Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Network Firewall

AWS Network Firewall (service prefix: network-firewall) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Network Firewall
Actions defined by AWS Network Firewall
Resource types defined by AWS Network Firewall
Condition keys for AWS Network Firewall

API operations defined by AWS Network Firewall

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AcceptNetworkFirewallTransitGatewayAttachment	network-firewall:AcceptNetworkFirewallTransitGatewayAttachment	Write
AssociateAvailabilityZones	network-firewall:AssociateAvailabilityZones	Write
AssociateFirewallPolicy	network-firewall:AssociateFirewallPolicy	Write
AssociateSubnets	network-firewall:AssociateSubnets	Write
AttachRuleGroupsToProxyConfiguration	network-firewall:AttachRuleGroupsToProxyConfiguration	Write
CreateContainerAssociation	network-firewall:CreateContainerAssociation	Write
CreateContainerAssociation	network-firewall:TagResource	Tagging, Write
CreateFirewall	network-firewall:AssociateFirewallPolicy	Write
	network-firewall:CreateFirewall	Write
	network-firewall:TagResource	Tagging, Write
CreateFirewallPolicy	network-firewall:CreateFirewallPolicy	Write
	network-firewall:ListRuleGroups	List
	network-firewall:ListTLSInspectionConfigurations	List
	network-firewall:TagResource	Tagging, Write
CreateProxy	network-firewall:CreateProxy	Write
CreateProxy	network-firewall:TagResource	Tagging, Write
CreateProxyConfiguration	network-firewall:AttachRuleGroupsToProxyConfiguration	Write
	network-firewall:CreateProxyConfiguration	Write
	network-firewall:TagResource	Tagging, Write
CreateProxyRuleGroup	network-firewall:CreateProxyRuleGroup	Write
CreateProxyRuleGroup	network-firewall:TagResource	Tagging, Write
CreateProxyRules	network-firewall:CreateProxyRules	Write
CreateRuleGroup	network-firewall:CreateRuleGroup	Write
CreateRuleGroup	network-firewall:TagResource	Tagging, Write
CreateTLSInspectionConfiguration	network-firewall:CreateTLSInspectionConfiguration	Write
CreateTLSInspectionConfiguration	network-firewall:TagResource	Tagging, Write
CreateVpcEndpointAssociation	network-firewall:CreateVpcEndpointAssociation	Write
	network-firewall:ListFirewalls	List
	network-firewall:TagResource	Tagging, Write
DeleteContainerAssociation	network-firewall:DeleteContainerAssociation	Write
DeleteFirewall	network-firewall:DeleteFirewall	Write
DeleteFirewallPolicy	network-firewall:DeleteFirewallPolicy	Write
DeleteNetworkFirewallTransitGatewayAttachment	network-firewall:DeleteNetworkFirewallTransitGatewayAttachment	Write
DeleteProxy	network-firewall:DeleteProxy	Write
DeleteProxyConfiguration	network-firewall:DeleteProxyConfiguration	Write
DeleteProxyRuleGroup	network-firewall:DeleteProxyRuleGroup	Write
DeleteProxyRules	network-firewall:DeleteProxyRules	Write
DeleteResourcePolicy	network-firewall:DeleteResourcePolicy	Write
DeleteRuleGroup	network-firewall:DeleteRuleGroup	Write
DeleteTLSInspectionConfiguration	network-firewall:DeleteTLSInspectionConfiguration	Write
DeleteVpcEndpointAssociation	network-firewall:DeleteVpcEndpointAssociation	Write
DescribeContainerAssociation	network-firewall:DescribeContainerAssociation	Read
DescribeFirewall	network-firewall:DescribeFirewall	Read
DescribeFirewallMetadata	network-firewall:DescribeFirewallMetadata	Read
DescribeFirewallPolicy	network-firewall:DescribeFirewallPolicy	Read
DescribeFlowOperation	network-firewall:DescribeFlowOperation	Read
DescribeLoggingConfiguration	network-firewall:DescribeLoggingConfiguration	Read
DescribeProxy	network-firewall:DescribeProxy	Read
DescribeProxyConfiguration	network-firewall:DescribeProxyConfiguration	Read
DescribeProxyRule	network-firewall:DescribeProxyRule	Read
DescribeProxyRuleGroup	network-firewall:DescribeProxyRuleGroup	Read
DescribeResourcePolicy	network-firewall:DescribeResourcePolicy	Read
DescribeRuleGroup	network-firewall:DescribeRuleGroup	Read
DescribeRuleGroupMetadata	network-firewall:DescribeRuleGroupMetadata	Read
DescribeRuleGroupSummary	network-firewall:DescribeRuleGroupSummary	Read
DescribeTLSInspectionConfiguration	network-firewall:DescribeTLSInspectionConfiguration