resource "aws_networkfirewall_rule_group" "DC-D-NFW-HTTP-HTTPS-10K" { # checkov:skip=CKV_AWS_345:Ignoring during migration capacity = 10000 description = "HTTP & HTTPS ONLY" name = "DC-D-NFW-HTTP-HTTPS-10K" tags = {} tags_all = {} type = "STATEFUL" rule_group { rule_variables { ip_sets { key = "ALLOWIPLIST" ip_set { definition = [ # Salesforce "100.20.188.121/32", "100.21.44.184/32", "108.136.121.194/32", "108.137.36.238/32", "108.137.42.152/32", "108.137.53.145/32", "13.124.20.192/32", "13.127.212.138/32", "13.210.180.120/32", "13.213.133.240/32", "13.238.98.67/32", "13.250.175.171/32", "13.251.9.241/32", "13.37.59.29/32", "13.37.73.160/32", "13.48.236.205/32", "13.51.112.202/32", "13.54.228.64/32", "15.160.107.113/32", "15.160.6.137/32", "15.161.14.241/32", "15.161.144.48/32", "15.164.190.110/32", "15.188.21.129/32", "15.206.226.165/32", "15.207.181.18/32", "15.207.182.186/32", "15.236.110.244/32", "15.236.160.173/32", "141.163.192.0/23", "141.163.196.0/23", "141.163.200.0/23", "141.163.204.0/23", "141.163.208.0/23", "141.163.212.0/24", "145.224.192.0/24", "145.224.194.0/24", "145.224.196.0/24", "145.224.198.0/24", "145.224.200.0/23", "145.224.204.0/23", "145.224.208.0/23", "145.224.212.0/24", "155.226.128.0/21", "155.226.144.0/22", "155.226.152.0/23", "155.226.156.0/23", "155.226.188.0/23", "192.157.32.0/24", "52.10.56.17/32", "52.221.176.129/32", "52.36.20.11/32", "52.37.187.105/32", "52.40.154.108/32", "52.43.157.174/32", "52.44.156.44/32", "52.56.93.218/32", "52.63.169.21/32", "54.150.150.203/32", "54.178.4.244/32", "54.207.153.164/32", "54.212.118.222/32", "54.252.37.181/32", "54.254.118.123/32", "54.94.21.95/32", "54.95.206.252/32", "65.0.79.252/32", "99.79.13.33/32", "192.157.32.0/32", "192.157.32.1/32", "192.157.32.2/32", "192.157.32.3/32", "192.157.32.4/32", "192.157.32.5/32", "16.16.10.27/32", "16.16.16.155/32", "16.16.40.254/32", "16.170.78.147/32", "16.62.104.149/32", "16.62.175.66/32", "16.62.92.172/32", "16.62.98.163/32", "16.63.42.112/32", "16.63.42.251/32", "177.71.229.247/32", "18.102.110.146/32", "18.102.41.117/32", "18.135.239.15/32", "18.139.129.19/32", "18.158.141.208/32", "18.158.197.13/32", "18.169.180.159/32", "18.170.134.202/32", "18.170.168.128/32", "18.181.43.11/32", "18.192.191.54/32", "18.198.236.19/32", "18.204.28.162/32", "18.214.12.209/32", "18.228.207.180/32", "18.228.66.156/32", "18.230.128.139/32", "3.105.213.105/32", "3.123.211.78/32", "3.123.235.151/32", "3.123.86.102/32", "3.225.240.254/32", "3.28.171.97/32", "3.28.247.201/32", "3.29.0.188/32", "3.29.155.56/32", "3.29.179.89/32", "3.29.51.25/32", "3.38.222.219/32", "3.6.203.25/32", "3.64.188.82/32", "3.74.105.255/32", "3.74.204.24/32", "3.74.205.166/32", "3.97.226.192/32", "3.97.246.224/32", "3.98.2.135/32", "3.98.40.214/32", "3.98.8.160/32", "34.202.86.120/32", "34.204.111.166/32", "34.218.219.0/32", "35.157.191.28/32", "35.161.141.162/32", "35.179.35.178/32", "35.181.111.6/32", "35.73.6.227/32", "35.73.89.117/32", "35.80.213.208/32", "43.200.10.234/32", "43.200.62.239/32", "43.200.68.114/32", "43.218.34.15/32", "43.218.65.36/32", "44.225.207.136/32", "44.229.102.225/32", "44.233.69.21/32", "44.234.249.148/32", "44.235.94.100/32", "44.237.79.66/32", "44.241.73.113/32" ] } } } rules_source { rules_source_list { generated_rules_type = "ALLOWLIST" target_types = [ "HTTP_HOST", "TLS_SNI", ] targets = [ ".twistlock.com", ".alteryx.com", ".amazon.co.uk", ".amazon.com", ".amazon.dev", ".amazonaws.com", ".amazontrust.com", ".anaconda.org", ".api.crowdtangle.com", ".api.musicconnect.mrc-data.com", ".apple.com", ".applemarketingtools.com", ".auth0.com", ".automox.com", ".azurewebsites.net", ".bitly.com", ".bitnami.com", ".bootstrapcdn.com", ".box.com", ".boxcloud.com", ".bravesoftware.com", ".centricsoftware.com", ".chartmetric.com", ".chartretailer.com", ".collibra.dev", ".collibra.io", ".cookielaw.org", ".creatoriq.com", ".dbeaver.com", ".dbeaver.io", ".dbvis.com", ".deezer.com", ".demdex.net", ".doubleclick.net", ".duosecurity.com", ".egnyte.com", ".elastic.co", ".exportallextension.theinformationlab.io", ".facebook.com", ".fastly.net", ".fedorainfracloud.org", ".genius.com", ".geoapify.com", ".git.io", ".github.io", ".githubusercontent.com", ".google-analytics.com", ".google.com", ".googletagmanager.com", ".googleusercontent.com", ".gracenote.com", ".gserviceaccount.com", ".http-intake.logs.datadoghq.com", ".ibb.co", ".imgbb.com", ".gcr.io", ".datadoghq.com", ".fedoraproject.org", ".salesforce.com", ".github.com", ".ifconfig.io", ".mapbox.com", ".mathtag.com", ".maven.org", ".mcafee.com", ".microsoft.com", ".microsoftonline.com", ".mozilla.org", ".mrc-data.com", ".msftauth.net", ".musictrace.de", ".mysql.com", ".mzstatic.com", ".pypa.io", ".pypi.org", ".python.org", ".pythonhosted.org", ".rlcdn.com", ".0365weve.com", ".akadns.net", ".aws", ".azure.com", ".azure.net", ".azureedge.net", ".cloudapp.net", ".cloudappsecurity.com", ".digicert.com", ".gcr.io", ".github.io", ".githubusercontent.com", ".googleapis.com", ".gstatic.com", ".gvt1.com", ".live.com", ".mewwi.net", ".micorosftonline-p.com", ".microsoftazuread-sso.com", ".microsoftonline-p.com", ".microsoftonline-p.net", ".msappproxy.net", ".msauth.net", ".msftconnecttest.com", ".msftncsi.com", ".msocdn.com", ".nodesource.com", ".nsatc.net", ".observability.collibra.dev", ".onetrust.com", ".opencagedata.com", ".openstreetmap.org", ".otlp-http.observability.collibra.dev", ".pm2.io", ".popruntheworld.pl", ".qualys.com", ".radiomonitor.com", ".repository.collibra.io", ".office.com", ".office.net", ".onmicrosoft.com", ".outlookgroups.ms", ".phonefactor.net", ".postgresql.org", ".quay.io", ".s3browser.com", ".scdn.co", ".scuba.tools", ".sendgrid.com", ".sendgrid.net", ".sfx.ms", ".sharepoint.com", ".shazam.com", ".skype.com", ".sme-apps.com", ".smeanalyticsapps.com", ".smeanalyticsportal.com", ".smecde.com", ".smecloudops.com", ".smehost.net", ".smeperforce.com", ".snowflake.com", ".snowflakecomputing.com", ".smcdp-aws.net", ".smcdp-de.net", ".sonymusic-poc.collibra.com", ".sonymusic.com", ".splunk.com", ".spotify.com", ".spotifycharts.com", ".ss2.us", ".tableau.com", ".tableau.egnyte.com", ".tikapi.io", ".tiktok.com", ".use.typekit.net", ".vo.msecnd.net", ".windows.com", ".windowsazure.com", ".windowsupdate.com", ".windowsupdates.com", ".xcsdata.com", ".yahoo.com", ".youtube.com", "api.beatport.com", "cdn.knmi.nl", "cloudfront.net", "crash-artifacts-747369.s3.amazonaws.com", "dev.two-media.com", "docker.com", "download.redis.io", "gql.music.amazon.dev", "ldap-ngd.me.sonymusic.com", "raw.githubusercontent.com", "report-issue.tableau.com", "s3-us-west-2-w.amazonaws.com", "s3-w-a.us-west-2.amazonaws.com", "sonymusicentertainment.sharepoint.com", "soundcloud.com", "updates.bravesoftware.com", "youtube.googleapis.com", "youtubemusicanalytics.googleapis.com", "assets.onestore.ms", "auth.gfx.ms", "az826701.vo.msecnd.net", "mem.gfx.ms", ".trendmicro.com", ".npmjs.org", ".docker.io", ".ecr.aws", ".helm.sh", ".ubuntu.com", ".windows.net", ".sonatype.org" ] } } stateful_rule_options { rule_order = "DEFAULT_ACTION_ORDER" } } }