steampipe plugin install awssteampipe plugin install aws

Table: aws_networkfirewall_firewall

The firewall defines the configuration settings for an AWS Network Firewall firewall. The settings include the firewall policy, the subnets in your VPC to use for the firewall endpoints, and any tags that are attached to the firewall AWS resource.

Examples

Basic info

select
  arn,
  name,
  description,
  vpc_id,
  policy_arn,
  region,
  tags
from
  aws_networkfirewall_firewall;

List firewalls using default encryption

select
  arn,
  name,
  description,
  encryption_configuration
from
  aws_networkfirewall_firewall
where
  encryption_configuration ->> 'Type' = 'AWS_OWNED_KMS_KEY';

List firewalls having deletion protection disabled

select
  arn,
  name,
  description,
  vpc_id
from
  aws_networkfirewall_firewall
where
  not delete_protection;

List firewalls having policy change protection disabled

select
  arn,
  name,
  description,
  vpc_id
from
  aws_networkfirewall_firewall
where
  not policy_change_protection;

List firewalls having subnet change protection disabled

select
  arn,
  name,
  description,
  vpc_id
from
  aws_networkfirewall_firewall
where
  not subnet_change_protection;

Get subnet details for each firewall

select
  f.arn,
  f.name,
  f.vpc_id,
  s ->> 'SubnetId' as subnet_id,
  cidr_block,
  availability_zone,
  default_for_az
from
  aws_networkfirewall_firewall f,
  jsonb_array_elements(subnet_mappings) s,
  aws_vpc_subnet vs
where
  vs.subnet_id = s ->> 'SubnetId';

Get KMS key details of firewalls encrypted with customer managed keys

select
  f.arn,
  f.name,
  f.vpc_id,
  k.arn as key_arn,
  key_rotation_enabled
from
  aws_networkfirewall_firewall f,
  aws_kms_key k
where
  k.id = encryption_configuration ->> 'KeyId'
  and not f.encryption_configuration ->> 'Type' = 'AWS_OWNED_KMS_KEY';

.inspect aws_networkfirewall_firewall

AWS Network Firewall Firewall

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
arn	text	The Amazon Resource Name (ARN) of the firewall.
delete_protection	boolean	A flag indicating whether it is possible to delete the firewall.
description	text	A description of the firewall.
encryption_configuration	jsonb	A complex type that contains the Amazon Web Services KMS encryption configuration settings for the firewall.
firewall_status	jsonb	Detailed information about the current status of a Firewall.
id	text	The unique identifier for the firewall.
name	text	The descriptive name of the firewall.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
policy_arn	text	The Amazon Resource Name (ARN) of the firewall policy.
policy_change_protection	boolean	A setting indicating whether the firewall is protected against a change to the firewall policy association.
region	text	The AWS Region in which the resource is located.
subnet_change_protection	boolean	A setting indicating whether the firewall is protected against changes to the subnet associations.
subnet_mappings	jsonb	The public subnets that Network Firewall is using for the firewall.
tags	jsonb	A map of tags for the resource.
tags_src	jsonb	A list of tags associated with the firewall
title	text	Title of the resource.
vpc_id	text	The unique identifier of the VPC where the firewall is in use.

turbot/aws