resource "aws_networkfirewall_rule_group" "MAX-U3-NFW-HTTP-HTTPS-10K" {
  #checkov:skip=CKV_AWS_345: Ensure that Network firewall encryption is via a CMK. Migrated existing rule group as-is.
  capacity    = 10000
  description = "HTTP & HTTPS ONLY"
  name        = "MAX-U3-NFW-HTTP-HTTPS-10K"
  tags        = {}
  tags_all    = {}
  type        = "STATEFUL"

  rule_group {
    rules_source {
      rules_source_list {
        generated_rules_type = "ALLOWLIST"
        target_types = [
          "HTTP_HOST",
          "TLS_SNI",
        ]
        targets = [
          ".visualstudio.com",
          ".twistlock.com",
          ".amazon.com",
          ".amazonaws.com",
          ".automox.com",
          ".github.io",
          ".githubusercontent.com",
          ".nvcr.io",
          ".gcr.io",
          ".apache.org",
          ".nvidia.com",
          ".datadoghq.com",
          ".fedoraproject.org",
          ".github.com",
          ".ifconfig.io",
          ".microsoft.com",
          ".mysql.com",
          ".microsoftonline.com",
          ".pypa.io",
          ".pypi.org",
          ".python.org",
          ".pythonhosted.org",
          ".0365weve.com",
          ".23m.com",
          ".akadns.net",
          ".amazonlinux.com",
          ".aws",
          ".azure.com",
          ".azure.net",
          ".azureedge.net",
          ".centos.org",
          ".cloudapp.net",
          ".cloudappsecurity.com",
          ".corretto.aws",
          ".debian.org",
          ".digicert.com",
          ".dogado.de",
          ".gcr.io",
          ".ghcr.io",
          ".github.io",
          ".githubapp.com",
          ".githubusercontent.com",
          ".googleapis.com",
          ".gstatic.com",
          ".gvt1.com",
          ".live.com",
          ".medigitalapps.com",
          ".mewwi.net",
          ".micorosftonline-p.com",
          ".microsoftazuread-sso.com",
          ".microsoftonline-p.com",
          ".microsoftonline-p.net",
          ".mongodb.com",
          ".mongodb.org",
          ".msappproxy.net",
          ".msauth.net",
          ".msftconnecttest.com",
          ".msftncsi.com",
          ".msocdn.com",
          ".nsatc.net",
          ".nvcr.io",
          ".nvidia.com",
          ".office.com",
          ".office.net",
          ".onmicrosoft.com",
          ".outlookgroups.ms",
          ".phonefactor.net",
          ".postgresql.org",
          ".quay.io",
          ".rwth-aachen.de",
          ".s3browser.com",
          ".sendgrid.com",
          ".sendgrid.net",
          ".sfx.ms",
          ".smcdp-aws.net",
          ".smcdp-de.net",
          ".smedifgitalapps.com",
          ".smedigitalapps.com",
          ".uni-stuttgart.de",
          ".vo.msecnd.net",
          ".windows.com",
          ".windowsazure.com",
          ".windowsupdate.com",
          ".windowsupdates.com",
          ".winehq.org",
          ".xtom.de",
          "assets.onestore.ms",
          "auth.gfx.ms",
          "az826701.vo.msecnd.net",
          "mem.gfx.ms",
          "update.microsoft.com",
          ".gradle.org",
          ".actions.githubusercontent.com",
          ".sony.com",
          ".deepsecurity.trendmicro.com",
          ".adoptium.net",
          ".trendmicro.com",
          ".blob.core.windows.net",
          ".apps.qualys.com",
          ".npmjs.org",
          ".cloud.twistlock.com",
          ".docker.io",
          ".docker.com",
          ".confluent.io",
          ".k8s.io",
          ".repository.redhat.com",
          ".jboss.org",
          ".shibboleth.net",
          ".sencha.com",
          ".ecr.aws",
          ".cloudfront.net",
          ".nginx.org",
          ".smecde.com",
          ".oracle.com",
          ".sonymusic.com",
          ".ius.io",
          ".smeperforce.com",
        ]
      }
    }
    stateful_rule_options {
      rule_order = "DEFAULT_ACTION_ORDER"
    }
  }
}