Request Syntax Request Parameters Response Syntax Response Elements Errors See Also

CreateFirewall

Creates an AWS Network Firewall Firewall and accompanying FirewallStatus for a VPC.

The firewall defines the configuration settings for an AWS Network Firewall firewall. The settings that you can define at creation include the firewall policy, the subnets in your VPC to use for the firewall endpoints, and any tags that are attached to the firewall AWS resource.

After you create a firewall, you can provide additional settings, like the logging configuration.

To update the settings for a firewall, you use the operations that apply to the settings themselves, for example UpdateLoggingConfiguration, AssociateSubnets, and UpdateFirewallDeleteProtection.

To manage a firewall's tags, use the standard AWS resource tagging operations, ListTagsForResource, TagResource, and UntagResource.

To retrieve information about firewalls, use ListFirewalls and DescribeFirewall.

Request Syntax


{
   "DeleteProtection": boolean,
   "Description": "string",
   "EncryptionConfiguration": { 
      "KeyId": "string",
      "Type": "string"
   },
   "FirewallName": "string",
   "FirewallPolicyArn": "string",
   "FirewallPolicyChangeProtection": boolean,
   "SubnetChangeProtection": boolean,
   "SubnetMappings": [ 
      { 
         "IPAddressType": "string",
         "SubnetId": "string"
      }
   ],
   "Tags": [ 
      { 
         "Key": "string",
         "Value": "string"
      }
   ],
   "VpcId": "string"
}

Request Parameters

For information about the parameters that are common to all actions, see Common Parameters.

The request accepts the following data in JSON format.

DeleteProtection

A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to TRUE.

Type: Boolean

Required: No

Description

A description of the firewall.

Type: String

Length Constraints: Maximum length of 512.

Pattern: ^.*$

Required: No

EncryptionConfiguration

A complex type that contains settings for encryption of your firewall resources.

Type: EncryptionConfiguration object

Required: No

FirewallName

The descriptive name of the firewall. You can't change the name of a firewall after you create it.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Pattern: ^[a-zA-Z0-9-]+$

Required: Yes

FirewallPolicyArn

The Amazon Resource Name (ARN) of the FirewallPolicy that you want to use for the firewall.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 256.

Pattern: ^arn:aws.*

Required: Yes

FirewallPolicyChangeProtection

A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

Type: Boolean

Required: No

SubnetChangeProtection

A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to TRUE.

Type: Boolean

Required: No

SubnetMappings

The public subnets to use for your Network Firewall firewalls. Each subnet must belong to a different Availability Zone in the VPC. Network Firewall creates a firewall endpoint in each subnet.

Type: Array of SubnetMapping objects

Required: Yes

Tags

The key:value pairs to associate with the resource.

Type: Array of Tag objects

Array Members: Minimum number of 1 item. Maximum number of 200 items.

Required: No

VpcId

The unique identifier of the VPC where Network Firewall should create the firewall.

You can't change this setting after you create the firewall.

Type: String

Length Constraints: Minimum length of 1. Maximum length of 128.

Pattern: ^vpc-[0-9a-f]+$

Required: Yes

Response Syntax


{
   "Firewall": { 
      "DeleteProtection": boolean,
      "Description": "string",
      "EncryptionConfiguration": { 
         "KeyId": "string",
         "Type": "string"
      },
      "FirewallArn": "string",
      "FirewallId": "string",
      "FirewallName": "string",
      "FirewallPolicyArn": "string",
      "FirewallPolicyChangeProtection": boolean,
      "SubnetChangeProtection": boolean,
      "SubnetMappings": [ 
         { 
            "IPAddressType": "string",
            "SubnetId": "string"
         }
      ],
      "Tags": [ 
         { 
            "Key": "string",
            "Value": "string"
         }
      ],
      "VpcId": "string"
   },
   "FirewallStatus": { 
      "CapacityUsageSummary": { 
         "CIDRs": { 
            "AvailableCIDRCount": number,
            "IPSetReferences": { 
               "string" : { 
                  "ResolvedCIDRCount": number
               }
            },
            "UtilizedCIDRCount": number
         }
      },
      "ConfigurationSyncStateSummary": "string",
      "Status": "string",
      "SyncStates": { 
         "string" : { 
            "Attachment": { 
               "EndpointId": "string",
               "Status": "string",
               "StatusMessage": "string",
               "SubnetId": "string"
            },
            "Config": { 
               "string" : { 
                  "SyncStatus": "string",
                  "UpdateToken": "string"
               }
            }
         }
      }
   }
}

Response Elements

If the action is successful, the service sends back an HTTP 200 response.

The following data is returned in JSON format by the service.

Firewall

The configuration settings for the firewall. These settings include the firewall policy and the subnets in your VPC to use for the firewall endpoints.

Type: Firewall object

FirewallStatus

Detailed information about the current status of a Firewall. You can retrieve this for a firewall by calling DescribeFirewall and providing the firewall name and ARN.

Type: FirewallStatus object

Errors

For information about the errors that are common to all actions, see Common Errors.

InsufficientCapacityException

AWS doesn't currently have enough available capacity to fulfill your request. Try your request later.

HTTP Status Code: 500

InternalServerError

Your request is valid, but Network Firewall couldn't perform the operation because of a system problem. Retry your request.

HTTP Status Code: 500

InvalidOperationException

The operation failed because it's not valid. For example, you might have tried to delete a rule group or firewall policy that's in use.

HTTP Status Code: 400

InvalidRequestException

The operation failed because of a problem with your request. Examples include:

You specified an unsupported parameter name or value.
You tried to update a property with a value that isn't among the available types.
Your request references an ARN that is malformed, or corresponds to a resource that isn't valid in the context of the request.

HTTP Status Code: 400

LimitExceededException

Unable to perform the operation because doing so would violate a limit setting.

HTTP Status Code: 400

ThrottlingException

Unable to process the request due to throttling limitations.

HTTP Status Code: 400