aws-sdk-networkfirewall 1.95.0 → 1.96.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e49743c64ce3f821f44464693c085ae86d078983edc7a7f6fff41380bca43f8a
-  data.tar.gz: 5a74a381f489461473bb6e7e2edb5049592ef9c1d632da1fe15c69ff40c10794
+  metadata.gz: 4a3e3dc1475e3dd6dc7504f48c2e7f4cb4d2e899a319c7b556e907c7243e7eb3
+  data.tar.gz: 3747273908aebabe39680fa07904a7cf275701bfb7adf1eec77113c8f5d0165b
 SHA512:
-  metadata.gz: bb18a57f675717b97dffb189a47648616e174416041cf5349ef269972a82dcf57a93eeacf435b8b0a65cd977bc1c3c2d77eb0867e0c76d178e5b5ba86303ad95
-  data.tar.gz: df180bc6465716ce039593c897f80e50b2b454ff37c021870475ab0c4942389e14717d589574d60aacd735a92d7786ebd3d8b1a73ed3a185b5668936f9590b4c
+  metadata.gz: 5f4a2fc8291f604f4815a5769d2410529d822b6613aa44c3f2a14ea882c9bb7fe1c8533c9c471980a41108e691b85ef14f31906a1f1cfef41b7db207a49b1012
+  data.tar.gz: 4014485ba584d5d0daa9b0aac624baec46c535ea8006160ceae357ffd1f121cfd1c9cbda51cb2e47a99af3ec91315d82ff19994c48d3c26f85dc14dc034b12ac

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.96.0 (2026-08-03)
+------------------
+
+* Feature - This launch allows customers to use Network Firewall as an explicit Proxy and protect their workloads against threat of data exfiltration.
+
 1.95.0 (2026-07-31)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.95.0
+1.96.0

data/lib/aws-sdk-networkfirewall/client.rb

@@ -1057,6 +1057,40 @@ module Aws::NetworkFirewall
     #
     #   Default value: `FALSE`
     #
+    # @option params [Array<Types::NatGatewayMapping>] :nat_gateway_mappings
+    #   The NAT gateways that the firewall uses to proxy traffic when
+    #   `NoSourcePreservation` is `TRUE`. Network Firewall attaches the
+    #   firewall to each NAT gateway that you specify, so that egress traffic
+    #   is proxied through the NAT gateway.
+    #
+    # @option params [Types::ProxySettings] :proxy_settings
+    #   The listener configuration for a proxy mode firewall, used when
+    #   `NoSourcePreservation` is `TRUE`. This specifies the ports and
+    #   protocols on which the firewall's proxy listens for traffic.
+    #
+    # @option params [Boolean] :no_source_preservation
+    #   Optional. Indicates whether the firewall operates in proxy mode, in
+    #   which the source IP address of the traffic is not preserved. When set
+    #   to `TRUE`, the firewall proxies traffic through a NAT gateway and the
+    #   traffic reaching the destination uses the NAT gateway's IP address as
+    #   the source.
+    #
+    #   When you set this to `TRUE`, you must specify `NatGatewayMappings` and
+    #   `VpcEndpoint` instead of a top-level `VpcId` and `SubnetMappings`.
+    #
+    #   You can't change this setting after you create the firewall.
+    #
+    #   Default value: `FALSE`
+    #
+    # @option params [Types::VpcEndpoint] :vpc_endpoint
+    #   The VPC and subnets for the firewall endpoint, used when
+    #   `NoSourcePreservation` is `TRUE`. Network Firewall creates the
+    #   firewall endpoint in the subnets that you specify here.
+    #
+    #   For proxy mode firewalls, provide the firewall's VPC and endpoint
+    #   subnets through this parameter instead of the top-level `VpcId` and
+    #   `SubnetMappings`.
+    #
     # @return [Types::CreateFirewallResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
     #   * {Types::CreateFirewallResponse#firewall #firewall} => Types::Firewall
@@ -1096,6 +1130,29 @@ module Aws::NetworkFirewall
     #       },
     #     ],
     #     availability_zone_change_protection: false,
+    #     nat_gateway_mappings: [
+    #       {
+    #         nat_gateway_id: "NatGatewayId", # required
+    #       },
+    #     ],
+    #     proxy_settings: {
+    #       listener_properties: [ # required
+    #         {
+    #           port: 1,
+    #           type: "HTTP", # accepts HTTP, HTTPS
+    #         },
+    #       ],
+    #     },
+    #     no_source_preservation: false,
+    #     vpc_endpoint: {
+    #       vpc_id: "VpcId", # required
+    #       subnet_mappings: [ # required
+    #         {
+    #           subnet_id: "CollectionMember_String", # required
+    #           ip_address_type: "DUALSTACK", # accepts DUALSTACK, IPV4, IPV6
+    #         },
+    #       ],
+    #     },
     #   })
     #
     # @example Response structure
@@ -1125,6 +1182,16 @@ module Aws::NetworkFirewall
     #   resp.firewall.availability_zone_mappings #=> Array
     #   resp.firewall.availability_zone_mappings[0].availability_zone #=> String
     #   resp.firewall.availability_zone_change_protection #=> Boolean
+    #   resp.firewall.nat_gateway_mappings #=> Array
+    #   resp.firewall.nat_gateway_mappings[0].nat_gateway_id #=> String
+    #   resp.firewall.proxy_settings.listener_properties #=> Array
+    #   resp.firewall.proxy_settings.listener_properties[0].port #=> Integer
+    #   resp.firewall.proxy_settings.listener_properties[0].type #=> String, one of "HTTP", "HTTPS"
+    #   resp.firewall.no_source_preservation #=> Boolean
+    #   resp.firewall.vpc_endpoint.vpc_id #=> String
+    #   resp.firewall.vpc_endpoint.subnet_mappings #=> Array
+    #   resp.firewall.vpc_endpoint.subnet_mappings[0].subnet_id #=> String
+    #   resp.firewall.vpc_endpoint.subnet_mappings[0].ip_address_type #=> String, one of "DUALSTACK", "IPV4", "IPV6"
     #   resp.firewall_status.status #=> String, one of "PROVISIONING", "DELETING", "READY"
     #   resp.firewall_status.configuration_sync_state_summary #=> String, one of "PENDING", "IN_SYNC", "CAPACITY_CONSTRAINED"
     #   resp.firewall_status.sync_states #=> Hash
@@ -1132,9 +1199,15 @@ module Aws::NetworkFirewall
     #   resp.firewall_status.sync_states["AvailabilityZone"].attachment.endpoint_id #=> String
     #   resp.firewall_status.sync_states["AvailabilityZone"].attachment.status #=> String, one of "CREATING", "DELETING", "FAILED", "ERROR", "SCALING", "READY"
     #   resp.firewall_status.sync_states["AvailabilityZone"].attachment.status_message #=> String
+    #   resp.firewall_status.sync_states["AvailabilityZone"].attachment.dns_name #=> String
     #   resp.firewall_status.sync_states["AvailabilityZone"].config #=> Hash
     #   resp.firewall_status.sync_states["AvailabilityZone"].config["ResourceName"].sync_status #=> String, one of "PENDING", "IN_SYNC", "CAPACITY_CONSTRAINED", "NOT_SUBSCRIBED", "DEPRECATED"
     #   resp.firewall_status.sync_states["AvailabilityZone"].config["ResourceName"].update_token #=> String
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments #=> Array
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments[0].nat_gateway_id #=> String
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments[0].status #=> String, one of "CREATING", "READY", "UPDATING", "FAILED", "DELETING"
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments[0].status_message #=> String
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments[0].dns_name #=> String
     #   resp.firewall_status.capacity_usage_summary.cid_rs.available_cidr_count #=> Integer
     #   resp.firewall_status.capacity_usage_summary.cid_rs.utilized_cidr_count #=> Integer
     #   resp.firewall_status.capacity_usage_summary.cid_rs.ip_set_references #=> Hash
@@ -2315,6 +2388,7 @@ module Aws::NetworkFirewall
     #   resp.vpc_endpoint_association_status.association_sync_state["AvailabilityZone"].attachment.endpoint_id #=> String
     #   resp.vpc_endpoint_association_status.association_sync_state["AvailabilityZone"].attachment.status #=> String, one of "CREATING", "DELETING", "FAILED", "ERROR", "SCALING", "READY"
     #   resp.vpc_endpoint_association_status.association_sync_state["AvailabilityZone"].attachment.status_message #=> String
+    #   resp.vpc_endpoint_association_status.association_sync_state["AvailabilityZone"].attachment.dns_name #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/CreateVpcEndpointAssociation AWS API Documentation
     #
@@ -2434,6 +2508,16 @@ module Aws::NetworkFirewall
     #   resp.firewall.availability_zone_mappings #=> Array
     #   resp.firewall.availability_zone_mappings[0].availability_zone #=> String
     #   resp.firewall.availability_zone_change_protection #=> Boolean
+    #   resp.firewall.nat_gateway_mappings #=> Array
+    #   resp.firewall.nat_gateway_mappings[0].nat_gateway_id #=> String
+    #   resp.firewall.proxy_settings.listener_properties #=> Array
+    #   resp.firewall.proxy_settings.listener_properties[0].port #=> Integer
+    #   resp.firewall.proxy_settings.listener_properties[0].type #=> String, one of "HTTP", "HTTPS"
+    #   resp.firewall.no_source_preservation #=> Boolean
+    #   resp.firewall.vpc_endpoint.vpc_id #=> String
+    #   resp.firewall.vpc_endpoint.subnet_mappings #=> Array
+    #   resp.firewall.vpc_endpoint.subnet_mappings[0].subnet_id #=> String
+    #   resp.firewall.vpc_endpoint.subnet_mappings[0].ip_address_type #=> String, one of "DUALSTACK", "IPV4", "IPV6"
     #   resp.firewall_status.status #=> String, one of "PROVISIONING", "DELETING", "READY"
     #   resp.firewall_status.configuration_sync_state_summary #=> String, one of "PENDING", "IN_SYNC", "CAPACITY_CONSTRAINED"
     #   resp.firewall_status.sync_states #=> Hash
@@ -2441,9 +2525,15 @@ module Aws::NetworkFirewall
     #   resp.firewall_status.sync_states["AvailabilityZone"].attachment.endpoint_id #=> String
     #   resp.firewall_status.sync_states["AvailabilityZone"].attachment.status #=> String, one of "CREATING", "DELETING", "FAILED", "ERROR", "SCALING", "READY"
     #   resp.firewall_status.sync_states["AvailabilityZone"].attachment.status_message #=> String
+    #   resp.firewall_status.sync_states["AvailabilityZone"].attachment.dns_name #=> String
     #   resp.firewall_status.sync_states["AvailabilityZone"].config #=> Hash
     #   resp.firewall_status.sync_states["AvailabilityZone"].config["ResourceName"].sync_status #=> String, one of "PENDING", "IN_SYNC", "CAPACITY_CONSTRAINED", "NOT_SUBSCRIBED", "DEPRECATED"
     #   resp.firewall_status.sync_states["AvailabilityZone"].config["ResourceName"].update_token #=> String
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments #=> Array
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments[0].nat_gateway_id #=> String
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments[0].status #=> String, one of "CREATING", "READY", "UPDATING", "FAILED", "DELETING"
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments[0].status_message #=> String
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments[0].dns_name #=> String
     #   resp.firewall_status.capacity_usage_summary.cid_rs.available_cidr_count #=> Integer
     #   resp.firewall_status.capacity_usage_summary.cid_rs.utilized_cidr_count #=> Integer
     #   resp.firewall_status.capacity_usage_summary.cid_rs.ip_set_references #=> Hash
@@ -2948,6 +3038,7 @@ module Aws::NetworkFirewall
     #   resp.vpc_endpoint_association_status.association_sync_state["AvailabilityZone"].attachment.endpoint_id #=> String
     #   resp.vpc_endpoint_association_status.association_sync_state["AvailabilityZone"].attachment.status #=> String, one of "CREATING", "DELETING", "FAILED", "ERROR", "SCALING", "READY"
     #   resp.vpc_endpoint_association_status.association_sync_state["AvailabilityZone"].attachment.status_message #=> String
+    #   resp.vpc_endpoint_association_status.association_sync_state["AvailabilityZone"].attachment.dns_name #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/DeleteVpcEndpointAssociation AWS API Documentation
     #
@@ -3072,6 +3163,16 @@ module Aws::NetworkFirewall
     #   resp.firewall.availability_zone_mappings #=> Array
     #   resp.firewall.availability_zone_mappings[0].availability_zone #=> String
     #   resp.firewall.availability_zone_change_protection #=> Boolean
+    #   resp.firewall.nat_gateway_mappings #=> Array
+    #   resp.firewall.nat_gateway_mappings[0].nat_gateway_id #=> String
+    #   resp.firewall.proxy_settings.listener_properties #=> Array
+    #   resp.firewall.proxy_settings.listener_properties[0].port #=> Integer
+    #   resp.firewall.proxy_settings.listener_properties[0].type #=> String, one of "HTTP", "HTTPS"
+    #   resp.firewall.no_source_preservation #=> Boolean
+    #   resp.firewall.vpc_endpoint.vpc_id #=> String
+    #   resp.firewall.vpc_endpoint.subnet_mappings #=> Array
+    #   resp.firewall.vpc_endpoint.subnet_mappings[0].subnet_id #=> String
+    #   resp.firewall.vpc_endpoint.subnet_mappings[0].ip_address_type #=> String, one of "DUALSTACK", "IPV4", "IPV6"
     #   resp.firewall_status.status #=> String, one of "PROVISIONING", "DELETING", "READY"
     #   resp.firewall_status.configuration_sync_state_summary #=> String, one of "PENDING", "IN_SYNC", "CAPACITY_CONSTRAINED"
     #   resp.firewall_status.sync_states #=> Hash
@@ -3079,9 +3180,15 @@ module Aws::NetworkFirewall
     #   resp.firewall_status.sync_states["AvailabilityZone"].attachment.endpoint_id #=> String
     #   resp.firewall_status.sync_states["AvailabilityZone"].attachment.status #=> String, one of "CREATING", "DELETING", "FAILED", "ERROR", "SCALING", "READY"
     #   resp.firewall_status.sync_states["AvailabilityZone"].attachment.status_message #=> String
+    #   resp.firewall_status.sync_states["AvailabilityZone"].attachment.dns_name #=> String
     #   resp.firewall_status.sync_states["AvailabilityZone"].config #=> Hash
     #   resp.firewall_status.sync_states["AvailabilityZone"].config["ResourceName"].sync_status #=> String, one of "PENDING", "IN_SYNC", "CAPACITY_CONSTRAINED", "NOT_SUBSCRIBED", "DEPRECATED"
     #   resp.firewall_status.sync_states["AvailabilityZone"].config["ResourceName"].update_token #=> String
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments #=> Array
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments[0].nat_gateway_id #=> String
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments[0].status #=> String, one of "CREATING", "READY", "UPDATING", "FAILED", "DELETING"
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments[0].status_message #=> String
+    #   resp.firewall_status.sync_states["AvailabilityZone"].nat_gateway_attachments[0].dns_name #=> String
     #   resp.firewall_status.capacity_usage_summary.cid_rs.available_cidr_count #=> Integer
     #   resp.firewall_status.capacity_usage_summary.cid_rs.utilized_cidr_count #=> Integer
     #   resp.firewall_status.capacity_usage_summary.cid_rs.ip_set_references #=> Hash
@@ -3989,6 +4096,7 @@ module Aws::NetworkFirewall
     #   resp.vpc_endpoint_association_status.association_sync_state["AvailabilityZone"].attachment.endpoint_id #=> String
     #   resp.vpc_endpoint_association_status.association_sync_state["AvailabilityZone"].attachment.status #=> String, one of "CREATING", "DELETING", "FAILED", "ERROR", "SCALING", "READY"
     #   resp.vpc_endpoint_association_status.association_sync_state["AvailabilityZone"].attachment.status_message #=> String
+    #   resp.vpc_endpoint_association_status.association_sync_state["AvailabilityZone"].attachment.dns_name #=> String
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/DescribeVpcEndpointAssociation AWS API Documentation
     #
@@ -6752,6 +6860,87 @@ module Aws::NetworkFirewall
       req.send_request(options)
     end
 
+    # Modifies the proxy listener configuration of a proxy mode firewall.
+    # Proxy mode firewalls are created with `NoSourcePreservation` set to
+    # `TRUE`. Use this operation to change the ports and protocols on which
+    # the firewall's proxy listens for traffic.
+    #
+    # @option params [String] :firewall_arn
+    #   The Amazon Resource Name (ARN) of the firewall.
+    #
+    #   You must specify the ARN or the name, and you can specify both.
+    #
+    # @option params [String] :firewall_name
+    #   The descriptive name of the firewall. You can't change the name of a
+    #   firewall after you create it.
+    #
+    #   You must specify the ARN or the name, and you can specify both.
+    #
+    # @option params [String] :update_token
+    #   An optional token that you can use for optimistic locking. Network
+    #   Firewall returns a token to your requests that access the firewall.
+    #   The token marks the state of the firewall resource at the time of the
+    #   request.
+    #
+    #   To make an unconditional change to the firewall, omit the token in
+    #   your update request. Without the token, Network Firewall performs your
+    #   updates regardless of whether the firewall has changed since you last
+    #   retrieved it.
+    #
+    #   To make a conditional change to the firewall, provide the token in
+    #   your update request. Network Firewall uses the token to ensure that
+    #   the firewall hasn't changed since you last retrieved it. If it has
+    #   changed, the operation fails with an `InvalidTokenException`. If this
+    #   happens, retrieve the firewall again to get a current copy of it with
+    #   a new token. Reapply your changes as needed, then try the operation
+    #   again using the new token.
+    #
+    # @option params [Types::ProxySettings] :proxy_settings
+    #   The proxy listener configuration to set on the firewall. This
+    #   specifies the ports and protocols on which the firewall's proxy
+    #   listens for traffic.
+    #
+    # @return [Types::UpdateProxySettingsResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::UpdateProxySettingsResponse#firewall_arn #firewall_arn} => String
+    #   * {Types::UpdateProxySettingsResponse#firewall_name #firewall_name} => String
+    #   * {Types::UpdateProxySettingsResponse#update_token #update_token} => String
+    #   * {Types::UpdateProxySettingsResponse#proxy_settings #proxy_settings} => Types::ProxySettings
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.update_proxy_settings({
+    #     firewall_arn: "ResourceArn",
+    #     firewall_name: "ResourceName",
+    #     update_token: "UpdateToken",
+    #     proxy_settings: {
+    #       listener_properties: [ # required
+    #         {
+    #           port: 1,
+    #           type: "HTTP", # accepts HTTP, HTTPS
+    #         },
+    #       ],
+    #     },
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.firewall_arn #=> String
+    #   resp.firewall_name #=> String
+    #   resp.update_token #=> String
+    #   resp.proxy_settings.listener_properties #=> Array
+    #   resp.proxy_settings.listener_properties[0].port #=> Integer
+    #   resp.proxy_settings.listener_properties[0].type #=> String, one of "HTTP", "HTTPS"
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/UpdateProxySettings AWS API Documentation
+    #
+    # @overload update_proxy_settings(params = {})
+    # @param [Hash] params ({})
+    def update_proxy_settings(params = {}, options = {})
+      req = build_request(:update_proxy_settings, params)
+      req.send_request(options)
+    end
+
     # Updates the rule settings for the specified rule group. You use a rule
     # group by reference in one or more firewall policies. When you modify a
     # rule group, you modify all firewall policies that use the rule group.
@@ -7275,7 +7464,7 @@ module Aws::NetworkFirewall
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-networkfirewall'
-      context[:gem_version] = '1.95.0'
+      context[:gem_version] = '1.96.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-networkfirewall/client_api.rb

@@ -170,6 +170,7 @@ module Aws::NetworkFirewall
     DisassociateAvailabilityZonesResponse = Shapes::StructureShape.new(name: 'DisassociateAvailabilityZonesResponse')
     DisassociateSubnetsRequest = Shapes::StructureShape.new(name: 'DisassociateSubnetsRequest')
     DisassociateSubnetsResponse = Shapes::StructureShape.new(name: 'DisassociateSubnetsResponse')
+    DnsName = Shapes::StringShape.new(name: 'DnsName')
     Domain = Shapes::StringShape.new(name: 'Domain')
     EnableMonitoringDashboard = Shapes::BooleanShape.new(name: 'EnableMonitoringDashboard')
     EnableTLSSessionHolding = Shapes::BooleanShape.new(name: 'EnableTLSSessionHolding')
@@ -274,7 +275,12 @@ module Aws::NetworkFirewall
     LogType = Shapes::StringShape.new(name: 'LogType')
     LoggingConfiguration = Shapes::StructureShape.new(name: 'LoggingConfiguration')
     MatchAttributes = Shapes::StructureShape.new(name: 'MatchAttributes')
+    NatGatewayAttachment = Shapes::StructureShape.new(name: 'NatGatewayAttachment')
+    NatGatewayAttachmentStatus = Shapes::StringShape.new(name: 'NatGatewayAttachmentStatus')
+    NatGatewayAttachmentsList = Shapes::ListShape.new(name: 'NatGatewayAttachmentsList')
     NatGatewayId = Shapes::StringShape.new(name: 'NatGatewayId')
+    NatGatewayMapping = Shapes::StructureShape.new(name: 'NatGatewayMapping')
+    NatGatewayMappingsList = Shapes::ListShape.new(name: 'NatGatewayMappingsList')
     NatGatewayPort = Shapes::IntegerShape.new(name: 'NatGatewayPort')
     NumberOfAssociations = Shapes::IntegerShape.new(name: 'NumberOfAssociations')
     OverrideAction = Shapes::StringShape.new(name: 'OverrideAction')
@@ -330,6 +336,7 @@ module Aws::NetworkFirewall
     ProxyRulePriority = Shapes::StructureShape.new(name: 'ProxyRulePriority')
     ProxyRulePriorityList = Shapes::ListShape.new(name: 'ProxyRulePriorityList')
     ProxyRulesByRequestPhase = Shapes::StructureShape.new(name: 'ProxyRulesByRequestPhase')
+    ProxySettings = Shapes::StructureShape.new(name: 'ProxySettings')
     ProxyState = Shapes::StringShape.new(name: 'ProxyState')
     PublishMetricAction = Shapes::StructureShape.new(name: 'PublishMetricAction')
     PutResourcePolicyRequest = Shapes::StructureShape.new(name: 'PutResourcePolicyRequest')
@@ -478,6 +485,8 @@ module Aws::NetworkFirewall
     UpdateProxyRulePrioritiesResponse = Shapes::StructureShape.new(name: 'UpdateProxyRulePrioritiesResponse')
     UpdateProxyRuleRequest = Shapes::StructureShape.new(name: 'UpdateProxyRuleRequest')
     UpdateProxyRuleResponse = Shapes::StructureShape.new(name: 'UpdateProxyRuleResponse')
+    UpdateProxySettingsRequest = Shapes::StructureShape.new(name: 'UpdateProxySettingsRequest')
+    UpdateProxySettingsResponse = Shapes::StructureShape.new(name: 'UpdateProxySettingsResponse')
     UpdateRuleGroupRequest = Shapes::StructureShape.new(name: 'UpdateRuleGroupRequest')
     UpdateRuleGroupResponse = Shapes::StructureShape.new(name: 'UpdateRuleGroupResponse')
     UpdateSubnetChangeProtectionRequest = Shapes::StructureShape.new(name: 'UpdateSubnetChangeProtectionRequest')
@@ -489,6 +498,7 @@ module Aws::NetworkFirewall
     VariableDefinition = Shapes::StringShape.new(name: 'VariableDefinition')
     VariableDefinitionList = Shapes::ListShape.new(name: 'VariableDefinitionList')
     VendorName = Shapes::StringShape.new(name: 'VendorName')
+    VpcEndpoint = Shapes::StructureShape.new(name: 'VpcEndpoint')
     VpcEndpointAssociation = Shapes::StructureShape.new(name: 'VpcEndpointAssociation')
     VpcEndpointAssociationMetadata = Shapes::StructureShape.new(name: 'VpcEndpointAssociationMetadata')
     VpcEndpointAssociationStatus = Shapes::StructureShape.new(name: 'VpcEndpointAssociationStatus')
@@ -594,6 +604,7 @@ module Aws::NetworkFirewall
     Attachment.add_member(:endpoint_id, Shapes::ShapeRef.new(shape: EndpointId, location_name: "EndpointId"))
     Attachment.add_member(:status, Shapes::ShapeRef.new(shape: AttachmentStatus, location_name: "Status"))
     Attachment.add_member(:status_message, Shapes::ShapeRef.new(shape: StatusMessage, location_name: "StatusMessage"))
+    Attachment.add_member(:dns_name, Shapes::ShapeRef.new(shape: DnsName, location_name: "DnsName"))
     Attachment.struct_class = Types::Attachment
 
     AvailabilityZoneMapping.add_member(:availability_zone, Shapes::ShapeRef.new(shape: AvailabilityZoneMappingString, required: true, location_name: "AvailabilityZone"))
@@ -681,6 +692,10 @@ module Aws::NetworkFirewall
     CreateFirewallRequest.add_member(:transit_gateway_id, Shapes::ShapeRef.new(shape: TransitGatewayId, location_name: "TransitGatewayId"))
     CreateFirewallRequest.add_member(:availability_zone_mappings, Shapes::ShapeRef.new(shape: AvailabilityZoneMappings, location_name: "AvailabilityZoneMappings"))
     CreateFirewallRequest.add_member(:availability_zone_change_protection, Shapes::ShapeRef.new(shape: Boolean, location_name: "AvailabilityZoneChangeProtection"))
+    CreateFirewallRequest.add_member(:nat_gateway_mappings, Shapes::ShapeRef.new(shape: NatGatewayMappingsList, location_name: "NatGatewayMappings"))
+    CreateFirewallRequest.add_member(:proxy_settings, Shapes::ShapeRef.new(shape: ProxySettings, location_name: "ProxySettings"))
+    CreateFirewallRequest.add_member(:no_source_preservation, Shapes::ShapeRef.new(shape: Boolean, location_name: "NoSourcePreservation"))
+    CreateFirewallRequest.add_member(:vpc_endpoint, Shapes::ShapeRef.new(shape: VpcEndpoint, location_name: "VpcEndpoint"))
     CreateFirewallRequest.struct_class = Types::CreateFirewallRequest
 
     CreateFirewallResponse.add_member(:firewall, Shapes::ShapeRef.new(shape: Firewall, location_name: "Firewall"))
@@ -1132,6 +1147,10 @@ module Aws::NetworkFirewall
     Firewall.add_member(:transit_gateway_owner_account_id, Shapes::ShapeRef.new(shape: AWSAccountId, location_name: "TransitGatewayOwnerAccountId"))
     Firewall.add_member(:availability_zone_mappings, Shapes::ShapeRef.new(shape: AvailabilityZoneMappings, location_name: "AvailabilityZoneMappings"))
     Firewall.add_member(:availability_zone_change_protection, Shapes::ShapeRef.new(shape: Boolean, location_name: "AvailabilityZoneChangeProtection"))
+    Firewall.add_member(:nat_gateway_mappings, Shapes::ShapeRef.new(shape: NatGatewayMappingsList, location_name: "NatGatewayMappings"))
+    Firewall.add_member(:proxy_settings, Shapes::ShapeRef.new(shape: ProxySettings, location_name: "ProxySettings"))
+    Firewall.add_member(:no_source_preservation, Shapes::ShapeRef.new(shape: Boolean, location_name: "NoSourcePreservation"))
+    Firewall.add_member(:vpc_endpoint, Shapes::ShapeRef.new(shape: VpcEndpoint, location_name: "VpcEndpoint"))
     Firewall.struct_class = Types::Firewall
 
     FirewallMetadata.add_member(:firewall_name, Shapes::ShapeRef.new(shape: ResourceName, location_name: "FirewallName"))
@@ -1451,6 +1470,19 @@ module Aws::NetworkFirewall
     MatchAttributes.add_member(:tcp_flags, Shapes::ShapeRef.new(shape: TCPFlags, location_name: "TCPFlags"))
     MatchAttributes.struct_class = Types::MatchAttributes
 
+    NatGatewayAttachment.add_member(:nat_gateway_id, Shapes::ShapeRef.new(shape: NatGatewayId, required: true, location_name: "NatGatewayId"))
+    NatGatewayAttachment.add_member(:status, Shapes::ShapeRef.new(shape: NatGatewayAttachmentStatus, required: true, location_name: "Status"))
+    NatGatewayAttachment.add_member(:status_message, Shapes::ShapeRef.new(shape: StatusReason, location_name: "StatusMessage"))
+    NatGatewayAttachment.add_member(:dns_name, Shapes::ShapeRef.new(shape: DnsName, location_name: "DnsName"))
+    NatGatewayAttachment.struct_class = Types::NatGatewayAttachment
+
+    NatGatewayAttachmentsList.member = Shapes::ShapeRef.new(shape: NatGatewayAttachment)
+
+    NatGatewayMapping.add_member(:nat_gateway_id, Shapes::ShapeRef.new(shape: NatGatewayId, required: true, location_name: "NatGatewayId"))
+    NatGatewayMapping.struct_class = Types::NatGatewayMapping
+
+    NatGatewayMappingsList.member = Shapes::ShapeRef.new(shape: NatGatewayMapping)
+
     PerObjectStatus.add_member(:sync_status, Shapes::ShapeRef.new(shape: PerObjectSyncStatus, location_name: "SyncStatus"))
     PerObjectStatus.add_member(:update_token, Shapes::ShapeRef.new(shape: UpdateToken, location_name: "UpdateToken"))
     PerObjectStatus.struct_class = Types::PerObjectStatus
@@ -1587,6 +1619,9 @@ module Aws::NetworkFirewall
     ProxyRulesByRequestPhase.add_member(:post_response, Shapes::ShapeRef.new(shape: ProxyRuleList, location_name: "PostRESPONSE"))
     ProxyRulesByRequestPhase.struct_class = Types::ProxyRulesByRequestPhase
 
+    ProxySettings.add_member(:listener_properties, Shapes::ShapeRef.new(shape: ListenerProperties, required: true, location_name: "ListenerProperties"))
+    ProxySettings.struct_class = Types::ProxySettings
+
     PublishMetricAction.add_member(:dimensions, Shapes::ShapeRef.new(shape: Dimensions, required: true, location_name: "Dimensions"))
     PublishMetricAction.struct_class = Types::PublishMetricAction
 
@@ -1810,6 +1845,7 @@ module Aws::NetworkFirewall
 
     SyncState.add_member(:attachment, Shapes::ShapeRef.new(shape: Attachment, location_name: "Attachment"))
     SyncState.add_member(:config, Shapes::ShapeRef.new(shape: SyncStateConfig, location_name: "Config"))
+    SyncState.add_member(:nat_gateway_attachments, Shapes::ShapeRef.new(shape: NatGatewayAttachmentsList, location_name: "NatGatewayAttachments"))
     SyncState.struct_class = Types::SyncState
 
     SyncStateConfig.key = Shapes::ShapeRef.new(shape: ResourceName)
@@ -2074,6 +2110,18 @@ module Aws::NetworkFirewall
     UpdateProxyRuleResponse.add_member(:update_token, Shapes::ShapeRef.new(shape: UpdateToken, location_name: "UpdateToken"))
     UpdateProxyRuleResponse.struct_class = Types::UpdateProxyRuleResponse
 
+    UpdateProxySettingsRequest.add_member(:firewall_arn, Shapes::ShapeRef.new(shape: ResourceArn, location_name: "FirewallArn"))
+    UpdateProxySettingsRequest.add_member(:firewall_name, Shapes::ShapeRef.new(shape: ResourceName, location_name: "FirewallName"))
+    UpdateProxySettingsRequest.add_member(:update_token, Shapes::ShapeRef.new(shape: UpdateToken, location_name: "UpdateToken"))
+    UpdateProxySettingsRequest.add_member(:proxy_settings, Shapes::ShapeRef.new(shape: ProxySettings, location_name: "ProxySettings"))
+    UpdateProxySettingsRequest.struct_class = Types::UpdateProxySettingsRequest
+
+    UpdateProxySettingsResponse.add_member(:firewall_arn, Shapes::ShapeRef.new(shape: ResourceArn, location_name: "FirewallArn"))
+    UpdateProxySettingsResponse.add_member(:firewall_name, Shapes::ShapeRef.new(shape: ResourceName, location_name: "FirewallName"))
+    UpdateProxySettingsResponse.add_member(:update_token, Shapes::ShapeRef.new(shape: UpdateToken, location_name: "UpdateToken"))
+    UpdateProxySettingsResponse.add_member(:proxy_settings, Shapes::ShapeRef.new(shape: ProxySettings, location_name: "ProxySettings"))
+    UpdateProxySettingsResponse.struct_class = Types::UpdateProxySettingsResponse
+
     UpdateRuleGroupRequest.add_member(:update_token, Shapes::ShapeRef.new(shape: UpdateToken, required: true, location_name: "UpdateToken"))
     UpdateRuleGroupRequest.add_member(:rule_group_arn, Shapes::ShapeRef.new(shape: ResourceArn, location_name: "RuleGroupArn"))
     UpdateRuleGroupRequest.add_member(:rule_group_name, Shapes::ShapeRef.new(shape: ResourceName, location_name: "RuleGroupName"))
@@ -2118,6 +2166,10 @@ module Aws::NetworkFirewall
 
     VariableDefinitionList.member = Shapes::ShapeRef.new(shape: VariableDefinition)
 
+    VpcEndpoint.add_member(:vpc_id, Shapes::ShapeRef.new(shape: VpcId, required: true, location_name: "VpcId"))
+    VpcEndpoint.add_member(:subnet_mappings, Shapes::ShapeRef.new(shape: SubnetMappings, required: true, location_name: "SubnetMappings"))
+    VpcEndpoint.struct_class = Types::VpcEndpoint
+
     VpcEndpointAssociation.add_member(:vpc_endpoint_association_id, Shapes::ShapeRef.new(shape: ResourceId, location_name: "VpcEndpointAssociationId"))
     VpcEndpointAssociation.add_member(:vpc_endpoint_association_arn, Shapes::ShapeRef.new(shape: ResourceArn, required: true, location_name: "VpcEndpointAssociationArn"))
     VpcEndpointAssociation.add_member(:firewall_arn, Shapes::ShapeRef.new(shape: ResourceArn, required: true, location_name: "FirewallArn"))
@@ -3259,6 +3311,21 @@ module Aws::NetworkFirewall
         o.errors << Shapes::ShapeRef.new(shape: ThrottlingException)
       end)
 
+      api.add_operation(:update_proxy_settings, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "UpdateProxySettings"
+        o.http_method = "POST"
+        o.http_request_uri = "/"
+        o.input = Shapes::ShapeRef.new(shape: UpdateProxySettingsRequest)
+        o.output = Shapes::ShapeRef.new(shape: UpdateProxySettingsResponse)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidRequestException)
+        o.errors << Shapes::ShapeRef.new(shape: InternalServerError)
+        o.errors << Shapes::ShapeRef.new(shape: ResourceNotFoundException)
+        o.errors << Shapes::ShapeRef.new(shape: ResourceOwnerCheckException)
+        o.errors << Shapes::ShapeRef.new(shape: ThrottlingException)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidTokenException)
+        o.errors << Shapes::ShapeRef.new(shape: InvalidOperationException)
+      end)
+
       api.add_operation(:update_rule_group, Seahorse::Model::Operation.new.tap do |o|
         o.name = "UpdateRuleGroup"
         o.http_method = "POST"

data/lib/aws-sdk-networkfirewall/types.rb

@@ -708,13 +708,20 @@ module Aws::NetworkFirewall
     #   [1]: https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-troubleshooting-endpoint-failures.html
     #   @return [String]
     #
+    # @!attribute [rw] dns_name
+    #   The DNS name that resolves to the firewall endpoint in the subnet.
+    #   This is populated for proxy mode firewalls, where clients direct
+    #   traffic to the firewall's proxy using this name.
+    #   @return [String]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/Attachment AWS API Documentation
     #
     class Attachment < Struct.new(
       :subnet_id,
       :endpoint_id,
       :status,
-      :status_message)
+      :status_message,
+      :dns_name)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -1212,6 +1219,45 @@ module Aws::NetworkFirewall
     #   Default value: `FALSE`
     #   @return [Boolean]
     #
+    # @!attribute [rw] nat_gateway_mappings
+    #   The NAT gateways that the firewall uses to proxy traffic when
+    #   `NoSourcePreservation` is `TRUE`. Network Firewall attaches the
+    #   firewall to each NAT gateway that you specify, so that egress
+    #   traffic is proxied through the NAT gateway.
+    #   @return [Array<Types::NatGatewayMapping>]
+    #
+    # @!attribute [rw] proxy_settings
+    #   The listener configuration for a proxy mode firewall, used when
+    #   `NoSourcePreservation` is `TRUE`. This specifies the ports and
+    #   protocols on which the firewall's proxy listens for traffic.
+    #   @return [Types::ProxySettings]
+    #
+    # @!attribute [rw] no_source_preservation
+    #   Optional. Indicates whether the firewall operates in proxy mode, in
+    #   which the source IP address of the traffic is not preserved. When
+    #   set to `TRUE`, the firewall proxies traffic through a NAT gateway
+    #   and the traffic reaching the destination uses the NAT gateway's IP
+    #   address as the source.
+    #
+    #   When you set this to `TRUE`, you must specify `NatGatewayMappings`
+    #   and `VpcEndpoint` instead of a top-level `VpcId` and
+    #   `SubnetMappings`.
+    #
+    #   You can't change this setting after you create the firewall.
+    #
+    #   Default value: `FALSE`
+    #   @return [Boolean]
+    #
+    # @!attribute [rw] vpc_endpoint
+    #   The VPC and subnets for the firewall endpoint, used when
+    #   `NoSourcePreservation` is `TRUE`. Network Firewall creates the
+    #   firewall endpoint in the subnets that you specify here.
+    #
+    #   For proxy mode firewalls, provide the firewall's VPC and endpoint
+    #   subnets through this parameter instead of the top-level `VpcId` and
+    #   `SubnetMappings`.
+    #   @return [Types::VpcEndpoint]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/CreateFirewallRequest AWS API Documentation
     #
     class CreateFirewallRequest < Struct.new(
@@ -1228,7 +1274,11 @@ module Aws::NetworkFirewall
       :enabled_analysis_types,
       :transit_gateway_id,
       :availability_zone_mappings,
-      :availability_zone_change_protection)
+      :availability_zone_change_protection,
+      :nat_gateway_mappings,
+      :proxy_settings,
+      :no_source_preservation,
+      :vpc_endpoint)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -4099,6 +4149,30 @@ module Aws::NetworkFirewall
     #   Availability Zones.
     #   @return [Boolean]
     #
+    # @!attribute [rw] nat_gateway_mappings
+    #   The NAT gateways that the firewall uses to proxy traffic. This is
+    #   set for proxy mode firewalls, where `NoSourcePreservation` is
+    #   `TRUE`.
+    #   @return [Array<Types::NatGatewayMapping>]
+    #
+    # @!attribute [rw] proxy_settings
+    #   The listener configuration for the firewall's proxy. This is set
+    #   for proxy mode firewalls, where `NoSourcePreservation` is `TRUE`.
+    #   @return [Types::ProxySettings]
+    #
+    # @!attribute [rw] no_source_preservation
+    #   Indicates whether the firewall operates in proxy mode, in which the
+    #   source IP address of the traffic is not preserved. When this value
+    #   is `TRUE`, the firewall proxies traffic through a NAT gateway and
+    #   uses the NAT gateway's IP address as the source for traffic
+    #   reaching the destination.
+    #   @return [Boolean]
+    #
+    # @!attribute [rw] vpc_endpoint
+    #   The VPC and subnets for the firewall endpoint. This is set for proxy
+    #   mode firewalls, where `NoSourcePreservation` is `TRUE`.
+    #   @return [Types::VpcEndpoint]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/Firewall AWS API Documentation
     #
     class Firewall < Struct.new(
@@ -4119,7 +4193,11 @@ module Aws::NetworkFirewall
       :transit_gateway_id,
       :transit_gateway_owner_account_id,
       :availability_zone_mappings,
-      :availability_zone_change_protection)
+      :availability_zone_change_protection,
+      :nat_gateway_mappings,
+      :proxy_settings,
+      :no_source_preservation,
+      :vpc_endpoint)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -6044,6 +6122,57 @@ module Aws::NetworkFirewall
       include Aws::Structure
     end
 
+    # The definition and status of the attachment between a proxy mode
+    # firewall and a NAT gateway that proxies its traffic.
+    #
+    # @!attribute [rw] nat_gateway_id
+    #   A unique identifier for the NAT gateway to use with proxy resources.
+    #   @return [String]
+    #
+    # @!attribute [rw] status
+    #   The current status of the NAT gateway attachment.
+    #
+    #   When this value is `READY`, the attachment is available to proxy
+    #   traffic. Otherwise, this value reflects its state, for example
+    #   `CREATING` or `DELETING`.
+    #   @return [String]
+    #
+    # @!attribute [rw] status_message
+    #   If Network Firewall encounters an issue with the NAT gateway
+    #   attachment, it populates this with an explanation of the problem.
+    #   @return [String]
+    #
+    # @!attribute [rw] dns_name
+    #   The DNS name that resolves to the firewall's proxy for traffic sent
+    #   through this NAT gateway attachment.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/NatGatewayAttachment AWS API Documentation
+    #
+    class NatGatewayAttachment < Struct.new(
+      :nat_gateway_id,
+      :status,
+      :status_message,
+      :dns_name)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # A NAT gateway that a proxy mode firewall uses to proxy traffic. This
+    # is used in CreateFirewall when `NoSourcePreservation` is `TRUE`.
+    #
+    # @!attribute [rw] nat_gateway_id
+    #   A unique identifier for the NAT gateway to use with proxy resources.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/NatGatewayMapping AWS API Documentation
+    #
+    class NatGatewayMapping < Struct.new(
+      :nat_gateway_id)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Provides configuration status for a single policy or rule group that
     # is used for a firewall endpoint. Network Firewall provides each
     # endpoint with the rules that are configured in the firewall policy.
@@ -6614,6 +6743,22 @@ module Aws::NetworkFirewall
       include Aws::Structure
     end
 
+    # The listener configuration for a proxy mode firewall. This specifies
+    # the ports and protocols on which the firewall's proxy listens for
+    # traffic.
+    #
+    # @!attribute [rw] listener_properties
+    #   Listener properties for HTTP and HTTPS traffic.
+    #   @return [Array<Types::ListenerProperty>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/ProxySettings AWS API Documentation
+    #
+    class ProxySettings < Struct.new(
+      :listener_properties)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # Stateless inspection criteria that publishes the specified metrics to
     # Amazon CloudWatch for the matching packet. This setting defines a
     # CloudWatch dimension value to be published.
@@ -8052,11 +8197,18 @@ module Aws::NetworkFirewall
     #   traffic.
     #   @return [Hash<String,Types::PerObjectStatus>]
     #
+    # @!attribute [rw] nat_gateway_attachments
+    #   The status of the NAT gateway attachments for a proxy mode firewall
+    #   in the Availability Zone. This reflects the attachment of the
+    #   firewall to each NAT gateway that proxies its traffic.
+    #   @return [Array<Types::NatGatewayAttachment>]
+    #
     # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/SyncState AWS API Documentation
     #
     class SyncState < Struct.new(
       :attachment,
-      :config)
+      :config,
+      :nat_gateway_attachments)
       SENSITIVE = []
       include Aws::Structure
     end
@@ -9837,6 +9989,100 @@ module Aws::NetworkFirewall
       include Aws::Structure
     end
 
+    # @!attribute [rw] firewall_arn
+    #   The Amazon Resource Name (ARN) of the firewall.
+    #
+    #   You must specify the ARN or the name, and you can specify both.
+    #   @return [String]
+    #
+    # @!attribute [rw] firewall_name
+    #   The descriptive name of the firewall. You can't change the name of
+    #   a firewall after you create it.
+    #
+    #   You must specify the ARN or the name, and you can specify both.
+    #   @return [String]
+    #
+    # @!attribute [rw] update_token
+    #   An optional token that you can use for optimistic locking. Network
+    #   Firewall returns a token to your requests that access the firewall.
+    #   The token marks the state of the firewall resource at the time of
+    #   the request.
+    #
+    #   To make an unconditional change to the firewall, omit the token in
+    #   your update request. Without the token, Network Firewall performs
+    #   your updates regardless of whether the firewall has changed since
+    #   you last retrieved it.
+    #
+    #   To make a conditional change to the firewall, provide the token in
+    #   your update request. Network Firewall uses the token to ensure that
+    #   the firewall hasn't changed since you last retrieved it. If it has
+    #   changed, the operation fails with an `InvalidTokenException`. If
+    #   this happens, retrieve the firewall again to get a current copy of
+    #   it with a new token. Reapply your changes as needed, then try the
+    #   operation again using the new token.
+    #   @return [String]
+    #
+    # @!attribute [rw] proxy_settings
+    #   The proxy listener configuration to set on the firewall. This
+    #   specifies the ports and protocols on which the firewall's proxy
+    #   listens for traffic.
+    #   @return [Types::ProxySettings]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/UpdateProxySettingsRequest AWS API Documentation
+    #
+    class UpdateProxySettingsRequest < Struct.new(
+      :firewall_arn,
+      :firewall_name,
+      :update_token,
+      :proxy_settings)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] firewall_arn
+    #   The Amazon Resource Name (ARN) of the firewall.
+    #   @return [String]
+    #
+    # @!attribute [rw] firewall_name
+    #   The descriptive name of the firewall. You can't change the name of
+    #   a firewall after you create it.
+    #   @return [String]
+    #
+    # @!attribute [rw] update_token
+    #   An optional token that you can use for optimistic locking. Network
+    #   Firewall returns a token to your requests that access the firewall.
+    #   The token marks the state of the firewall resource at the time of
+    #   the request.
+    #
+    #   To make an unconditional change to the firewall, omit the token in
+    #   your update request. Without the token, Network Firewall performs
+    #   your updates regardless of whether the firewall has changed since
+    #   you last retrieved it.
+    #
+    #   To make a conditional change to the firewall, provide the token in
+    #   your update request. Network Firewall uses the token to ensure that
+    #   the firewall hasn't changed since you last retrieved it. If it has
+    #   changed, the operation fails with an `InvalidTokenException`. If
+    #   this happens, retrieve the firewall again to get a current copy of
+    #   it with a new token. Reapply your changes as needed, then try the
+    #   operation again using the new token.
+    #   @return [String]
+    #
+    # @!attribute [rw] proxy_settings
+    #   The updated proxy listener configuration on the firewall.
+    #   @return [Types::ProxySettings]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/UpdateProxySettingsResponse AWS API Documentation
+    #
+    class UpdateProxySettingsResponse < Struct.new(
+      :firewall_arn,
+      :firewall_name,
+      :update_token,
+      :proxy_settings)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # @!attribute [rw] update_token
     #   A token used for optimistic locking. Network Firewall returns a
     #   token to your requests that access the rule group. The token marks
@@ -10198,6 +10444,33 @@ module Aws::NetworkFirewall
       include Aws::Structure
     end
 
+    # The VPC and subnets for a proxy mode firewall endpoint. This is used
+    # in CreateFirewall when `NoSourcePreservation` is `TRUE`, to specify
+    # where Network Firewall creates the firewall endpoint.
+    #
+    # This differs from VpcEndpointAssociation, which defines additional
+    # secondary endpoints for a firewall in other VPCs.
+    #
+    # @!attribute [rw] vpc_id
+    #   The unique identifier of the VPC where Network Firewall creates the
+    #   proxy mode firewall endpoint.
+    #   @return [String]
+    #
+    # @!attribute [rw] subnet_mappings
+    #   The subnets in which Network Firewall creates the firewall endpoint
+    #   for a proxy mode firewall. Each subnet must belong to a different
+    #   Availability Zone in the VPC.
+    #   @return [Array<Types::SubnetMapping>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/network-firewall-2020-11-12/VpcEndpoint AWS API Documentation
+    #
+    class VpcEndpoint < Struct.new(
+      :vpc_id,
+      :subnet_mappings)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # A VPC endpoint association defines a single subnet to use for a
     # firewall endpoint for a `Firewall`. You can define VPC endpoint
     # associations only in the Availability Zones that already have a subnet

data/lib/aws-sdk-networkfirewall.rb

@@ -54,7 +54,7 @@ module Aws::NetworkFirewall
   autoload :EndpointProvider, 'aws-sdk-networkfirewall/endpoint_provider'
   autoload :Endpoints, 'aws-sdk-networkfirewall/endpoints'
 
-  GEM_VERSION = '1.95.0'
+  GEM_VERSION = '1.96.0'
 
 end
 

data/sig/client.rbs

@@ -239,7 +239,30 @@ module Aws
                                  availability_zone: ::String
                                }
                              ],
-                             ?availability_zone_change_protection: bool
+                             ?availability_zone_change_protection: bool,
+                             ?nat_gateway_mappings: Array[
+                               {
+                                 nat_gateway_id: ::String
+                               }
+                             ],
+                             ?proxy_settings: {
+                               listener_properties: Array[
+                                 {
+                                   port: ::Integer?,
+                                   type: ("HTTP" | "HTTPS")?
+                                 }
+                               ]
+                             },
+                             ?no_source_preservation: bool,
+                             ?vpc_endpoint: {
+                               vpc_id: ::String,
+                               subnet_mappings: Array[
+                                 {
+                                   subnet_id: ::String,
+                                   ip_address_type: ("DUALSTACK" | "IPV4" | "IPV6")?
+                                 }
+                               ]
+                             }
                            ) -> _CreateFirewallResponseSuccess
                          | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _CreateFirewallResponseSuccess
 
@@ -1477,6 +1500,29 @@ module Aws
                                         ) -> _UpdateProxyRulePrioritiesResponseSuccess
                                       | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _UpdateProxyRulePrioritiesResponseSuccess
 
+      interface _UpdateProxySettingsResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::UpdateProxySettingsResponse]
+        def firewall_arn: () -> ::String
+        def firewall_name: () -> ::String
+        def update_token: () -> ::String
+        def proxy_settings: () -> Types::ProxySettings
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/NetworkFirewall/Client.html#update_proxy_settings-instance_method
+      def update_proxy_settings: (
+                                   ?firewall_arn: ::String,
+                                   ?firewall_name: ::String,
+                                   ?update_token: ::String,
+                                   ?proxy_settings: {
+                                     listener_properties: Array[
+                                       {
+                                         port: ::Integer?,
+                                         type: ("HTTP" | "HTTPS")?
+                                       }
+                                     ]
+                                   }
+                                 ) -> _UpdateProxySettingsResponseSuccess
+                               | (?Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _UpdateProxySettingsResponseSuccess
+
       interface _UpdateRuleGroupResponseSuccess
         include ::Seahorse::Client::_ResponseSuccess[Types::UpdateRuleGroupResponse]
         def update_token: () -> ::String

data/sig/types.rbs

@@ -126,6 +126,7 @@ module Aws::NetworkFirewall
       attr_accessor endpoint_id: ::String
       attr_accessor status: ("CREATING" | "DELETING" | "FAILED" | "ERROR" | "SCALING" | "READY")
       attr_accessor status_message: ::String
+      attr_accessor dns_name: ::String
       SENSITIVE: []
     end
 
@@ -227,6 +228,10 @@ module Aws::NetworkFirewall
       attr_accessor transit_gateway_id: ::String
       attr_accessor availability_zone_mappings: ::Array[Types::AvailabilityZoneMapping]
       attr_accessor availability_zone_change_protection: bool
+      attr_accessor nat_gateway_mappings: ::Array[Types::NatGatewayMapping]
+      attr_accessor proxy_settings: Types::ProxySettings
+      attr_accessor no_source_preservation: bool
+      attr_accessor vpc_endpoint: Types::VpcEndpoint
       SENSITIVE: []
     end
 
@@ -837,6 +842,10 @@ module Aws::NetworkFirewall
       attr_accessor transit_gateway_owner_account_id: ::String
       attr_accessor availability_zone_mappings: ::Array[Types::AvailabilityZoneMapping]
       attr_accessor availability_zone_change_protection: bool
+      attr_accessor nat_gateway_mappings: ::Array[Types::NatGatewayMapping]
+      attr_accessor proxy_settings: Types::ProxySettings
+      attr_accessor no_source_preservation: bool
+      attr_accessor vpc_endpoint: Types::VpcEndpoint
       SENSITIVE: []
     end
 
@@ -1239,6 +1248,19 @@ module Aws::NetworkFirewall
       SENSITIVE: []
     end
 
+    class NatGatewayAttachment
+      attr_accessor nat_gateway_id: ::String
+      attr_accessor status: ("CREATING" | "READY" | "UPDATING" | "FAILED" | "DELETING")
+      attr_accessor status_message: ::String
+      attr_accessor dns_name: ::String
+      SENSITIVE: []
+    end
+
+    class NatGatewayMapping
+      attr_accessor nat_gateway_id: ::String
+      SENSITIVE: []
+    end
+
     class PerObjectStatus
       attr_accessor sync_status: ("PENDING" | "IN_SYNC" | "CAPACITY_CONSTRAINED" | "NOT_SUBSCRIBED" | "DEPRECATED")
       attr_accessor update_token: ::String
@@ -1382,6 +1404,11 @@ module Aws::NetworkFirewall
       SENSITIVE: []
     end
 
+    class ProxySettings
+      attr_accessor listener_properties: ::Array[Types::ListenerProperty]
+      SENSITIVE: []
+    end
+
     class PublishMetricAction
       attr_accessor dimensions: ::Array[Types::Dimension]
       SENSITIVE: []
@@ -1640,6 +1667,7 @@ module Aws::NetworkFirewall
     class SyncState
       attr_accessor attachment: Types::Attachment
       attr_accessor config: ::Hash[::String, Types::PerObjectStatus]
+      attr_accessor nat_gateway_attachments: ::Array[Types::NatGatewayAttachment]
       SENSITIVE: []
     end
 
@@ -1975,6 +2003,22 @@ module Aws::NetworkFirewall
       SENSITIVE: []
     end
 
+    class UpdateProxySettingsRequest
+      attr_accessor firewall_arn: ::String
+      attr_accessor firewall_name: ::String
+      attr_accessor update_token: ::String
+      attr_accessor proxy_settings: Types::ProxySettings
+      SENSITIVE: []
+    end
+
+    class UpdateProxySettingsResponse
+      attr_accessor firewall_arn: ::String
+      attr_accessor firewall_name: ::String
+      attr_accessor update_token: ::String
+      attr_accessor proxy_settings: Types::ProxySettings
+      SENSITIVE: []
+    end
+
     class UpdateRuleGroupRequest
       attr_accessor update_token: ::String
       attr_accessor rule_group_arn: ::String
@@ -2029,6 +2073,12 @@ module Aws::NetworkFirewall
       SENSITIVE: []
     end
 
+    class VpcEndpoint
+      attr_accessor vpc_id: ::String
+      attr_accessor subnet_mappings: ::Array[Types::SubnetMapping]
+      SENSITIVE: []
+    end
+
     class VpcEndpointAssociation
       attr_accessor vpc_endpoint_association_id: ::String
       attr_accessor vpc_endpoint_association_arn: ::String

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-networkfirewall
 version: !ruby/object:Gem::Version
-  version: 1.95.0
+  version: 1.96.0
 platform: ruby
 authors:
 - Amazon Web Services