resource "aws_networkfirewall_rule_group" "grps-d3-nfw-http-https-extended" {
  # checkov:skip=CKV_AWS_345:Ensure Network Firewall rule group is stateful
  capacity    = 200
  description = "HTTP & HTTPS ONLY"
  name        = "GRPS-D3-NFW-HTTP-HTTPS-EXTENDED"
  rules       = null
  tags        = {}
  tags_all    = {}
  type        = "STATEFUL"
  rule_group {
    rules_source {
      rules_string = null
      rules_source_list {
        generated_rules_type = "ALLOWLIST"
        target_types         = ["HTTP_HOST", "TLS_SNI"]
        targets              = [".gracenote.com", ".deezer.com", ".musicbrainz.org"]
      }
    }
  }
}