create_firewall ¶

def create_firewall(
    self,
    firewall_name: "capo_network_firewall.types.resource_name.ResourceName",
    firewall_policy_arn: "capo_network_firewall.types.resource_arn.ResourceArn",
    *,
    config_overrides: Optional[NetworkFirewallClientConfig] = None,
    vpc_id: Optional["capo_network_firewall.types.vpc_id.VpcId"] = None,
    subnet_mappings: Optional[
        "capo_network_firewall.types.subnet_mappings.SubnetMappings"
    ] = None,
    delete_protection: Optional[
        "capo_network_firewall.types.boolean.Boolean"
    ] = None,
    subnet_change_protection: Optional[
        "capo_network_firewall.types.boolean.Boolean"
    ] = None,
    firewall_policy_change_protection: Optional[
        "capo_network_firewall.types.boolean.Boolean"
    ] = None,
    description: Optional[
        "capo_network_firewall.types.description.Description"
    ] = None,
    tags: Optional["capo_network_firewall.types.tag_list.TagList"] = None,
    encryption_configuration: Optional[
        "capo_network_firewall.types.encryption_configuration.EncryptionConfiguration"
    ] = None,
    enabled_analysis_types: Optional[
        "capo_network_firewall.types.enabled_analysis_types.EnabledAnalysisTypes"
    ] = None,
    transit_gateway_id: Optional[
        "capo_network_firewall.types.transit_gateway_id.TransitGatewayId"
    ] = None,
    availability_zone_mappings: Optional[
        "capo_network_firewall.types.availability_zone_mappings.AvailabilityZoneMappings"
    ] = None,
    availability_zone_change_protection: Optional[
        "capo_network_firewall.types.boolean.Boolean"
    ] = None,
    nat_gateway_mappings: Optional[
        "capo_network_firewall.types.nat_gateway_mappings_list.NatGatewayMappingsList"
    ] = None,
    proxy_settings: Optional[
        "capo_network_firewall.types.proxy_settings.ProxySettings"
    ] = None,
    no_source_preservation: Optional[
        "capo_network_firewall.types.boolean.Boolean"
    ] = None,
    vpc_endpoint: Optional[
        "capo_network_firewall.types.vpc_endpoint.VpcEndpoint"
    ] = None,
) -> "capo_network_firewall.types.create_firewall_response.CreateFirewallResponse":
    """<p>Creates an Network Firewall <a>Firewall</a> and accompanying <a>FirewallStatus</a> for a VPC. </p> <p>The firewall defines the configuration settings for an Network Firewall firewall. The settings that you can define at creation include the firewall policy, the subnets in your VPC to use for the firewall endpoints, and any tags that are attached to the firewall Amazon Web Services resource. </p> <p>After you create a firewall, you can provide additional settings, like the logging configuration. </p> <p>To update the settings for a firewall, you use the operations that apply to the settings themselves, for example <a>UpdateLoggingConfiguration</a>, <a>AssociateSubnets</a>, and <a>UpdateFirewallDeleteProtection</a>. </p> <p>To manage a firewall's tags, use the standard Amazon Web Services resource tagging operations, <a>ListTagsForResource</a>, <a>TagResource</a>, and <a>UntagResource</a>.</p> <p>To retrieve information about firewalls, use <a>ListFirewalls</a> and <a>DescribeFirewall</a>.</p> <p>To generate a report on the last 30 days of traffic monitored by a firewall, use <a>StartAnalysisReport</a>.</p>

    Args:
        firewall_name: <p>The descriptive name of the firewall. You can't change the name of a firewall after you create it.</p>
        firewall_policy_arn: <p>The Amazon Resource Name (ARN) of the <a>FirewallPolicy</a> that you want to use for the firewall.</p>
        vpc_id: <p>The unique identifier of the VPC where Network Firewall should create the firewall. </p> <p>You can't change this setting after you create the firewall. </p>
        subnet_mappings: <p>The public subnets to use for your Network Firewall firewalls. Each subnet must belong to a different Availability Zone in the VPC. Network Firewall creates a firewall endpoint in each subnet. </p>
        delete_protection: <p>A flag indicating whether it is possible to delete the firewall. A setting of <code>TRUE</code> indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting a firewall that is in use. When you create a firewall, the operation initializes this flag to <code>TRUE</code>.</p>
        subnet_change_protection: <p>A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall that is in use. When you create a firewall, the operation initializes this setting to <code>TRUE</code>.</p>
        firewall_policy_change_protection: <p>A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewall that is in use. When you create a firewall, the operation initializes this setting to <code>TRUE</code>.</p>
        description: <p>A description of the firewall.</p>
        tags: <p>The key:value pairs to associate with the resource.</p>
        encryption_configuration: <p>A complex type that contains settings for encryption of your firewall resources.</p>
        enabled_analysis_types: <p>An optional setting indicating the specific traffic analysis types to enable on the firewall. </p>
        transit_gateway_id: <p>Required when creating a transit gateway-attached firewall. The unique identifier of the transit gateway to attach to this firewall. You can provide either a transit gateway from your account or one that has been shared with you through Resource Access Manager.</p> <important> <p>After creating the firewall, you cannot change the transit gateway association. To use a different transit gateway, you must create a new firewall.</p> </important> <p>For information about creating firewalls, see <a>CreateFirewall</a>. For specific guidance about transit gateway-attached firewalls, see <a href="https://docs.aws.amazon.com/network-firewall/latest/developerguide/tgw-firewall-considerations.html">Considerations for transit gateway-attached firewalls</a> in the <i>Network Firewall Developer Guide</i>.</p>
        availability_zone_mappings: <p>Required. The Availability Zones where you want to create firewall endpoints for a transit gateway-attached firewall. You must specify at least one Availability Zone. Consider enabling the firewall in every Availability Zone where you have workloads to maintain Availability Zone isolation.</p> <p>You can modify Availability Zones later using <a>AssociateAvailabilityZones</a> or <a>DisassociateAvailabilityZones</a>, but this may briefly disrupt traffic. The <code>AvailabilityZoneChangeProtection</code> setting controls whether you can make these modifications.</p>
        availability_zone_change_protection: <p>Optional. A setting indicating whether the firewall is protected against changes to its Availability Zone configuration. When set to <code>TRUE</code>, you cannot add or remove Availability Zones without first disabling this protection using <a>UpdateAvailabilityZoneChangeProtection</a>.</p> <p>Default value: <code>FALSE</code> </p>
        nat_gateway_mappings: <p>The NAT gateways that the firewall uses to proxy traffic when <code>NoSourcePreservation</code> is <code>TRUE</code>. Network Firewall attaches the firewall to each NAT gateway that you specify, so that egress traffic is proxied through the NAT gateway. </p>
        proxy_settings: <p>The listener configuration for a proxy mode firewall, used when <code>NoSourcePreservation</code> is <code>TRUE</code>. This specifies the ports and protocols on which the firewall's proxy listens for traffic. </p>
        no_source_preservation: <p>Optional. Indicates whether the firewall operates in proxy mode, in which the source IP address of the traffic is not preserved. When set to <code>TRUE</code>, the firewall proxies traffic through a NAT gateway and the traffic reaching the destination uses the NAT gateway's IP address as the source. </p> <p>When you set this to <code>TRUE</code>, you must specify <code>NatGatewayMappings</code> and <code>VpcEndpoint</code> instead of a top-level <code>VpcId</code> and <code>SubnetMappings</code>. </p> <p>You can't change this setting after you create the firewall. </p> <p>Default value: <code>FALSE</code> </p>
        vpc_endpoint: <p>The VPC and subnets for the firewall endpoint, used when <code>NoSourcePreservation</code> is <code>TRUE</code>. Network Firewall creates the firewall endpoint in the subnets that you specify here. </p> <p>For proxy mode firewalls, provide the firewall's VPC and endpoint subnets through this parameter instead of the top-level <code>VpcId</code> and <code>SubnetMappings</code>. </p>

    Raises:
        capo_network_firewall.errors.insufficient_capacity_exception.InsufficientCapacityException: <p>Amazon Web Services doesn't currently have enough available capacity to fulfill your request. Try your request later. </p>
        capo_network_firewall.errors.internal_server_error.InternalServerError: <p>Your request is valid, but Network Firewall couldn't perform the operation because of a system problem. Retry your request. </p>
        capo_network_firewall.errors.invalid_operation_exception.InvalidOperationException: <p>The operation failed because it's not valid. For example, you might have tried to delete a rule group or firewall policy that's in use.</p>
        capo_network_firewall.errors.invalid_request_exception.InvalidRequestException: <p>The operation failed because of a problem with your request. Examples include: </p> <ul> <li> <p>You specified an unsupported parameter name or value.</p> </li> <li> <p>You tried to update a property with a value that isn't among the available types.</p> </li> <li> <p>Your request references an ARN that is malformed, or corresponds to a resource that isn't valid in the context of the request.</p> </li> </ul>
        capo_network_firewall.errors.limit_exceeded_exception.LimitExceededException: <p>Unable to perform the operation because doing so would violate a limit setting. </p>
        capo_network_firewall.errors.throttling_exception.ThrottlingException: <p>Unable to process the request due to throttling limitations.</p>
        capo_network_firewall.errors.UnknownServiceError: The service returned an error code this client does not model.
    """

    def _handler(
        req: "OperationRequest[capo_network_firewall.types.create_firewall_request.CreateFirewallRequest]",
    ) -> OperationResponse[
        "capo_network_firewall.types.create_firewall_response.CreateFirewallResponse"
    ]:
        import capo_network_firewall._operations.network_firewall_20201112.create_firewall

        output, http_response = (
            capo_network_firewall._operations.network_firewall_20201112.create_firewall.create_firewall(
                req.options, req.input
            )
        )
        return OperationResponse(output=output, response=http_response)

    interceptors_, options_ = self.operation_options(
        config_overrides, OperationLogging("CreateFirewall")
    )
    input_: capo_network_firewall.types.create_firewall_request.CreateFirewallRequest = {
        "firewall_name": firewall_name,
        "firewall_policy_arn": firewall_policy_arn,
    }
    if vpc_id is not None:
        input_["vpc_id"] = vpc_id
    if subnet_mappings is not None:
        input_["subnet_mappings"] = subnet_mappings
    if delete_protection is not None:
        input_["delete_protection"] = delete_protection
    if subnet_change_protection is not None:
        input_["subnet_change_protection"] = subnet_change_protection
    if firewall_policy_change_protection is not None:
        input_["firewall_policy_change_protection"] = (
            firewall_policy_change_protection
        )
    if description is not None:
        input_["description"] = description
    if tags is not None:
        input_["tags"] = tags
    if encryption_configuration is not None:
        input_["encryption_configuration"] = encryption_configuration
    if enabled_analysis_types is not None:
        input_["enabled_analysis_types"] = enabled_analysis_types
    if transit_gateway_id is not None:
        input_["transit_gateway_id"] = transit_gateway_id
    if availability_zone_mappings is not None:
        input_["availability_zone_mappings"] = availability_zone_mappings
    if availability_zone_change_protection is not None:
        input_["availability_zone_change_protection"] = (
            availability_zone_change_protection
        )
    if nat_gateway_mappings is not None:
        input_["nat_gateway_mappings"] = nat_gateway_mappings
    if proxy_settings is not None:
        input_["proxy_settings"] = proxy_settings
    if no_source_preservation is not None:
        input_["no_source_preservation"] = no_source_preservation
    if vpc_endpoint is not None:
        input_["vpc_endpoint"] = vpc_endpoint

    response = execute_pipeline(
        OperationRequest(input=input_, options=options_),
        handler=_handler,
        interceptors=list(interceptors_),
    )
    response.response.close()
    return response.output