Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. Palo Alto Networks Cloud NGFW for AWS Provider
  3. API Docs
  4. SecurityRule
Palo Alto Networks Cloud NGFW for AWS v0.1.1 published on Saturday, Mar 15, 2025 by Pulumi
pulumi/pulumi-cloudngfwaws

cloudngfwaws.SecurityRule

Explore with Pulumi AI

cloudngfwaws logo
Palo Alto Networks Cloud NGFW for AWS v0.1.1 published on Saturday, Mar 15, 2025 by Pulumi
pulumi/pulumi-cloudngfwaws

    Resource for security rule manipulation.

    Admin Permission Type

    • Rulestack (for scope="Local")
    • Global Rulestack (for scope="Global")

    Example Usage

    import * as pulumi from "@pulumi/pulumi";
import * as cloudngfwaws from "@pulumi/cloudngfwaws";

const r = new cloudngfwaws.Rulestack("r", {
    name: "terraform-rulestack",
    scope: "Local",
    accountId: "123456789",
    description: "Made by Pulumi",
    profileConfig: {
        antiSpyware: "BestPractice",
    },
});
const example = new cloudngfwaws.SecurityRule("example", {
    rulestack: r.name,
    ruleList: "LocalRule",
    priority: 3,
    name: "tf-security-rule",
    description: "Also configured by Terraform",
    source: {
        cidrs: ["any"],
    },
    destination: {
        cidrs: ["192.168.0.0/16"],
    },
    negateDestination: true,
    applications: ["any"],
    category: {},
    action: "Allow",
    logging: true,
    auditComment: "initial config",
});

    import pulumi
import pulumi_cloudngfwaws as cloudngfwaws

r = cloudngfwaws.Rulestack("r",
    name="terraform-rulestack",
    scope="Local",
    account_id="123456789",
    description="Made by Pulumi",
    profile_config={
        "anti_spyware": "BestPractice",
    })
example = cloudngfwaws.SecurityRule("example",
    rulestack=r.name,
    rule_list="LocalRule",
    priority=3,
    name="tf-security-rule",
    description="Also configured by Terraform",
    source={
        "cidrs": ["any"],
    },
    destination={
        "cidrs": ["192.168.0.0/16"],
    },
    negate_destination=True,
    applications=["any"],
    category={},
    action="Allow",
    logging=True,
    audit_comment="initial config")

    package main

import (
	"github.com/pulumi/pulumi-cloudngfwaws/sdk/go/cloudngfwaws"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		r, err := cloudngfwaws.NewRulestack(ctx, "r", &cloudngfwaws.RulestackArgs{
			Name:        pulumi.String("terraform-rulestack"),
			Scope:       pulumi.String("Local"),
			AccountId:   pulumi.String("123456789"),
			Description: pulumi.String("Made by Pulumi"),
			ProfileConfig: &cloudngfwaws.RulestackProfileConfigArgs{
				AntiSpyware: pulumi.String("BestPractice"),
			},
		})
		if err != nil {
			return err
		}
		_, err = cloudngfwaws.NewSecurityRule(ctx, "example", &cloudngfwaws.SecurityRuleArgs{
			Rulestack:   r.Name,
			RuleList:    pulumi.String("LocalRule"),
			Priority:    pulumi.Int(3),
			Name:        pulumi.String("tf-security-rule"),
			Description: pulumi.String("Also configured by Terraform"),
			Source: &cloudngfwaws.SecurityRuleSourceArgs{
				Cidrs: pulumi.StringArray{
					pulumi.String("any"),
				},
			},
			Destination: &cloudngfwaws.SecurityRuleDestinationArgs{
				Cidrs: pulumi.StringArray{
					pulumi.String("192.168.0.0/16"),
				},
			},
			NegateDestination: pulumi.Bool(true),
			Applications: pulumi.StringArray{
				pulumi.String("any"),
			},
			Category:     &cloudngfwaws.SecurityRuleCategoryArgs{},
			Action:       pulumi.String("Allow"),
			Logging:      pulumi.Bool(true),
			AuditComment: pulumi.String("initial config"),
		})
		if err != nil {
			return err
		}
		return nil
	})
}

    using System.Collections.Generic;
using System.Linq;
using Pulumi;
using CloudNgfwAws = Pulumi.CloudNgfwAws;

return await Deployment.RunAsync(() => 
{
    var r = new CloudNgfwAws.Rulestack("r", new()
    {
        Name = "terraform-rulestack",
        Scope = "Local",
        AccountId = "123456789",
        Description = "Made by Pulumi",
        ProfileConfig = new CloudNgfwAws.Inputs.RulestackProfileConfigArgs
        {
            AntiSpyware = "BestPractice",
        },
    });

    var example = new CloudNgfwAws.SecurityRule("example", new()
    {
        Rulestack = r.Name,
        RuleList = "LocalRule",
        Priority = 3,
        Name = "tf-security-rule",
        Description = "Also configured by Terraform",
        Source = new CloudNgfwAws.Inputs.SecurityRuleSourceArgs
        {
            Cidrs = new[]
            {
                "any",
            },
        },
        Destination = new CloudNgfwAws.Inputs.SecurityRuleDestinationArgs
        {
            Cidrs = new[]
            {
                "192.168.0.0/16",
            },
        },
        NegateDestination = true,
        Applications = new[]
        {
            "any",
        },
        Category = null,
        Action = "Allow",
        Logging = true,
        AuditComment = "initial config",
    });

});

    package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.cloudngfwaws.Rulestack;
import com.pulumi.cloudngfwaws.RulestackArgs;
import com.pulumi.cloudngfwaws.inputs.RulestackProfileConfigArgs;
import com.pulumi.cloudngfwaws.SecurityRule;
import com.pulumi.cloudngfwaws.SecurityRuleArgs;
import com.pulumi.cloudngfwaws.inputs.SecurityRuleSourceArgs;
import com.pulumi.cloudngfwaws.inputs.SecurityRuleDestinationArgs;
import com.pulumi.cloudngfwaws.inputs.SecurityRuleCategoryArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        var r = new Rulestack("r", RulestackArgs.builder()
            .name("terraform-rulestack")
            .scope("Local")
            .accountId("123456789")
            .description("Made by Pulumi")
            .profileConfig(RulestackProfileConfigArgs.builder()
                .antiSpyware("BestPractice")
                .build())
            .build());

        var example = new SecurityRule("example", SecurityRuleArgs.builder()
            .rulestack(r.name())
            .ruleList("LocalRule")
            .priority(3)
            .name("tf-security-rule")
            .description("Also configured by Terraform")
            .source(SecurityRuleSourceArgs.builder()
                .cidrs("any")
                .build())
            .destination(SecurityRuleDestinationArgs.builder()
                .cidrs("192.168.0.0/16")
                .build())
            .negateDestination(true)
            .applications("any")
            .category()
            .action("Allow")
            .logging(true)
            .auditComment("initial config")
            .build());

    }
}

    resources:
  example:
    type: cloudngfwaws:SecurityRule
    properties:
      rulestack: ${r.name}
      ruleList: LocalRule
      priority: 3
      name: tf-security-rule
      description: Also configured by Terraform
      source:
        cidrs:
          - any
      destination:
        cidrs:
          - 192.168.0.0/16
      negateDestination: true
      applications:
        - any
      category: {}
      action: Allow
      logging: true
      auditComment: initial config
  r:
    type: cloudngfwaws:Rulestack
    properties:
      name: terraform-rulestack
      scope: Local
      accountId: '123456789'
      description: Made by Pulumi
      profileConfig:
        antiSpyware: BestPractice

    Create SecurityRule Resource

    Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

    Constructor syntax

    new SecurityRule(name: string, args: SecurityRuleArgs, opts?: CustomResourceOptions);
    @overload
def SecurityRule(resource_name: str,
                 args: SecurityRuleArgs,
                 opts: Optional[ResourceOptions] = None)

@overload
def SecurityRule(resource_name: str,
                 opts: Optional[ResourceOptions] = None,
                 action: Optional[str] = None,
                 applications: Optional[Sequence[str]] = None,
                 source: Optional[SecurityRuleSourceArgs] = None,
                 category: Optional[SecurityRuleCategoryArgs] = None,
                 rulestack: Optional[str] = None,
                 priority: Optional[int] = None,
                 destination: Optional[SecurityRuleDestinationArgs] = None,
                 negate_destination: Optional[bool] = None,
                 logging: Optional[bool] = None,
                 name: Optional[str] = None,
                 enabled: Optional[bool] = None,
                 negate_source: Optional[bool] = None,
                 description: Optional[str] = None,
                 prot_port_lists: Optional[Sequence[str]] = None,
                 protocol: Optional[str] = None,
                 rule_list: Optional[str] = None,
                 decryption_rule_type: Optional[str] = None,
                 scope: Optional[str] = None,
                 audit_comment: Optional[str] = None,
                 tags: Optional[Mapping[str, str]] = None)
    func NewSecurityRule(ctx *Context, name string, args SecurityRuleArgs, opts ...ResourceOption) (*SecurityRule, error)
    public SecurityRule(string name, SecurityRuleArgs args, CustomResourceOptions? opts = null)
    public SecurityRule(String name, SecurityRuleArgs args)
public SecurityRule(String name, SecurityRuleArgs args, CustomResourceOptions options)

    type: cloudngfwaws:SecurityRule
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

    Parameters

    name string
    The unique name of the resource.
    args SecurityRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    resource_name str
    The unique name of the resource.
    args SecurityRuleArgs
    The arguments to resource properties.
    opts ResourceOptions
    Bag of options to control resource's behavior.
    ctx Context
    Context object for the current deployment.
    name string
    The unique name of the resource.
    args SecurityRuleArgs
    The arguments to resource properties.
    opts ResourceOption
    Bag of options to control resource's behavior.
    name string
    The unique name of the resource.
    args SecurityRuleArgs
    The arguments to resource properties.
    opts CustomResourceOptions
    Bag of options to control resource's behavior.
    name String
    The unique name of the resource.
    args SecurityRuleArgs
    The arguments to resource properties.
    options CustomResourceOptions
    Bag of options to control resource's behavior.

    Constructor example

    The following reference example uses placeholder values for all input properties.

    var securityRuleResource = new CloudNgfwAws.SecurityRule("securityRuleResource", new()
{
    Action = "string",
    Applications = new[]
    {
        "string",
    },
    Source = new CloudNgfwAws.Inputs.SecurityRuleSourceArgs
    {
        Cidrs = new[]
        {
            "string",
        },
        Countries = new[]
        {
            "string",
        },
        Feeds = new[]
        {
            "string",
        },
        PrefixLists = new[]
        {
            "string",
        },
    },
    Category = new CloudNgfwAws.Inputs.SecurityRuleCategoryArgs
    {
        Feeds = new[]
        {
            "string",
        },
        UrlCategoryNames = new[]
        {
            "string",
        },
    },
    Rulestack = "string",
    Priority = 0,
    Destination = new CloudNgfwAws.Inputs.SecurityRuleDestinationArgs
    {
        Cidrs = new[]
        {
            "string",
        },
        Countries = new[]
        {
            "string",
        },
        Feeds = new[]
        {
            "string",
        },
        FqdnLists = new[]
        {
            "string",
        },
        PrefixLists = new[]
        {
            "string",
        },
    },
    NegateDestination = false,
    Logging = false,
    Name = "string",
    Enabled = false,
    NegateSource = false,
    Description = "string",
    ProtPortLists = new[]
    {
        "string",
    },
    Protocol = "string",
    RuleList = "string",
    DecryptionRuleType = "string",
    Scope = "string",
    AuditComment = "string",
    Tags = 
    {
        { "string", "string" },
    },
});

    example, err := cloudngfwaws.NewSecurityRule(ctx, "securityRuleResource", &cloudngfwaws.SecurityRuleArgs{
	Action: pulumi.String("string"),
	Applications: pulumi.StringArray{
		pulumi.String("string"),
	},
	Source: &cloudngfwaws.SecurityRuleSourceArgs{
		Cidrs: pulumi.StringArray{
			pulumi.String("string"),
		},
		Countries: pulumi.StringArray{
			pulumi.String("string"),
		},
		Feeds: pulumi.StringArray{
			pulumi.String("string"),
		},
		PrefixLists: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
	Category: &cloudngfwaws.SecurityRuleCategoryArgs{
		Feeds: pulumi.StringArray{
			pulumi.String("string"),
		},
		UrlCategoryNames: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
	Rulestack: pulumi.String("string"),
	Priority:  pulumi.Int(0),
	Destination: &cloudngfwaws.SecurityRuleDestinationArgs{
		Cidrs: pulumi.StringArray{
			pulumi.String("string"),
		},
		Countries: pulumi.StringArray{
			pulumi.String("string"),
		},
		Feeds: pulumi.StringArray{
			pulumi.String("string"),
		},
		FqdnLists: pulumi.StringArray{
			pulumi.String("string"),
		},
		PrefixLists: pulumi.StringArray{
			pulumi.String("string"),
		},
	},
	NegateDestination: pulumi.Bool(false),
	Logging:           pulumi.Bool(false),
	Name:              pulumi.String("string"),
	Enabled:           pulumi.Bool(false),
	NegateSource:      pulumi.Bool(false),
	Description:       pulumi.String("string"),
	ProtPortLists: pulumi.StringArray{
		pulumi.String("string"),
	},
	Protocol:           pulumi.String("string"),
	RuleList:           pulumi.String("string"),
	DecryptionRuleType: pulumi.String("string"),
	Scope:              pulumi.String("string"),
	AuditComment:       pulumi.String("string"),
	Tags: pulumi.StringMap{
		"string": pulumi.String("string"),
	},
})

    var securityRuleResource = new SecurityRule("securityRuleResource", SecurityRuleArgs.builder()
    .action("string")
    .applications("string")
    .source(SecurityRuleSourceArgs.builder()
        .cidrs("string")
        .countries("string")
        .feeds("string")
        .prefixLists("string")
        .build())
    .category(SecurityRuleCategoryArgs.builder()
        .feeds("string")
        .urlCategoryNames("string")
        .build())
    .rulestack("string")
    .priority(0)
    .destination(SecurityRuleDestinationArgs.builder()
        .cidrs("string")
        .countries("string")
        .feeds("string")
        .fqdnLists("string")
        .prefixLists("string")
        .build())
    .negateDestination(false)
    .logging(false)
    .name("string")
    .enabled(false)
    .negateSource(false)
    .description("string")
    .protPortLists("string")
    .protocol("string")
    .ruleList("string")
    .decryptionRuleType("string")
    .scope("string")
    .auditComment("string")
    .tags(Map.of("string", "string"))
    .build());

    security_rule_resource = cloudngfwaws.SecurityRule("securityRuleResource",
    action="string",
    applications=["string"],
    source={
        "cidrs": ["string"],
        "countries": ["string"],
        "feeds": ["string"],
        "prefix_lists": ["string"],
    },
    category={
        "feeds": ["string"],
        "url_category_names": ["string"],
    },
    rulestack="string",
    priority=0,
    destination={
        "cidrs": ["string"],
        "countries": ["string"],
        "feeds": ["string"],
        "fqdn_lists": ["string"],
        "prefix_lists": ["string"],
    },
    negate_destination=False,
    logging=False,
    name="string",
    enabled=False,
    negate_source=False,
    description="string",
    prot_port_lists=["string"],
    protocol="string",
    rule_list="string",
    decryption_rule_type="string",
    scope="string",
    audit_comment="string",
    tags={
        "string": "string",
    })

    const securityRuleResource = new cloudngfwaws.SecurityRule("securityRuleResource", {
    action: "string",
    applications: ["string"],
    source: {
        cidrs: ["string"],
        countries: ["string"],
        feeds: ["string"],
        prefixLists: ["string"],
    },
    category: {
        feeds: ["string"],
        urlCategoryNames: ["string"],
    },
    rulestack: "string",
    priority: 0,
    destination: {
        cidrs: ["string"],
        countries: ["string"],
        feeds: ["string"],
        fqdnLists: ["string"],
        prefixLists: ["string"],
    },
    negateDestination: false,
    logging: false,
    name: "string",
    enabled: false,
    negateSource: false,
    description: "string",
    protPortLists: ["string"],
    protocol: "string",
    ruleList: "string",
    decryptionRuleType: "string",
    scope: "string",
    auditComment: "string",
    tags: {
        string: "string",
    },
});

    type: cloudngfwaws:SecurityRule
properties:
    action: string
    applications:
        - string
    auditComment: string
    category:
        feeds:
            - string
        urlCategoryNames:
            - string
    decryptionRuleType: string
    description: string
    destination:
        cidrs:
            - string
        countries:
            - string
        feeds:
            - string
        fqdnLists:
            - string
        prefixLists:
            - string
    enabled: false
    logging: false
    name: string
    negateDestination: false
    negateSource: false
    priority: 0
    protPortLists:
        - string
    protocol: string
    ruleList: string
    rulestack: string
    scope: string
    source:
        cidrs:
            - string
        countries:
            - string
        feeds:
            - string
        prefixLists:
            - string
    tags:
        string: string

    SecurityRule Resource Properties

    To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

    Inputs

    In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

    The SecurityRule resource accepts the following input properties:

    Action string
    The action to take. Valid values are Allow, DenySilent, DenyResetServer, or DenyResetBoth.
    Applications List<string>
    The list of applications.
    Category Pulumi.CloudNgfwAws.Inputs.SecurityRuleCategory
    The category spec.
    Destination Pulumi.CloudNgfwAws.Inputs.SecurityRuleDestination
    The destination spec.
    Priority int
    The rule priority.
    Rulestack string
    The rulestack.
    Source Pulumi.CloudNgfwAws.Inputs.SecurityRuleSource
    The source spec.
    AuditComment string
    The audit comment.
    DecryptionRuleType string
    Decryption rule type. Valid values are ``orSSLOutboundInspection.
    Description string
    The description.
    Enabled bool
    Set to false to disable this rule. Defaults to true.
    Logging bool
    Enable logging at end. Defaults to true.
    Name string
    The name.
    NegateDestination bool
    Negate the destination definition.
    NegateSource bool
    Negate the source definition.
    ProtPortLists List<string>
    Protocol port list.
    Protocol string
    The protocol.
    RuleList string
    The rulebase. Valid values are PreRule, PostRule, or LocalRule. Defaults to PreRule.
    Scope string
    The rulestack's scope. A local rulestack will require that you've retrieved a LRA JWT. A global rulestack will require that you've retrieved a GRA JWT. Valid values are Local or Global. Defaults to Local.
    Tags Dictionary<string, string>
    The tags.
    Action string
    The action to take. Valid values are Allow, DenySilent, DenyResetServer, or DenyResetBoth.
    Applications []string
    The list of applications.
    Category SecurityRuleCategoryArgs
    The category spec.
    Destination SecurityRuleDestinationArgs
    The destination spec.
    Priority int
    The rule priority.
    Rulestack string
    The rulestack.
    Source SecurityRuleSourceArgs
    The source spec.
    AuditComment string
    The audit comment.
    DecryptionRuleType string
    Decryption rule type. Valid values are ``orSSLOutboundInspection.
    Description string
    The description.
    Enabled bool
    Set to false to disable this rule. Defaults to true.
    Logging bool
    Enable logging at end. Defaults to true.
    Name string
    The name.
    NegateDestination bool
    Negate the destination definition.
    NegateSource bool
    Negate the source definition.
    ProtPortLists []string
    Protocol port list.
    Protocol string
    The protocol.
    RuleList string
    The rulebase. Valid values are PreRule, PostRule, or LocalRule. Defaults to PreRule.
    Scope string
    The rulestack's scope. A local rulestack will require that you've retrieved a LRA JWT. A global rulestack will require that you've retrieved a GRA JWT. Valid values are Local or Global. Defaults to Local.
    Tags map[string]string
    The tags.
    action String
    The action to take. Valid values are Allow, DenySilent, DenyResetServer, or DenyResetBoth.
    applications List<String>
    The list of applications.
    category SecurityRuleCategory
    The category spec.
    destination SecurityRuleDestination
    The destination spec.
    priority Integer
    The rule priority.
    rulestack String
    The rulestack.
    source SecurityRuleSource
    The source spec.
    auditComment String
    The audit comment.
    decryptionRuleType String
    Decryption rule type. Valid values are ``orSSLOutboundInspection.
    description String
    The description.
    enabled Boolean
    Set to false to disable this rule. Defaults to true.
    logging Boolean
    Enable logging at end. Defaults to true.
    name String
    The name.
    negateDestination Boolean
    Negate the destination definition.
    negateSource Boolean
    Negate the source definition.
    protPortLists List<String>
    Protocol port list.
    protocol String
    The protocol.
    ruleList String
    The rulebase. Valid values are PreRule, PostRule, or LocalRule. Defaults to PreRule.
    scope String
    The rulestack's scope. A local rulestack will require that you've retrieved a LRA JWT. A global rulestack will require that you've retrieved a GRA JWT. Valid values are Local or Global. Defaults to Local.
    tags Map<String,String>
    The tags.
    action string
    The action to take. Valid values are Allow, DenySilent, DenyResetServer, or DenyResetBoth.
    applications string[]
    The list of applications.
    category SecurityRuleCategory
    The category spec.
    destination SecurityRuleDestination
    The destination spec.
    priority number
    The rule priority.
    rulestack string
    The rulestack.
    source SecurityRuleSource
    The source spec.
    auditComment string
    The audit comment.
    decryptionRuleType string
    Decryption rule type. Valid values are ``orSSLOutboundInspection.
    description string
    The description.
    enabled boolean
    Set to false to disable this rule. Defaults to true.
    logging boolean
    Enable logging at end. Defaults to true.
    name string
    The name.
    negateDestination boolean
    Negate the destination definition.
    negateSource boolean
    Negate the source definition.
    protPortLists string[]
    Protocol port list.
    protocol string
    The protocol.
    ruleList string
    The rulebase. Valid values are PreRule, PostRule, or LocalRule. Defaults to PreRule.
    scope string
    The rulestack's scope. A local rulestack will require that you've retrieved a LRA JWT. A global rulestack will require that you've retrieved a GRA JWT. Valid values are Local or Global. Defaults to Local.
    tags {[key: string]: string}
    The tags.
    action str
    The action to take. Valid values are Allow, DenySilent, DenyResetServer, or DenyResetBoth.
    applications Sequence[str]
    The list of applications.
    category SecurityRuleCategoryArgs
    The category spec.
    destination SecurityRuleDestinationArgs
    The destination spec.
    priority int
    The rule priority.
    rulestack str
    The rulestack.
    source SecurityRuleSourceArgs
    The source spec.
    audit_comment str
    The audit comment.
    decryption_rule_type str
    Decryption rule type. Valid values are ``orSSLOutboundInspection.
    description str
    The description.
    enabled bool
    Set to false to disable this rule. Defaults to true.
    logging bool
    Enable logging at end. Defaults to true.
    name str
    The name.
    negate_destination bool
    Negate the destination definition.
    negate_source bool
    Negate the source definition.
    prot_port_lists Sequence[str]
    Protocol port list.
    protocol str
    The protocol.
    rule_list str
    The rulebase. Valid values are PreRule, PostRule, or LocalRule. Defaults to PreRule.
    scope str
    The rulestack's scope. A local rulestack will require that you've retrieved a LRA JWT. A global rulestack will require that you've retrieved a GRA JWT. Valid values are Local or Global. Defaults to Local.
    tags Mapping[str, str]
    The tags.
    action String
    The action to take. Valid values are Allow, DenySilent, DenyResetServer, or DenyResetBoth.
    applications List<String>
    The list of applications.
    category Property Map
    The category spec.
    destination Property Map
    The destination spec.
    priority Number
    The rule priority.
    rulestack String
    The rulestack.
    source Property Map
    The source spec.
    auditComment String
    The audit comment.
    decryptionRuleType String
    Decryption rule type. Valid values are ``orSSLOutboundInspection.
    description String
    The description.
    enabled Boolean
    Set to false to disable this rule. Defaults to true.
    logging Boolean
    Enable logging at end. Defaults to true.
    name String
    The name.
    negateDestination Boolean
    Negate the destination definition.
    negateSource Boolean
    Negate the source definition.
    protPortLists List<String>
    Protocol port list.
    protocol String
    The protocol.
    ruleList String
    The rulebase. Valid values are PreRule, PostRule, or LocalRule. Defaults to PreRule.
    scope String
    The rulestack's scope. A local rulestack will require that you've retrieved a LRA JWT. A global rulestack will require that you've retrieved a GRA JWT. Valid values are Local or Global. Defaults to Local.
    tags Map<String>
    The tags.

    Outputs

    All input properties are implicitly available as output properties. Additionally, the SecurityRule resource produces the following output properties:

    Id string
    The provider-assigned unique ID for this managed resource.
    UpdateToken string
    The update token.
    Id string
    The provider-assigned unique ID for this managed resource.
    UpdateToken string
    The update token.
    id String
    The provider-assigned unique ID for this managed resource.
    updateToken String
    The update token.
    id string
    The provider-assigned unique ID for this managed resource.
    updateToken string
    The update token.
    id str
    The provider-assigned unique ID for this managed resource.
    update_token str
    The update token.
    id String
    The provider-assigned unique ID for this managed resource.
    updateToken String
    The update token.

    Look up Existing SecurityRule Resource

    Get an existing SecurityRule resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

    public static get(name: string, id: Input<ID>, state?: SecurityRuleState, opts?: CustomResourceOptions): SecurityRule
    @staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        action: Optional[str] = None,
        applications: Optional[Sequence[str]] = None,
        audit_comment: Optional[str] = None,
        category: Optional[SecurityRuleCategoryArgs] = None,
        decryption_rule_type: Optional[str] = None,
        description: Optional[str] = None,
        destination: Optional[SecurityRuleDestinationArgs] = None,
        enabled: Optional[bool] = None,
        logging: Optional[bool] = None,
        name: Optional[str] = None,
        negate_destination: Optional[bool] = None,
        negate_source: Optional[bool] = None,
        priority: Optional[int] = None,
        prot_port_lists: Optional[Sequence[str]] = None,
        protocol: Optional[str] = None,
        rule_list: Optional[str] = None,
        rulestack: Optional[str] = None,
        scope: Optional[str] = None,
        source: Optional[SecurityRuleSourceArgs] = None,
        tags: Optional[Mapping[str, str]] = None,
        update_token: Optional[str] = None) -> SecurityRule
    func GetSecurityRule(ctx *Context, name string, id IDInput, state *SecurityRuleState, opts ...ResourceOption) (*SecurityRule, error)
    public static SecurityRule Get(string name, Input<string> id, SecurityRuleState? state, CustomResourceOptions? opts = null)
    public static SecurityRule get(String name, Output<String> id, SecurityRuleState state, CustomResourceOptions options)
    resources:  _:    type: cloudngfwaws:SecurityRule    get:      id: ${id}
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    resource_name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    name
    The unique name of the resulting resource.
    id
    The unique provider ID of the resource to lookup.
    state
    Any extra arguments used during the lookup.
    opts
    A bag of options that control this resource's behavior.
    The following state arguments are supported:
    Action string
    The action to take. Valid values are Allow, DenySilent, DenyResetServer, or DenyResetBoth.
    Applications List<string>
    The list of applications.
    AuditComment string
    The audit comment.
    Category Pulumi.CloudNgfwAws.Inputs.SecurityRuleCategory
    The category spec.
    DecryptionRuleType string
    Decryption rule type. Valid values are ``orSSLOutboundInspection.
    Description string
    The description.
    Destination Pulumi.CloudNgfwAws.Inputs.SecurityRuleDestination
    The destination spec.
    Enabled bool
    Set to false to disable this rule. Defaults to true.
    Logging bool
    Enable logging at end. Defaults to true.
    Name string
    The name.
    NegateDestination bool
    Negate the destination definition.
    NegateSource bool
    Negate the source definition.
    Priority int
    The rule priority.
    ProtPortLists List<string>
    Protocol port list.
    Protocol string
    The protocol.
    RuleList string
    The rulebase. Valid values are PreRule, PostRule, or LocalRule. Defaults to PreRule.
    Rulestack string
    The rulestack.
    Scope string
    The rulestack's scope. A local rulestack will require that you've retrieved a LRA JWT. A global rulestack will require that you've retrieved a GRA JWT. Valid values are Local or Global. Defaults to Local.
    Source Pulumi.CloudNgfwAws.Inputs.SecurityRuleSource
    The source spec.
    Tags Dictionary<string, string>
    The tags.
    UpdateToken string
    The update token.
    Action string
    The action to take. Valid values are Allow, DenySilent, DenyResetServer, or DenyResetBoth.
    Applications []string
    The list of applications.
    AuditComment string
    The audit comment.
    Category SecurityRuleCategoryArgs
    The category spec.
    DecryptionRuleType string
    Decryption rule type. Valid values are ``orSSLOutboundInspection.
    Description string
    The description.
    Destination SecurityRuleDestinationArgs
    The destination spec.
    Enabled bool
    Set to false to disable this rule. Defaults to true.
    Logging bool
    Enable logging at end. Defaults to true.
    Name string
    The name.
    NegateDestination bool
    Negate the destination definition.
    NegateSource bool
    Negate the source definition.
    Priority int
    The rule priority.
    ProtPortLists []string
    Protocol port list.
    Protocol string
    The protocol.
    RuleList string
    The rulebase. Valid values are PreRule, PostRule, or LocalRule. Defaults to PreRule.
    Rulestack string
    The rulestack.
    Scope string
    The rulestack's scope. A local rulestack will require that you've retrieved a LRA JWT. A global rulestack will require that you've retrieved a GRA JWT. Valid values are Local or Global. Defaults to Local.
    Source SecurityRuleSourceArgs
    The source spec.
    Tags map[string]string
    The tags.
    UpdateToken string
    The update token.
    action String
    The action to take. Valid values are Allow, DenySilent, DenyResetServer, or DenyResetBoth.
    applications List<String>
    The list of applications.
    auditComment String
    The audit comment.
    category SecurityRuleCategory
    The category spec.
    decryptionRuleType String
    Decryption rule type. Valid values are ``orSSLOutboundInspection.
    description String
    The description.
    destination SecurityRuleDestination
    The destination spec.
    enabled Boolean
    Set to false to disable this rule. Defaults to true.
    logging Boolean
    Enable logging at end. Defaults to true.
    name String
    The name.
    negateDestination Boolean
    Negate the destination definition.
    negateSource Boolean
    Negate the source definition.
    priority Integer
    The rule priority.
    protPortLists List<String>
    Protocol port list.
    protocol String
    The protocol.
    ruleList String
    The rulebase. Valid values are PreRule, PostRule, or LocalRule. Defaults to PreRule.
    rulestack String
    The rulestack.
    scope String
    The rulestack's scope. A local rulestack will require that you've retrieved a LRA JWT. A global rulestack will require that you've retrieved a GRA JWT. Valid values are Local or Global. Defaults to Local.
    source SecurityRuleSource
    The source spec.
    tags Map<String,String>
    The tags.
    updateToken String
    The update token.
    action string
    The action to take. Valid values are Allow, DenySilent, DenyResetServer, or DenyResetBoth.
    applications string[]
    The list of applications.
    auditComment string
    The audit comment.
    category SecurityRuleCategory
    The category spec.
    decryptionRuleType string
    Decryption rule type. Valid values are ``orSSLOutboundInspection.
    description string
    The description.
    destination SecurityRuleDestination
    The destination spec.
    enabled boolean
    Set to false to disable this rule. Defaults to true.
    logging boolean
    Enable logging at end. Defaults to true.
    name string
    The name.
    negateDestination boolean
    Negate the destination definition.
    negateSource boolean
    Negate the source definition.
    priority number
    The rule priority.
    protPortLists string[]
    Protocol port list.
    protocol string
    The protocol.
    ruleList string
    The rulebase. Valid values are PreRule, PostRule, or LocalRule. Defaults to PreRule.
    rulestack string
    The rulestack.
    scope string
    The rulestack's scope. A local rulestack will require that you've retrieved a LRA JWT. A global rulestack will require that you've retrieved a GRA JWT. Valid values are Local or Global. Defaults to Local.
    source SecurityRuleSource
    The source spec.
    tags {[key: string]: string}
    The tags.
    updateToken string
    The update token.
    action str
    The action to take. Valid values are Allow, DenySilent, DenyResetServer, or DenyResetBoth.
    applications Sequence[str]
    The list of applications.
    audit_comment str
    The audit comment.
    category SecurityRuleCategoryArgs
    The category spec.
    decryption_rule_type str
    Decryption rule type. Valid values are ``orSSLOutboundInspection.
    description str
    The description.
    destination SecurityRuleDestinationArgs
    The destination spec.
    enabled bool
    Set to false to disable this rule. Defaults to true.
    logging bool
    Enable logging at end. Defaults to true.
    name str
    The name.
    negate_destination bool
    Negate the destination definition.
    negate_source bool
    Negate the source definition.
    priority int
    The rule priority.
    prot_port_lists Sequence[str]
    Protocol port list.
    protocol str
    The protocol.
    rule_list str
    The rulebase. Valid values are PreRule, PostRule, or LocalRule. Defaults to PreRule.
    rulestack str
    The rulestack.
    scope str
    The rulestack's scope. A local rulestack will require that you've retrieved a LRA JWT. A global rulestack will require that you've retrieved a GRA JWT. Valid values are Local or Global. Defaults to Local.
    source SecurityRuleSourceArgs
    The source spec.
    tags Mapping[str, str]
    The tags.
    update_token str
    The update token.
    action String
    The action to take. Valid values are Allow, DenySilent, DenyResetServer, or DenyResetBoth.
    applications List<String>
    The list of applications.
    auditComment String
    The audit comment.
    category Property Map
    The category spec.
    decryptionRuleType String
    Decryption rule type. Valid values are ``orSSLOutboundInspection.
    description String
    The description.
    destination Property Map
    The destination spec.
    enabled Boolean
    Set to false to disable this rule. Defaults to true.
    logging Boolean
    Enable logging at end. Defaults to true.
    name String
    The name.
    negateDestination Boolean
    Negate the destination definition.
    negateSource Boolean
    Negate the source definition.
    priority Number
    The rule priority.
    protPortLists List<String>
    Protocol port list.
    protocol String
    The protocol.
    ruleList String
    The rulebase. Valid values are PreRule, PostRule, or LocalRule. Defaults to PreRule.
    rulestack String
    The rulestack.
    scope String
    The rulestack's scope. A local rulestack will require that you've retrieved a LRA JWT. A global rulestack will require that you've retrieved a GRA JWT. Valid values are Local or Global. Defaults to Local.
    source Property Map
    The source spec.
    tags Map<String>
    The tags.
    updateToken String
    The update token.

    Supporting Types

    SecurityRuleCategory, SecurityRuleCategoryArgs

    Feeds List<string>
    List of feeds.
    UrlCategoryNames List<string>
    List of URL category names.
    Feeds []string
    List of feeds.
    UrlCategoryNames []string
    List of URL category names.
    feeds List<String>
    List of feeds.
    urlCategoryNames List<String>
    List of URL category names.
    feeds string[]
    List of feeds.
    urlCategoryNames string[]
    List of URL category names.
    feeds Sequence[str]
    List of feeds.
    url_category_names Sequence[str]
    List of URL category names.
    feeds List<String>
    List of feeds.
    urlCategoryNames List<String>
    List of URL category names.

    SecurityRuleDestination, SecurityRuleDestinationArgs

    Cidrs List<string>
    List of CIDRs.
    Countries List<string>
    List of countries.
    Feeds List<string>
    List of feeds.
    FqdnLists List<string>
    List of FQDN lists.
    PrefixLists List<string>
    List of prefix list.
    Cidrs []string
    List of CIDRs.
    Countries []string
    List of countries.
    Feeds []string
    List of feeds.
    FqdnLists []string
    List of FQDN lists.
    PrefixLists []string
    List of prefix list.
    cidrs List<String>
    List of CIDRs.
    countries List<String>
    List of countries.
    feeds List<String>
    List of feeds.
    fqdnLists List<String>
    List of FQDN lists.
    prefixLists List<String>
    List of prefix list.
    cidrs string[]
    List of CIDRs.
    countries string[]
    List of countries.
    feeds string[]
    List of feeds.
    fqdnLists string[]
    List of FQDN lists.
    prefixLists string[]
    List of prefix list.
    cidrs Sequence[str]
    List of CIDRs.
    countries Sequence[str]
    List of countries.
    feeds Sequence[str]
    List of feeds.
    fqdn_lists Sequence[str]
    List of FQDN lists.
    prefix_lists Sequence[str]
    List of prefix list.
    cidrs List<String>
    List of CIDRs.
    countries List<String>
    List of countries.
    feeds List<String>
    List of feeds.
    fqdnLists List<String>
    List of FQDN lists.
    prefixLists List<String>
    List of prefix list.

    SecurityRuleSource, SecurityRuleSourceArgs

    Cidrs List<string>
    List of CIDRs.
    Countries List<string>
    List of countries.
    Feeds List<string>
    List of feeds.
    PrefixLists List<string>
    List of prefix list.
    Cidrs []string
    List of CIDRs.
    Countries []string
    List of countries.
    Feeds []string
    List of feeds.
    PrefixLists []string
    List of prefix list.
    cidrs List<String>
    List of CIDRs.
    countries List<String>
    List of countries.
    feeds List<String>
    List of feeds.
    prefixLists List<String>
    List of prefix list.
    cidrs string[]
    List of CIDRs.
    countries string[]
    List of countries.
    feeds string[]
    List of feeds.
    prefixLists string[]
    List of prefix list.
    cidrs Sequence[str]
    List of CIDRs.
    countries Sequence[str]
    List of countries.
    feeds Sequence[str]
    List of feeds.
    prefix_lists Sequence[str]
    List of prefix list.
    cidrs List<String>
    List of CIDRs.
    countries List<String>
    List of countries.
    feeds List<String>
    List of feeds.
    prefixLists List<String>
    List of prefix list.

    Import

    import name is ::<rule_list>:

    $ pulumi import cloudngfwaws:index/securityRule:SecurityRule example Local:terraform-rulestack:LocalRule:3

    To learn more about importing existing cloud resources, see Importing resources.

    Package Details

    Repository
    cloudngfwaws pulumi/pulumi-cloudngfwaws
    License
    Apache-2.0
    Notes
    This Pulumi package is based on the cloudngfwaws Terraform Provider.
    cloudngfwaws logo
    Palo Alto Networks Cloud NGFW for AWS v0.1.1 published on Saturday, Mar 15, 2025 by Pulumi
    pulumi/pulumi-cloudngfwaws