export interface AvailabilityZoneMapping {
    /** The ID of the Availability Zone where the firewall endpoint is located. For example, us-east-2a. The Availability Zone must be in the same Region as the transit gateway. */
    AvailabilityZone: string;
}
export interface SubnetMapping {
    /** The unique identifier for the subnet. */
    SubnetId: string;
    /** The subnet's IP address type. You can't change the IP address type after you create the subnet. */
    IPAddressType?: 'DUALSTACK' | 'IPV4' | 'IPV6';
}
export interface ProxyRuleGroupAttachment {
    /** The descriptive name of the proxy rule group. You can't change the name of a proxy rule group after you create it. */
    ProxyRuleGroupName?: string;
    /** Where to insert a proxy rule group in a proxy configuration. */
    InsertPosition?: number;
}
export interface Tag {
    /** The part of the key:value pair that defines a tag. You can use a tag key to describe a category of information, such as "customer." Tag keys are case-sensitive. */
    Key: string;
    /** The part of the key:value pair that defines a tag. You can use a tag value to describe a specific value within a category, such as "companyA" or "companyB." Tag values are case-sensitive. */
    Value: string;
}
export interface EncryptionConfiguration {
    /** The ID of the Amazon Web Services Key Management Service (KMS) customer managed key. You can use any of the key identifiers that KMS supports, unless you're using a key that's managed by another accou */
    KeyId?: string;
    /** The type of Amazon Web Services KMS key to use for encryption of your Network Firewall resources. */
    Type: 'CUSTOMER_KMS' | 'AWS_OWNED_KMS_KEY';
}
export interface StatefulEngineOptions {
    /** Indicates how to manage the order of stateful rule evaluation for the policy. STRICT_ORDER is the recommended option, but DEFAULT_ACTION_ORDER is the default option. With STRICT_ORDER, provide your ru */
    RuleOrder?: 'DEFAULT_ACTION_ORDER' | 'STRICT_ORDER';
    /** Configures how Network Firewall processes traffic when a network connection breaks midstream. Network connections can break due to disruptions in external networks or within the firewall itself. DROP  */
    StreamExceptionPolicy?: 'DROP' | 'CONTINUE' | 'REJECT';
    /** Configures the amount of time that can pass without any traffic sent through the firewall before the firewall determines that the connection is idle. */
    FlowTimeouts?: any;
}
export interface PolicyVariables {
    /** The IPv4 or IPv6 addresses in CIDR notation to use for the Suricata HOME_NET variable. If your firewall uses an inspection VPC, you might want to override the HOME_NET variable with the CIDRs of your  */
    RuleVariables?: Record<string, any>;
}
export interface FirewallPolicy {
    /** References to the stateless rule groups that are used in the policy. These define the matching criteria in stateless rules. */
    StatelessRuleGroupReferences?: any[];
    /** The actions to take on a packet if it doesn't match any of the stateless rules in the policy. If you want non-matching packets to be forwarded for stateful inspection, specify aws:forward_to_sfe. You  */
    StatelessDefaultActions: string[];
    /** The actions to take on a fragmented UDP packet if it doesn't match any of the stateless rules in the policy. Network Firewall only manages UDP packet fragments and silently drops packet fragments for  */
    StatelessFragmentDefaultActions: string[];
    /** The custom action definitions that are available for use in the firewall policy's StatelessDefaultActions setting. You name each custom action that you define, and then you can use it by name in your  */
    StatelessCustomActions?: any[];
    /** References to the stateful rule groups that are used in the policy. These define the inspection criteria in stateful rules. */
    StatefulRuleGroupReferences?: any[];
    /** The default actions to take on a packet that doesn't match any stateful rules. The stateful default action is optional, and is only valid when using the strict rule order. Valid values of the stateful */
    StatefulDefaultActions?: string[];
    /** Additional options governing how Network Firewall handles stateful rules. The stateful rule groups that you use in your policy must have stateful rule options settings that are compatible with these s */
    StatefulEngineOptions?: StatefulEngineOptions;
    /** The Amazon Resource Name (ARN) of the TLS inspection configuration. */
    TLSInspectionConfigurationArn?: string;
    /** Contains variables that you can use to override default Suricata settings in your firewall policy. */
    PolicyVariables?: PolicyVariables;
    /** When true, prevents TCP and TLS packets from reaching destination servers until TLS Inspection has evaluated Server Name Indication (SNI) rules. Requires an associated TLS Inspection configuration. */
    EnableTLSSessionHolding?: boolean;
}
export interface ListenerPropertyRequest {
    /** Port for processing traffic. */
    Port: number;
    /** Selection of HTTP or HTTPS traffic. */
    Type: 'HTTP' | 'HTTPS';
}
export interface TlsInterceptPropertiesRequest {
    /** Private Certificate Authority (PCA) used to issue private TLS certificates so that the proxy can present PCA-signed certificates which applications trust through the same root, establishing a secure a */
    PcaArn?: string;
    /** Specifies whether to enable or disable TLS Intercept Mode. */
    TlsInterceptMode?: 'ENABLED' | 'DISABLED';
}
export interface ProxyConfigDefaultRulePhaseActionsRequest {
    /** Before domain resolution. */
    PreDNS?: 'ALLOW' | 'DENY' | 'ALERT';
    /** After DNS, before request. */
    PreREQUEST?: 'ALLOW' | 'DENY' | 'ALERT';
    /** After receiving response. */
    PostRESPONSE?: 'ALLOW' | 'DENY' | 'ALERT';
}
export interface ProxyRulesByRequestPhase {
    /** Before domain resolution. */
    PreDNS?: any[];
    /** After DNS, before request. */
    PreREQUEST?: any[];
    /** After receiving response. */
    PostRESPONSE?: any[];
}
export interface CreateProxyRulesByRequestPhase {
    /** Before domain resolution. */
    PreDNS?: any[];
    /** After DNS, before request. */
    PreREQUEST?: any[];
    /** After receiving response. */
    PostRESPONSE?: any[];
}
export interface RuleVariables {
    /** A list of IP addresses and address ranges, in CIDR notation. */
    IPSets?: Record<string, any>;
    /** A list of port ranges. */
    PortSets?: Record<string, any>;
}
export interface ReferenceSets {
    /** The list of IP set references. */
    IPSetReferences?: Record<string, any>;
}
export interface RulesSource {
    /** Stateful inspection criteria, provided in Suricata compatible rules. Suricata is an open-source threat detection framework that includes a standard rule-based language for network traffic inspection.  */
    RulesString?: string;
    /** Stateful inspection criteria for a domain list rule group. */
    RulesSourceList?: any;
    /** An array of individual stateful rules inspection criteria to be used together in a stateful rule group. Use this option to specify simple Suricata rules with protocol, source and destination, ports, d */
    StatefulRules?: any[];
    /** Stateless inspection criteria to be used in a stateless rule group. */
    StatelessRulesAndCustomActions?: any;
}
export interface StatefulRuleOptions {
    /** Indicates how to manage the order of the rule evaluation for the rule group. DEFAULT_ACTION_ORDER is the default behavior. Stateful rules are provided to the rule engine as Suricata compatible strings */
    RuleOrder?: 'DEFAULT_ACTION_ORDER' | 'STRICT_ORDER';
}
export interface RuleGroup {
    /** Settings that are available for use in the rules in the rule group. You can only use these for stateful rule groups. */
    RuleVariables?: RuleVariables;
    /** The list of a rule group's reference sets. */
    ReferenceSets?: ReferenceSets;
    /** The stateful rules or stateless rules for the rule group. */
    RulesSource: RulesSource;
    /** Additional options governing how Network Firewall handles stateful rules. The policies where you use your stateful rule group must have stateful rule options settings that are compatible with these se */
    StatefulRuleOptions?: StatefulRuleOptions;
}
export interface SourceMetadata {
    /** The Amazon Resource Name (ARN) of the rule group that your own rule group is copied from. */
    SourceArn?: string;
    /** The update token of the Amazon Web Services managed rule group that your own rule group is copied from. To determine the update token for the managed rule group, call DescribeRuleGroup. */
    SourceUpdateToken?: string;
}
export interface SummaryConfiguration {
    /** Specifies the selected rule options returned by DescribeRuleGroupSummary. */
    RuleOptions?: 'SID' | 'MSG' | 'METADATA'[];
}
export interface TLSInspectionConfiguration {
    /** Lists the server certificate configurations that are associated with the TLS configuration. */
    ServerCertificateConfigurations?: any[];
}
export interface FlowFilter {
    SourceAddress?: any;
    DestinationAddress?: any;
    /** The source port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994. To match with any port, specify ANY. */
    SourcePort?: string;
    /** The destination port to inspect for. You can specify an individual port, for example 1994 and you can specify a port range, for example 1990:1994. To match with any port, specify ANY. */
    DestinationPort?: string;
    /** The protocols to inspect for, specified using the assigned internet protocol number (IANA) for each protocol. If not specified, this matches with any protocol. */
    Protocols?: any[];
}
export interface LoggingConfiguration {
    /** Defines the logging destinations for the logs for a firewall. Network Firewall generates logs for stateful rule groups. */
    LogDestinationConfigs: any[];
}
export interface ProxyRuleCondition {
    /** Defines how to perform a match. */
    ConditionOperator?: string;
    /** Defines what is to be matched. */
    ConditionKey?: string;
    /** Specifes the exact value that needs to be matched against. */
    ConditionValues?: any[];
}
export interface ProxyRuleGroupPriority {
    /** The descriptive name of the proxy rule group. You can't change the name of a proxy rule group after you create it. */
    ProxyRuleGroupName?: string;
    /** Where to move a proxy rule group in a proxy configuration. */
    NewPosition?: number;
}
export interface ProxyRulePriority {
    /** The descriptive name of the proxy rule. You can't change the name of a proxy rule after you create it. */
    ProxyRuleName?: string;
    /** Where to move a proxy rule in a proxy rule group. */
    NewPosition?: number;
}
export interface AcceptNetworkFirewallTransitGatewayAttachmentInput {
    /** Required. The unique identifier of the transit gateway attachment to accept. This ID is returned in the response when creating a transit gateway-attached firewall. */
    TransitGatewayAttachmentId: string;
}
export interface AssociateAvailabilityZonesInput {
    /** Required. The Availability Zones where you want to create firewall endpoints. You must specify at least one Availability Zone. */
    AvailabilityZoneMappings: AvailabilityZoneMapping[];
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of */
    UpdateToken?: string;
}
export interface AssociateFirewallPolicyInput {
    /** The Amazon Resource Name (ARN) of the firewall policy. */
    FirewallPolicyArn: string;
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of */
    UpdateToken?: string;
}
export interface AssociateSubnetsInput {
    /** The IDs of the subnets that you want to associate with the firewall. */
    SubnetMappings: SubnetMapping[];
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of */
    UpdateToken?: string;
}
export interface AttachRuleGroupsToProxyConfigurationInput {
    /** The proxy rule group(s) to attach to the proxy configuration */
    RuleGroups: ProxyRuleGroupAttachment[];
    /** A token used for optimistic locking. Network Firewall returns a token to your requests that access the proxy configuration. The token marks the state of the proxy configuration resource at the time of */
    UpdateToken: string;
    /** The Amazon Resource Name (ARN) of a proxy configuration. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationArn?: string;
    /** The descriptive name of the proxy configuration. You can't change the name of a proxy configuration after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationName?: string;
}
export interface CreateFirewallInput {
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. */
    FirewallName: string;
    /** The Amazon Resource Name (ARN) of the FirewallPolicy that you want to use for the firewall. */
    FirewallPolicyArn: string;
    /** Optional. A setting indicating whether the firewall is protected against changes to its Availability Zone configuration. When set to TRUE, you cannot add or remove Availability Zones without first dis */
    AvailabilityZoneChangeProtection?: boolean;
    /** Required. The Availability Zones where you want to create firewall endpoints for a transit gateway-attached firewall. You must specify at least one Availability Zone. Consider enabling the firewall in */
    AvailabilityZoneMappings?: AvailabilityZoneMapping[];
    /** A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting  */
    DeleteProtection?: boolean;
    /** A description of the firewall. */
    Description?: string;
    /** An optional setting indicating the specific traffic analysis types to enable on the firewall. */
    EnabledAnalysisTypes?: 'TLS_SNI' | 'HTTP_HOST'[];
    /** A complex type that contains settings for encryption of your firewall resources. */
    EncryptionConfiguration?: EncryptionConfiguration;
    /** A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewal */
    FirewallPolicyChangeProtection?: boolean;
    /** A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall tha */
    SubnetChangeProtection?: boolean;
    /** The public subnets to use for your Network Firewall firewalls. Each subnet must belong to a different Availability Zone in the VPC. Network Firewall creates a firewall endpoint in each subnet. */
    SubnetMappings?: SubnetMapping[];
    /** The key:value pairs to associate with the resource. */
    Tags?: Tag[];
    /** Required when creating a transit gateway-attached firewall. The unique identifier of the transit gateway to attach to this firewall. You can provide either a transit gateway from your account or one t */
    TransitGatewayId?: string;
    /** The unique identifier of the VPC where Network Firewall should create the firewall. You can't change this setting after you create the firewall. */
    VpcId?: string;
}
export interface CreateFirewallPolicyInput {
    /** The rule groups and policy actions to use in the firewall policy. */
    FirewallPolicy: FirewallPolicy;
    /** The descriptive name of the firewall policy. You can't change the name of a firewall policy after you create it. */
    FirewallPolicyName: string;
    /** A description of the firewall policy. */
    Description?: string;
    /** Indicates whether you want Network Firewall to just check the validity of the request, rather than run the request. If set to TRUE, Network Firewall checks whether the request can run successfully, bu */
    DryRun?: boolean;
    /** A complex type that contains settings for encryption of your firewall policy resources. */
    EncryptionConfiguration?: EncryptionConfiguration;
    /** The key:value pairs to associate with the resource. */
    Tags?: Tag[];
}
export interface CreateProxyInput {
    /** A unique identifier for the NAT gateway to use with proxy resources. */
    NatGatewayId: string;
    /** The descriptive name of the proxy. You can't change the name of a proxy after you create it. */
    ProxyName: string;
    /** TLS decryption on traffic to filter on attributes in the HTTP header. */
    TlsInterceptProperties: TlsInterceptPropertiesRequest;
    /** Listener properties for HTTP and HTTPS traffic. */
    ListenerProperties?: ListenerPropertyRequest[];
    /** The Amazon Resource Name (ARN) of a proxy configuration. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationArn?: string;
    /** The descriptive name of the proxy configuration. You can't change the name of a proxy configuration after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationName?: string;
    /** The key:value pairs to associate with the resource. */
    Tags?: Tag[];
}
export interface CreateProxyConfigurationInput {
    /** Evaluation points in the traffic flow where rules are applied. There are three phases in a traffic where the rule match is applied. */
    DefaultRulePhaseActions: ProxyConfigDefaultRulePhaseActionsRequest;
    /** The descriptive name of the proxy configuration. You can't change the name of a proxy configuration after you create it. */
    ProxyConfigurationName: string;
    /** A description of the proxy configuration. */
    Description?: string;
    /** The proxy rule group arn(s) to attach to the proxy configuration. You must specify the ARNs or the names, and you can specify both. */
    RuleGroupArns?: string[];
    /** The proxy rule group name(s) to attach to the proxy configuration. You must specify the ARNs or the names, and you can specify both. */
    RuleGroupNames?: string[];
    /** The key:value pairs to associate with the resource. */
    Tags?: Tag[];
}
export interface CreateProxyRuleGroupInput {
    /** The descriptive name of the proxy rule group. You can't change the name of a proxy rule group after you create it. */
    ProxyRuleGroupName: string;
    /** A description of the proxy rule group. */
    Description?: string;
    /** Individual rules that define match conditions and actions for application-layer traffic. Rules specify what to inspect (domains, headers, methods) and what action to take (allow, deny, alert). */
    Rules?: ProxyRulesByRequestPhase;
    /** The key:value pairs to associate with the resource. */
    Tags?: Tag[];
}
export interface CreateProxyRulesInput {
    /** Individual rules that define match conditions and actions for application-layer traffic. Rules specify what to inspect (domains, headers, methods) and what action to take (allow, deny, alert). */
    Rules: CreateProxyRulesByRequestPhase;
    /** The Amazon Resource Name (ARN) of a proxy rule group. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupArn?: string;
    /** The descriptive name of the proxy rule group. You can't change the name of a proxy rule group after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupName?: string;
}
export interface CreateRuleGroupInput {
    /** The maximum operating resources that this rule group can use. Rule group capacity is fixed at creation. When you update a rule group, you are limited to this capacity. When you reference a rule group  */
    Capacity: number;
    /** The descriptive name of the rule group. You can't change the name of a rule group after you create it. */
    RuleGroupName: string;
    /** Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules. */
    Type: 'STATELESS' | 'STATEFUL';
    /** Indicates whether you want Network Firewall to analyze the stateless rules in the rule group for rule behavior such as asymmetric routing. If set to TRUE, Network Firewall runs the analysis and then c */
    AnalyzeRuleGroup?: boolean;
    /** A description of the rule group. */
    Description?: string;
    /** Indicates whether you want Network Firewall to just check the validity of the request, rather than run the request. If set to TRUE, Network Firewall checks whether the request can run successfully, bu */
    DryRun?: boolean;
    /** A complex type that contains settings for encryption of your rule group resources. */
    EncryptionConfiguration?: EncryptionConfiguration;
    /** An object that defines the rule group rules. You must provide either this rule group setting or a Rules setting, but not both. */
    RuleGroup?: RuleGroup;
    /** A string containing stateful rule group rules specifications in Suricata flat format, with one rule per line. Use this to import your existing Suricata compatible rule groups. You must provide either  */
    Rules?: string;
    /** A complex type that contains metadata about the rule group that your own rule group is copied from. You can use the metadata to keep track of updates made to the originating rule group. */
    SourceMetadata?: SourceMetadata;
    /** An object that contains a RuleOptions array of strings. You use RuleOptions to determine which of the following RuleSummary values are returned in response to DescribeRuleGroupSummary. Metadata - retu */
    SummaryConfiguration?: SummaryConfiguration;
    /** The key:value pairs to associate with the resource. */
    Tags?: Tag[];
}
export interface CreateTLSInspectionConfigurationInput {
    /** The object that defines a TLS inspection configuration. This, along with TLSInspectionConfigurationResponse, define the TLS inspection configuration. You can retrieve all objects for a TLS inspection  */
    TLSInspectionConfiguration: TLSInspectionConfiguration;
    /** The descriptive name of the TLS inspection configuration. You can't change the name of a TLS inspection configuration after you create it. */
    TLSInspectionConfigurationName: string;
    /** A description of the TLS inspection configuration. */
    Description?: string;
    EncryptionConfiguration?: EncryptionConfiguration;
    /** The key:value pairs to associate with the resource. */
    Tags?: Tag[];
}
export interface CreateVpcEndpointAssociationInput {
    /** The Amazon Resource Name (ARN) of the firewall. */
    FirewallArn: string;
    SubnetMapping: SubnetMapping;
    /** The unique identifier of the VPC where you want to create a firewall endpoint. */
    VpcId: string;
    /** A description of the VPC endpoint association. */
    Description?: string;
    /** The key:value pairs to associate with the resource. */
    Tags?: Tag[];
}
export interface DeleteFirewallInput {
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
}
export interface DeleteFirewallPolicyInput {
    /** The Amazon Resource Name (ARN) of the firewall policy. You must specify the ARN or the name, and you can specify both. */
    FirewallPolicyArn?: string;
    /** The descriptive name of the firewall policy. You can't change the name of a firewall policy after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallPolicyName?: string;
}
export interface DeleteNetworkFirewallTransitGatewayAttachmentInput {
    /** Required. The unique identifier of the transit gateway attachment to delete. */
    TransitGatewayAttachmentId: string;
}
export interface DeleteProxyInput {
    /** The NAT Gateway the proxy is attached to. */
    NatGatewayId: string;
    /** The Amazon Resource Name (ARN) of a proxy. You must specify the ARN or the name, and you can specify both. */
    ProxyArn?: string;
    /** The descriptive name of the proxy. You can't change the name of a proxy after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyName?: string;
}
export interface DeleteProxyConfigurationInput {
    /** The Amazon Resource Name (ARN) of a proxy configuration. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationArn?: string;
    /** The descriptive name of the proxy configuration. You can't change the name of a proxy configuration after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationName?: string;
}
export interface DeleteProxyRuleGroupInput {
    /** The Amazon Resource Name (ARN) of a proxy rule group. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupArn?: string;
    /** The descriptive name of the proxy rule group. You can't change the name of a proxy rule group after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupName?: string;
}
export interface DeleteProxyRulesInput {
    /** The proxy rule(s) to remove from the existing proxy rule group. */
    Rules: string[];
    /** The Amazon Resource Name (ARN) of a proxy rule group. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupArn?: string;
    /** The descriptive name of the proxy rule group. You can't change the name of a proxy rule group after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupName?: string;
}
export interface DeleteResourcePolicyInput {
    /** The Amazon Resource Name (ARN) of the rule group or firewall policy whose resource policy you want to delete. */
    ResourceArn: string;
}
export interface DeleteRuleGroupInput {
    /** The Amazon Resource Name (ARN) of the rule group. You must specify the ARN or the name, and you can specify both. */
    RuleGroupArn?: string;
    /** The descriptive name of the rule group. You can't change the name of a rule group after you create it. You must specify the ARN or the name, and you can specify both. */
    RuleGroupName?: string;
    /** Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules. This setting is required for requ */
    Type?: 'STATELESS' | 'STATEFUL';
}
export interface DeleteTLSInspectionConfigurationInput {
    /** The Amazon Resource Name (ARN) of the TLS inspection configuration. You must specify the ARN or the name, and you can specify both. */
    TLSInspectionConfigurationArn?: string;
    /** The descriptive name of the TLS inspection configuration. You can't change the name of a TLS inspection configuration after you create it. You must specify the ARN or the name, and you can specify bot */
    TLSInspectionConfigurationName?: string;
}
export interface DeleteVpcEndpointAssociationInput {
    /** The Amazon Resource Name (ARN) of a VPC endpoint association. */
    VpcEndpointAssociationArn: string;
}
export interface DescribeFirewallInput {
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
}
export interface DescribeFirewallMetadataInput {
    /** The Amazon Resource Name (ARN) of the firewall. */
    FirewallArn?: string;
}
export interface DescribeFirewallPolicyInput {
    /** The Amazon Resource Name (ARN) of the firewall policy. You must specify the ARN or the name, and you can specify both. */
    FirewallPolicyArn?: string;
    /** The descriptive name of the firewall policy. You can't change the name of a firewall policy after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallPolicyName?: string;
}
export interface DescribeFlowOperationInput {
    /** The Amazon Resource Name (ARN) of the firewall. */
    FirewallArn: string;
    /** A unique identifier for the flow operation. This ID is returned in the responses to start and list commands. You provide to describe commands. */
    FlowOperationId: string;
    /** The ID of the Availability Zone where the firewall is located. For example, us-east-2a. Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation. */
    AvailabilityZone?: string;
    /** The Amazon Resource Name (ARN) of a VPC endpoint association. */
    VpcEndpointAssociationArn?: string;
    /** A unique identifier for the primary endpoint associated with a firewall. */
    VpcEndpointId?: string;
}
export interface DescribeLoggingConfigurationInput {
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
}
export interface DescribeProxyInput {
    /** The Amazon Resource Name (ARN) of a proxy. You must specify the ARN or the name, and you can specify both. */
    ProxyArn?: string;
    /** The descriptive name of the proxy. You can't change the name of a proxy after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyName?: string;
}
export interface DescribeProxyConfigurationInput {
    /** The Amazon Resource Name (ARN) of a proxy configuration. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationArn?: string;
    /** The descriptive name of the proxy configuration. You can't change the name of a proxy configuration after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationName?: string;
}
export interface DescribeProxyRuleInput {
    /** The descriptive name of the proxy rule. You can't change the name of a proxy rule after you create it. */
    ProxyRuleName: string;
    /** The Amazon Resource Name (ARN) of a proxy rule group. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupArn?: string;
    /** The descriptive name of the proxy rule group. You can't change the name of a proxy rule group after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupName?: string;
}
export interface DescribeProxyRuleGroupInput {
    /** The Amazon Resource Name (ARN) of a proxy rule group. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupArn?: string;
    /** The descriptive name of the proxy rule group. You can't change the name of a proxy rule group after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupName?: string;
}
export interface DescribeResourcePolicyInput {
    /** The Amazon Resource Name (ARN) of the rule group or firewall policy whose resource policy you want to retrieve. */
    ResourceArn: string;
}
export interface DescribeRuleGroupInput {
    /** Indicates whether you want Network Firewall to analyze the stateless rules in the rule group for rule behavior such as asymmetric routing. If set to TRUE, Network Firewall runs the analysis. */
    AnalyzeRuleGroup?: boolean;
    /** The Amazon Resource Name (ARN) of the rule group. You must specify the ARN or the name, and you can specify both. */
    RuleGroupArn?: string;
    /** The descriptive name of the rule group. You can't change the name of a rule group after you create it. You must specify the ARN or the name, and you can specify both. */
    RuleGroupName?: string;
    /** Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules. This setting is required for requ */
    Type?: 'STATELESS' | 'STATEFUL';
}
export interface DescribeRuleGroupMetadataInput {
    /** The descriptive name of the rule group. You can't change the name of a rule group after you create it. You must specify the ARN or the name, and you can specify both. */
    RuleGroupArn?: string;
    /** The descriptive name of the rule group. You can't change the name of a rule group after you create it. You must specify the ARN or the name, and you can specify both. */
    RuleGroupName?: string;
    /** Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules. This setting is required for requ */
    Type?: 'STATELESS' | 'STATEFUL';
}
export interface DescribeRuleGroupSummaryInput {
    /** Required. The Amazon Resource Name (ARN) of the rule group. You must specify the ARN or the name, and you can specify both. */
    RuleGroupArn?: string;
    /** The descriptive name of the rule group. You can't change the name of a rule group after you create it. You must specify the ARN or the name, and you can specify both. */
    RuleGroupName?: string;
    /** The type of rule group you want a summary for. This is a required field. Valid value: STATEFUL Note that STATELESS exists but is not currently supported. If you provide STATELESS, an exception is retu */
    Type?: 'STATELESS' | 'STATEFUL';
}
export interface DescribeTLSInspectionConfigurationInput {
    /** The Amazon Resource Name (ARN) of the TLS inspection configuration. You must specify the ARN or the name, and you can specify both. */
    TLSInspectionConfigurationArn?: string;
    /** The descriptive name of the TLS inspection configuration. You can't change the name of a TLS inspection configuration after you create it. You must specify the ARN or the name, and you can specify bot */
    TLSInspectionConfigurationName?: string;
}
export interface DescribeVpcEndpointAssociationInput {
    /** The Amazon Resource Name (ARN) of a VPC endpoint association. */
    VpcEndpointAssociationArn: string;
}
export interface DetachRuleGroupsFromProxyConfigurationInput {
    /** A token used for optimistic locking. Network Firewall returns a token to your requests that access the proxy configuration. The token marks the state of the proxy configuration resource at the time of */
    UpdateToken: string;
    /** The Amazon Resource Name (ARN) of a proxy configuration. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationArn?: string;
    /** The descriptive name of the proxy configuration. You can't change the name of a proxy configuration after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationName?: string;
    /** The proxy rule group arns to detach from the proxy configuration */
    RuleGroupArns?: string[];
    /** The proxy rule group names to detach from the proxy configuration */
    RuleGroupNames?: string[];
}
export interface DisassociateAvailabilityZonesInput {
    /** Required. The Availability Zones to remove from the firewall's configuration. */
    AvailabilityZoneMappings: AvailabilityZoneMapping[];
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of */
    UpdateToken?: string;
}
export interface DisassociateSubnetsInput {
    /** The unique identifiers for the subnets that you want to disassociate. */
    SubnetIds: string[];
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of */
    UpdateToken?: string;
}
export interface GetAnalysisReportResultsInput {
    /** The unique ID of the query that ran when you requested an analysis report. */
    AnalysisReportId: string;
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in */
    MaxResults?: number;
    /** When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken va */
    NextToken?: string;
}
export interface ListAnalysisReportsInput {
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in */
    MaxResults?: number;
    /** When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken va */
    NextToken?: string;
}
export interface ListFirewallPoliciesInput {
    /** The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in */
    MaxResults?: number;
    /** When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken va */
    NextToken?: string;
}
export interface ListFirewallsInput {
    /** The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in */
    MaxResults?: number;
    /** When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken va */
    NextToken?: string;
    /** The unique identifiers of the VPCs that you want Network Firewall to retrieve the firewalls for. Leave this blank to retrieve all firewalls that you have defined. */
    VpcIds?: string[];
}
export interface ListFlowOperationResultsInput {
    /** The Amazon Resource Name (ARN) of the firewall. */
    FirewallArn: string;
    /** A unique identifier for the flow operation. This ID is returned in the responses to start and list commands. You provide to describe commands. */
    FlowOperationId: string;
    /** The ID of the Availability Zone where the firewall is located. For example, us-east-2a. Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation. */
    AvailabilityZone?: string;
    /** The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in */
    MaxResults?: number;
    /** When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken va */
    NextToken?: string;
    /** The Amazon Resource Name (ARN) of a VPC endpoint association. */
    VpcEndpointAssociationArn?: string;
    /** A unique identifier for the primary endpoint associated with a firewall. */
    VpcEndpointId?: string;
}
export interface ListFlowOperationsInput {
    /** The Amazon Resource Name (ARN) of the firewall. */
    FirewallArn: string;
    /** The ID of the Availability Zone where the firewall is located. For example, us-east-2a. Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation. */
    AvailabilityZone?: string;
    /** An optional string that defines whether any or all operation types are returned. */
    FlowOperationType?: 'FLOW_FLUSH' | 'FLOW_CAPTURE';
    /** The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in */
    MaxResults?: number;
    /** When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken va */
    NextToken?: string;
    /** The Amazon Resource Name (ARN) of a VPC endpoint association. */
    VpcEndpointAssociationArn?: string;
    /** A unique identifier for the primary endpoint associated with a firewall. */
    VpcEndpointId?: string;
}
export interface ListProxiesInput {
    /** The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in */
    MaxResults?: number;
    /** When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken va */
    NextToken?: string;
}
export interface ListProxyConfigurationsInput {
    /** The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in */
    MaxResults?: number;
    /** When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken va */
    NextToken?: string;
}
export interface ListProxyRuleGroupsInput {
    /** The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in */
    MaxResults?: number;
    /** When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken va */
    NextToken?: string;
}
export interface ListRuleGroupsInput {
    /** Indicates the general category of the Amazon Web Services managed rule group. */
    ManagedType?: 'AWS_MANAGED_THREAT_SIGNATURES' | 'AWS_MANAGED_DOMAIN_LISTS' | 'ACTIVE_THREAT_DEFENSE' | 'PARTNER_MANAGED';
    /** The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in */
    MaxResults?: number;
    /** When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken va */
    NextToken?: string;
    /** The scope of the request. The default setting of ACCOUNT or a setting of NULL returns all of the rule groups in your account. A setting of MANAGED returns all available managed rule groups. */
    Scope?: 'MANAGED' | 'ACCOUNT';
    /** Filters the results to show only rule groups with the specified subscription status. Use this to find subscribed or unsubscribed rule groups. */
    SubscriptionStatus?: 'NOT_SUBSCRIBED' | 'SUBSCRIBED';
    /** Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules. */
    Type?: 'STATELESS' | 'STATEFUL';
}
export interface ListTagsForResourceInput {
    /** The Amazon Resource Name (ARN) of the resource. */
    ResourceArn: string;
    /** The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in */
    MaxResults?: number;
    /** When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken va */
    NextToken?: string;
}
export interface ListTLSInspectionConfigurationsInput {
    /** The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in */
    MaxResults?: number;
    /** When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken va */
    NextToken?: string;
}
export interface ListVpcEndpointAssociationsInput {
    /** The Amazon Resource Name (ARN) of the firewall. If you don't specify this, Network Firewall retrieves all VPC endpoint associations that you have defined. */
    FirewallArn?: string;
    /** The maximum number of objects that you want Network Firewall to return for this request. If more objects are available, in the response, Network Firewall provides a NextToken value that you can use in */
    MaxResults?: number;
    /** When you request a list of objects with a MaxResults setting, if the number of objects that are still available for retrieval exceeds the maximum you requested, Network Firewall returns a NextToken va */
    NextToken?: string;
}
export interface PutResourcePolicyInput {
    /** The IAM policy statement that lists the accounts that you want to share your Network Firewall resources with and the operations that you want the accounts to be able to perform. For a rule group resou */
    Policy: string;
    /** The Amazon Resource Name (ARN) of the account that you want to share your Network Firewall resources with. */
    ResourceArn: string;
}
export interface RejectNetworkFirewallTransitGatewayAttachmentInput {
    /** Required. The unique identifier of the transit gateway attachment to reject. This ID is returned in the response when creating a transit gateway-attached firewall. */
    TransitGatewayAttachmentId: string;
}
export interface StartAnalysisReportInput {
    /** The type of traffic that will be used to generate a report. */
    AnalysisType: 'TLS_SNI' | 'HTTP_HOST';
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
}
export interface StartFlowCaptureInput {
    /** The Amazon Resource Name (ARN) of the firewall. */
    FirewallArn: string;
    /** Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation. */
    FlowFilters: FlowFilter[];
    /** The ID of the Availability Zone where the firewall is located. For example, us-east-2a. Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation. */
    AvailabilityZone?: string;
    /** The reqested FlowOperation ignores flows with an age (in seconds) lower than MinimumFlowAgeInSeconds. You provide this for start commands. We recommend setting this value to at least 1 minute (60 seco */
    MinimumFlowAgeInSeconds?: number;
    /** The Amazon Resource Name (ARN) of a VPC endpoint association. */
    VpcEndpointAssociationArn?: string;
    /** A unique identifier for the primary endpoint associated with a firewall. */
    VpcEndpointId?: string;
}
export interface StartFlowFlushInput {
    /** The Amazon Resource Name (ARN) of the firewall. */
    FirewallArn: string;
    /** Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation. */
    FlowFilters: FlowFilter[];
    /** The ID of the Availability Zone where the firewall is located. For example, us-east-2a. Defines the scope a flow operation. You can use up to 20 filters to configure a single flow operation. */
    AvailabilityZone?: string;
    /** The reqested FlowOperation ignores flows with an age (in seconds) lower than MinimumFlowAgeInSeconds. You provide this for start commands. */
    MinimumFlowAgeInSeconds?: number;
    /** The Amazon Resource Name (ARN) of a VPC endpoint association. */
    VpcEndpointAssociationArn?: string;
    /** A unique identifier for the primary endpoint associated with a firewall. */
    VpcEndpointId?: string;
}
export interface TagResourceInput {
    /** The Amazon Resource Name (ARN) of the resource. */
    ResourceArn: string;
    Tags: Tag[];
}
export interface UntagResourceInput {
    /** The Amazon Resource Name (ARN) of the resource. */
    ResourceArn: string;
    TagKeys: string[];
}
export interface UpdateAvailabilityZoneChangeProtectionInput {
    /** A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall tha */
    AvailabilityZoneChangeProtection: boolean;
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of */
    UpdateToken?: string;
}
export interface UpdateFirewallAnalysisSettingsInput {
    /** An optional setting indicating the specific traffic analysis types to enable on the firewall. */
    EnabledAnalysisTypes?: 'TLS_SNI' | 'HTTP_HOST'[];
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of */
    UpdateToken?: string;
}
export interface UpdateFirewallDeleteProtectionInput {
    /** A flag indicating whether it is possible to delete the firewall. A setting of TRUE indicates that the firewall is protected against deletion. Use this setting to protect against accidentally deleting  */
    DeleteProtection: boolean;
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of */
    UpdateToken?: string;
}
export interface UpdateFirewallDescriptionInput {
    /** The new description for the firewall. If you omit this setting, Network Firewall removes the description for the firewall. */
    Description?: string;
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of */
    UpdateToken?: string;
}
export interface UpdateFirewallEncryptionConfigurationInput {
    EncryptionConfiguration?: EncryptionConfiguration;
    /** The Amazon Resource Name (ARN) of the firewall. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. */
    FirewallName?: string;
    /** An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of */
    UpdateToken?: string;
}
export interface UpdateFirewallPolicyInput {
    /** The updated firewall policy to use for the firewall. You can't add or remove a TLSInspectionConfiguration after you create a firewall policy. However, you can replace an existing TLS inspection config */
    FirewallPolicy: FirewallPolicy;
    /** A token used for optimistic locking. Network Firewall returns a token to your requests that access the firewall policy. The token marks the state of the policy resource at the time of the request. To  */
    UpdateToken: string;
    /** A description of the firewall policy. */
    Description?: string;
    /** Indicates whether you want Network Firewall to just check the validity of the request, rather than run the request. If set to TRUE, Network Firewall checks whether the request can run successfully, bu */
    DryRun?: boolean;
    /** A complex type that contains settings for encryption of your firewall policy resources. */
    EncryptionConfiguration?: EncryptionConfiguration;
    /** The Amazon Resource Name (ARN) of the firewall policy. You must specify the ARN or the name, and you can specify both. */
    FirewallPolicyArn?: string;
    /** The descriptive name of the firewall policy. You can't change the name of a firewall policy after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallPolicyName?: string;
}
export interface UpdateFirewallPolicyChangeProtectionInput {
    /** A setting indicating whether the firewall is protected against a change to the firewall policy association. Use this setting to protect against accidentally modifying the firewall policy for a firewal */
    FirewallPolicyChangeProtection: boolean;
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of */
    UpdateToken?: string;
}
export interface UpdateLoggingConfigurationInput {
    /** A boolean that lets you enable or disable the detailed firewall monitoring dashboard on the firewall. The monitoring dashboard provides comprehensive visibility into your firewall's flow logs and aler */
    EnableMonitoringDashboard?: boolean;
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** Defines how Network Firewall performs logging for a firewall. If you omit this setting, Network Firewall disables logging for the firewall. */
    LoggingConfiguration?: LoggingConfiguration;
}
export interface UpdateProxyInput {
    /** The NAT Gateway the proxy is attached to. */
    NatGatewayId: string;
    /** A token used for optimistic locking. Network Firewall returns a token to your requests that access the proxy. The token marks the state of the proxy resource at the time of the request. To make change */
    UpdateToken: string;
    /** Listener properties for HTTP and HTTPS traffic to add. */
    ListenerPropertiesToAdd?: ListenerPropertyRequest[];
    /** Listener properties for HTTP and HTTPS traffic to remove. */
    ListenerPropertiesToRemove?: ListenerPropertyRequest[];
    /** The Amazon Resource Name (ARN) of a proxy. You must specify the ARN or the name, and you can specify both. */
    ProxyArn?: string;
    /** The descriptive name of the proxy. You can't change the name of a proxy after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyName?: string;
    /** TLS decryption on traffic to filter on attributes in the HTTP header. */
    TlsInterceptProperties?: TlsInterceptPropertiesRequest;
}
export interface UpdateProxyConfigurationInput {
    /** Evaluation points in the traffic flow where rules are applied. There are three phases in a traffic where the rule match is applied. */
    DefaultRulePhaseActions: ProxyConfigDefaultRulePhaseActionsRequest;
    /** A token used for optimistic locking. Network Firewall returns a token to your requests that access the proxy configuration. The token marks the state of the proxy configuration resource at the time of */
    UpdateToken: string;
    /** The Amazon Resource Name (ARN) of a proxy configuration. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationArn?: string;
    /** The descriptive name of the proxy configuration. You can't change the name of a proxy configuration after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationName?: string;
}
export interface UpdateProxyRuleInput {
    /** The descriptive name of the proxy rule. You can't change the name of a proxy rule after you create it. */
    ProxyRuleName: string;
    /** A token used for optimistic locking. Network Firewall returns a token to your requests that access the proxy rule. The token marks the state of the proxy rule resource at the time of the request. To m */
    UpdateToken: string;
    /** Depending on the match action, the proxy either stops the evaluation (if the action is terminal - allow or deny), or continues it (if the action is alert) until it matches a rule with a terminal actio */
    Action?: 'ALLOW' | 'DENY' | 'ALERT';
    /** Proxy rule conditions to add. Match criteria that specify what traffic attributes to examine. Conditions include operators (StringEquals, StringLike) and values to match against. */
    AddConditions?: ProxyRuleCondition[];
    /** A description of the proxy rule. */
    Description?: string;
    /** The Amazon Resource Name (ARN) of a proxy rule group. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupArn?: string;
    /** The descriptive name of the proxy rule group. You can't change the name of a proxy rule group after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupName?: string;
    /** Proxy rule conditions to remove. Match criteria that specify what traffic attributes to examine. Conditions include operators (StringEquals, StringLike) and values to match against. */
    RemoveConditions?: ProxyRuleCondition[];
}
export interface UpdateProxyRuleGroupPrioritiesInput {
    /** proxy rule group resources to update to new positions. */
    RuleGroups: ProxyRuleGroupPriority[];
    /** A token used for optimistic locking. Network Firewall returns a token to your requests that access the proxy configuration. The token marks the state of the proxy configuration resource at the time of */
    UpdateToken: string;
    /** The Amazon Resource Name (ARN) of a proxy configuration. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationArn?: string;
    /** The descriptive name of the proxy configuration. You can't change the name of a proxy configuration after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyConfigurationName?: string;
}
export interface UpdateProxyRulePrioritiesInput {
    /** Evaluation points in the traffic flow where rules are applied. There are three phases in a traffic where the rule match is applied. */
    RuleGroupRequestPhase: 'PRE_DNS' | 'PRE_REQ' | 'POST_RES';
    /** proxy rule resources to update to new positions. */
    Rules: ProxyRulePriority[];
    /** A token used for optimistic locking. Network Firewall returns a token to your requests that access the proxy rule group. The token marks the state of the proxy rule group resource at the time of the r */
    UpdateToken: string;
    /** The Amazon Resource Name (ARN) of a proxy rule group. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupArn?: string;
    /** The descriptive name of the proxy rule group. You can't change the name of a proxy rule group after you create it. You must specify the ARN or the name, and you can specify both. */
    ProxyRuleGroupName?: string;
}
export interface UpdateRuleGroupInput {
    /** A token used for optimistic locking. Network Firewall returns a token to your requests that access the rule group. The token marks the state of the rule group resource at the time of the request. To m */
    UpdateToken: string;
    /** Indicates whether you want Network Firewall to analyze the stateless rules in the rule group for rule behavior such as asymmetric routing. If set to TRUE, Network Firewall runs the analysis and then u */
    AnalyzeRuleGroup?: boolean;
    /** A description of the rule group. */
    Description?: string;
    /** Indicates whether you want Network Firewall to just check the validity of the request, rather than run the request. If set to TRUE, Network Firewall checks whether the request can run successfully, bu */
    DryRun?: boolean;
    /** A complex type that contains settings for encryption of your rule group resources. */
    EncryptionConfiguration?: EncryptionConfiguration;
    /** An object that defines the rule group rules. You must provide either this rule group setting or a Rules setting, but not both. */
    RuleGroup?: RuleGroup;
    /** The Amazon Resource Name (ARN) of the rule group. You must specify the ARN or the name, and you can specify both. */
    RuleGroupArn?: string;
    /** The descriptive name of the rule group. You can't change the name of a rule group after you create it. You must specify the ARN or the name, and you can specify both. */
    RuleGroupName?: string;
    /** A string containing stateful rule group rules specifications in Suricata flat format, with one rule per line. Use this to import your existing Suricata compatible rule groups. You must provide either  */
    Rules?: string;
    /** A complex type that contains metadata about the rule group that your own rule group is copied from. You can use the metadata to keep track of updates made to the originating rule group. */
    SourceMetadata?: SourceMetadata;
    /** Updates the selected summary configuration for a rule group. Changes affect subsequent responses from DescribeRuleGroupSummary. */
    SummaryConfiguration?: SummaryConfiguration;
    /** Indicates whether the rule group is stateless or stateful. If the rule group is stateless, it contains stateless rules. If it is stateful, it contains stateful rules. This setting is required for requ */
    Type?: 'STATELESS' | 'STATEFUL';
}
export interface UpdateSubnetChangeProtectionInput {
    /** A setting indicating whether the firewall is protected against changes to the subnet associations. Use this setting to protect against accidentally modifying the subnet associations for a firewall tha */
    SubnetChangeProtection: boolean;
    /** The Amazon Resource Name (ARN) of the firewall. You must specify the ARN or the name, and you can specify both. */
    FirewallArn?: string;
    /** The descriptive name of the firewall. You can't change the name of a firewall after you create it. You must specify the ARN or the name, and you can specify both. */
    FirewallName?: string;
    /** An optional token that you can use for optimistic locking. Network Firewall returns a token to your requests that access the firewall. The token marks the state of the firewall resource at the time of */
    UpdateToken?: string;
}
export interface UpdateTLSInspectionConfigurationInput {
    /** The object that defines a TLS inspection configuration. This, along with TLSInspectionConfigurationResponse, define the TLS inspection configuration. You can retrieve all objects for a TLS inspection  */
    TLSInspectionConfiguration: TLSInspectionConfiguration;
    /** A token used for optimistic locking. Network Firewall returns a token to your requests that access the TLS inspection configuration. The token marks the state of the TLS inspection configuration resou */
    UpdateToken: string;
    /** A description of the TLS inspection configuration. */
    Description?: string;
    /** A complex type that contains the Amazon Web Services KMS encryption configuration settings for your TLS inspection configuration. */
    EncryptionConfiguration?: EncryptionConfiguration;
    /** The Amazon Resource Name (ARN) of the TLS inspection configuration. */
    TLSInspectionConfigurationArn?: string;
    /** The descriptive name of the TLS inspection configuration. You can't change the name of a TLS inspection configuration after you create it. */
    TLSInspectionConfigurationName?: string;
}
/** Network Firewall service binding for Step Functions SDK integrations. */
export declare class NetworkFirewall {
    constructor();
    acceptNetworkFirewallTransitGatewayAttachment<T>(params: AcceptNetworkFirewallTransitGatewayAttachmentInput): Promise<T>;
    associateAvailabilityZones<T>(params: AssociateAvailabilityZonesInput): Promise<T>;
    associateFirewallPolicy<T>(params: AssociateFirewallPolicyInput): Promise<T>;
    associateSubnets<T>(params: AssociateSubnetsInput): Promise<T>;
    attachRuleGroupsToProxyConfiguration<T>(params: AttachRuleGroupsToProxyConfigurationInput): Promise<T>;
    createFirewall<T>(params: CreateFirewallInput): Promise<T>;
    createFirewallPolicy<T>(params: CreateFirewallPolicyInput): Promise<T>;
    createProxy<T>(params: CreateProxyInput): Promise<T>;
    createProxyConfiguration<T>(params: CreateProxyConfigurationInput): Promise<T>;
    createProxyRuleGroup<T>(params: CreateProxyRuleGroupInput): Promise<T>;
    createProxyRules<T>(params: CreateProxyRulesInput): Promise<T>;
    createRuleGroup<T>(params: CreateRuleGroupInput): Promise<T>;
    createTLSInspectionConfiguration<T>(params: CreateTLSInspectionConfigurationInput): Promise<T>;
    createVpcEndpointAssociation<T>(params: CreateVpcEndpointAssociationInput): Promise<T>;
    deleteFirewall<T>(params: DeleteFirewallInput): Promise<T>;
    deleteFirewallPolicy<T>(params: DeleteFirewallPolicyInput): Promise<T>;
    deleteNetworkFirewallTransitGatewayAttachment<T>(params: DeleteNetworkFirewallTransitGatewayAttachmentInput): Promise<T>;
    deleteProxy<T>(params: DeleteProxyInput): Promise<T>;
    deleteProxyConfiguration<T>(params: DeleteProxyConfigurationInput): Promise<T>;
    deleteProxyRuleGroup<T>(params: DeleteProxyRuleGroupInput): Promise<T>;
    deleteProxyRules<T>(params: DeleteProxyRulesInput): Promise<T>;
    deleteResourcePolicy<T>(params: DeleteResourcePolicyInput): Promise<T>;
    deleteRuleGroup<T>(params: DeleteRuleGroupInput): Promise<T>;
    deleteTLSInspectionConfiguration<T>(params: DeleteTLSInspectionConfigurationInput): Promise<T>;
    deleteVpcEndpointAssociation<T>(params: DeleteVpcEndpointAssociationInput): Promise<T>;
    describeFirewall<T>(params: DescribeFirewallInput): Promise<T>;
    describeFirewallMetadata<T>(params: DescribeFirewallMetadataInput): Promise<T>;
    describeFirewallPolicy<T>(params: DescribeFirewallPolicyInput): Promise<T>;
    describeFlowOperation<T>(params: DescribeFlowOperationInput): Promise<T>;
    describeLoggingConfiguration<T>(params: DescribeLoggingConfigurationInput): Promise<T>;
    describeProxy<T>(params: DescribeProxyInput): Promise<T>;
    describeProxyConfiguration<T>(params: DescribeProxyConfigurationInput): Promise<T>;
    describeProxyRule<T>(params: DescribeProxyRuleInput): Promise<T>;
    describeProxyRuleGroup<T>(params: DescribeProxyRuleGroupInput): Promise<T>;
    describeResourcePolicy<T>(params: DescribeResourcePolicyInput): Promise<T>;
    describeRuleGroup<T>(params: DescribeRuleGroupInput): Promise<T>;
    describeRuleGroupMetadata<T>(params: DescribeRuleGroupMetadataInput): Promise<T>;
    describeRuleGroupSummary<T>(params: DescribeRuleGroupSummaryInput): Promise<T>;
    describeTLSInspectionConfiguration<T>(params: DescribeTLSInspectionConfigurationInput): Promise<T>;
    describeVpcEndpointAssociation<T>(params: DescribeVpcEndpointAssociationInput): Promise<T>;
    detachRuleGroupsFromProxyConfiguration<T>(params: DetachRuleGroupsFromProxyConfigurationInput): Promise<T>;
    disassociateAvailabilityZones<T>(params: DisassociateAvailabilityZonesInput): Promise<T>;
    disassociateSubnets<T>(params: DisassociateSubnetsInput): Promise<T>;
    getAnalysisReportResults<T>(params: GetAnalysisReportResultsInput): Promise<T>;
    listAnalysisReports<T>(params: ListAnalysisReportsInput): Promise<T>;
    listFirewallPolicies<T>(params: ListFirewallPoliciesInput): Promise<T>;
    listFirewalls<T>(params: ListFirewallsInput): Promise<T>;
    listFlowOperationResults<T>(params: ListFlowOperationResultsInput): Promise<T>;
    listFlowOperations<T>(params: ListFlowOperationsInput): Promise<T>;
    listProxies<T>(params: ListProxiesInput): Promise<T>;
    listProxyConfigurations<T>(params: ListProxyConfigurationsInput): Promise<T>;
    listProxyRuleGroups<T>(params: ListProxyRuleGroupsInput): Promise<T>;
    listRuleGroups<T>(params: ListRuleGroupsInput): Promise<T>;
    listTagsForResource<T>(params: ListTagsForResourceInput): Promise<T>;
    listTLSInspectionConfigurations<T>(params: ListTLSInspectionConfigurationsInput): Promise<T>;
    listVpcEndpointAssociations<T>(params: ListVpcEndpointAssociationsInput): Promise<T>;
    putResourcePolicy<T>(params: PutResourcePolicyInput): Promise<T>;
    rejectNetworkFirewallTransitGatewayAttachment<T>(params: RejectNetworkFirewallTransitGatewayAttachmentInput): Promise<T>;
    startAnalysisReport<T>(params: StartAnalysisReportInput): Promise<T>;
    startFlowCapture<T>(params: StartFlowCaptureInput): Promise<T>;
    startFlowFlush<T>(params: StartFlowFlushInput): Promise<T>;
    tagResource<T>(params: TagResourceInput): Promise<T>;
    untagResource<T>(params: UntagResourceInput): Promise<T>;
    updateAvailabilityZoneChangeProtection<T>(params: UpdateAvailabilityZoneChangeProtectionInput): Promise<T>;
    updateFirewallAnalysisSettings<T>(params: UpdateFirewallAnalysisSettingsInput): Promise<T>;
    updateFirewallDeleteProtection<T>(params: UpdateFirewallDeleteProtectionInput): Promise<T>;
    updateFirewallDescription<T>(params: UpdateFirewallDescriptionInput): Promise<T>;
    updateFirewallEncryptionConfiguration<T>(params: UpdateFirewallEncryptionConfigurationInput): Promise<T>;
    updateFirewallPolicy<T>(params: UpdateFirewallPolicyInput): Promise<T>;
    updateFirewallPolicyChangeProtection<T>(params: UpdateFirewallPolicyChangeProtectionInput): Promise<T>;
    updateLoggingConfiguration<T>(params: UpdateLoggingConfigurationInput): Promise<T>;
    updateProxy<T>(params: UpdateProxyInput): Promise<T>;
    updateProxyConfiguration<T>(params: UpdateProxyConfigurationInput): Promise<T>;
    updateProxyRule<T>(params: UpdateProxyRuleInput): Promise<T>;
    updateProxyRuleGroupPriorities<T>(params: UpdateProxyRuleGroupPrioritiesInput): Promise<T>;
    updateProxyRulePriorities<T>(params: UpdateProxyRulePrioritiesInput): Promise<T>;
    updateRuleGroup<T>(params: UpdateRuleGroupInput): Promise<T>;
    updateSubnetChangeProtection<T>(params: UpdateSubnetChangeProtectionInput): Promise<T>;
    updateTLSInspectionConfiguration<T>(params: UpdateTLSInspectionConfigurationInput): Promise<T>;
}
//# sourceMappingURL=NetworkFirewall.d.ts.map