Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. AWS Cloud Control
  3. API Docs
  4. networkfirewall
  5. getTlsInspectionConfiguration

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.27.0 published on Monday, Apr 14, 2025 by Pulumi
pulumi/pulumi-aws-native

aws-native.networkfirewall.getTlsInspectionConfiguration

Explore with Pulumi AI

aws-native logo

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.27.0 published on Monday, Apr 14, 2025 by Pulumi
pulumi/pulumi-aws-native

    Resource type definition for AWS::NetworkFirewall::TLSInspectionConfiguration

    Using getTlsInspectionConfiguration

    Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

    function getTlsInspectionConfiguration(args: GetTlsInspectionConfigurationArgs, opts?: InvokeOptions): Promise<GetTlsInspectionConfigurationResult>
function getTlsInspectionConfigurationOutput(args: GetTlsInspectionConfigurationOutputArgs, opts?: InvokeOptions): Output<GetTlsInspectionConfigurationResult>
    def get_tls_inspection_configuration(tls_inspection_configuration_arn: Optional[str] = None,
                                     opts: Optional[InvokeOptions] = None) -> GetTlsInspectionConfigurationResult
def get_tls_inspection_configuration_output(tls_inspection_configuration_arn: Optional[pulumi.Input[str]] = None,
                                     opts: Optional[InvokeOptions] = None) -> Output[GetTlsInspectionConfigurationResult]
    func LookupTlsInspectionConfiguration(ctx *Context, args *LookupTlsInspectionConfigurationArgs, opts ...InvokeOption) (*LookupTlsInspectionConfigurationResult, error)
func LookupTlsInspectionConfigurationOutput(ctx *Context, args *LookupTlsInspectionConfigurationOutputArgs, opts ...InvokeOption) LookupTlsInspectionConfigurationResultOutput

    > Note: This function is named LookupTlsInspectionConfiguration in the Go SDK.

    public static class GetTlsInspectionConfiguration 
{
    public static Task<GetTlsInspectionConfigurationResult> InvokeAsync(GetTlsInspectionConfigurationArgs args, InvokeOptions? opts = null)
    public static Output<GetTlsInspectionConfigurationResult> Invoke(GetTlsInspectionConfigurationInvokeArgs args, InvokeOptions? opts = null)
}
    public static CompletableFuture<GetTlsInspectionConfigurationResult> getTlsInspectionConfiguration(GetTlsInspectionConfigurationArgs args, InvokeOptions options)
public static Output<GetTlsInspectionConfigurationResult> getTlsInspectionConfiguration(GetTlsInspectionConfigurationArgs args, InvokeOptions options)

    fn::invoke:
  function: aws-native:networkfirewall:getTlsInspectionConfiguration
  arguments:
    # arguments dictionary

    The following arguments are supported:

    TlsInspectionConfigurationArn string
    The Amazon Resource Name (ARN) of the TLS inspection configuration.
    TlsInspectionConfigurationArn string
    The Amazon Resource Name (ARN) of the TLS inspection configuration.
    tlsInspectionConfigurationArn String
    The Amazon Resource Name (ARN) of the TLS inspection configuration.
    tlsInspectionConfigurationArn string
    The Amazon Resource Name (ARN) of the TLS inspection configuration.
    tls_inspection_configuration_arn str
    The Amazon Resource Name (ARN) of the TLS inspection configuration.
    tlsInspectionConfigurationArn String
    The Amazon Resource Name (ARN) of the TLS inspection configuration.

    getTlsInspectionConfiguration Result

    The following output properties are available:

    Description string
    A description of the TLS inspection configuration.
    TLSInspectionConfigurationValue Pulumi.AwsNative.NetworkFirewall.Outputs.TlsInspectionConfigurationTlsInspectionConfiguration
    The object that defines a TLS inspection configuration. AWS Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, AWS Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using AWS Certificate Manager , create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. For more information about using TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the AWS Network Firewall Developer Guide .
    Tags List<Pulumi.AwsNative.Outputs.Tag>
    The key:value pairs to associate with the resource.
    TlsInspectionConfigurationArn string
    The Amazon Resource Name (ARN) of the TLS inspection configuration.
    TlsInspectionConfigurationId string
    A unique identifier for the TLS inspection configuration. This ID is returned in the responses to create and list commands. You provide it to operations such as update and delete.
    Description string
    A description of the TLS inspection configuration.
    Tags Tag
    The key:value pairs to associate with the resource.
    TlsInspectionConfiguration TlsInspectionConfigurationTlsInspectionConfiguration
    The object that defines a TLS inspection configuration. AWS Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, AWS Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using AWS Certificate Manager , create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. For more information about using TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the AWS Network Firewall Developer Guide .
    TlsInspectionConfigurationArn string
    The Amazon Resource Name (ARN) of the TLS inspection configuration.
    TlsInspectionConfigurationId string
    A unique identifier for the TLS inspection configuration. This ID is returned in the responses to create and list commands. You provide it to operations such as update and delete.
    description String
    A description of the TLS inspection configuration.
    tags List<Tag>
    The key:value pairs to associate with the resource.
    tlsInspectionConfiguration TlsInspectionConfigurationTlsInspectionConfiguration
    The object that defines a TLS inspection configuration. AWS Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, AWS Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using AWS Certificate Manager , create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. For more information about using TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the AWS Network Firewall Developer Guide .
    tlsInspectionConfigurationArn String
    The Amazon Resource Name (ARN) of the TLS inspection configuration.
    tlsInspectionConfigurationId String
    A unique identifier for the TLS inspection configuration. This ID is returned in the responses to create and list commands. You provide it to operations such as update and delete.
    description string
    A description of the TLS inspection configuration.
    tags Tag[]
    The key:value pairs to associate with the resource.
    tlsInspectionConfiguration TlsInspectionConfigurationTlsInspectionConfiguration
    The object that defines a TLS inspection configuration. AWS Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, AWS Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using AWS Certificate Manager , create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. For more information about using TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the AWS Network Firewall Developer Guide .
    tlsInspectionConfigurationArn string
    The Amazon Resource Name (ARN) of the TLS inspection configuration.
    tlsInspectionConfigurationId string
    A unique identifier for the TLS inspection configuration. This ID is returned in the responses to create and list commands. You provide it to operations such as update and delete.
    description str
    A description of the TLS inspection configuration.
    tags Sequence[root_Tag]
    The key:value pairs to associate with the resource.
    tls_inspection_configuration TlsInspectionConfigurationTlsInspectionConfiguration
    The object that defines a TLS inspection configuration. AWS Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, AWS Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using AWS Certificate Manager , create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. For more information about using TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the AWS Network Firewall Developer Guide .
    tls_inspection_configuration_arn str
    The Amazon Resource Name (ARN) of the TLS inspection configuration.
    tls_inspection_configuration_id str
    A unique identifier for the TLS inspection configuration. This ID is returned in the responses to create and list commands. You provide it to operations such as update and delete.
    description String
    A description of the TLS inspection configuration.
    tags List<Property Map>
    The key:value pairs to associate with the resource.
    tlsInspectionConfiguration Property Map
    The object that defines a TLS inspection configuration. AWS Network Firewall uses TLS inspection configurations to decrypt your firewall's inbound and outbound SSL/TLS traffic. After decryption, AWS Network Firewall inspects the traffic according to your firewall policy's stateful rules, and then re-encrypts it before sending it to its destination. You can enable inspection of your firewall's inbound traffic, outbound traffic, or both. To use TLS inspection with your firewall, you must first import or provision certificates using AWS Certificate Manager , create a TLS inspection configuration, add that configuration to a new firewall policy, and then associate that policy with your firewall. For more information about using TLS inspection configurations, see Inspecting SSL/TLS traffic with TLS inspection configurations in the AWS Network Firewall Developer Guide .
    tlsInspectionConfigurationArn String
    The Amazon Resource Name (ARN) of the TLS inspection configuration.
    tlsInspectionConfigurationId String
    A unique identifier for the TLS inspection configuration. This ID is returned in the responses to create and list commands. You provide it to operations such as update and delete.

    Supporting Types

    Tag

    Key string
    The key name of the tag
    Value string
    The value of the tag
    Key string
    The key name of the tag
    Value string
    The value of the tag
    key String
    The key name of the tag
    value String
    The value of the tag
    key string
    The key name of the tag
    value string
    The value of the tag
    key str
    The key name of the tag
    value str
    The value of the tag
    key String
    The key name of the tag
    value String
    The value of the tag

    TlsInspectionConfigurationAddress

    AddressDefinition string

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    AddressDefinition string

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    addressDefinition String

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    addressDefinition string

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    address_definition str

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    addressDefinition String

    Specify an IP address or a block of IP addresses in Classless Inter-Domain Routing (CIDR) notation. Network Firewall supports all address ranges for IPv4 and IPv6.

    Examples:

    • To configure Network Firewall to inspect for the IP address 192.0.2.44, specify 192.0.2.44/32 .
    • To configure Network Firewall to inspect for IP addresses from 192.0.2.0 to 192.0.2.255, specify 192.0.2.0/24 .
    • To configure Network Firewall to inspect for the IP address 1111:0000:0000:0000:0000:0000:0000:0111, specify 1111:0000:0000:0000:0000:0000:0000:0111/128 .
    • To configure Network Firewall to inspect for IP addresses from 1111:0000:0000:0000:0000:0000:0000:0000 to 1111:0000:0000:0000:ffff:ffff:ffff:ffff, specify 1111:0000:0000:0000:0000:0000:0000:0000/64 .

    For more information about CIDR notation, see the Wikipedia entry Classless Inter-Domain Routing .

    TlsInspectionConfigurationPortRange

    FromPort int
    The lower limit of the port range. This must be less than or equal to the ToPort specification.
    ToPort int
    The upper limit of the port range. This must be greater than or equal to the FromPort specification.
    FromPort int
    The lower limit of the port range. This must be less than or equal to the ToPort specification.
    ToPort int
    The upper limit of the port range. This must be greater than or equal to the FromPort specification.
    fromPort Integer
    The lower limit of the port range. This must be less than or equal to the ToPort specification.
    toPort Integer
    The upper limit of the port range. This must be greater than or equal to the FromPort specification.
    fromPort number
    The lower limit of the port range. This must be less than or equal to the ToPort specification.
    toPort number
    The upper limit of the port range. This must be greater than or equal to the FromPort specification.
    from_port int
    The lower limit of the port range. This must be less than or equal to the ToPort specification.
    to_port int
    The upper limit of the port range. This must be greater than or equal to the FromPort specification.
    fromPort Number
    The lower limit of the port range. This must be less than or equal to the ToPort specification.
    toPort Number
    The upper limit of the port range. This must be greater than or equal to the FromPort specification.

    TlsInspectionConfigurationRevokedStatusAction

    TlsInspectionConfigurationServerCertificate

    ResourceArn string
    The Amazon Resource Name (ARN) of the AWS Certificate Manager SSL/TLS server certificate that's used for inbound SSL/TLS inspection.
    ResourceArn string
    The Amazon Resource Name (ARN) of the AWS Certificate Manager SSL/TLS server certificate that's used for inbound SSL/TLS inspection.
    resourceArn String
    The Amazon Resource Name (ARN) of the AWS Certificate Manager SSL/TLS server certificate that's used for inbound SSL/TLS inspection.
    resourceArn string
    The Amazon Resource Name (ARN) of the AWS Certificate Manager SSL/TLS server certificate that's used for inbound SSL/TLS inspection.
    resource_arn str
    The Amazon Resource Name (ARN) of the AWS Certificate Manager SSL/TLS server certificate that's used for inbound SSL/TLS inspection.
    resourceArn String
    The Amazon Resource Name (ARN) of the AWS Certificate Manager SSL/TLS server certificate that's used for inbound SSL/TLS inspection.

    TlsInspectionConfigurationServerCertificateConfiguration

    CertificateAuthorityArn string

    The Amazon Resource Name (ARN) of the imported certificate authority (CA) certificate within AWS Certificate Manager (ACM) to use for outbound SSL/TLS inspection.

    The following limitations apply:

    • You can use CA certificates that you imported into ACM, but you can't generate CA certificates with ACM.
    • You can't use certificates issued by AWS Private Certificate Authority .

    For more information about configuring certificates for outbound inspection, see Using SSL/TLS certificates with certificates with TLS inspection configurations in the AWS Network Firewall Developer Guide .

    For information about working with certificates in ACM, see Importing certificates in the AWS Certificate Manager User Guide .

    CheckCertificateRevocationStatus Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationServerCertificateConfigurationCheckCertificateRevocationStatusProperties
    When enabled, Network Firewall checks if the server certificate presented by the server in the SSL/TLS connection has a revoked or unkown status. If the certificate has an unknown or revoked status, you must specify the actions that Network Firewall takes on outbound traffic. To check the certificate revocation status, you must also specify a CertificateAuthorityArn in ServerCertificateConfiguration .
    Scopes List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationServerCertificateScope>
    A list of scopes.
    ServerCertificates List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationServerCertificate>
    The list of server certificates to use for inbound SSL/TLS inspection.
    CertificateAuthorityArn string

    The Amazon Resource Name (ARN) of the imported certificate authority (CA) certificate within AWS Certificate Manager (ACM) to use for outbound SSL/TLS inspection.

    The following limitations apply:

    • You can use CA certificates that you imported into ACM, but you can't generate CA certificates with ACM.
    • You can't use certificates issued by AWS Private Certificate Authority .

    For more information about configuring certificates for outbound inspection, see Using SSL/TLS certificates with certificates with TLS inspection configurations in the AWS Network Firewall Developer Guide .

    For information about working with certificates in ACM, see Importing certificates in the AWS Certificate Manager User Guide .

    CheckCertificateRevocationStatus TlsInspectionConfigurationServerCertificateConfigurationCheckCertificateRevocationStatusProperties
    When enabled, Network Firewall checks if the server certificate presented by the server in the SSL/TLS connection has a revoked or unkown status. If the certificate has an unknown or revoked status, you must specify the actions that Network Firewall takes on outbound traffic. To check the certificate revocation status, you must also specify a CertificateAuthorityArn in ServerCertificateConfiguration .
    Scopes []TlsInspectionConfigurationServerCertificateScope
    A list of scopes.
    ServerCertificates []TlsInspectionConfigurationServerCertificate
    The list of server certificates to use for inbound SSL/TLS inspection.
    certificateAuthorityArn String

    The Amazon Resource Name (ARN) of the imported certificate authority (CA) certificate within AWS Certificate Manager (ACM) to use for outbound SSL/TLS inspection.

    The following limitations apply:

    • You can use CA certificates that you imported into ACM, but you can't generate CA certificates with ACM.
    • You can't use certificates issued by AWS Private Certificate Authority .

    For more information about configuring certificates for outbound inspection, see Using SSL/TLS certificates with certificates with TLS inspection configurations in the AWS Network Firewall Developer Guide .

    For information about working with certificates in ACM, see Importing certificates in the AWS Certificate Manager User Guide .

    checkCertificateRevocationStatus TlsInspectionConfigurationServerCertificateConfigurationCheckCertificateRevocationStatusProperties
    When enabled, Network Firewall checks if the server certificate presented by the server in the SSL/TLS connection has a revoked or unkown status. If the certificate has an unknown or revoked status, you must specify the actions that Network Firewall takes on outbound traffic. To check the certificate revocation status, you must also specify a CertificateAuthorityArn in ServerCertificateConfiguration .
    scopes List<TlsInspectionConfigurationServerCertificateScope>
    A list of scopes.
    serverCertificates List<TlsInspectionConfigurationServerCertificate>
    The list of server certificates to use for inbound SSL/TLS inspection.
    certificateAuthorityArn string

    The Amazon Resource Name (ARN) of the imported certificate authority (CA) certificate within AWS Certificate Manager (ACM) to use for outbound SSL/TLS inspection.

    The following limitations apply:

    • You can use CA certificates that you imported into ACM, but you can't generate CA certificates with ACM.
    • You can't use certificates issued by AWS Private Certificate Authority .

    For more information about configuring certificates for outbound inspection, see Using SSL/TLS certificates with certificates with TLS inspection configurations in the AWS Network Firewall Developer Guide .

    For information about working with certificates in ACM, see Importing certificates in the AWS Certificate Manager User Guide .

    checkCertificateRevocationStatus TlsInspectionConfigurationServerCertificateConfigurationCheckCertificateRevocationStatusProperties
    When enabled, Network Firewall checks if the server certificate presented by the server in the SSL/TLS connection has a revoked or unkown status. If the certificate has an unknown or revoked status, you must specify the actions that Network Firewall takes on outbound traffic. To check the certificate revocation status, you must also specify a CertificateAuthorityArn in ServerCertificateConfiguration .
    scopes TlsInspectionConfigurationServerCertificateScope[]
    A list of scopes.
    serverCertificates TlsInspectionConfigurationServerCertificate[]
    The list of server certificates to use for inbound SSL/TLS inspection.
    certificate_authority_arn str

    The Amazon Resource Name (ARN) of the imported certificate authority (CA) certificate within AWS Certificate Manager (ACM) to use for outbound SSL/TLS inspection.

    The following limitations apply:

    • You can use CA certificates that you imported into ACM, but you can't generate CA certificates with ACM.
    • You can't use certificates issued by AWS Private Certificate Authority .

    For more information about configuring certificates for outbound inspection, see Using SSL/TLS certificates with certificates with TLS inspection configurations in the AWS Network Firewall Developer Guide .

    For information about working with certificates in ACM, see Importing certificates in the AWS Certificate Manager User Guide .

    check_certificate_revocation_status TlsInspectionConfigurationServerCertificateConfigurationCheckCertificateRevocationStatusProperties
    When enabled, Network Firewall checks if the server certificate presented by the server in the SSL/TLS connection has a revoked or unkown status. If the certificate has an unknown or revoked status, you must specify the actions that Network Firewall takes on outbound traffic. To check the certificate revocation status, you must also specify a CertificateAuthorityArn in ServerCertificateConfiguration .
    scopes Sequence[TlsInspectionConfigurationServerCertificateScope]
    A list of scopes.
    server_certificates Sequence[TlsInspectionConfigurationServerCertificate]
    The list of server certificates to use for inbound SSL/TLS inspection.
    certificateAuthorityArn String

    The Amazon Resource Name (ARN) of the imported certificate authority (CA) certificate within AWS Certificate Manager (ACM) to use for outbound SSL/TLS inspection.

    The following limitations apply:

    • You can use CA certificates that you imported into ACM, but you can't generate CA certificates with ACM.
    • You can't use certificates issued by AWS Private Certificate Authority .

    For more information about configuring certificates for outbound inspection, see Using SSL/TLS certificates with certificates with TLS inspection configurations in the AWS Network Firewall Developer Guide .

    For information about working with certificates in ACM, see Importing certificates in the AWS Certificate Manager User Guide .

    checkCertificateRevocationStatus Property Map
    When enabled, Network Firewall checks if the server certificate presented by the server in the SSL/TLS connection has a revoked or unkown status. If the certificate has an unknown or revoked status, you must specify the actions that Network Firewall takes on outbound traffic. To check the certificate revocation status, you must also specify a CertificateAuthorityArn in ServerCertificateConfiguration .
    scopes List<Property Map>
    A list of scopes.
    serverCertificates List<Property Map>
    The list of server certificates to use for inbound SSL/TLS inspection.

    TlsInspectionConfigurationServerCertificateConfigurationCheckCertificateRevocationStatusProperties

    TlsInspectionConfigurationServerCertificateScope

    DestinationPorts List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationPortRange>

    The destination ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any destination port.

    You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

    Destinations List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationAddress>
    The destination IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any destination address.
    Protocols List<int>

    The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol.

    Network Firewall currently supports only TCP.

    SourcePorts List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationPortRange>

    The source ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any source port.

    You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

    Sources List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationAddress>
    The source IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any source address.
    DestinationPorts []TlsInspectionConfigurationPortRange

    The destination ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any destination port.

    You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

    Destinations []TlsInspectionConfigurationAddress
    The destination IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any destination address.
    Protocols []int

    The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol.

    Network Firewall currently supports only TCP.

    SourcePorts []TlsInspectionConfigurationPortRange

    The source ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any source port.

    You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

    Sources []TlsInspectionConfigurationAddress
    The source IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any source address.
    destinationPorts List<TlsInspectionConfigurationPortRange>

    The destination ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any destination port.

    You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

    destinations List<TlsInspectionConfigurationAddress>
    The destination IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any destination address.
    protocols List<Integer>

    The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol.

    Network Firewall currently supports only TCP.

    sourcePorts List<TlsInspectionConfigurationPortRange>

    The source ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any source port.

    You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

    sources List<TlsInspectionConfigurationAddress>
    The source IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any source address.
    destinationPorts TlsInspectionConfigurationPortRange[]

    The destination ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any destination port.

    You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

    destinations TlsInspectionConfigurationAddress[]
    The destination IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any destination address.
    protocols number[]

    The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol.

    Network Firewall currently supports only TCP.

    sourcePorts TlsInspectionConfigurationPortRange[]

    The source ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any source port.

    You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

    sources TlsInspectionConfigurationAddress[]
    The source IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any source address.
    destination_ports Sequence[TlsInspectionConfigurationPortRange]

    The destination ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any destination port.

    You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

    destinations Sequence[TlsInspectionConfigurationAddress]
    The destination IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any destination address.
    protocols Sequence[int]

    The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol.

    Network Firewall currently supports only TCP.

    source_ports Sequence[TlsInspectionConfigurationPortRange]

    The source ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any source port.

    You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

    sources Sequence[TlsInspectionConfigurationAddress]
    The source IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any source address.
    destinationPorts List<Property Map>

    The destination ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any destination port.

    You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

    destinations List<Property Map>
    The destination IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any destination address.
    protocols List<Number>

    The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol.

    Network Firewall currently supports only TCP.

    sourcePorts List<Property Map>

    The source ports to decrypt for inspection, in Transmission Control Protocol (TCP) format. If not specified, this matches with any source port.

    You can specify individual ports, for example 1994 , and you can specify port ranges, such as 1990:1994 .

    sources List<Property Map>
    The source IP addresses and address ranges to decrypt for inspection, in CIDR notation. If not specified, this matches with any source address.

    TlsInspectionConfigurationTlsInspectionConfiguration

    ServerCertificateConfigurations List<Pulumi.AwsNative.NetworkFirewall.Inputs.TlsInspectionConfigurationServerCertificateConfiguration>
    Lists the server certificate configurations that are associated with the TLS configuration.
    ServerCertificateConfigurations []TlsInspectionConfigurationServerCertificateConfiguration
    Lists the server certificate configurations that are associated with the TLS configuration.
    serverCertificateConfigurations List<TlsInspectionConfigurationServerCertificateConfiguration>
    Lists the server certificate configurations that are associated with the TLS configuration.
    serverCertificateConfigurations TlsInspectionConfigurationServerCertificateConfiguration[]
    Lists the server certificate configurations that are associated with the TLS configuration.
    server_certificate_configurations Sequence[TlsInspectionConfigurationServerCertificateConfiguration]
    Lists the server certificate configurations that are associated with the TLS configuration.
    serverCertificateConfigurations List<Property Map>
    Lists the server certificate configurations that are associated with the TLS configuration.

    TlsInspectionConfigurationUnknownStatusAction

    Package Details

    Repository
    AWS Native pulumi/pulumi-aws-native
    License
    Apache-2.0
    aws-native logo

    We recommend new projects start with resources from the AWS provider.

    AWS Cloud Control v1.27.0 published on Monday, Apr 14, 2025 by Pulumi
    pulumi/pulumi-aws-native