resource "aws_networkfirewall_rule_group" "MSRV-D2-NFW-HTTP-HTTPS" {
  #checkov:skip=CKV_AWS_345: Ensure that Network firewall encryption is via a CMK
  capacity    = 100
  description = "HTTP ^ HTTPS ONLY"
  name        = "MSRV-D2-NFW-HTTP-HTTPS"
  tags        = {}
  tags_all    = {}
  type        = "STATEFUL"

  rule_group {

    rules_source {
      rules_source_list {
        generated_rules_type = "ALLOWLIST"
        target_types = [
          "HTTP_HOST",
          "TLS_SNI",
        ]
        targets = [
          ".google.com",
          ".amazon.com",
          ".amazonaws.com",
          ".automox.com",
          ".aws",
          ".cloudfront.net",
          ".datadoghq.com",
          ".docker.io",
          ".ecr.aws",
          ".fedoraproject.org",
          ".gcr.io",
          ".googleapis.com",
          ".ifconfig.io",
          ".k8s.io",
          ".pkg.dev",
          ".microsoft.com",
          ".microsoftonline.com",
          ".pypa.io",
          ".pypi.org",
          ".python.org",
          ".pythonhosted.org",
          ".qualys.com",
          ".quay.io",
          ".smcdp-aws.net",
          ".smecde.com",
          ".smecloudops.com",
          ".smehost.net",
          ".smeperforce.com",
          ".sonymusic.com",
          ".trendmicro.com",
          ".twistlock.com",
          ".github.com",
          ".githubusercontent.com",
          ".amazonlinux.com",
          ".apache.org",
          ".bintray.com",
          ".gradle.org",
          ".helm.sh",
          ".spring.io",
          ".corretto.aws",
          ".fedorapeople.org",
          ".ghcr.io",
          ".githubapp.com",
          ".windows.net",
        ]
      }
    }
  }
}