import * as pulumi from "@pulumi/pulumi"; import * as inputs from "./types/input"; import * as outputs from "./types/output"; /** * Resource for NGFW log profile manipulation. * * ## Admin Permission Type * * * `Firewall` * * ## Schema Overview * * The log profile resource supports two schemas for configuring log delivery: * * | | V1 Schema | V2 Schema | * |---|---|---| * | **Block** | `logDestination` | `logConfig` | * | **Log types per block** | One | Multiple (Set) | * | **Cross-account logging** | Not supported | Supported via `roleType` + `accountId` | * | **Use case** | Existing deployments | New deployments | * * *** * * ## V1 Schema — `logDestination` (Existing Deployments) * * > Use V1 if you already have a log profile deployed using `logDestination` blocks. * Existing configurations do not need to be migrated. * * One `logDestination` block is required per log type. The following destination types * are supported: `S3`, `CloudWatchLogs`, `KinesisDataFirehose`. * * **Full example — V1 log profile with multiple destinations:** * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as cloudngfwaws from "@pulumi/cloudngfwaws"; * * const example = new cloudngfwaws.NgfwLogProfile("example", { * ngfw: exampleCloudngfwawsNgfw.name, * accountId: exampleCloudngfwawsNgfw.accountId, * logDestinations: [ * { * destinationType: "S3", * destination: "my-s3-bucket", * logType: "TRAFFIC", * }, * { * destinationType: "CloudWatchLogs", * destination: "my-log-group", * logType: "THREAT", * }, * { * destinationType: "KinesisDataFirehose", * destination: "my-firehose-stream", * logType: "DECRYPTION", * }, * ], * }); * ``` * * **To add a destination:** add another `logDestination` block and re-apply. * **To remove a destination:** remove the block and re-apply. * * *** * * ## V2 Schema — `logConfig` (New Deployments) * * > Use V2 for new deployments. It consolidates all destination configuration into a * single `logConfig` block and supports multiple log types per destination. * * **Full example — V2 log profile, same-account delivery:** * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as cloudngfwaws from "@pulumi/cloudngfwaws"; * * const example = new cloudngfwaws.NgfwLogProfile("example", { * ngfw: exampleCloudngfwawsNgfw.name, * accountId: exampleCloudngfwawsNgfw.accountId, * logConfig: { * logDestinationType: "S3", * logDestination: "my-s3-bucket", * logTypes: [ * "TRAFFIC", * "THREAT", * "DECRYPTION", * ], * }, * }); * ``` * * **Full example — V2 log profile with cross-account delivery:** * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as cloudngfwaws from "@pulumi/cloudngfwaws"; * * const example = new cloudngfwaws.NgfwLogProfile("example", { * ngfw: exampleCloudngfwawsNgfw.name, * accountId: exampleCloudngfwawsNgfw.accountId, * logConfig: { * logDestinationType: "CloudWatchLogs", * logDestination: "arn:aws:logs:us-east-1:222222222222:log-group:my-log-group", * logTypes: [ * "TRAFFIC", * "THREAT", * ], * roleType: "CrossAccount", * accountId: "222222222222", * }, * }); * ``` * * **Full example — V2 log profile with advanced threat logging and CloudWatch metrics:** * * ```typescript * import * as pulumi from "@pulumi/pulumi"; * import * as cloudngfwaws from "@pulumi/cloudngfwaws"; * * const example = new cloudngfwaws.NgfwLogProfile("example", { * ngfw: exampleCloudngfwawsNgfw.name, * accountId: exampleCloudngfwawsNgfw.accountId, * advancedThreatLog: true, * cloudWatchMetricNamespace: "CloudNGFW", * logConfig: { * logDestinationType: "KinesisDataFirehose", * logDestination: "my-firehose-stream", * logTypes: [ * "TRAFFIC", * "THREAT", * "DECRYPTION", * ], * }, * }); * ``` * * *** * * ## Import * * import name is : * * ```sh * $ pulumi import cloudngfwaws:index/ngfwLogProfile:NgfwLogProfile example 12345678:example-instance * ``` */ export declare class NgfwLogProfile extends pulumi.CustomResource { /** * Get an existing NgfwLogProfile resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: NgfwLogProfileState, opts?: pulumi.CustomResourceOptions): NgfwLogProfile; /** * Returns true if the given object is an instance of NgfwLogProfile. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is NgfwLogProfile; /** * The unique ID of the account. */ readonly accountId: pulumi.Output; /** * Enable advanced threat logging. */ readonly advancedThreatLog: pulumi.Output; /** * The CloudWatch metric namespace. */ readonly cloudWatchMetricNamespace: pulumi.Output; /** * Cloudwatch metric fields. */ readonly cloudwatchMetricFields: pulumi.Output; /** * The Firewall Id for the NGFW. */ readonly firewallId: pulumi.Output; /** * Log configuration details. */ readonly logConfig: pulumi.Output; /** * List of log destinations. */ readonly logDestinations: pulumi.Output; /** * The name of the NGFW. */ readonly ngfw: pulumi.Output; /** * The region of the NGFW. */ readonly region: pulumi.Output; /** * The update token. */ readonly updateToken: pulumi.Output; /** * Create a NgfwLogProfile resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args?: NgfwLogProfileArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering NgfwLogProfile resources. */ export interface NgfwLogProfileState { /** * The unique ID of the account. */ accountId?: pulumi.Input; /** * Enable advanced threat logging. */ advancedThreatLog?: pulumi.Input; /** * The CloudWatch metric namespace. */ cloudWatchMetricNamespace?: pulumi.Input; /** * Cloudwatch metric fields. */ cloudwatchMetricFields?: pulumi.Input[] | undefined>; /** * The Firewall Id for the NGFW. */ firewallId?: pulumi.Input; /** * Log configuration details. */ logConfig?: pulumi.Input; /** * List of log destinations. */ logDestinations?: pulumi.Input[] | undefined>; /** * The name of the NGFW. */ ngfw?: pulumi.Input; /** * The region of the NGFW. */ region?: pulumi.Input; /** * The update token. */ updateToken?: pulumi.Input; } /** * The set of arguments for constructing a NgfwLogProfile resource. */ export interface NgfwLogProfileArgs { /** * The unique ID of the account. */ accountId?: pulumi.Input; /** * Enable advanced threat logging. */ advancedThreatLog?: pulumi.Input; /** * The CloudWatch metric namespace. */ cloudWatchMetricNamespace?: pulumi.Input; /** * Cloudwatch metric fields. */ cloudwatchMetricFields?: pulumi.Input[] | undefined>; /** * The Firewall Id for the NGFW. */ firewallId?: pulumi.Input; /** * Log configuration details. */ logConfig?: pulumi.Input; /** * List of log destinations. */ logDestinations?: pulumi.Input[] | undefined>; /** * The name of the NGFW. */ ngfw?: pulumi.Input; /** * The region of the NGFW. */ region?: pulumi.Input; } //# sourceMappingURL=ngfwLogProfile.d.ts.map