resource "aws_networkfirewall_rule_group" "MSRV-P-NFW-HTTP-HTTPS" {
  #checkov:skip=CKV_AWS_345: Ensure that Network firewall encryption is via a CMK
  capacity    = 200
  description = "HTTP & HTTPS ONLY"
  name        = "MSRV-P-NFW-HTTP-HTTPS"
  tags        = {}
  tags_all    = {}
  type        = "STATEFUL"

  rule_group {

    rules_source {
      rules_source_list {
        generated_rules_type = "ALLOWLIST"
        target_types = [
          "HTTP_HOST",
          "TLS_SNI",
        ]
        targets = [
          ".amazon.com",
          ".amazonaws.com",
          ".automox.com",
          ".aws",
          ".cloudfront.net",
          ".datadoghq.com",
          ".docker.io",
          ".ecr.aws",
          ".fedoraproject.org",
          ".gcr.io",
          ".github.com",
          ".googleapis.com",
          ".ifconfig.io",
          ".k8s.io",
          ".microsoft.com",
          ".microsoftonline.com",
          ".pkg.dev",
          ".pypa.io",
          ".pypi.org",
          ".python.org",
          ".pythonhosted.org",
          ".qualys.com",
          ".quay.io",
          ".smcdp-aws.net",
          ".smecde.com",
          ".smecloudops.com",
          ".smehost.net",
          ".smeperforce.com",
          ".sonymusic.com",
          ".trendmicro.com",
          ".twistlock.com",
        ]
      }
    }
  }
}