Actions, resources, and condition keys for Amazon Network Firewall

Amazon Network Firewall (service prefix: network-firewall) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Network Firewall
Actions defined by Amazon Network Firewall
Resource types defined by Amazon Network Firewall
Condition keys for Amazon Network Firewall

API operations defined by Amazon Network Firewall

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AcceptNetworkFirewallTransitGatewayAttachment	network-firewall:AcceptNetworkFirewallTransitGatewayAttachment	Write
AssociateAvailabilityZones	network-firewall:AssociateAvailabilityZones	Write
AssociateFirewallPolicy	network-firewall:AssociateFirewallPolicy	Write
AssociateSubnets	network-firewall:AssociateSubnets	Write
AttachRuleGroupsToProxyConfiguration	network-firewall:AttachRuleGroupsToProxyConfiguration	Write
CreateContainerAssociation	network-firewall:CreateContainerAssociation	Write
CreateFirewall	network-firewall:AssociateFirewallPolicy	Write
	network-firewall:CreateFirewall	Write
	network-firewall:TagResource	Tagging, Write
CreateFirewallPolicy	network-firewall:CreateFirewallPolicy	Write
	network-firewall:ListRuleGroups	List
	network-firewall:ListTLSInspectionConfigurations	List
	network-firewall:TagResource	Tagging, Write
CreateProxy	network-firewall:CreateProxy	Write
CreateProxy	network-firewall:TagResource	Tagging, Write
CreateProxyConfiguration	network-firewall:AttachRuleGroupsToProxyConfiguration	Write
	network-firewall:CreateProxyConfiguration	Write
	network-firewall:TagResource	Tagging, Write
CreateProxyRuleGroup	network-firewall:CreateProxyRuleGroup	Write
CreateProxyRuleGroup	network-firewall:TagResource	Tagging, Write
CreateProxyRules	network-firewall:CreateProxyRules	Write
CreateRuleGroup	network-firewall:CreateRuleGroup	Write
CreateRuleGroup	network-firewall:TagResource	Tagging, Write
CreateTLSInspectionConfiguration	network-firewall:CreateTLSInspectionConfiguration	Write
CreateTLSInspectionConfiguration	network-firewall:TagResource	Tagging, Write
CreateVpcEndpointAssociation	network-firewall:CreateVpcEndpointAssociation	Write
	network-firewall:ListFirewalls	List
	network-firewall:TagResource	Tagging, Write
DeleteContainerAssociation	network-firewall:DeleteContainerAssociation	Write
DeleteFirewall	network-firewall:DeleteFirewall	Write
DeleteFirewallPolicy	network-firewall:DeleteFirewallPolicy	Write
DeleteNetworkFirewallTransitGatewayAttachment	network-firewall:DeleteNetworkFirewallTransitGatewayAttachment	Write
DeleteProxy	network-firewall:DeleteProxy	Write
DeleteProxyConfiguration	network-firewall:DeleteProxyConfiguration	Write
DeleteProxyRuleGroup	network-firewall:DeleteProxyRuleGroup	Write
DeleteProxyRules	network-firewall:DeleteProxyRules	Write
DeleteResourcePolicy	network-firewall:DeleteResourcePolicy	Write
DeleteRuleGroup	network-firewall:DeleteRuleGroup	Write
DeleteTLSInspectionConfiguration	network-firewall:DeleteTLSInspectionConfiguration	Write
DeleteVpcEndpointAssociation	network-firewall:DeleteVpcEndpointAssociation	Write
DescribeContainerAssociation	network-firewall:DescribeContainerAssociation	Read
DescribeFirewall	network-firewall:DescribeFirewall	Read
DescribeFirewallMetadata	network-firewall:DescribeFirewallMetadata	Read
DescribeFirewallPolicy	network-firewall:DescribeFirewallPolicy	Read
DescribeFlowOperation	network-firewall:DescribeFlowOperation	Read
DescribeLoggingConfiguration	network-firewall:DescribeLoggingConfiguration	Read
DescribeProxy	network-firewall:DescribeProxy	Read
DescribeProxyConfiguration	network-firewall:DescribeProxyConfiguration	Read
DescribeProxyRule	network-firewall:DescribeProxyRule	Read
DescribeProxyRuleGroup	network-firewall:DescribeProxyRuleGroup	Read
DescribeResourcePolicy	network-firewall:DescribeResourcePolicy	Read
DescribeRuleGroup	network-firewall:DescribeRuleGroup	Read
DescribeRuleGroupMetadata	network-firewall:DescribeRuleGroupMetadata	Read
DescribeRuleGroupSummary	network-firewall:DescribeRuleGroupSummary	Read
DescribeTLSInspectionConfiguration	network-firewall:DescribeTLSInspectionConfiguration	Read
DescribeVpcEndpointAssociation	network-firewall:DescribeVpcEndpointAssociation	Read
DetachRuleGroupsFromProxyConfiguration	network-firewall:DetachRuleGroupsFromProxyConfiguration	Write
DisassociateAvailabilityZones	network-firewall:DisassociateAvailabilityZones	Write
DisassociateSubnets	network-firewall:DisassociateSubnets	Write
GetAnalysisReportResults	network-firewall:GetAnalysisReportResults	Read
ListAnalysisReports	network-firewall:ListAnalysisReports	List
ListContainerAssociations	network-firewall:ListContainerAssociations	List
ListFirewallPolicies	network-firewall:ListFirewallPolicies	List
ListFirewalls	network-firewall:ListFirewalls	List
ListFlowOperationResults	network-firewall:ListFlowOperationResults	Read
ListFlowOperations	network-firewall:ListFlowOperations	List
ListProxies	network-firewall:ListProxies	List
ListProxyConfigurations	network-firewall:ListProxyConfigurations	List
ListProxyRuleGroups	network-firewall:ListProxyRuleGroups	List
ListRuleGroups	network-firewall:ListRuleGroups	List
ListTLSInspectionConfigurations	network-firewall:ListTLSInspectionConfigurations	List
ListTagsForResource	network-firewall:ListTagsForResource	List
ListVpcEndpointAssociations	network-firewall:ListVpcEndpointAssociations	List
PutResourcePolicy	network-firewall:PutResourcePolicy	Write
RejectNetworkFirewallTransitGatewayAttachment	network-firewall:RejectNetworkFirewallTransitGatewayAttachment	Write
StartAnalysisReport	network-firewall:StartAnalysisReport	Write
StartFlowCapture	network-firewall:StartFlowCapture	Write
StartFlowFlush	network-firewall:StartFlowFlush	Write
TagResource	network-firewall:TagResource	Tagging, Write
UntagResource	network-firewall:UntagResource	Tagging, Write
UpdateAvailabilityZoneChangeProtection	network-firewall:UpdateAvailabilityZoneChangeProtection	Write
UpdateContainerAssociation	network-firewall:UpdateContainerAssociation	Write
UpdateFirewallAnalysisSettings	network-firewall:UpdateFirewallAnalysisSettings	Write
UpdateFirewallDeleteProtection	network-firewall:UpdateFirewallDeleteProtection	Write
UpdateFirewallDescription	network-firewall:UpdateFirewallDescription	Write
UpdateFirewallEncryptionConfiguration	network-firewall:UpdateFirewallEncryptionConfiguration	Write
UpdateFirewallPolicy	network-firewall:ListRuleGroups	List
	network-firewall:ListTLSInspectionConfigurations	List
	network-firewall:UpdateFirewallPolicy	Write
UpdateFirewallPolicyChangeProtection	network-firewall:UpdateFirewallPolicyChangeProtection	Write
UpdateLoggingConfiguration	network-firewall:UpdateLoggingConfiguration	Write
UpdateProxy	network-firewall:UpdateProxy	Write
UpdateProxyConfiguration	network-firewall:UpdateProxyConfiguration	Write
UpdateProxyRule	network-firewall:UpdateProxyRule	Write
UpdateProxyRuleGroupPriorities	network-firewall:UpdateProxyRuleGroupPriorities	Write
UpdateProxyRulePriorities	network-firewall:UpdateProxyRulePriorities	Write
UpdateRuleGroup	network-firewall:UpdateRuleGroup	Write
UpdateSubnetChangeProtection	network-firewall:UpdateSubnetChangeProtection	Write
UpdateTLSInspectionConfiguration	network-firewall:UpdateTLSInspectionConfiguration	Write

Actions defined by Amazon Network Firewall

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptNetworkFirewallTransitGatewayAttachment	Grants permission to accept pending Network Firewall attachments on a transit gateway	Firewall*	aws:ResourceTag/${TagKey}	Write
AssociateAvailabilityZones	Grants permission to associate availability zones to a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
AssociateFirewallPolicy	Grants permission to create an association between a firewall policy and a firewall	Firewall*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AssociateFirewallPolicy		FirewallPolicy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AssociateSubnets	Grants permission to associate VPC subnets to a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
AttachRuleGroupsToProxyConfiguration	Grants permission to attach proxy rule groups to a proxy configuration	ProxyConfiguration*	aws:ResourceTag/${TagKey}	Write
AttachRuleGroupsToProxyConfiguration		ProxyRuleGroup*	aws:ResourceTag/${TagKey}	Write
CreateContainerAssociation	Grants permission to create an Amazon Network Firewall container association	ContainerAssociation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFirewall	Grants permission to create an Amazon Network Firewall firewall	Firewall*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFirewall		FirewallPolicy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFirewallPolicy	Grants permission to create an Amazon Network Firewall firewall policy	FirewallPolicy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		StatefulRuleGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		StatelessRuleGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		TLSInspectionConfiguration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateProxy	Grants permission to create an Amazon Network Firewall proxy	Proxy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateProxy		ProxyConfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateProxyConfiguration	Grants permission to create an Amazon Network Firewall proxy configuration	ProxyConfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateProxyConfiguration		ProxyRuleGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateProxyRuleGroup	Grants permission to create an Amazon Network Firewall proxy rule group	ProxyRuleGroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateProxyRules	Grants permission to add proxy rules to a proxy rule group	ProxyRuleGroup*	aws:ResourceTag/${TagKey}	Write
CreateRuleGroup	Grants permission to create an Amazon Network Firewall rule group	StatefulRuleGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRuleGroup		StatelessRuleGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTLSInspectionConfiguration	Grants permission to create an Amazon Network Firewall tls inspection configuration	TLSInspectionConfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateVpcEndpointAssociation	Grants permission to create an Amazon Network Firewall vpc endpoint association	Firewall*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateVpcEndpointAssociation		VpcEndpointAssociation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteContainerAssociation	Grants permission to delete an Amazon Network Firewall container association	ContainerAssociation*	aws:ResourceTag/${TagKey}	Write
DeleteFirewall	Grants permission to delete a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
DeleteFirewallPolicy	Grants permission to delete a firewall policy	FirewallPolicy*	aws:ResourceTag/${TagKey}	Write
DeleteNetworkFirewallTransitGatewayAttachment	Grants permission to delete Network Firewall attachments on a transit gateway	Firewall*	aws:ResourceTag/${TagKey}	Write
DeleteProxy	Grants permission to delete a proxy	Proxy*	aws:ResourceTag/${TagKey}	Write
DeleteProxyConfiguration	Grants permission to delete a proxy configuration	ProxyConfiguration*	aws:ResourceTag/${TagKey}	Write
DeleteProxyRuleGroup	Grants permission to delete a proxy rule group	ProxyRuleGroup*	aws:ResourceTag/${TagKey}	Write
DeleteProxyRules	Grants permission to remove proxy rules from a proxy rule group	ProxyRuleGroup*	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy	Grants permission to delete a resource policy for a firewall policy or rule group or firewall	Firewall	aws:ResourceTag/${TagKey}	Write
		FirewallPolicy	aws:ResourceTag/${TagKey}
		StatefulRuleGroup	aws:ResourceTag/${TagKey}
		StatelessRuleGroup	aws:ResourceTag/${TagKey}
DeleteRuleGroup	Grants permission to delete a rule group	StatefulRuleGroup*	aws:ResourceTag/${TagKey}	Write
DeleteRuleGroup	Grants permission to delete a rule group	StatelessRuleGroup*	aws:ResourceTag/${TagKey}	Write
DeleteTLSInspectionConfiguration	Grants permission to delete a tls inspection configuration	TLSInspectionConfiguration*	aws:ResourceTag/${TagKey}	Write
DeleteVpcEndpointAssociation	Grants permission to delete a vpc endpoint association	VpcEndpointAssociation*	aws:ResourceTag/${TagKey}	Write
DescribeContainerAssociation	Grants permission to retrieve the data objects that define a container association	ContainerAssociation*	aws:ResourceTag/${TagKey}	Read
DescribeFirewall	Grants permission to retrieve the data objects that define a firewall	Firewall*	aws:ResourceTag/${TagKey}	Read
DescribeFirewallMetadata	Grants permission to retrieve the high-level information about a firewall	Firewall*	aws:ResourceTag/${TagKey}	Read
DescribeFirewallPolicy	Grants permission to retrieve the data objects that define a firewall policy	FirewallPolicy*	aws:ResourceTag/${TagKey}	Read
		StatefulRuleGroup	aws:ResourceTag/${TagKey}
		StatelessRuleGroup	aws:ResourceTag/${TagKey}
		TLSInspectionConfiguration	aws:ResourceTag/${TagKey}
DescribeFlowOperation	Grants permission to describe a flow operation performed on a firewall	Firewall*	aws:ResourceTag/${TagKey}	Read
DescribeLoggingConfiguration	Grants permission to describe the logging configuration of a firewall	Firewall*	aws:ResourceTag/${TagKey}	Read
DescribeProxy	Grants permission to retrieve the data objects that define a proxy	Proxy*	aws:ResourceTag/${TagKey}	Read
DescribeProxyConfiguration	Grants permission to retrieve the data objects that define a proxy configuration	ProxyConfiguration*	aws:ResourceTag/${TagKey}	Read
DescribeProxyRule	Grants permission to retrieve the data objects that define a proxy rule	ProxyRuleGroup*	aws:ResourceTag/${TagKey}	Read
DescribeProxyRuleGroup	Grants permission to retrieve the data objects that define a proxy rule group	ProxyRuleGroup*	aws:ResourceTag/${TagKey}	Read
DescribeResourcePolicy	Grants permission to describe a resource policy for a firewall policy or rule group or firewall	Firewall	aws:ResourceTag/${TagKey}	Read
		FirewallPolicy	aws:ResourceTag/${TagKey}
		StatefulRuleGroup	aws:ResourceTag/${TagKey}
		StatelessRuleGroup	aws:ResourceTag/${TagKey}
DescribeRuleGroup	Grants permission to retrieve the data objects that define a rule group	StatefulRuleGroup	aws:ResourceTag/${TagKey}	Read
DescribeRuleGroup		StatelessRuleGroup	aws:ResourceTag/${TagKey}	Read
DescribeRuleGroupMetadata	Grants permission to retrieve the high-level information about a rule group	StatefulRuleGroup	aws:ResourceTag/${TagKey}	Read
DescribeRuleGroupMetadata		StatelessRuleGroup	aws:ResourceTag/${TagKey}	Read
DescribeRuleGroupSummary	Grants permission to retrieve the summary information about a rule group	StatefulRuleGroup	aws:ResourceTag/${TagKey}	Read
DescribeRuleGroupSummary		StatelessRuleGroup	aws:ResourceTag/${TagKey}	Read
DescribeTLSInspectionConfiguration	Grants permission to retrieve the data objects that define a tls inspection configuration	TLSInspectionConfiguration*	aws:ResourceTag/${TagKey}	Read
DescribeVpcEndpointAssociation	Grants permission to retrieve the data objects that define a vpc endpoint association	VpcEndpointAssociation*	aws:ResourceTag/${TagKey}	Read
DetachRuleGroupsFromProxyConfiguration	Grants permission to detach proxy rule groups from a proxy configuration	ProxyConfiguration*	aws:ResourceTag/${TagKey}	Write
DetachRuleGroupsFromProxyConfiguration		ProxyRuleGroup*	aws:ResourceTag/${TagKey}	Write
DisassociateAvailabilityZones	Grants permission to disassociate availability zones to a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
DisassociateSubnets	Grants permission to disassociate VPC subnets from a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
GetAnalysisReportResults	Grants permission to retrieve analysis report results of a firewall	Firewall*	aws:ResourceTag/${TagKey}	Read
ListAnalysisReports	Grants permission to list firewall analysis reports	Firewall*	aws:ResourceTag/${TagKey}	List
ListContainerAssociations	Grants permission to retrieve the metadata for container associations			List
ListFirewallPolicies	Grants permission to retrieve the metadata for firewall policies	FirewallPolicy*	aws:ResourceTag/${TagKey}	List
ListFirewalls	Grants permission to retrieve the metadata for firewalls	Firewall*	aws:ResourceTag/${TagKey}	List
ListFlowOperationResults	Grants permission to list results from a flow operation performed on a firewall	Firewall*	aws:ResourceTag/${TagKey}	Read
ListFlowOperations	Grants permission to list flow operations performed on a firewall	Firewall*	aws:ResourceTag/${TagKey}	List
ListProxies	Grants permission to retrieve the metadata for proxies	Proxy*	aws:ResourceTag/${TagKey}	List
ListProxyConfigurations	Grants permission to retrieve the metadata for proxy configurations	ProxyConfiguration*	aws:ResourceTag/${TagKey}	List
ListProxyRuleGroups	Grants permission to retrieve the metadata for proxy rule groups	ProxyRuleGroup*	aws:ResourceTag/${TagKey}	List
ListRuleGroups	Grants permission to retrieve the metadata for rule groups			List
ListTLSInspectionConfigurations	Grants permission to retrieve the metadata for tls inspection configurations	TLSInspectionConfiguration*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to retrieve the tags for a resource	ContainerAssociation	aws:ResourceTag/${TagKey}	List
		Firewall*	aws:ResourceTag/${TagKey}
		FirewallPolicy*	aws:ResourceTag/${TagKey}
		StatefulRuleGroup	aws:ResourceTag/${TagKey}
		StatelessRuleGroup	aws:ResourceTag/${TagKey}
		TLSInspectionConfiguration	aws:ResourceTag/${TagKey}
		VpcEndpointAssociation	aws:ResourceTag/${TagKey}
ListVpcEndpointAssociations	Grants permission to retrieve the metadata for vpc endpoint associations	VpcEndpointAssociation*	aws:ResourceTag/${TagKey}	List
PutResourcePolicy	Grants permission to put a resource policy for a firewall policy or rule group or firewall	Firewall	aws:ResourceTag/${TagKey}	Write
		FirewallPolicy	aws:ResourceTag/${TagKey}
		StatefulRuleGroup	aws:ResourceTag/${TagKey}
		StatelessRuleGroup	aws:ResourceTag/${TagKey}
RejectNetworkFirewallTransitGatewayAttachment	Grants permission to reject pending Network Firewall attachments on a transit gateway	Firewall*	aws:ResourceTag/${TagKey}	Write
StartAnalysisReport	Grants permission to start an analysis report on a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
StartFlowCapture	Grants permission to start capture operation on a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
StartFlowFlush	Grants permission to start flush operation on a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to attach tags to a resource	ContainerAssociation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		Firewall	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		FirewallPolicy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Proxy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		ProxyConfiguration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		ProxyRuleGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		StatefulRuleGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		StatelessRuleGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		TLSInspectionConfiguration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		VpcEndpointAssociation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from a resource	ContainerAssociation	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		Firewall	aws:ResourceTag/${TagKey} aws:TagKeys
		FirewallPolicy	aws:ResourceTag/${TagKey} aws:TagKeys
		Proxy	aws:ResourceTag/${TagKey} aws:TagKeys
		ProxyConfiguration	aws:ResourceTag/${TagKey} aws:TagKeys
		ProxyRuleGroup	aws:ResourceTag/${TagKey} aws:TagKeys
		StatefulRuleGroup	aws:ResourceTag/${TagKey} aws:TagKeys
		StatelessRuleGroup	aws:ResourceTag/${TagKey} aws:TagKeys
		TLSInspectionConfiguration	aws:ResourceTag/${TagKey} aws:TagKeys
		VpcEndpointAssociation	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAvailabilityZoneChangeProtection	Grants permission to add or remove availability zone change protection for a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
UpdateContainerAssociation	Grants permission to update an Amazon Network Firewall container association	ContainerAssociation*	aws:ResourceTag/${TagKey}	Write
UpdateFirewallAnalysisSettings	Grants permission to modify firewall analysis settings of a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
UpdateFirewallDeleteProtection	Grants permission to add or remove delete protection for a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
UpdateFirewallDescription	Grants permission to modify the description for a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
UpdateFirewallEncryptionConfiguration	Grants permission to modify the encryption configuration of a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
UpdateFirewallPolicy	Grants permission to modify a firewall policy	FirewallPolicy*	aws:ResourceTag/${TagKey}	Write
		StatefulRuleGroup	aws:ResourceTag/${TagKey}
		StatelessRuleGroup	aws:ResourceTag/${TagKey}
		TLSInspectionConfiguration	aws:ResourceTag/${TagKey}
UpdateFirewallPolicyChangeProtection	Grants permission to add or remove firewall policy change protection for a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
UpdateLoggingConfiguration	Grants permission to modify the logging configuration of a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
UpdateProxy	Grants permission to modify a proxy	Proxy*	aws:ResourceTag/${TagKey}	Write
UpdateProxyConfiguration	Grants permission to modify a proxy configuration	ProxyConfiguration*	aws:ResourceTag/${TagKey}	Write
UpdateProxyRule	Grants permission to update an existing proxy rule on a proxy rule group	ProxyRuleGroup*	aws:ResourceTag/${TagKey}	Write
UpdateProxyRuleGroupPriorities	Grants permission to modify rule group priorities on a proxy configuration	ProxyConfiguration*	aws:ResourceTag/${TagKey}	Write
UpdateProxyRulePriorities	Grants permission to update proxy rule priorities within a proxy rule group	ProxyRuleGroup*	aws:ResourceTag/${TagKey}	Write
UpdateRuleGroup	Grants permission to modify a rule group	StatefulRuleGroup	aws:ResourceTag/${TagKey}	Write
UpdateRuleGroup	Grants permission to modify a rule group	StatelessRuleGroup	aws:ResourceTag/${TagKey}	Write
UpdateSubnetChangeProtection	Grants permission to add or remove subnet change protection for a firewall	Firewall*	aws:ResourceTag/${TagKey}	Write
UpdateTLSInspectionConfiguration	Grants permission to modify a tls inspection configuration	TLSInspectionConfiguration*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Network Firewall

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
ContainerAssociation	arn:${Partition}:network-firewall:${Region}:${Account}:container-association/${Name}	aws:ResourceTag/${TagKey}
Firewall	arn:${Partition}:network-firewall:${Region}:${Account}:firewall/${Name}	aws:ResourceTag/${TagKey}
FirewallPolicy	arn:${Partition}:network-firewall:${Region}:${Account}:firewall-policy/${Name}	aws:ResourceTag/${TagKey}
Proxy	arn:${Partition}:network-firewall:${Region}:${Account}:proxy/${Name}	aws:ResourceTag/${TagKey}
ProxyConfiguration	arn:${Partition}:network-firewall:${Region}:${Account}:proxy-configuration/${Name}	aws:ResourceTag/${TagKey}
ProxyRuleGroup	arn:${Partition}:network-firewall:${Region}:${Account}:proxy-rule-group/${Name}	aws:ResourceTag/${TagKey}
StatefulRuleGroup	arn:${Partition}:network-firewall:${Region}:${Account}:stateful-rulegroup/${Name}	aws:ResourceTag/${TagKey}
StatelessRuleGroup	arn:${Partition}:network-firewall:${Region}:${Account}:stateless-rulegroup/${Name}	aws:ResourceTag/${TagKey}
TLSInspectionConfiguration	arn:${Partition}:network-firewall:${Region}:${Account}:tls-configuration/${Name}	aws:ResourceTag/${TagKey}
VpcEndpointAssociation	arn:${Partition}:network-firewall:${Region}:${Account}:vpc-endpoint-association/${Name}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Network Firewall

Amazon Network Firewall defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by on the allowed set of values for each of the tags	String
aws:ResourceTag/${TagKey}	Filters access by the tag value associated with the resource	String
aws:TagKeys	Filters access by the presence of mandatory tags in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon License Manager Linux Subscriptions Manager (license-manager-linux-subscriptions)

Amazon Organizations (organizations)