resource "aws_networkfirewall_firewall_policy" "ROUGH-CUTS-D-NFW-HTTP-HTTPS" {
  #checkov:skip=CKV_AWS_346: Ensure Network Firewall Policy defines an encryption configuration that uses a customer managed Key (CMK)
  description = "HTTP & HTTPS ONLY"
  name        = "ROUGH-CUTS-D-NFW-HTTP-HTTPS"
  tags        = {}
  tags_all    = {}

  firewall_policy {
    stateful_default_actions = []
    stateless_default_actions = [
      "aws:forward_to_sfe",
    ]
    stateless_fragment_default_actions = [
      "aws:pass",
    ]

    stateful_rule_group_reference {
      resource_arn = "arn:aws:network-firewall:eu-central-1:662302927201:stateful-rulegroup/ROUGH-CUTS-D-NFW-HTTP-HTTPS-10K"
    }
  }
}