aws-sdk-networkfirewall 1.101.0 → 1.102.0

data/lib/aws-sdk-networkfirewall/types.rb

@@ -880,14 +880,57 @@ module Aws::NetworkFirewall
     end
 
     # A key-value filter pair used in container association monitoring
-    # configurations to narrow which containers are tracked.
+    # configurations to narrow which containers are tracked. The key must
+    # match exactly. The value can be an exact value or a wildcard pattern.
     #
     # @!attribute [rw] key
-    #   The attribute key to filter on.
+    #   The attribute key to filter on. For Amazon EKS, specify `namespace`
+    #   to filter by namespace, or specify a Kubernetes label key. For
+    #   Amazon ECS, specify a container instance attribute name. Keys don't
+    #   support wildcards.
+    #
+    #   Valid characters are letters, numbers, spaces, hyphens (`-`),
+    #   underscores (`_`), periods (`.`), forward slashes (`/`), and colons
+    #   (`:`).
     #   @return [String]
     #
     # @!attribute [rw] value
-    #   The attribute value to match.
+    #   The attribute value to match. You can specify an exact value, such
+    #   as `payments-api`, or a wildcard pattern, such as `payments-*`.
+    #
+    #   Valid characters are letters, numbers, spaces, hyphens (`-`),
+    #   underscores (`_`), periods (`.`), forward slashes (`/`), colons
+    #   (`:`), asterisks (`*`), and backslashes (``).
+    #
+    #   Network Firewall evaluates the value using the following rules:
+    #
+    #   * An asterisk (`*`) matches zero or more characters. For example,
+    #     `payments-*` matches `payments-`, `payments-api`, and
+    #     `payments-api-v2`, and `*-prod` matches `web-prod`.
+    #
+    #   * The pattern must match the entire value. For example, `payments-*`
+    #     doesn't match `my-payments-api`. To match a value that contains
+    #     `payments` anywhere, use `*payments*`.
+    #
+    #   * Matching is case sensitive. For example, `Payments-*` doesn't
+    #     match `payments-api`.
+    #
+    #   * To match a literal asterisk, escape it with a backslash (`*`). To
+    #     match a literal backslash, use `\`. A backslash followed by any
+    #     other character matches a literal backslash followed by that
+    #     character.
+    #
+    #   * A wildcard pattern matches only containers that have the
+    #     attribute. For example, a filter with key `app` and value `*`
+    #     matches every container that has an `app` label, but doesn't
+    #     match a container without an `app` label.
+    #
+    #   * A value that doesn't contain `*` or `` matches only that exact
+    #     value.
+    #
+    #   A value can contain at most 10 unescaped asterisks. Escaped
+    #   asterisks (`*`) don't count toward this limit. A value can't end
+    #   with a single unescaped backslash.
     #   @return [String]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/ContainerAttribute AWS API Documentation
@@ -914,6 +957,9 @@ module Aws::NetworkFirewall
     #   EKS, you can filter by namespace and Kubernetes labels. For Amazon
     #   ECS, you can filter by container instance attributes (EC2 launch
     #   type only).
+    #
+    #   Attribute values can contain wildcard patterns, for example
+    #   `payments-*`. Attribute keys must match exactly.
     #   @return [Array<Types::ContainerAttribute>]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/ContainerMonitoringConfiguration AWS API Documentation
@@ -2815,13 +2861,22 @@ module Aws::NetworkFirewall
     #   @return [String]
     #
     # @!attribute [rw] availability_zone
-    #   The ID of the Availability Zone where the firewall is located. For
+    #   The name of the Availability Zone where the firewall is located. For
     #   example, `us-east-2a`.
     #
     #   Defines the scope a flow operation. You can use up to 20 filters to
     #   configure a single flow operation.
     #   @return [String]
     #
+    # @!attribute [rw] availability_zone_id
+    #   The ID of the Availability Zone where the firewall is located. For
+    #   example, `use2-az1`. Availability Zone IDs are the same in every
+    #   Amazon Web Services account, so use this parameter when you
+    #   coordinate resources across accounts. Specify either
+    #   `AvailabilityZone` or `AvailabilityZoneId`, not both. If you specify
+    #   both, the request fails.
+    #   @return [String]
+    #
     # @!attribute [rw] vpc_endpoint_association_arn
     #   The Amazon Resource Name (ARN) of a VPC endpoint association.
     #   @return [String]
@@ -2842,6 +2897,7 @@ module Aws::NetworkFirewall
     class DescribeFlowOperationRequest < Struct.new(
       :firewall_arn,
       :availability_zone,
+      :availability_zone_id,
       :vpc_endpoint_association_arn,
       :vpc_endpoint_id,
       :flow_operation_id)
@@ -2854,13 +2910,18 @@ module Aws::NetworkFirewall
     #   @return [String]
     #
     # @!attribute [rw] availability_zone
-    #   The ID of the Availability Zone where the firewall is located. For
+    #   The name of the Availability Zone where the firewall is located. For
     #   example, `us-east-2a`.
     #
     #   Defines the scope a flow operation. You can use up to 20 filters to
     #   configure a single flow operation.
     #   @return [String]
     #
+    # @!attribute [rw] availability_zone_id
+    #   The ID of the Availability Zone where the firewall is located. For
+    #   example, `use2-az1`.
+    #   @return [String]
+    #
     # @!attribute [rw] vpc_endpoint_association_arn
     #   The Amazon Resource Name (ARN) of a VPC endpoint association.
     #   @return [String]
@@ -2911,6 +2972,7 @@ module Aws::NetworkFirewall
     class DescribeFlowOperationResponse < Struct.new(
       :firewall_arn,
       :availability_zone,
+      :availability_zone_id,
       :vpc_endpoint_association_arn,
       :vpc_endpoint_id,
       :flow_operation_id,
@@ -4343,6 +4405,18 @@ module Aws::NetworkFirewall
     #   (SNI) rules. Requires an associated TLS Inspection configuration.
     #   @return [Boolean]
     #
+    # @!attribute [rw] route_53_resolved_ip_validation
+    #   The settings that enable resolved IP validation for the policy.
+    #   Resolved IP validation verifies that a connection's destination IP
+    #   address is one that the Amazon Route 53 Resolver returned in a DNS
+    #   response for a domain. The response must come from a VPC that's
+    #   associated with the Route 53 Resolver DNS Firewall rule group that
+    #   you specify. This checks how the destination IP address was
+    #   obtained, instead of relying only on the domain that the client
+    #   asserts in its TLS Server Name Indication (SNI) or HTTP `Host`
+    #   header. For more information, see Route53ResolvedIPValidation.
+    #   @return [Types::Route53ResolvedIPValidation]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/FirewallPolicy AWS API Documentation
     #
     class FirewallPolicy < Struct.new(
@@ -4355,7 +4429,48 @@ module Aws::NetworkFirewall
       :stateful_engine_options,
       :tls_inspection_configuration_arn,
       :policy_variables,
-      :enable_tls_session_holding)
+      :enable_tls_session_holding,
+      :route_53_resolved_ip_validation)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # A configuration error that Network Firewall detected for a firewall
+    # policy.
+    #
+    # @!attribute [rw] code
+    #   The error code identifies the type of error. Valid values are the
+    #   following:
+    #
+    #   * `DNS_FIREWALL_RULE_GROUP_UNAVAILABLE` – The Amazon Route 53
+    #     Resolver DNS Firewall rule group that resolved IP validation
+    #     references is unavailable, for example, because it was deleted or
+    #     is no longer accessible from your account. Update the rule group
+    #     ID or remove the resolved IP validation configuration.
+    #
+    #   * `ROUTE53_RESOLVED_IP_VALIDATION_MISSING` – An associated stateful
+    #     rule group uses the `aws_route_53_resolved_domain` keyword, but
+    #     the policy doesn't have resolved IP validation configured. The
+    #     affected rules are inactive until you add resolved IP validation
+    #     to the policy or remove the keyword rules.
+    #   @return [String]
+    #
+    # @!attribute [rw] message
+    #   A description of the error and how to resolve it.
+    #   @return [String]
+    #
+    # @!attribute [rw] resource_id
+    #   The ID of the resource that the error relates to, when applicable.
+    #   For example, for `DNS_FIREWALL_RULE_GROUP_UNAVAILABLE` this is the
+    #   Amazon Route 53 Resolver DNS Firewall rule group ID.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/FirewallPolicyError AWS API Documentation
+    #
+    class FirewallPolicyError < Struct.new(
+      :code,
+      :message,
+      :resource_id)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -4416,6 +4531,14 @@ module Aws::NetworkFirewall
     #   the firewall policy's name or ARN.
     #   @return [String]
     #
+    # @!attribute [rw] status_message
+    #   Additional detail about the firewall policy's current status, when
+    #   applicable. For example, while an Amazon Route 53 Resolver DNS
+    #   Firewall rule group change is in progress, the status is `UPDATING`
+    #   and this message is "A DNS Firewall rule group change is in
+    #   progress."
+    #   @return [String]
+    #
     # @!attribute [rw] tags
     #   The key:value pairs to associate with the resource.
     #   @return [Array<Types::Tag>]
@@ -4446,6 +4569,15 @@ module Aws::NetworkFirewall
     #   configuration settings for your firewall policy.
     #   @return [Types::EncryptionConfiguration]
     #
+    # @!attribute [rw] errors
+    #   Any configuration errors that apply to the firewall policy. Network
+    #   Firewall detects these errors asynchronously, after you create or
+    #   update the policy, so an error can appear after the request that
+    #   caused it has already succeeded. Each entry describes the problem
+    #   and how to resolve it, and Network Firewall clears it automatically
+    #   after you resolve the problem.
+    #   @return [Array<Types::FirewallPolicyError>]
+    #
     # @!attribute [rw] last_modified_time
     #   The last time that the firewall policy was changed.
     #   @return [Time]
@@ -4458,12 +4590,14 @@ module Aws::NetworkFirewall
       :firewall_policy_id,
       :description,
       :firewall_policy_status,
+      :status_message,
       :tags,
       :consumed_stateless_rule_capacity,
       :consumed_stateful_rule_capacity,
       :consumed_stateful_domain_capacity,
       :number_of_associations,
       :encryption_configuration,
+      :errors,
       :last_modified_time)
       SENSITIVE = []
       include Aws::Structure
@@ -5363,13 +5497,22 @@ module Aws::NetworkFirewall
     #   @return [Integer]
     #
     # @!attribute [rw] availability_zone
-    #   The ID of the Availability Zone where the firewall is located. For
+    #   The name of the Availability Zone where the firewall is located. For
     #   example, `us-east-2a`.
     #
     #   Defines the scope a flow operation. You can use up to 20 filters to
     #   configure a single flow operation.
     #   @return [String]
     #
+    # @!attribute [rw] availability_zone_id
+    #   The ID of the Availability Zone where the firewall is located. For
+    #   example, `use2-az1`. Availability Zone IDs are the same in every
+    #   Amazon Web Services account, so use this parameter when you
+    #   coordinate resources across accounts. Specify either
+    #   `AvailabilityZone` or `AvailabilityZoneId`, not both. If you specify
+    #   both, the request fails.
+    #   @return [String]
+    #
     # @!attribute [rw] vpc_endpoint_id
     #   A unique identifier for the primary endpoint associated with a
     #   firewall.
@@ -5387,6 +5530,7 @@ module Aws::NetworkFirewall
       :next_token,
       :max_results,
       :availability_zone,
+      :availability_zone_id,
       :vpc_endpoint_id,
       :vpc_endpoint_association_arn)
       SENSITIVE = []
@@ -5398,13 +5542,18 @@ module Aws::NetworkFirewall
     #   @return [String]
     #
     # @!attribute [rw] availability_zone
-    #   The ID of the Availability Zone where the firewall is located. For
+    #   The name of the Availability Zone where the firewall is located. For
     #   example, `us-east-2a`.
     #
     #   Defines the scope a flow operation. You can use up to 20 filters to
     #   configure a single flow operation.
     #   @return [String]
     #
+    # @!attribute [rw] availability_zone_id
+    #   The ID of the Availability Zone where the firewall is located. For
+    #   example, `use2-az1`.
+    #   @return [String]
+    #
     # @!attribute [rw] vpc_endpoint_association_arn
     #   @return [String]
     #
@@ -5456,6 +5605,7 @@ module Aws::NetworkFirewall
     class ListFlowOperationResultsResponse < Struct.new(
       :firewall_arn,
       :availability_zone,
+      :availability_zone_id,
       :vpc_endpoint_association_arn,
       :vpc_endpoint_id,
       :flow_operation_id,
@@ -5473,13 +5623,22 @@ module Aws::NetworkFirewall
     #   @return [String]
     #
     # @!attribute [rw] availability_zone
-    #   The ID of the Availability Zone where the firewall is located. For
+    #   The name of the Availability Zone where the firewall is located. For
     #   example, `us-east-2a`.
     #
     #   Defines the scope a flow operation. You can use up to 20 filters to
     #   configure a single flow operation.
     #   @return [String]
     #
+    # @!attribute [rw] availability_zone_id
+    #   The ID of the Availability Zone where the firewall is located. For
+    #   example, `use2-az1`. Availability Zone IDs are the same in every
+    #   Amazon Web Services account, so use this parameter when you
+    #   coordinate resources across accounts. Specify either
+    #   `AvailabilityZone` or `AvailabilityZoneId`, not both. If you specify
+    #   both, the request fails.
+    #   @return [String]
+    #
     # @!attribute [rw] vpc_endpoint_association_arn
     #   The Amazon Resource Name (ARN) of a VPC endpoint association.
     #   @return [String]
@@ -5514,6 +5673,7 @@ module Aws::NetworkFirewall
     class ListFlowOperationsRequest < Struct.new(
       :firewall_arn,
       :availability_zone,
+      :availability_zone_id,
       :vpc_endpoint_association_arn,
       :vpc_endpoint_id,
       :flow_operation_type,
@@ -6928,6 +7088,117 @@ module Aws::NetworkFirewall
       include Aws::Structure
     end
 
+    # The policy-level configuration for resolved IP validation. When you
+    # set this on a firewall policy, you require that the destination IP
+    # address of a connection is one that the Amazon Route 53 Resolver
+    # returned in a DNS response for a domain. The Route 53 Resolver must
+    # have returned the response in a VPC that's associated with the Route
+    # 53 Resolver DNS Firewall rule group identified by
+    # `DNSFirewallRuleGroupId`. At the policy level, this verifies that the
+    # destination IP address was resolved for some domain. To match specific
+    # domains, also configure stateful rule groups that use the
+    # `AWS_ROUTE_53_RESOLVED_DOMAIN` target type or the
+    # `aws_route_53_resolved_domain` rule keyword.
+    #
+    # @!attribute [rw] action
+    #   The action that Network Firewall takes for a connection whose
+    #   destination IP address fails resolved IP validation. A destination
+    #   IP address fails validation when the Route 53 Resolver didn't
+    #   return it in a DNS response in an associated VPC. Valid values are
+    #   the following:
+    #
+    #   * `ALERT` – Tags the matching connection in the firewall's flow
+    #     logs without blocking it, when you enable logging. Use this to
+    #     observe the effect of resolved IP validation before you enforce
+    #     it.
+    #
+    #   * `DROP` – Silently blocks the connection without sending any
+    #     response to the client.
+    #
+    #   * `REJECT` – Blocks the connection and sends a TCP reset (RST) to
+    #     the client. Because a TCP reset applies only to TCP connections,
+    #     Network Firewall drops non-TCP traffic instead of resetting it.
+    #   @return [String]
+    #
+    # @!attribute [rw] dns_firewall_rule_group_id
+    #   The ID of the Route 53 Resolver DNS Firewall rule group that
+    #   determines which VPCs' DNS resolutions count for resolved IP
+    #   validation. A destination IP address counts as resolved for a domain
+    #   only when the Route 53 Resolver returned it in a DNS response within
+    #   a VPC that's associated with this rule group. Associate the rule
+    #   group with the VPCs that send traffic to the firewall. The ID must
+    #   match the pattern `^rslvr-frg-[0-9a-f]+$`. It must also exist and be
+    #   accessible from your account. Network Firewall validates this when
+    #   you create or update the policy.
+    #
+    #   Changing this value swaps the managed rule group association.
+    #   Network Firewall processes the swap asynchronously. Each policy can
+    #   have only one managed Route 53 Resolver DNS Firewall association.
+    #   While a swap is in progress, Network Firewall rejects further
+    #   changes to this setting. Wait until the swap completes, then retry.
+    #   @return [String]
+    #
+    # @!attribute [rw] dns_expiry_exception_policy
+    #   The action that Network Firewall takes when the DNS resolution
+    #   recorded for a destination IP address has expired from the resolved
+    #   IP cache. This applies when Network Firewall still sees traffic to
+    #   that IP address after the expiry. Network Firewall keeps a
+    #   resolution for longer than the DNS record's time to live (TTL).
+    #   Valid values are the following:
+    #
+    #   * `CONTINUE` – Treats the expired resolution as still valid and
+    #     doesn't block the connection because of expiry.
+    #
+    #   * `DROP` – Silently blocks traffic to the IP address after its
+    #     resolution has expired, without sending any response to the
+    #     client.
+    #
+    #   * `REJECT` – Blocks traffic to the IP address after its resolution
+    #     has expired and sends a TCP reset (RST) to the client. Network
+    #     Firewall drops non-TCP traffic instead of resetting it.
+    #   @return [String]
+    #
+    # @!attribute [rw] bypass_destination_validation_ip_ranges
+    #   The destination IP address ranges that are exempt from the
+    #   policy-level resolved IP check. Network Firewall doesn't apply the
+    #   `Action` in this configuration to a connection whose destination
+    #   falls in these ranges, even if the Route 53 Resolver didn't return
+    #   that IP address in an associated VPC. Specify each entry as an IPv4
+    #   or IPv6 address or CIDR range, up to 100 entries.
+    #
+    #   This exemption applies only to the policy-level check. Stateful
+    #   rules that use the `AWS_ROUTE_53_RESOLVED_DOMAIN` target type or the
+    #   `aws_route_53_resolved_domain` keyword still evaluate connections to
+    #   these destinations and match them independently of this list.
+    #   @return [Array<Types::Address>]
+    #
+    # @!attribute [rw] source_ip_ranges
+    #   The client source IP address ranges whose connections are subject to
+    #   resolved IP validation. Specify each entry as an IPv4 or IPv6
+    #   address or CIDR range, up to 100 entries. If you omit this field,
+    #   resolved IP validation applies to the CIDR ranges of the firewall's
+    #   VPC and of any additional VPCs attached to the firewall. Specifying
+    #   an empty list is not the same as omitting the field: an empty list
+    #   means that Network Firewall doesn't validate any source addresses.
+    #
+    #   This scope applies to the policy-level check only. Stateful rules
+    #   that use the `AWS_ROUTE_53_RESOLVED_DOMAIN` target type or the
+    #   `aws_route_53_resolved_domain` keyword still evaluate their
+    #   destinations regardless of `SourceIPRanges`.
+    #   @return [Array<Types::Address>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/Route53ResolvedIPValidation AWS API Documentation
+    #
+    class Route53ResolvedIPValidation < Struct.new(
+      :action,
+      :dns_firewall_rule_group_id,
+      :dns_expiry_exception_policy,
+      :bypass_destination_validation_ip_ranges,
+      :source_ip_ranges)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # The inspection criteria and action for a single stateless rule.
     # Network Firewall inspects each packet for the specified matching
     # criteria. When a packet matches the criteria, Network Firewall
@@ -7210,7 +7481,7 @@ module Aws::NetworkFirewall
     #
     #
     #
-    #   [1]: https://suricata.readthedocs.io/en/suricata-7.0.8/rules/intro.html#rule-options
+    #   [1]: https://suricata.readthedocs.io/en/suricata-8.0.3/rules/intro.html#rule-options
     #   @return [String]
     #
     # @!attribute [rw] settings
@@ -7221,7 +7492,7 @@ module Aws::NetworkFirewall
     #
     #
     #
-    #   [1]: https://suricata.readthedocs.io/en/suricata-7.0.8/rules/intro.html#rule-options
+    #   [1]: https://suricata.readthedocs.io/en/suricata-8.0.3/rules/intro.html#rule-options
     #   @return [Array<String>]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/RuleOption AWS API Documentation
@@ -7319,7 +7590,7 @@ module Aws::NetworkFirewall
     #
     #
     #
-    #   [1]: https://suricata.readthedocs.io/en/suricata-7.0.8/rules/intro.html
+    #   [1]: https://suricata.readthedocs.io/en/suricata-8.0.3/rules/intro.html
     #   @return [Array<Types::StatefulRule>]
     #
     # @!attribute [rw] stateless_rules_and_custom_actions
@@ -7368,8 +7639,51 @@ module Aws::NetworkFirewall
     #   @return [Array<String>]
     #
     # @!attribute [rw] target_types
-    #   The protocols you want to inspect. Specify `TLS_SNI` for `HTTPS`.
-    #   Specify `HTTP_HOST` for `HTTP`. You can specify either or both.
+    #   The types of matching to perform against the domains in `Targets`.
+    #   You can specify any combination of the following:
+    #
+    #   * `AWS_ROUTE_53_RESOLVED_DOMAIN` – Match the domain against the
+    #     domain that the Amazon Route 53 Resolver resolved the
+    #     connection's destination IP address for.
+    #
+    #   * `HTTP_HOST` – Match the domain against the `Host` header of HTTP
+    #     traffic.
+    #
+    #   * `TLS_SNI` – Match the domain against the Server Name Indication
+    #     (SNI) of HTTPS traffic.
+    #
+    #   `AWS_ROUTE_53_RESOLVED_DOMAIN` matches on how the destination IP
+    #   address was resolved, rather than on the domain that the client
+    #   asserts in its TLS SNI or HTTP `Host` header. This target type takes
+    #   effect when you configure resolved IP validation on the firewall
+    #   policy. For more information, see Route53ResolvedIPValidation.
+    #
+    #   Whether you include `AWS_ROUTE_53_RESOLVED_DOMAIN` changes what the
+    #   generated rules match, together with `GeneratedRulesType`:
+    #
+    #   * Combining `AWS_ROUTE_53_RESOLVED_DOMAIN` with `TLS_SNI` or
+    #     `HTTP_HOST` in an `ALLOWLIST` requires both conditions to match.
+    #     The SNI or `Host` header must match the domain, **and** the Route
+    #     53 Resolver must have resolved the destination IP address for that
+    #     domain. Network Firewall allows traffic only in that case. Traffic
+    #     that matches one condition, such as a spoofed `Host` header sent
+    #     to an unresolved IP address, is not allowed.
+    #
+    #   * In a `DENYLIST`, or when `AWS_ROUTE_53_RESOLVED_DOMAIN` is the
+    #     only target type, Network Firewall evaluates each condition
+    #     independently: a match on either the domain (SNI or `Host`) or the
+    #     resolved destination IP address triggers the rule.
+    #
+    #   * When you don't include `AWS_ROUTE_53_RESOLVED_DOMAIN`, the
+    #     generated rules match only on the SNI or `Host` header, without
+    #     checking how the destination IP address was resolved.
+    #
+    #   An `ALLOWLIST` whose only target type is
+    #   `AWS_ROUTE_53_RESOLVED_DOMAIN` is additive: it allows matching
+    #   traffic but doesn't generate a default rule that drops non-matching
+    #   traffic. Only the `TLS_SNI` and `HTTP_HOST` target types generate
+    #   that default drop. To allow only the resolved domains and drop all
+    #   other traffic, include a protocol target type as well.
     #   @return [Array<String>]
     #
     # @!attribute [rw] generated_rules_type
@@ -7631,13 +7945,22 @@ module Aws::NetworkFirewall
     #   @return [String]
     #
     # @!attribute [rw] availability_zone
-    #   The ID of the Availability Zone where the firewall is located. For
+    #   The name of the Availability Zone where the firewall is located. For
     #   example, `us-east-2a`.
     #
     #   Defines the scope a flow operation. You can use up to 20 filters to
     #   configure a single flow operation.
     #   @return [String]
     #
+    # @!attribute [rw] availability_zone_id
+    #   The ID of the Availability Zone where the firewall is located. For
+    #   example, `use2-az1`. Availability Zone IDs are the same in every
+    #   Amazon Web Services account, so use this parameter when you
+    #   coordinate resources across accounts. Specify either
+    #   `AvailabilityZone` or `AvailabilityZoneId`, not both. If you specify
+    #   both, the request fails.
+    #   @return [String]
+    #
     # @!attribute [rw] vpc_endpoint_association_arn
     #   The Amazon Resource Name (ARN) of a VPC endpoint association.
     #   @return [String]
@@ -7668,6 +7991,7 @@ module Aws::NetworkFirewall
     class StartFlowCaptureRequest < Struct.new(
       :firewall_arn,
       :availability_zone,
+      :availability_zone_id,
       :vpc_endpoint_association_arn,
       :vpc_endpoint_id,
       :minimum_flow_age_in_seconds,
@@ -7710,13 +8034,22 @@ module Aws::NetworkFirewall
     #   @return [String]
     #
     # @!attribute [rw] availability_zone
-    #   The ID of the Availability Zone where the firewall is located. For
+    #   The name of the Availability Zone where the firewall is located. For
     #   example, `us-east-2a`.
     #
     #   Defines the scope a flow operation. You can use up to 20 filters to
     #   configure a single flow operation.
     #   @return [String]
     #
+    # @!attribute [rw] availability_zone_id
+    #   The ID of the Availability Zone where the firewall is located. For
+    #   example, `use2-az1`. Availability Zone IDs are the same in every
+    #   Amazon Web Services account, so use this parameter when you
+    #   coordinate resources across accounts. Specify either
+    #   `AvailabilityZone` or `AvailabilityZoneId`, not both. If you specify
+    #   both, the request fails.
+    #   @return [String]
+    #
     # @!attribute [rw] vpc_endpoint_association_arn
     #   The Amazon Resource Name (ARN) of a VPC endpoint association.
     #   @return [String]
@@ -7742,6 +8075,7 @@ module Aws::NetworkFirewall
     class StartFlowFlushRequest < Struct.new(
       :firewall_arn,
       :availability_zone,
+      :availability_zone_id,
       :vpc_endpoint_association_arn,
       :vpc_endpoint_id,
       :minimum_flow_age_in_seconds,
@@ -7858,7 +8192,7 @@ module Aws::NetworkFirewall
     #
     #
     #
-    # [1]: https://suricata.readthedocs.io/en/suricata-7.0.8/rules/intro.html
+    # [1]: https://suricata.readthedocs.io/en/suricata-8.0.3/rules/intro.html
     #
     # @!attribute [rw] action
     #   Defines what Network Firewall should do with the packets in a