
    Name of subnet filter
    NetworkAddress string
    Network IP address of the subnet filter
    DiscoveryInclude bool
    Include or exclude this subnet from user-id configuration
    Enabled bool
    Enable this specific custom include/exclude network
    Name string
    Name of subnet filter
    NetworkAddress string
    Network IP address of the subnet filter
    discoveryInclude Boolean
    Include or exclude this subnet from user-id configuration
    enabled Boolean
    Enable this specific custom include/exclude network
    name String
    Name of subnet filter
    networkAddress String
    Network IP address of the subnet filter
    discoveryInclude boolean
    Include or exclude this subnet from user-id configuration
    enabled boolean
    Enable this specific custom include/exclude network
    name string
    Name of subnet filter
    networkAddress string
    Network IP address of the subnet filter
    discovery_include bool
    Include or exclude this subnet from user-id configuration
    enabled bool
    Enable this specific custom include/exclude network
    name str
    Name of subnet filter
    network_address str
    Network IP address of the subnet filter
    discoveryInclude Boolean
    Include or exclude this subnet from user-id configuration
    enabled Boolean
    Enable this specific custom include/exclude network
    name String
    Name of subnet filter
    networkAddress String
    Network IP address of the subnet filter

    Import

    import name is <account_id>:

    $ pulumi import cloudngfwaws:index/ngfw:Ngfw example 12345678:example-instance

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    cloudngfwaws pulumi/pulumi-cloudngfwaws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the cloudngfwaws Terraform Provider.
    cloudngfwaws logo
    Palo Alto Networks Cloud NGFW for AWS v1.0.0 published on Wednesday, Oct 8, 2025 by Pulumi
    pulumi/pulumi-cloudngfwaws
      Meet Neo: Your AI Platform Teammate