Aws-cdk: [aws-networkfirewall] Add support for AWS Network Firewall

[bf-sodle]

The new managed AWS Network Firewall service is now available, and has CloudFormation support.

Use Case

Need to create a firewall.

Proposed Solution

CDK should incorporate L1 and eventually L2 constructs for the AWS Network Firewall.

Other

• [ ] :wave: I may be able to implement this feature request
• [ ] :warning: This feature might incur a breaking change

---

This is a :rocket: Feature Request

[sciarrilli]

@SomayaB I’m curious what the time frame is for this?

[NukaCody]

L1 constructs for Network firewall is included in the 1.77 release of CDK. Docs are still updating (Currently 1.76) but since it's L1, it just points to CFN docs: https://github.com/aws/aws-cdk/tree/master/packages/%40aws-cdk/aws-networkfirewall

[SomayaB]

@sciarrilli The L1 is awaiting release and was merged a few days after it was added to Cloudformation, which always happens automatically whenever a new resource is added to CFN. As far as an L2, we don't have a timeline right now but we welcome PRs, here's the tracking issue for the L2.

[github-actions[bot]]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[bf-sodle]

@SomayaB I am unable to deploy the CfnFirewallPolicy construct included in this update. TypeScript sees the construct as valid, but CloudFormation raises the following validation errors:

Properties validation failed for resource firewallpolicy with message:
#/Tags: expected type: JSONArray, found: JSONObject
#/FirewallPolicy/StatelessDefaultActions: expected type: JSONArray, found: JSONObject
#/FirewallPolicy/StatelessFragmentDefaultActions: expected type: JSONArray, found: JSONObject

On further inspection of the CloudFormation documentation, I believe there is an inconsistency in the spec for this resource. The specification seems to define AWS::NetworkFirewall::FirewallPolicy.StatelessActions as a nested object, but the top-level example shows it as a simple list. I believe the CDK is synthesizing the nested object form, while CloudFormation is actually expecting the list form.

[skinny85]

Thanks for reporting @bf-sodle . Confirmed I was able to reproduce the error. Working on a fix.

[bf-sodle]

I've just reproduced it with the Tags property on CfnRuleGroup as well. Haven't tested other constructs yet.

[bf-sodle]

Thank you for looking at this!

[SomayaB]

I opened a new issue specifically for this bug here.