resource "aws_networkfirewall_firewall" "ROUGH-CUTS-D-NFW" {
  #checkov:skip=CKV2_AWS_63: Ensure Network firewall has logging configuration defined
  #checkov:skip=CKV_AWS_345: Ensure that Network firewall encryption is via a CMK
  delete_protection                 = true
  description                       = "ROUGH-CUTS-D-NETWORK-FIREWALL"
  firewall_policy_arn               = "arn:aws:network-firewall:eu-central-1:662302927201:firewall-policy/ROUGH-CUTS-D-NFW-HTTP-HTTPS"
  name                              = "ROUGH-CUTS-D-NFW"
  firewall_policy_change_protection = "false"
  subnet_change_protection          = "true"
  vpc_id                            = aws_vpc.ROUGH-CUTS-D.id
  subnet_mapping {
    ip_address_type = "IPV4"
    subnet_id       = aws_subnet.ROUGH-CUTS-D-FNET-1A.id
  }
  tags                                 = merge(var.tags, { Name = "ROUGH-CUTS-D-NFW-EP" })
}

resource "aws_networkfirewall_logging_configuration" "ROUGH-CUTS-D-NFW" {
  firewall_arn = "arn:aws:network-firewall:eu-central-1:662302927201:firewall/ROUGH-CUTS-D-NFW"

  logging_configuration {
    log_destination_config {
      log_destination = {
        "bucketName" = "sme-core-cloud-compliance-nfw-logs-use1"
      }
      log_destination_type = "S3"
      log_type             = "ALERT"
    }
    log_destination_config {
      log_destination = {
        "bucketName" = "sme-core-cloud-compliance-nfw-logs-use1"
      }
      log_destination_type = "S3"
      log_type             = "FLOW"
    }
  }
}