resource "aws_networkfirewall_rule_group" "ROUGH-CUTS-D-NFW-HTTP-HTTPS-10K" {
  #checkov:skip=CKV_AWS_345: Ensure that Network firewall encryption is via a CMK
  capacity    = 10000
  description = "HTTP & HTTPS ONLY"
  name        = "ROUGH-CUTS-D-NFW-HTTP-HTTPS-10K"
  tags        = {}
  tags_all    = {}
  type        = "STATEFUL"

  rule_group {
    rules_source {
      rules_source_list {
        generated_rules_type = "ALLOWLIST"
        target_types = [
          "HTTP_HOST",
          "TLS_SNI",
        ]
        targets = [
          ".amazon.com",
          ".amazonaws.com",
          ".automox.com",
          ".datadoghq.com",
          ".fedoraproject.org",
          ".github.com",
          ".ifconfig.io",
          ".microsoft.com",
          ".microsoftonline.com",
          ".pypa.io",
          ".pypi.org",
          ".python.org",
          ".pythonhosted.org",
          ".qualys.com",
          ".smecloudops.com",
          ".smehost.net",
          ".smeperforce.com",
          ".sonymusic.com",
          ".trendmicro.com",
          ".twistlock.com",
          ".aws",
          ".smecde.com",
          ".smcdp-aws.net",
          ".smcdp-de.net",
          ".amazonlinux.com",
          ".centos.org",
        ]
      }
    }
    stateful_rule_options {
      rule_order = "DEFAULT_ACTION_ORDER"
    }
  }
}