steampipe plugin install awssteampipe plugin install aws

Table: aws_networkfirewall_rule_group

A rule group to inspect and control network traffic. You define stateless rule groups to inspect individual packets and you define stateful rule groups to inspect packets in the context of their traffic flow.

Examples

Basic info

select
  rule_group_name,
  rule_group_status,
  type,
  jsonb_pretty(rules_source) as rules_source
from
  aws_networkfirewall_rule_group;

List rule groups with no associations

select
  rule_group_name,
  rule_group_status
from
  aws_networkfirewall_rule_group
where
  number_of_associations = 0;

Get rules for stateful rule groups

select
  rule_group_name,
  rule_group_status,
  jsonb_pretty(rules_source -> 'StatefulRules') as stateful_rules,
  jsonb_pretty(rule_variables) as rule_variables,
  stateful_rule_options
from
  aws_networkfirewall_rule_group
where
  type = 'STATEFUL';

Get rules and custom actions for stateless rule groups

select
  rule_group_name,
  rule_group_status,
  jsonb_pretty(
    rules_source -> 'StatelessRulesAndCustomActions' -> 'StatelessRules'
  ) as stateless_rules,
  jsonb_pretty(
    rules_source -> 'StatelessRulesAndCustomActions' -> 'CustomActions'
  ) as custom_actions
from
  aws_networkfirewall_rule_group
where
  type = 'STATELESS';

List rule groups with no rules

select
  rule_group_name,
  rule_group_status,
  number_of_associations
from
  aws_networkfirewall_rule_group
where
  type = 'STATELESS'
  and jsonb_array_length(
    rules_source -> 'StatelessRulesAndCustomActions' -> 'StatelessRules'
  ) = 0
  or type = 'STATEFUL'
  and jsonb_array_length(rules_source -> 'StatefulRules') = 0;

.inspect aws_networkfirewall_rule_group

AWS Network Firewall Rule Group

Name	Type	Description
_ctx	jsonb	Steampipe context in JSON form, e.g. connection_name.
account_id	text	The AWS Account ID in which the resource is located.
akas	jsonb	Array of globally unique identifier strings (also known as) for the resource.
arn	text	The Amazon Resource Name (ARN) of the rule group.
capacity	bigint	The maximum operating resources that this rule group can use. Rule group capacity is fixed at creation. When you update a rule group, you are limited to this capacity. When you reference a rule group from a firewall policy, Network Firewall reserves this capacity for the rule group.
consumed_capacity	bigint	The number of capacity units currently consumed by the rule group rules.
description	text	A description of the rule group.
number_of_associations	bigint	The number of firewall policies that use this rule group.
partition	text	The AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
region	text	The AWS Region in which the resource is located.
rule_group_id	text	The unique identifier for the rule group.
rule_group_name	text	The descriptive name of the rule group.
rule_group_status	text	Detailed information about the current status of a rule group.
rule_variables	jsonb	Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups.
rules_source	jsonb	The stateful rules or stateless rules for the rule group.
stateful_rule_options	jsonb	Additional options governing how Network Firewall handles the rule group. You can only use these for stateful rule groups.
tags	jsonb	A map of tags for the resource.
tags_src	jsonb	A list of tags assigned to the resource.
title	text	Title of the resource.
type	text	Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules.

turbot/aws