Skip to content

Commit 73b191f

Browse files
author
awstools
committed
feat(client-network-firewall): You can now use VPC endpoint associations to create multiple firewall endpoints for a single firewall.
1 parent 7467f15 commit 73b191f

24 files changed

+2433
-88
lines changed

clients/client-network-firewall/README.md

Lines changed: 50 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,13 +68,18 @@ Amazon VPC. </p>
6868
subnet for the sole use of Network Firewall. </p>
6969
</li>
7070
<li>
71-
<p>In Network Firewall, create stateless and stateful rule groups,
71+
<p>In Network Firewall, define the firewall behavior as follows: </p>
72+
<ol>
73+
<li>
74+
<p>Create stateless and stateful rule groups,
7275
to define the components of the network traffic filtering behavior that you want your firewall to have. </p>
7376
</li>
7477
<li>
75-
<p>In Network Firewall, create a firewall policy that uses your rule groups and
78+
<p>Create a firewall policy that uses your rule groups and
7679
specifies additional default traffic filtering behavior. </p>
7780
</li>
81+
</ol>
82+
</li>
7883
<li>
7984
<p>In Network Firewall, create a firewall and specify your new firewall policy and
8085
VPC subnets. Network Firewall creates a firewall endpoint in each subnet that you
@@ -85,6 +90,9 @@ specify, with the behavior that's defined in the firewall policy.</p>
8590
endpoints.</p>
8691
</li>
8792
</ol>
93+
<p>After your firewall is established, you can add firewall endpoints for new Availability Zones by following the prior steps for the Amazon VPC setup and
94+
firewall subnet definitions. You can also add endpoints to Availability Zones that you're using in the firewall, either for the same VPC
95+
or for another VPC, by following the prior steps for the Amazon VPC setup, and defining the new VPC subnets as VPC endpoint associations. </p>
8896

8997
## Installing
9098

@@ -328,6 +336,14 @@ CreateTLSInspectionConfiguration
328336

329337
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/network-firewall/command/CreateTLSInspectionConfigurationCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/CreateTLSInspectionConfigurationCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/CreateTLSInspectionConfigurationCommandOutput/)
330338

339+
</details>
340+
<details>
341+
<summary>
342+
CreateVpcEndpointAssociation
343+
</summary>
344+
345+
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/network-firewall/command/CreateVpcEndpointAssociationCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/CreateVpcEndpointAssociationCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/CreateVpcEndpointAssociationCommandOutput/)
346+
331347
</details>
332348
<details>
333349
<summary>
@@ -368,6 +384,14 @@ DeleteTLSInspectionConfiguration
368384

369385
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/network-firewall/command/DeleteTLSInspectionConfigurationCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/DeleteTLSInspectionConfigurationCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/DeleteTLSInspectionConfigurationCommandOutput/)
370386

387+
</details>
388+
<details>
389+
<summary>
390+
DeleteVpcEndpointAssociation
391+
</summary>
392+
393+
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/network-firewall/command/DeleteVpcEndpointAssociationCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/DeleteVpcEndpointAssociationCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/DeleteVpcEndpointAssociationCommandOutput/)
394+
371395
</details>
372396
<details>
373397
<summary>
@@ -376,6 +400,14 @@ DescribeFirewall
376400

377401
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/network-firewall/command/DescribeFirewallCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/DescribeFirewallCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/DescribeFirewallCommandOutput/)
378402

403+
</details>
404+
<details>
405+
<summary>
406+
DescribeFirewallMetadata
407+
</summary>
408+
409+
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/network-firewall/command/DescribeFirewallMetadataCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/DescribeFirewallMetadataCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/DescribeFirewallMetadataCommandOutput/)
410+
379411
</details>
380412
<details>
381413
<summary>
@@ -432,6 +464,14 @@ DescribeTLSInspectionConfiguration
432464

433465
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/network-firewall/command/DescribeTLSInspectionConfigurationCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/DescribeTLSInspectionConfigurationCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/DescribeTLSInspectionConfigurationCommandOutput/)
434466

467+
</details>
468+
<details>
469+
<summary>
470+
DescribeVpcEndpointAssociation
471+
</summary>
472+
473+
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/network-firewall/command/DescribeVpcEndpointAssociationCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/DescribeVpcEndpointAssociationCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/DescribeVpcEndpointAssociationCommandOutput/)
474+
435475
</details>
436476
<details>
437477
<summary>
@@ -512,6 +552,14 @@ ListTLSInspectionConfigurations
512552

513553
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/network-firewall/command/ListTLSInspectionConfigurationsCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/ListTLSInspectionConfigurationsCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/ListTLSInspectionConfigurationsCommandOutput/)
514554

555+
</details>
556+
<details>
557+
<summary>
558+
ListVpcEndpointAssociations
559+
</summary>
560+
561+
[Command API Reference](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/network-firewall/command/ListVpcEndpointAssociationsCommand/) / [Input](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/ListVpcEndpointAssociationsCommandInput/) / [Output](https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-client-network-firewall/Interface/ListVpcEndpointAssociationsCommandOutput/)
562+
515563
</details>
516564
<details>
517565
<summary>

clients/client-network-firewall/src/NetworkFirewall.ts

Lines changed: 130 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,11 @@ import {
3232
CreateTLSInspectionConfigurationCommandInput,
3333
CreateTLSInspectionConfigurationCommandOutput,
3434
} from "./commands/CreateTLSInspectionConfigurationCommand";
35+
import {
36+
CreateVpcEndpointAssociationCommand,
37+
CreateVpcEndpointAssociationCommandInput,
38+
CreateVpcEndpointAssociationCommandOutput,
39+
} from "./commands/CreateVpcEndpointAssociationCommand";
3540
import {
3641
DeleteFirewallCommand,
3742
DeleteFirewallCommandInput,
@@ -57,11 +62,21 @@ import {
5762
DeleteTLSInspectionConfigurationCommandInput,
5863
DeleteTLSInspectionConfigurationCommandOutput,
5964
} from "./commands/DeleteTLSInspectionConfigurationCommand";
65+
import {
66+
DeleteVpcEndpointAssociationCommand,
67+
DeleteVpcEndpointAssociationCommandInput,
68+
DeleteVpcEndpointAssociationCommandOutput,
69+
} from "./commands/DeleteVpcEndpointAssociationCommand";
6070
import {
6171
DescribeFirewallCommand,
6272
DescribeFirewallCommandInput,
6373
DescribeFirewallCommandOutput,
6474
} from "./commands/DescribeFirewallCommand";
75+
import {
76+
DescribeFirewallMetadataCommand,
77+
DescribeFirewallMetadataCommandInput,
78+
DescribeFirewallMetadataCommandOutput,
79+
} from "./commands/DescribeFirewallMetadataCommand";
6580
import {
6681
DescribeFirewallPolicyCommand,
6782
DescribeFirewallPolicyCommandInput,
@@ -97,6 +112,11 @@ import {
97112
DescribeTLSInspectionConfigurationCommandInput,
98113
DescribeTLSInspectionConfigurationCommandOutput,
99114
} from "./commands/DescribeTLSInspectionConfigurationCommand";
115+
import {
116+
DescribeVpcEndpointAssociationCommand,
117+
DescribeVpcEndpointAssociationCommandInput,
118+
DescribeVpcEndpointAssociationCommandOutput,
119+
} from "./commands/DescribeVpcEndpointAssociationCommand";
100120
import {
101121
DisassociateSubnetsCommand,
102122
DisassociateSubnetsCommandInput,
@@ -147,6 +167,11 @@ import {
147167
ListTLSInspectionConfigurationsCommandInput,
148168
ListTLSInspectionConfigurationsCommandOutput,
149169
} from "./commands/ListTLSInspectionConfigurationsCommand";
170+
import {
171+
ListVpcEndpointAssociationsCommand,
172+
ListVpcEndpointAssociationsCommandInput,
173+
ListVpcEndpointAssociationsCommandOutput,
174+
} from "./commands/ListVpcEndpointAssociationsCommand";
150175
import {
151176
PutResourcePolicyCommand,
152177
PutResourcePolicyCommandInput,
@@ -232,19 +257,23 @@ const commands = {
232257
CreateFirewallPolicyCommand,
233258
CreateRuleGroupCommand,
234259
CreateTLSInspectionConfigurationCommand,
260+
CreateVpcEndpointAssociationCommand,
235261
DeleteFirewallCommand,
236262
DeleteFirewallPolicyCommand,
237263
DeleteResourcePolicyCommand,
238264
DeleteRuleGroupCommand,
239265
DeleteTLSInspectionConfigurationCommand,
266+
DeleteVpcEndpointAssociationCommand,
240267
DescribeFirewallCommand,
268+
DescribeFirewallMetadataCommand,
241269
DescribeFirewallPolicyCommand,
242270
DescribeFlowOperationCommand,
243271
DescribeLoggingConfigurationCommand,
244272
DescribeResourcePolicyCommand,
245273
DescribeRuleGroupCommand,
246274
DescribeRuleGroupMetadataCommand,
247275
DescribeTLSInspectionConfigurationCommand,
276+
DescribeVpcEndpointAssociationCommand,
248277
DisassociateSubnetsCommand,
249278
GetAnalysisReportResultsCommand,
250279
ListAnalysisReportsCommand,
@@ -255,6 +284,7 @@ const commands = {
255284
ListRuleGroupsCommand,
256285
ListTagsForResourceCommand,
257286
ListTLSInspectionConfigurationsCommand,
287+
ListVpcEndpointAssociationsCommand,
258288
PutResourcePolicyCommand,
259289
StartAnalysisReportCommand,
260290
StartFlowCaptureCommand,
@@ -370,6 +400,23 @@ export interface NetworkFirewall {
370400
cb: (err: any, data?: CreateTLSInspectionConfigurationCommandOutput) => void
371401
): void;
372402

403+
/**
404+
* @see {@link CreateVpcEndpointAssociationCommand}
405+
*/
406+
createVpcEndpointAssociation(
407+
args: CreateVpcEndpointAssociationCommandInput,
408+
options?: __HttpHandlerOptions
409+
): Promise<CreateVpcEndpointAssociationCommandOutput>;
410+
createVpcEndpointAssociation(
411+
args: CreateVpcEndpointAssociationCommandInput,
412+
cb: (err: any, data?: CreateVpcEndpointAssociationCommandOutput) => void
413+
): void;
414+
createVpcEndpointAssociation(
415+
args: CreateVpcEndpointAssociationCommandInput,
416+
options: __HttpHandlerOptions,
417+
cb: (err: any, data?: CreateVpcEndpointAssociationCommandOutput) => void
418+
): void;
419+
373420
/**
374421
* @see {@link DeleteFirewallCommand}
375422
*/
@@ -453,6 +500,23 @@ export interface NetworkFirewall {
453500
cb: (err: any, data?: DeleteTLSInspectionConfigurationCommandOutput) => void
454501
): void;
455502

503+
/**
504+
* @see {@link DeleteVpcEndpointAssociationCommand}
505+
*/
506+
deleteVpcEndpointAssociation(
507+
args: DeleteVpcEndpointAssociationCommandInput,
508+
options?: __HttpHandlerOptions
509+
): Promise<DeleteVpcEndpointAssociationCommandOutput>;
510+
deleteVpcEndpointAssociation(
511+
args: DeleteVpcEndpointAssociationCommandInput,
512+
cb: (err: any, data?: DeleteVpcEndpointAssociationCommandOutput) => void
513+
): void;
514+
deleteVpcEndpointAssociation(
515+
args: DeleteVpcEndpointAssociationCommandInput,
516+
options: __HttpHandlerOptions,
517+
cb: (err: any, data?: DeleteVpcEndpointAssociationCommandOutput) => void
518+
): void;
519+
456520
/**
457521
* @see {@link DescribeFirewallCommand}
458522
*/
@@ -471,6 +535,24 @@ export interface NetworkFirewall {
471535
cb: (err: any, data?: DescribeFirewallCommandOutput) => void
472536
): void;
473537

538+
/**
539+
* @see {@link DescribeFirewallMetadataCommand}
540+
*/
541+
describeFirewallMetadata(): Promise<DescribeFirewallMetadataCommandOutput>;
542+
describeFirewallMetadata(
543+
args: DescribeFirewallMetadataCommandInput,
544+
options?: __HttpHandlerOptions
545+
): Promise<DescribeFirewallMetadataCommandOutput>;
546+
describeFirewallMetadata(
547+
args: DescribeFirewallMetadataCommandInput,
548+
cb: (err: any, data?: DescribeFirewallMetadataCommandOutput) => void
549+
): void;
550+
describeFirewallMetadata(
551+
args: DescribeFirewallMetadataCommandInput,
552+
options: __HttpHandlerOptions,
553+
cb: (err: any, data?: DescribeFirewallMetadataCommandOutput) => void
554+
): void;
555+
474556
/**
475557
* @see {@link DescribeFirewallPolicyCommand}
476558
*/
@@ -595,6 +677,23 @@ export interface NetworkFirewall {
595677
cb: (err: any, data?: DescribeTLSInspectionConfigurationCommandOutput) => void
596678
): void;
597679

680+
/**
681+
* @see {@link DescribeVpcEndpointAssociationCommand}
682+
*/
683+
describeVpcEndpointAssociation(
684+
args: DescribeVpcEndpointAssociationCommandInput,
685+
options?: __HttpHandlerOptions
686+
): Promise<DescribeVpcEndpointAssociationCommandOutput>;
687+
describeVpcEndpointAssociation(
688+
args: DescribeVpcEndpointAssociationCommandInput,
689+
cb: (err: any, data?: DescribeVpcEndpointAssociationCommandOutput) => void
690+
): void;
691+
describeVpcEndpointAssociation(
692+
args: DescribeVpcEndpointAssociationCommandInput,
693+
options: __HttpHandlerOptions,
694+
cb: (err: any, data?: DescribeVpcEndpointAssociationCommandOutput) => void
695+
): void;
696+
598697
/**
599698
* @see {@link DisassociateSubnetsCommand}
600699
*/
@@ -761,6 +860,24 @@ export interface NetworkFirewall {
761860
cb: (err: any, data?: ListTLSInspectionConfigurationsCommandOutput) => void
762861
): void;
763862

863+
/**
864+
* @see {@link ListVpcEndpointAssociationsCommand}
865+
*/
866+
listVpcEndpointAssociations(): Promise<ListVpcEndpointAssociationsCommandOutput>;
867+
listVpcEndpointAssociations(
868+
args: ListVpcEndpointAssociationsCommandInput,
869+
options?: __HttpHandlerOptions
870+
): Promise<ListVpcEndpointAssociationsCommandOutput>;
871+
listVpcEndpointAssociations(
872+
args: ListVpcEndpointAssociationsCommandInput,
873+
cb: (err: any, data?: ListVpcEndpointAssociationsCommandOutput) => void
874+
): void;
875+
listVpcEndpointAssociations(
876+
args: ListVpcEndpointAssociationsCommandInput,
877+
options: __HttpHandlerOptions,
878+
cb: (err: any, data?: ListVpcEndpointAssociationsCommandOutput) => void
879+
): void;
880+
764881
/**
765882
* @see {@link PutResourcePolicyCommand}
766883
*/
@@ -1083,12 +1200,17 @@ export interface NetworkFirewall {
10831200
* subnet for the sole use of Network Firewall. </p>
10841201
* </li>
10851202
* <li>
1086-
* <p>In Network Firewall, create stateless and stateful rule groups,
1203+
* <p>In Network Firewall, define the firewall behavior as follows: </p>
1204+
* <ol>
1205+
* <li>
1206+
* <p>Create stateless and stateful rule groups,
10871207
* to define the components of the network traffic filtering behavior that you want your firewall to have. </p>
1088-
* </li>
1089-
* <li>
1090-
* <p>In Network Firewall, create a firewall policy that uses your rule groups and
1091-
* specifies additional default traffic filtering behavior. </p>
1208+
* </li>
1209+
* <li>
1210+
* <p>Create a firewall policy that uses your rule groups and
1211+
* specifies additional default traffic filtering behavior. </p>
1212+
* </li>
1213+
* </ol>
10921214
* </li>
10931215
* <li>
10941216
* <p>In Network Firewall, create a firewall and specify your new firewall policy and
@@ -1100,6 +1222,9 @@ export interface NetworkFirewall {
11001222
* endpoints.</p>
11011223
* </li>
11021224
* </ol>
1225+
* <p>After your firewall is established, you can add firewall endpoints for new Availability Zones by following the prior steps for the Amazon VPC setup and
1226+
* firewall subnet definitions. You can also add endpoints to Availability Zones that you're using in the firewall, either for the same VPC
1227+
* or for another VPC, by following the prior steps for the Amazon VPC setup, and defining the new VPC subnets as VPC endpoint associations. </p>
11031228
* @public
11041229
*/
11051230
export class NetworkFirewall extends NetworkFirewallClient implements NetworkFirewall {}

0 commit comments

Comments
 (0)