resource "aws_networkfirewall_firewall" "MSRV-P-NFW" {
  #checkov:skip=CKV2_AWS_63: Ensure Network firewall has logging configuration defined
  #checkov:skip=CKV_AWS_345: Ensure that Network firewall encryption is via a CMK
  delete_protection                 = true
  description                       = "MSRV-P-NETWORK-FIREWALL"
  firewall_policy_arn               = "arn:aws:network-firewall:us-east-1:361463692799:firewall-policy/MSRV-P-NFW-HTTP-HTTPS"
  name                              = "MSRV-P-NFW"
  firewall_policy_change_protection = "false"
  subnet_change_protection          = "true"
  vpc_id                            = "vpc-40fb5427"
  subnet_mapping {
    ip_address_type = "IPV4"
    subnet_id       = "subnet-09ae2668160f5e249"
  }
}

resource "aws_networkfirewall_logging_configuration" "MSRV-P-NFW" {
  firewall_arn = "arn:aws:network-firewall:us-east-1:361463692799:firewall/MSRV-P-NFW"

  logging_configuration {
    log_destination_config {
      log_destination = {
        "bucketName" = "sme-core-cloud-compliance-nfw-logs-use1"
      }
      log_destination_type = "S3"
      log_type             = "ALERT"
    }
    log_destination_config {
      log_destination = {
        "bucketName" = "sme-core-cloud-compliance-nfw-logs-use1"
      }
      log_destination_type = "S3"
      log_type             = "FLOW"
    }
  }
}