Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. AWS Cloud Control
  3. API Docs
  4. networkfirewall
  5. getTlsInspectionConfiguration

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.27.0 published on Monday, Apr 14, 2025 by Pulumi
pulumi/pulumi-aws-native

aws-native.networkfirewall.getTlsInspectionConfiguration

Explore with Pulumi AI

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.27.0 published on Monday, Apr 14, 2025 by Pulumi
pulumi/pulumi-aws-native

Resource type definition for AWS::NetworkFirewall::TLSInspectionConfiguration

Using getTlsInspectionConfiguration

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getTlsInspectionConfiguration(args: GetTlsInspectionConfigurationArgs, opts?: InvokeOptions): Promise<GetTlsInspectionConfigurationResult>
function getTlsInspectionConfigurationOutput(args: GetTlsInspectionConfigurationOutputArgs, opts?: InvokeOptions): Output<GetTlsInspectionConfigurationResult>
Copy
def get_tls_inspection_configuration(tls_inspection_configuration_arn: Optional[str] = None,
                                     opts: Optional[InvokeOptions] = None) -> GetTlsInspectionConfigurationResult
def get_tls_inspection_configuration_output(tls_inspection_configuration_arn: Optional[pulumi.Input[str]] = None,
                                     opts: Optional[InvokeOptions] = None) -> Output[GetTlsInspectionConfigurationResult]
Copy
func LookupTlsInspectionConfiguration(ctx *Context, args *LookupTlsInspectionConfigurationArgs, opts ...InvokeOption) (*LookupTlsInspectionConfigurationResult, error)
func LookupTlsInspectionConfigurationOutput(ctx *Context, args *LookupTlsInspectionConfigurationOutputArgs, opts ...InvokeOption) LookupTlsInspectionConfigurationResultOutput
Copy

> Note: This function is named LookupTlsInspectionConfiguration in the Go SDK.

public static class GetTlsInspectionConfiguration 
{
    public static Task<GetTlsInspectionConfigurationResult> InvokeAsync(GetTlsInspectionConfigurationArgs args, InvokeOptions? opts = null)
    public static Output<GetTlsInspectionConfigurationResult> Invoke(GetTlsInspectionConfigurationInvokeArgs args, InvokeOptions? opts = null)
}
Copy
public static CompletableFuture<GetTlsInspectionConfigurationResult> getTlsInspectionConfiguration(GetTlsInspectionConfigurationArgs args, InvokeOptions options)
public static Output<GetTlsInspectionConfigurationResult> getTlsInspectionConfiguration(GetTlsInspectionConfigurationArgs args, InvokeOptions options)
Copy
fn::invoke:
  function: aws-native:networkfirewall:getTlsInspectionConfiguration
  arguments:
    # arguments dictionary
Copy

The following arguments are supported:

TlsInspectionConfigurationArn This property is required. string
The Amazon Resource Name (ARN) of the TLS inspection configuration.
TlsInspectionConfigurationArn This property is required. string
The Amazon Resource Name (ARN) of the TLS inspection configuration.
tlsInspectionConfigurationArn This property is required. String
The Amazon Resource Name (ARN) of the TLS inspection configuration.
tlsInspectionConfigurationArn This property is required. string
The Amazon Resource Name (ARN) of the TLS inspection configuration.
tls_inspection_configuration_arn This property is required. str
The Amazon Resource Name (ARN) of the TLS inspection configuration.
tlsInspectionConfigurationArn This property is required. String
The Amazon Resource Name (ARN) of the TLS inspection configuration.

getTlsInspectionConfiguration Result

The following output properties are available:

Description string
A description of the TLS inspection configuration.
TLSInspectionConfigurationValue Pulumi.AwsNative.NetworkFirewall.Outputs.TlsInspectionConfigurationTlsInspectionConfiguration
The object that defines a TLS inspection configuration. AWS Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, AWS Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using AWS Certificate Manager , create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. For more information about using TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the AWS Network Firewall Developer Guide .
Tags List<Pulumi.AwsNative.Outputs.Tag>
The key:value pairs to associate with the resource.
TlsInspectionConfigurationArn string
The Amazon Resource Name (ARN) of the TLS inspection configuration.
TlsInspectionConfigurationId string
A unique identifier for the TLS inspection configuration. This ID is returned in the responses to create and list commands. You provide it to operations such as update and delete.
Description string
A description of the TLS inspection configuration.
Tags Tag
The key:value pairs to associate with the resource.
TlsInspectionConfiguration TlsInspectionConfigurationTlsInspectionConfiguration
The object that defines a TLS inspection configuration. AWS Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, AWS Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using AWS Certificate Manager , create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. For more information about using TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the AWS Network Firewall Developer Guide .
TlsInspectionConfigurationArn string
The Amazon Resource Name (ARN) of the TLS inspection configuration.
TlsInspectionConfigurationId string
A unique identifier for the TLS inspection configuration. This ID is returned in the responses to create and list commands. You provide it to operations such as update and delete.
description String
A description of the TLS inspection configuration.
tags List<Tag>
The key:value pairs to associate with the resource.
tlsInspectionConfiguration TlsInspectionConfigurationTlsInspectionConfiguration
The object that defines a TLS inspection configuration. AWS Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, AWS Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using AWS Certificate Manager , create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. For more information about using TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the AWS Network Firewall Developer Guide .
tlsInspectionConfigurationArn String
The Amazon Resource Name (ARN) of the TLS inspection configuration.
tlsInspectionConfigurationId String
A unique identifier for the TLS inspection configuration. This ID is returned in the responses to create and list commands. You provide it to operations such as update and delete.
description string
A description of the TLS inspection configuration.
tags Tag[]
The key:value pairs to associate with the resource.
tlsInspectionConfiguration TlsInspectionConfigurationTlsInspectionConfiguration
The object that defines a TLS inspection configuration. AWS Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, AWS Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using AWS Certificate Manager , create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. For more information about using TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the AWS Network Firewall Developer Guide .
tlsInspectionConfigurationArn string
The Amazon Resource Name (ARN) of the TLS inspection configuration.
tlsInspectionConfigurationId string
A unique identifier for the TLS inspection configuration. This ID is returned in the responses to create and list commands. You provide it to operations such as update and delete.
description str
A description of the TLS inspection configuration.
tags Sequence[root_Tag]
The key:value pairs to associate with the resource.
tls_inspection_configuration TlsInspectionConfigurationTlsInspectionConfiguration
The object that defines a TLS inspection configuration. AWS Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, AWS Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using AWS Certificate Manager , create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. For more information about using TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the AWS Network Firewall Developer Guide .
tls_inspection_configuration_arn str
The Amazon Resource Name (ARN) of the TLS inspection configuration.
tls_inspection_configuration_id str
A unique identifier for the TLS inspection configuration. This ID is returned in the responses to create and list commands. You provide it to operations such as update and delete.
description String
A description of the TLS inspection configuration.
tags List<Property Map>
The key:value pairs to associate with the resource.
tlsInspectionConfiguration Property Map
The object that defines a TLS inspection configuration. AWS Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, AWS Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using AWS Certificate Manager , create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. For more information about using TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the AWS Network Firewall Developer Guide .
tlsInspectionConfigurationArn String
The Amazon Resource Name (ARN) of the TLS inspection configuration.
tlsInspectionConfigurationId String
A unique identifier for the TLS inspection configuration. This ID is returned in the responses to create and list commands. You provide it to operations such as update and delete.

Supporting Types

Tag

Key This property is required. string
The key name of the tag
Value This property is required. string
The value of the tag
Key This property is required. string
The key name of the tag
Value This property is required. string
The value of the tag
key This property is required. String
The key name of the tag
value This property is required. String
The value of the tag
key This property is required. string
The key name of the tag
value This property is required. string
The value of the tag
key This property is required. str
The key name of the tag
value This property is required. str
The value of the tag
key This property is required. String
The key name of the tag
value This property is required. String
The value of the tag

TlsInspectionConfigurationAddress

AddressDefinition This property is required. string

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

  • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
  • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
  • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
  • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

AddressDefinition This property is required. string

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

  • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
  • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
  • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
  • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

addressDefinition This property is required. String

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

  • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
  • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
  • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
  • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

addressDefinition This property is required. string

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

  • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
  • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
  • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
  • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

address_definition This property is required. str

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

  • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
  • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
  • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
  • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

addressDefinition This property is required. String

Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

Examples:

  • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
  • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
  • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
  • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

TlsInspectionConfigurationPortRange

FromPort This property is required. int
The lower limit of the port range. This must be less than or equal to the ToPort specification.
ToPort This property is required. int
The upper limit of the port range. This must be greater than or equal to the FromPort specification.
FromPort This property is required. int
The lower limit of the port range. This must be less than or equal to the ToPort specification.
ToPort This property is required. int
The upper limit of the port range. This must be greater than or equal to the FromPort specification.
fromPort This property is required. Integer
The lower limit of the port range. This must be less than or equal to the ToPort specification.
toPort This property is required. Integer
The upper limit of the port range. This must be greater than or equal to the FromPort specification.
fromPort This property is required. number
The lower limit of the port range. This must be less than or equal to the ToPort specification.
toPort This property is required. number
The upper limit of the port range. This must be greater than or equal to the FromPort specification.
from_port This property is required. int
The lower limit of the port range. This must be less than or equal to the ToPort specification.
to_port This property is required. int
The upper limit of the port range. This must be greater than or equal to the FromPort specification.
fromPort This property is required. Number
The lower limit of the port range. This must be less than or equal to the ToPort specification.
toPort This property is required. Number
The upper limit of the port range. This must be greater than or equal to the FromPort specification.

TlsInspectionConfigurationRevokedStatusAction

TlsInspectionConfigurationServerCertificate

ResourceArn string
The Amazon Resource Name (ARN) of the AWS Certificate Manager SSL/TLS server certificate that's used for inbound SSL/TLS inspection.
ResourceArn string
The Amazon Resource Name (ARN) of the AWS Certificate Manager SSL/TLS server certificate that's used for inbound SSL/TLS inspection.
resourceArn String
The Amazon Resource Name (ARN) of the AWS Certificate Manager SSL/TLS server certificate that's used for inbound SSL/TLS inspection.
resourceArn string
The Amazon Resource Name (ARN) of the AWS Certificate Manager SSL/TLS server certificate that's used for inbound SSL/TLS inspection.
resource_arn str
The Amazon Resource Name (ARN) of the AWS Certificate Manager SSL/TLS server certificate that's used for inbound SSL/TLS inspection.
resourceArn String
The Amazon Resource Name (ARN) of the AWS Certificate Manager SSL/TLS server certificate that's used for inbound SSL/TLS inspection.

TlsInspectionConfigurationServerCertificateConfiguration

CertificateAuthorityArn string

The Amazon Resource Name (ARN) of the imported certificate authority (CA) certificate within AWS Certificate Manager (ACM) to use for outbound SSL/TLS inspection.

The following limitations apply:

  • You can use CA certificates that you imported into ACM, but you can't generate CA certificates with ACM.
  • You can't use certificates issued by AWS Private Certificate Authority .

For more information about configuring certificates for outbound inspection, see Using SSL/TLS certificates with certificates with TLS inspection configurations in the AWS Network Firewall Developer Guide .

For information about working with certificates in ACM, see Importing certificates in the AWS Certificate Manager User Guide .

CheckCertificateRevocationStatus Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationServerCertificateConfigurationCheckCertificateRevocationStatusProperties
When enabled, Network Firewall checks if the server certificate presented by the server in the SSL/TLS connection has a revoked or unkown status. If the certificate has an unknown or revoked status, you must specify the actions that Network Firewall takes on outbound traffic. To check the certificate revocation status, you must also specify a CertificateAuthorityArn in ServerCertificateConfiguration .
Scopes List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationServerCertificateScope>
A list of scopes.
ServerCertificates List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationServerCertificate>
The list of server certificates to use for inbound SSL/TLS inspection.
CertificateAuthorityArn string

The Amazon Resource Name (ARN) of the imported certificate authority (CA) certificate within AWS Certificate Manager (ACM) to use for outbound SSL/TLS inspection.

The following limitations apply:

  • You can use CA certificates that you imported into ACM, but you can't generate CA certificates with ACM.
  • You can't use certificates issued by AWS Private Certificate Authority .

For more information about configuring certificates for outbound inspection, see Using SSL/TLS certificates with certificates with TLS inspection configurations in the AWS Network Firewall Developer Guide .

For information about working with certificates in ACM, see Importing certificates in the AWS Certificate Manager User Guide .

CheckCertificateRevocationStatus TlsInspectionConfigurationServerCertificateConfigurationCheckCertificateRevocationStatusProperties
When enabled, Network Firewall checks if the server certificate presented by the server in the SSL/TLS connection has a revoked or unkown status. If the certificate has an unknown or revoked status, you must specify the actions that Network Firewall takes on outbound traffic. To check the certificate revocation status, you must also specify a CertificateAuthorityArn in ServerCertificateConfiguration .
Scopes []TlsInspectionConfigurationServerCertificateScope
A list of scopes.
ServerCertificates []TlsInspectionConfigurationServerCertificate
The list of server certificates to use for inbound SSL/TLS inspection.
certificateAuthorityArn String

The Amazon Resource Name (ARN) of the imported certificate authority (CA) certificate within AWS Certificate Manager (ACM) to use for outbound SSL/TLS inspection.

The following limitations apply:

  • You can use CA certificates that you imported into ACM, but you can't generate CA certificates with ACM.
  • You can't use certificates issued by AWS Private Certificate Authority .

For more information about configuring certificates for outbound inspection, see Using SSL/TLS certificates with certificates with TLS inspection configurations in the AWS Network Firewall Developer Guide .

For information about working with certificates in ACM, see Importing certificates in the AWS Certificate Manager User Guide .

checkCertificateRevocationStatus TlsInspectionConfigurationServerCertificateConfigurationCheckCertificateRevocationStatusProperties
When enabled, Network Firewall checks if the server certificate presented by the server in the SSL/TLS connection has a revoked or unkown status. If the certificate has an unknown or revoked status, you must specify the actions that Network Firewall takes on outbound traffic. To check the certificate revocation status, you must also specify a CertificateAuthorityArn in ServerCertificateConfiguration .
scopes List<TlsInspectionConfigurationServerCertificateScope>
A list of scopes.
serverCertificates List<TlsInspectionConfigurationServerCertificate>
The list of server certificates to use for inbound SSL/TLS inspection.
certificateAuthorityArn string

The Amazon Resource Name (ARN) of the imported certificate authority (CA) certificate within AWS Certificate Manager (ACM) to use for outbound SSL/TLS inspection.

The following limitations apply:

  • You can use CA certificates that you imported into ACM, but you can't generate CA certificates with ACM.
  • You can't use certificates issued by AWS Private Certificate Authority .

For more information about configuring certificates for outbound inspection, see Using SSL/TLS certificates with certificates with TLS inspection configurations in the AWS Network Firewall Developer Guide .

For information about working with certificates in ACM, see Importing certificates in the AWS Certificate Manager User Guide .

checkCertificateRevocationStatus TlsInspectionConfigurationServerCertificateConfigurationCheckCertificateRevocationStatusProperties
When enabled, Network Firewall checks if the server certificate presented by the server in the SSL/TLS connection has a revoked or unkown status. If the certificate has an unknown or revoked status, you must specify the actions that Network Firewall takes on outbound traffic. To check the certificate revocation status, you must also specify a CertificateAuthorityArn in ServerCertificateConfiguration .
scopes TlsInspectionConfigurationServerCertificateScope[]
A list of scopes.
serverCertificates TlsInspectionConfigurationServerCertificate[]
The list of server certificates to use for inbound SSL/TLS inspection.
certificate_authority_arn str

The Amazon Resource Name (ARN) of the imported certificate authority (CA) certificate within AWS Certificate Manager (ACM) to use for outbound SSL/TLS inspection.

The following limitations apply:

  • You can use CA certificates that you imported into ACM, but you can't generate CA certificates with ACM.
  • You can't use certificates issued by AWS Private Certificate Authority .

For more information about configuring certificates for outbound inspection, see Using SSL/TLS certificates with certificates with TLS inspection configurations in the AWS Network Firewall Developer Guide .

For information about working with certificates in ACM, see Importing certificates in the AWS Certificate Manager User Guide .

check_certificate_revocation_status TlsInspectionConfigurationServerCertificateConfigurationCheckCertificateRevocationStatusProperties
When enabled, Network Firewall checks if the server certificate presented by the server in the SSL/TLS connection has a revoked or unkown status. If the certificate has an unknown or revoked status, you must specify the actions that Network Firewall takes on outbound traffic. To check the certificate revocation status, you must also specify a CertificateAuthorityArn in ServerCertificateConfiguration .
scopes Sequence[TlsInspectionConfigurationServerCertificateScope]
A list of scopes.
server_certificates Sequence[TlsInspectionConfigurationServerCertificate]
The list of server certificates to use for inbound SSL/TLS inspection.
certificateAuthorityArn String

The Amazon Resource Name (ARN) of the imported certificate authority (CA) certificate within AWS Certificate Manager (ACM) to use for outbound SSL/TLS inspection.

The following limitations apply:

  • You can use CA certificates that you imported into ACM, but you can't generate CA certificates with ACM.
  • You can't use certificates issued by AWS Private Certificate Authority .

For more information about configuring certificates for outbound inspection, see Using SSL/TLS certificates with certificates with TLS inspection configurations in the AWS Network Firewall Developer Guide .

For information about working with certificates in ACM, see Importing certificates in the AWS Certificate Manager User Guide .

checkCertificateRevocationStatus Property Map
When enabled, Network Firewall checks if the server certificate presented by the server in the SSL/TLS connection has a revoked or unkown status. If the certificate has an unknown or revoked status, you must specify the actions that Network Firewall takes on outbound traffic. To check the certificate revocation status, you must also specify a CertificateAuthorityArn in ServerCertificateConfiguration .
scopes List<Property Map>
A list of scopes.
serverCertificates List<Property Map>
The list of server certificates to use for inbound SSL/TLS inspection.

TlsInspectionConfigurationServerCertificateConfigurationCheckCertificateRevocationStatusProperties

TlsInspectionConfigurationServerCertificateScope

DestinationPorts List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationPortRange>

The destination ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any destination port.

You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

Destinations List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationAddress>
The destination IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any destination address.
Protocols List<int>

The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol.

Network Firewall currently supports only TCP.

SourcePorts List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationPortRange>

The source ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any source port.

You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

Sources List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationAddress>
The source IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any source address.
DestinationPorts []TlsInspectionConfigurationPortRange

The destination ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any destination port.

You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

Destinations []TlsInspectionConfigurationAddress
The destination IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any destination address.
Protocols []int

The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol.

Network Firewall currently supports only TCP.

SourcePorts []TlsInspectionConfigurationPortRange

The source ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any source port.

You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

Sources []TlsInspectionConfigurationAddress
The source IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any source address.
destinationPorts List<TlsInspectionConfigurationPortRange>

The destination ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any destination port.

You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

destinations List<TlsInspectionConfigurationAddress>
The destination IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any destination address.
protocols List<Integer>

The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol.

Network Firewall currently supports only TCP.

sourcePorts List<TlsInspectionConfigurationPortRange>

The source ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any source port.

You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

sources List<TlsInspectionConfigurationAddress>
The source IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any source address.
destinationPorts TlsInspectionConfigurationPortRange[]

The destination ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any destination port.

You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

destinations TlsInspectionConfigurationAddress[]
The destination IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any destination address.
protocols number[]

The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol.

Network Firewall currently supports only TCP.

sourcePorts TlsInspectionConfigurationPortRange[]

The source ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any source port.

You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

sources TlsInspectionConfigurationAddress[]
The source IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any source address.
destination_ports Sequence[TlsInspectionConfigurationPortRange]

The destination ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any destination port.

You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

destinations Sequence[TlsInspectionConfigurationAddress]
The destination IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any destination address.
protocols Sequence[int]

The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol.

Network Firewall currently supports only TCP.

source_ports Sequence[TlsInspectionConfigurationPortRange]

The source ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any source port.

You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

sources Sequence[TlsInspectionConfigurationAddress]
The source IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any source address.
destinationPorts List<Property Map>

The destination ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any destination port.

You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

destinations List<Property Map>
The destination IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any destination address.
protocols List<Number>

The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol.

Network Firewall currently supports only TCP.

sourcePorts List<Property Map>

The source ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any source port.

You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

sources List<Property Map>
The source IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any source address.

TlsInspectionConfigurationTlsInspectionConfiguration

ServerCertificateConfigurations List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationServerCertificateConfiguration>
Lists the server certificate configurations that are associated with the TLS configuration.
ServerCertificateConfigurations []TlsInspectionConfigurationServerCertificateConfiguration
Lists the server certificate configurations that are associated with the TLS configuration.
serverCertificateConfigurations List<TlsInspectionConfigurationServerCertificateConfiguration>
Lists the server certificate configurations that are associated with the TLS configuration.
serverCertificateConfigurations TlsInspectionConfigurationServerCertificateConfiguration[]
Lists the server certificate configurations that are associated with the TLS configuration.
server_certificate_configurations Sequence[TlsInspectionConfigurationServerCertificateConfiguration]
Lists the server certificate configurations that are associated with the TLS configuration.
serverCertificateConfigurations List<Property Map>
Lists the server certificate configurations that are associated with the TLS configuration.

TlsInspectionConfigurationUnknownStatusAction

Package Details

Repository
AWS Native pulumi/pulumi-aws-native
License
Apache-2.0

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.27.0 published on Monday, Apr 14, 2025 by Pulumi
pulumi/pulumi-aws-native