resource "aws_networkfirewall_rule_group" "MAX-P3-NFW-HTTP-HTTPS-10K" {
  #checkov:skip=CKV_AWS_345: Ensure that Network firewall encryption is via a CMK. Migrated existing firewall rule group as-is.
  capacity    = 10000
  description = "HTTP & HTTPS ONLY"
  name        = "MAX-P3-NFW-HTTP-HTTPS-10K"
  tags        = {}
  tags_all    = {}
  type        = "STATEFUL"

  rule_group {
    rules_source {
      rules_source_list {
        generated_rules_type = "ALLOWLIST"
        target_types = [
          "HTTP_HOST",
          "TLS_SNI",
        ]
        targets = [
          ".0365weve.com",
          ".23m.com",
          ".actions.githubusercontent.com",
          ".adoptium.net",
          ".akadns.net",
          ".amazon.com",
          ".amazonaws.com",
          ".amazonlinux.com",
          ".anaconda.org",
          ".apache.org",
          ".apple.com",
          ".apps.qualys.com",
          ".archive.apache.org",
          ".automox.com",
          ".aws",
          ".azure.com",
          ".azure.net",
          ".azureedge.net",
          ".blob.core.windows.net",
          ".brave.com",
          ".braveupdate.com",
          ".braveupdate.exe",
          ".centos.org",
          ".cloud.twistlock.com",
          ".cloudapp.net",
          ".cloudappsecurity.com",
          ".cloudfront.net",
          ".confluent.io",
          ".corretto.aws",
          ".datadoghq.com",
          ".debian.org",
          ".deezer.com",
          ".deepsecurity.trendmicro.com",
          ".digicert.com",
          ".docker.com",
          ".docker.io",
          ".dogado.de",
          ".ecr.aws",
          ".facebook.com",
          ".fedoraproject.org",
          ".gcr.io",
          ".gfx.ms",
          ".ghcr.io",
          ".github.com",
          ".github.io",
          ".githubapp.com",
          ".githubusercontent.com",
          ".google.com",
          ".googleapis.com",
          ".googleusercontent.com",
          ".gradle.org",
          ".gstatic.com",
          ".gvt1.com",
          ".ifconfig.io",
          ".ip-connect.vn.ua",
          ".ius.io",
          ".jboss.org",
          ".k8s.io",
          ".live.com",
          ".maven.org",
          ".medigitalapps.com",
          ".mewwi.net",
          ".micorosftonline-p.com",
          ".microsoft.com",
          ".microsoftazuread-sso.com",
          ".microsoftonline-p.com",
          ".microsoftonline-p.net",
          ".microsoftonline.com",
          ".mongodb.com",
          ".mongodb.org",
          ".msappproxy.net",
          ".msauth.net",
          ".msftconnecttest.com",
          ".msftncsi.com",
          ".msocdn.com",
          ".mysql.com",
          ".nginx.org",
          ".npmjs.org",
          ".nsatc.net",
          ".nvcr.io",
          ".nvidia.com",
          ".office.com",
          ".office.net",
          ".onestore.ms",
          ".onmicrosoft.com",
          ".oracle.com",
          ".outlookgroups.ms",
          ".phonefactor.net",
          ".postgresql.org",
          ".prefix.dev",
          ".ptisp.pt",
          ".pypa.io",
          ".pypi.org",
          ".python.org",
          ".pythonhosted.org",
          ".qualys.com",
          ".quay.io",
          ".rackspace.com",
          ".redhat.com",
          ".repository.redhat.com",
          ".rwth-aachen.de",
          ".s3browser.com",
          ".sencha.com",
          ".sendgrid.com",
          ".sendgrid.net",
          ".sfx.ms",
          ".sharepoint.com",
          ".shibboleth.net",
          ".smcdp-aws.net",
          ".smcdp-de.net",
          ".smecde.com",
          ".smecloudops.com",
          ".smedigitalapps.com",
          ".smehost.net",
          ".smeperforce.com",
          ".sony.com",
          ".sonymusic.com",
          ".spark-packages.org",
          ".trendmicro.com",
          ".twistlock.com",
          ".uni-stuttgart.de",
          ".visualstudio.com",
          ".vo.msecnd.net",
          ".windows.com",
          ".windows.net",
          ".windowsazure.com",
          ".windowsupdate.com",
          ".windowsupdates.com",
          ".winehq.org",
          ".xtom.de",
          "conda-forge.org",
          "pixi.sh",
        ]
      }
    }
    stateful_rule_options {
      rule_order = "DEFAULT_ACTION_ORDER"
    }
  }
}