resource "aws_networkfirewall_firewall" "DC-P-NFW" {
  # checkov:skip=CKV_AWS_345:Ignoring during migration
  # checkov:skip=CKV2_AWS_63:Ignoring during migration
  delete_protection                 = true
  description                       = "DC-P-NETWORK-FIREWALL"
  firewall_policy_arn               = "arn:aws:network-firewall:us-east-1:280383026186:firewall-policy/DC-P-NFW-HTTP-HTTPS"
  name                              = "DC-P-NFW"
  firewall_policy_change_protection = "false"
  subnet_change_protection          = "true"
  vpc_id                            = aws_vpc.DC-P.id
  subnet_mapping {
    ip_address_type = "IPV4"
    subnet_id       = aws_subnet.DC-P-FNET-1A.id
  }
  tags = merge(var.tags, { Name = "DC-P-NFW-EP" })
}

resource "aws_networkfirewall_logging_configuration" "DC-P-NFW" {
  firewall_arn = "arn:aws:network-firewall:us-east-1:280383026186:firewall/DC-P-NFW"

  logging_configuration {
    log_destination_config {
      log_destination = {
        "bucketName" = "sme-core-cloud-compliance-nfw-logs-use1"
      }
      log_destination_type = "S3"
      log_type             = "ALERT"
    }
    log_destination_config {
      log_destination = {
        "bucketName" = "sme-core-cloud-compliance-nfw-logs-use1"
      }
      log_destination_type = "S3"
      log_type             = "FLOW"
    }
  }
}