import * as pulumi from "@pulumi/pulumi";
import * as inputs from "./types/input";
import * as outputs from "./types/output";
/**
 * ## <!-- This file is generated by `make docs`. Do not edit directly — edit templates/resources/ngfw.md.tmpl instead. -->
 *
 * ***
 * ## page_title: "terraform-provider-cloudngfwaws: cloudngfwaws.Ngfw Resource"
 *
 * subcategory: ""
 * description: |-
 *   Resource for NGFW manipulation.
 * ---
 *
 * # cloudngfwaws.Ngfw
 *
 * Resource for NGFW manipulation.
 *
 * > **NOTE:** Having the `rulestack` param reference the rulestack name from `cloudngfwaws.CommitRulestack` ensures that Terraform will only try to spin up a NGFW instance if the commit is successful.
 *
 * ## Admin Permission Type
 *
 * * `Firewall`
 *
 * ## Configuration Guide
 *
 * ***
 *
 * ### V1 Schema — Existing Deployments Only
 *
 * > **Important:** V1 schema is for existing customers who already have firewalls deployed with Terraform.
 * New firewalls must be created using the V2 schema.
 *
 * ***
 *
 * #### 1. Managing an Existing Firewall (no configuration changes)
 *
 * Use the V1 schema as-is. No steps required beyond ensuring your existing state is in sync.
 *
 * **Steps:**
 *
 * 1. Verify there is no unintended drift:
 *    2. If the plan is clean, no action needed. If drift is detected, review and apply:
 *
 * **Full example — existing V1 firewall:**
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as cloudngfwaws from "@pulumi/cloudngfwaws";
 *
 * const rs = new cloudngfwaws.CommitRulestack("rs", {rulestack: "my-rulestack"});
 * const example = new cloudngfwaws.Ngfw("example", {
 *     name: "example-instance",
 *     vpcId: exampleAwsVpc.id,
 *     accountId: "111111111111",
 *     description: "Example description",
 *     endpointMode: "ServiceManaged",
 *     subnetMappings: [
 *         {
 *             subnetId: subnet1.id,
 *         },
 *         {
 *             subnetId: subnet2.id,
 *         },
 *     ],
 *     rulestack: rs.rulestack,
 *     tags: {
 *         Foo: "bar",
 *     },
 * });
 * ```
 *
 * ***
 *
 * #### 2. Configuring Egress NAT on an Existing Firewall (V1)
 *
 * Egress NAT can be added to an existing V1 firewall without recreating the resource.
 *
 * > `ipPoolType` accepts `AWSService` or `BYOIP`. Use `BYOIP` together with `ipamPoolId`
 * if bringing your own IP pool.
 *
 * **Steps:**
 *
 * 1. Add the `egressNat` block to your existing resource.
 *
 * **Full example — existing V1 firewall with Egress NAT enabled:**
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as cloudngfwaws from "@pulumi/cloudngfwaws";
 *
 * const example = new cloudngfwaws.Ngfw("example", {
 *     name: "example-instance",
 *     vpcId: "vpc-0a1b2c3d4e5f00001",
 *     accountId: "111111111111",
 *     description: "Example description",
 *     endpointMode: "CustomerManaged",
 *     subnetMappings: [
 *         {
 *             availabilityZone: "us-east-1a",
 *         },
 *         {
 *             availabilityZone: "us-east-1c",
 *         },
 *     ],
 *     rulestack: "my-rulestack",
 *     egressNats: [{
 *         enabled: true,
 *         settings: [{
 *             ipPoolType: "AWSService",
 *         }],
 *     }],
 *     tags: {
 *         Foo: "bar",
 *     },
 * });
 * ```
 *
 * **To disable Egress NAT:** set `enabled = false` and re-apply.
 *
 * ***
 *
 * #### 3. Configuring Security Zones on an Existing Firewall (V1)
 *
 * Security zones let you enable or disable Egress NAT per endpoint and add or remove private CIDR prefixes.
 *
 * > **Prerequisite:** Endpoints must be successfully created and in `ACCEPTED` state before
 * security zones can be configured. Check `status.attachment[*].status` in Terraform state
 * or the AWS console before proceeding.
 *
 * **Steps:**
 *
 * 1. Confirm endpoint status is `ACCEPTED`:
 *
 * **To remove private prefixes:** remove the CIDR entries from `cidrs` and re-apply.
 * **To disable Egress NAT for a specific zone:** set `egressNatEnabled = false` and re-apply.
 *
 * ***
 *
 * ### V2 Schema — New Firewalls
 *
 * > **Important:** New firewalls can only be created using the V2 schema. Use `azList`
 * instead of `subnetMapping`, and `endpoints` instead of `endpointMode`/`subnetMapping`.
 *
 * ***
 *
 * #### 1. Creating a New Firewall (V2)
 *
 * Firewall creation uses `azList` to specify availability zones.
 * **Do not include `endpoints` during creation** — they must be added in a separate update after the firewall is running.
 *
 * **Steps:**
 *
 * 1. Define the resource with `azList` and no `endpoints` block.
 * 2. Proceed to **Step 2** once the firewall reaches `RUNNING` state.
 *
 * **Full example — new V2 firewall (creation only):**
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as cloudngfwaws from "@pulumi/cloudngfwaws";
 *
 * const example = new cloudngfwaws.Ngfw("example", {
 *     name: "my-firewall",
 *     description: "My new firewall",
 *     azLists: [
 *         "use1-az1",
 *         "use1-az4",
 *     ],
 *     allowlistAccounts: ["111111111111"],
 *     tags: {
 *         Owner: "my-team",
 *     },
 * });
 * ```
 *
 * ***
 *
 * #### 2. Adding Endpoints to a V2 Firewall
 *
 * Endpoints connect the firewall to customer VPCs. They must be added in a separate
 * a separate update after the firewall is running.
 *
 * **Steps:**
 *
 * 1. Confirm the firewall status is `RUNNING`:
 *
 * **Full example — V2 firewall with endpoints added:**
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as cloudngfwaws from "@pulumi/cloudngfwaws";
 *
 * const example = new cloudngfwaws.Ngfw("example", {
 *     name: "my-firewall",
 *     description: "My new firewall",
 *     azLists: [
 *         "use1-az1",
 *         "use1-az4",
 *     ],
 *     allowlistAccounts: ["111111111111"],
 *     endpoints: [
 *         {
 *             accountId: "111111111111",
 *             vpcId: "vpc-0a1b2c3d4e5f00002",
 *             subnetId: "subnet-0a1b2c3d4e5f00001",
 *             mode: "ServiceManaged",
 *         },
 *         {
 *             accountId: "111111111111",
 *             vpcId: "vpc-0a1b2c3d4e5f00003",
 *             subnetId: "subnet-0a1b2c3d4e5f00002",
 *             mode: "ServiceManaged",
 *         },
 *     ],
 *     tags: {
 *         Owner: "my-team",
 *     },
 * });
 * ```
 *
 * ***
 *
 * #### 3. Configuring Egress NAT on a V2 Firewall
 *
 * Egress NAT can be enabled at the firewall level once at least one endpoint is accepted.
 *
 * > **Prerequisite:** At least one endpoint must be in `ACCEPTED` state.
 *
 * **Steps:**
 *
 * 1. Add the `egressNat` block to the resource.
 *
 * **Full example — V2 firewall with Egress NAT enabled:**
 *
 * ```typescript
 * import * as pulumi from "@pulumi/pulumi";
 * import * as cloudngfwaws from "@pulumi/cloudngfwaws";
 *
 * const example = new cloudngfwaws.Ngfw("example", {
 *     name: "my-firewall",
 *     description: "My new firewall",
 *     azLists: [
 *         "use1-az1",
 *         "use1-az4",
 *     ],
 *     allowlistAccounts: ["111111111111"],
 *     endpoints: [
 *         {
 *             accountId: "111111111111",
 *             vpcId: "vpc-0a1b2c3d4e5f00002",
 *             subnetId: "subnet-0a1b2c3d4e5f00001",
 *             mode: "ServiceManaged",
 *         },
 *         {
 *             accountId: "111111111111",
 *             vpcId: "vpc-0a1b2c3d4e5f00003",
 *             subnetId: "subnet-0a1b2c3d4e5f00002",
 *             mode: "ServiceManaged",
 *         },
 *     ],
 *     egressNats: [{
 *         enabled: true,
 *         settings: [{
 *             ipPoolType: "AWSService",
 *         }],
 *     }],
 *     tags: {
 *         Owner: "my-team",
 *     },
 * });
 * ```
 *
 * **To disable Egress NAT:** set `enabled = false` and re-apply.
 *
 * ***
 *
 * #### 4. Configuring Private Prefixes and Per-Endpoint Egress NAT (V2)
 *
 * Once an endpoint is accepted, you can enable or disable Egress NAT and configure private
 * CIDR prefixes on a per-endpoint basis within the `endpoints` block.
 *
 * > **Prerequisite:** The endpoint must be in `ACCEPTED` state. The `endpointId`
 * is a read-only computed value — retrieve it from Terraform state after apply:
 *
 * **To remove private prefixes:** remove the CIDR entries from `cidrs` and re-apply.
 * **To disable per-endpoint Egress NAT:** set `egressNatEnabled = false` and re-apply.
 *
 * ***
 *
 * ## Import
 *
 * import name is <account_id>:<name>
 *
 * ```sh
 * $ pulumi import cloudngfwaws:index/ngfw:Ngfw example 12345678:example-instance
 * ```
 */
export declare class Ngfw extends pulumi.CustomResource {
    /**
     * Get an existing Ngfw resource's state with the given name, ID, and optional extra
     * properties used to qualify the lookup.
     *
     * @param name The _unique_ name of the resulting resource.
     * @param id The _unique_ provider ID of the resource to lookup.
     * @param state Any extra arguments used during the lookup.
     * @param opts Optional settings to control the behavior of the CustomResource.
     */
    static get(name: string, id: pulumi.Input<pulumi.ID>, state?: NgfwState, opts?: pulumi.CustomResourceOptions): Ngfw;
    /**
     * Returns true if the given object is an instance of Ngfw.  This is designed to work even
     * when multiple copies of the Pulumi SDK have been loaded into the same process.
     */
    static isInstance(obj: any): obj is Ngfw;
    /**
     * The Account Id.
     */
    readonly accountId: pulumi.Output<string | undefined>;
    /**
     * The list of allowed accounts for this NGFW.
     */
    readonly allowlistAccounts: pulumi.Output<string[] | undefined>;
    /**
     * App-ID version number.
     */
    readonly appIdVersion: pulumi.Output<string>;
    /**
     * Automatic App-ID upgrade version number. Defaults to `true`.
     */
    readonly automaticUpgradeAppIdVersion: pulumi.Output<boolean | undefined>;
    /**
     * The list of availability zone IDs for this NGFW.
     */
    readonly azLists: pulumi.Output<string[] | undefined>;
    /**
     * Enables or disables change protection for the NGFW.
     */
    readonly changeProtections: pulumi.Output<string[]>;
    /**
     * The update token.
     */
    readonly deploymentUpdateToken: pulumi.Output<string>;
    /**
     * The NGFW description.
     */
    readonly description: pulumi.Output<string | undefined>;
    readonly egressNats: pulumi.Output<outputs.NgfwEgressNat[]>;
    /**
     * Set endpoint mode from the following options. Valid values are `ServiceManaged` or `CustomerManaged`.
     */
    readonly endpointMode: pulumi.Output<string | undefined>;
    /**
     * The endpoint service name.
     */
    readonly endpointServiceName: pulumi.Output<string>;
    readonly endpoints: pulumi.Output<outputs.NgfwEndpoint[] | undefined>;
    /**
     * The Firewall ID.
     */
    readonly firewallId: pulumi.Output<string>;
    /**
     * The global rulestack for this NGFW.
     */
    readonly globalRulestack: pulumi.Output<string | undefined>;
    /**
     * The link ID.
     */
    readonly linkId: pulumi.Output<string>;
    /**
     * The link status.
     */
    readonly linkStatus: pulumi.Output<string>;
    /**
     * Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
     */
    readonly multiVpc: pulumi.Output<boolean>;
    /**
     * The NGFW name.
     */
    readonly name: pulumi.Output<string>;
    readonly privateAccesses: pulumi.Output<outputs.NgfwPrivateAccess[]>;
    /**
     * The rulestack for this NGFW.
     */
    readonly rulestack: pulumi.Output<string | undefined>;
    readonly securityZones: pulumi.Output<outputs.NgfwSecurityZone[] | undefined>;
    readonly statuses: pulumi.Output<outputs.NgfwStatus[]>;
    /**
     * Subnet mappings.
     */
    readonly subnetMappings: pulumi.Output<outputs.NgfwSubnetMapping[] | undefined>;
    /**
     * The tags.
     */
    readonly tags: pulumi.Output<{
        [key: string]: string;
    }>;
    /**
     * The update token.
     */
    readonly updateToken: pulumi.Output<string>;
    readonly userIds: pulumi.Output<outputs.NgfwUserId[]>;
    /**
     * The VPC ID for the NGFW.
     */
    readonly vpcId: pulumi.Output<string | undefined>;
    /**
     * Create a Ngfw resource with the given unique name, arguments, and options.
     *
     * @param name The _unique_ name of the resource.
     * @param args The arguments to use to populate this resource's properties.
     * @param opts A bag of options that control this resource's behavior.
     */
    constructor(name: string, args?: NgfwArgs, opts?: pulumi.CustomResourceOptions);
}
/**
 * Input properties used for looking up and filtering Ngfw resources.
 */
export interface NgfwState {
    /**
     * The Account Id.
     */
    accountId?: pulumi.Input<string | undefined>;
    /**
     * The list of allowed accounts for this NGFW.
     */
    allowlistAccounts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    /**
     * App-ID version number.
     */
    appIdVersion?: pulumi.Input<string | undefined>;
    /**
     * Automatic App-ID upgrade version number. Defaults to `true`.
     */
    automaticUpgradeAppIdVersion?: pulumi.Input<boolean | undefined>;
    /**
     * The list of availability zone IDs for this NGFW.
     */
    azLists?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    /**
     * Enables or disables change protection for the NGFW.
     */
    changeProtections?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    /**
     * The update token.
     */
    deploymentUpdateToken?: pulumi.Input<string | undefined>;
    /**
     * The NGFW description.
     */
    description?: pulumi.Input<string | undefined>;
    egressNats?: pulumi.Input<pulumi.Input<inputs.NgfwEgressNat>[] | undefined>;
    /**
     * Set endpoint mode from the following options. Valid values are `ServiceManaged` or `CustomerManaged`.
     */
    endpointMode?: pulumi.Input<string | undefined>;
    /**
     * The endpoint service name.
     */
    endpointServiceName?: pulumi.Input<string | undefined>;
    endpoints?: pulumi.Input<pulumi.Input<inputs.NgfwEndpoint>[] | undefined>;
    /**
     * The Firewall ID.
     */
    firewallId?: pulumi.Input<string | undefined>;
    /**
     * The global rulestack for this NGFW.
     */
    globalRulestack?: pulumi.Input<string | undefined>;
    /**
     * The link ID.
     */
    linkId?: pulumi.Input<string | undefined>;
    /**
     * The link status.
     */
    linkStatus?: pulumi.Input<string | undefined>;
    /**
     * Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
     */
    multiVpc?: pulumi.Input<boolean | undefined>;
    /**
     * The NGFW name.
     */
    name?: pulumi.Input<string | undefined>;
    privateAccesses?: pulumi.Input<pulumi.Input<inputs.NgfwPrivateAccess>[] | undefined>;
    /**
     * The rulestack for this NGFW.
     */
    rulestack?: pulumi.Input<string | undefined>;
    securityZones?: pulumi.Input<pulumi.Input<inputs.NgfwSecurityZone>[] | undefined>;
    statuses?: pulumi.Input<pulumi.Input<inputs.NgfwStatus>[] | undefined>;
    /**
     * Subnet mappings.
     */
    subnetMappings?: pulumi.Input<pulumi.Input<inputs.NgfwSubnetMapping>[] | undefined>;
    /**
     * The tags.
     */
    tags?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    } | undefined>;
    /**
     * The update token.
     */
    updateToken?: pulumi.Input<string | undefined>;
    userIds?: pulumi.Input<pulumi.Input<inputs.NgfwUserId>[] | undefined>;
    /**
     * The VPC ID for the NGFW.
     */
    vpcId?: pulumi.Input<string | undefined>;
}
/**
 * The set of arguments for constructing a Ngfw resource.
 */
export interface NgfwArgs {
    /**
     * The Account Id.
     */
    accountId?: pulumi.Input<string | undefined>;
    /**
     * The list of allowed accounts for this NGFW.
     */
    allowlistAccounts?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    /**
     * App-ID version number.
     */
    appIdVersion?: pulumi.Input<string | undefined>;
    /**
     * Automatic App-ID upgrade version number. Defaults to `true`.
     */
    automaticUpgradeAppIdVersion?: pulumi.Input<boolean | undefined>;
    /**
     * The list of availability zone IDs for this NGFW.
     */
    azLists?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    /**
     * Enables or disables change protection for the NGFW.
     */
    changeProtections?: pulumi.Input<pulumi.Input<string>[] | undefined>;
    /**
     * The NGFW description.
     */
    description?: pulumi.Input<string | undefined>;
    egressNats?: pulumi.Input<pulumi.Input<inputs.NgfwEgressNat>[] | undefined>;
    /**
     * Set endpoint mode from the following options. Valid values are `ServiceManaged` or `CustomerManaged`.
     */
    endpointMode?: pulumi.Input<string | undefined>;
    endpoints?: pulumi.Input<pulumi.Input<inputs.NgfwEndpoint>[] | undefined>;
    /**
     * The Firewall ID.
     */
    firewallId?: pulumi.Input<string | undefined>;
    /**
     * The global rulestack for this NGFW.
     */
    globalRulestack?: pulumi.Input<string | undefined>;
    /**
     * The link ID.
     */
    linkId?: pulumi.Input<string | undefined>;
    /**
     * Share NGFW with Multiple VPCs. This feature can be enabled only if the endpointMode is CustomerManaged.
     */
    multiVpc?: pulumi.Input<boolean | undefined>;
    /**
     * The NGFW name.
     */
    name?: pulumi.Input<string | undefined>;
    privateAccesses?: pulumi.Input<pulumi.Input<inputs.NgfwPrivateAccess>[] | undefined>;
    /**
     * The rulestack for this NGFW.
     */
    rulestack?: pulumi.Input<string | undefined>;
    securityZones?: pulumi.Input<pulumi.Input<inputs.NgfwSecurityZone>[] | undefined>;
    /**
     * Subnet mappings.
     */
    subnetMappings?: pulumi.Input<pulumi.Input<inputs.NgfwSubnetMapping>[] | undefined>;
    /**
     * The tags.
     */
    tags?: pulumi.Input<{
        [key: string]: pulumi.Input<string>;
    } | undefined>;
    userIds?: pulumi.Input<pulumi.Input<inputs.NgfwUserId>[] | undefined>;
    /**
     * The VPC ID for the NGFW.
     */
    vpcId?: pulumi.Input<string | undefined>;
}
//# sourceMappingURL=ngfw.d.ts.map