resource "aws_networkfirewall_firewall" "DIGSYS-S3-NFW" {
  #checkov:skip=CKV_AWS_345: Ensure that Network firewall encryption is via a CMK
  #checkov:skip=CKV2_AWS_63: Ensure Network firewall has logging configuration defined
  delete_protection                 = true
  description                       = "DIGSYS-S3-NETWORK-FIREWALL"
  firewall_policy_arn               = "arn:aws:network-firewall:eu-central-1:718729873097:firewall-policy/DIGSYS-S3-NFW-HTTP-HTTPS"
  name                              = "DIGSYS-S3-NFW"
  firewall_policy_change_protection = "false"
  subnet_change_protection          = "true"
  vpc_id                            = aws_vpc.DIGSYS-S3.id
  subnet_mapping {
    ip_address_type = "IPV4"
    subnet_id       = aws_subnet.DIGSYS-S3-FNET-1A.id
  }
  tags = merge(var.tags, { Name = "DIGSYS-S3-NFW-EP" })
}

resource "aws_networkfirewall_logging_configuration" "DIGSYS-S3-NFW" {
  firewall_arn = "arn:aws:network-firewall:eu-central-1:718729873097:firewall/DIGSYS-S3-NFW"

  logging_configuration {
    log_destination_config {
      log_destination = {
        "bucketName" = "sme-core-cloud-compliance-nfw-logs-use1"
      }
      log_destination_type = "S3"
      log_type             = "ALERT"
    }
    log_destination_config {
      log_destination = {
        "bucketName" = "sme-core-cloud-compliance-nfw-logs-use1"
      }
      log_destination_type = "S3"
      log_type             = "FLOW"
    }
  }
}