type AccountRoleStatus string

const (
	AccountRoleStatusReady           AccountRoleStatus = "READY"
	AccountRoleStatusCreating        AccountRoleStatus = "CREATING"
	AccountRoleStatusPendingDeletion AccountRoleStatus = "PENDING_DELETION"
	AccountRoleStatusDeleting        AccountRoleStatus = "DELETING"
	AccountRoleStatusDeleted         AccountRoleStatus = "DELETED"
)

type ActionTarget struct {

	// A description of the remediation action target.
	Description *string

	// The ID of the remediation target.
	ResourceId *string
	// contains filtered or unexported fields
}

type App struct {

	// The application's name.
	//
	// This member is required.
	AppName *string

	// The application's port number, for example 80.
	//
	// This member is required.
	Port *int64

	// The IP protocol name or number. The name can be one of tcp, udp, or icmp. For
	// information on possible numbers, see Protocol Numbers
	// (https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml).
	//
	// This member is required.
	Protocol *string
	// contains filtered or unexported fields
}

type AppsListData struct {

	// An array of applications in the Firewall Manager applications list.
	//
	// This member is required.
	AppsList []App

	// The name of the Firewall Manager applications list.
	//
	// This member is required.
	ListName *string

	// The time that the Firewall Manager applications list was created.
	CreateTime *time.Time

	// The time that the Firewall Manager applications list was last updated.
	LastUpdateTime *time.Time

	// The ID of the Firewall Manager applications list.
	ListId *string

	// A unique identifier for each update to the list. When you update the list, the
	// update token must match the token of the current version of the application
	// list. You can retrieve the update token by getting the list.
	ListUpdateToken *string

	// A map of previous version numbers to their corresponding App object arrays.
	PreviousAppsList map[string][]App
	// contains filtered or unexported fields
}

type AppsListDataSummary struct {

	// An array of App objects in the Firewall Manager applications list.
	AppsList []App

	// The Amazon Resource Name (ARN) of the applications list.
	ListArn *string

	// The ID of the applications list.
	ListId *string

	// The name of the applications list.
	ListName *string
	// contains filtered or unexported fields
}

type AwsEc2InstanceViolation struct {

	// Violation detail for network interfaces associated with the EC2 instance.
	AwsEc2NetworkInterfaceViolations []AwsEc2NetworkInterfaceViolation

	// The resource ID of the EC2 instance.
	ViolationTarget *string
	// contains filtered or unexported fields
}

type AwsEc2NetworkInterfaceViolation struct {

	// List of security groups that violate the rules specified in the primary security
	// group of the Firewall Manager policy.
	ViolatingSecurityGroups []string

	// The resource ID of the network interface.
	ViolationTarget *string
	// contains filtered or unexported fields
}

type AwsVPCSecurityGroupViolation struct {

	// List of rules specified in the security group of the Firewall Manager policy
	// that partially match the ViolationTarget rule.
	PartialMatches []PartialMatch

	// Remediation options for the rule specified in the ViolationTarget.
	PossibleSecurityGroupRemediationActions []SecurityGroupRemediationAction

	// The security group rule that is being evaluated.
	ViolationTarget *string

	// A description of the security group that violates the policy.
	ViolationTargetDescription *string
	// contains filtered or unexported fields
}

type ComplianceViolator struct {

	// The resource ID.
	ResourceId *string

	// The resource type. This is in the format shown in the Amazon Web Services
	// Resource Types Reference
	// (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html).
	// For example: AWS::ElasticLoadBalancingV2::LoadBalancer,
	// AWS::CloudFront::Distribution, or AWS::NetworkFirewall::FirewallPolicy.
	ResourceType *string

	// The reason that the resource is not protected by the policy.
	ViolationReason ViolationReason
	// contains filtered or unexported fields
}

type CustomerPolicyScopeIdType string

const (
	CustomerPolicyScopeIdTypeAccount CustomerPolicyScopeIdType = "ACCOUNT"
	CustomerPolicyScopeIdTypeOrgUnit CustomerPolicyScopeIdType = "ORG_UNIT"
)

type DependentServiceName string

const (
	DependentServiceNameAWSConfig              DependentServiceName = "AWSCONFIG"
	DependentServiceNameAwswaf                 DependentServiceName = "AWSWAF"
	DependentServiceNameAWSShieldAdvanced      DependentServiceName = "AWSSHIELD_ADVANCED"
	DependentServiceNameAWSVirtualPrivateCloud DependentServiceName = "AWSVPC"
)

type DestinationType string

const (
	DestinationTypeIpv4       DestinationType = "IPV4"
	DestinationTypeIpv6       DestinationType = "IPV6"
	DestinationTypePrefixList DestinationType = "PREFIX_LIST"
)

type DnsDuplicateRuleGroupViolation struct {

	// Information about the VPC ID.
	ViolationTarget *string

	// A description of the violation that specifies the rule group and VPC.
	ViolationTargetDescription *string
	// contains filtered or unexported fields
}

type DnsRuleGroupLimitExceededViolation struct {

	// The number of rule groups currently associated with the VPC.
	NumberOfRuleGroupsAlreadyAssociated int32

	// Information about the VPC ID.
	ViolationTarget *string

	// A description of the violation that specifies the rule group and VPC.
	ViolationTargetDescription *string
	// contains filtered or unexported fields
}

type DnsRuleGroupPriorityConflictViolation struct {

	// The ID of the Firewall Manager DNS Firewall policy that was already applied to
	// the VPC. This policy contains the rule group that's already associated with the
	// VPC.
	ConflictingPolicyId *string

	// The priority setting of the two conflicting rule groups.
	ConflictingPriority int32

	// The priorities of rule groups that are already associated with the VPC. To retry
	// your operation, choose priority settings that aren't in this list for the rule
	// groups in your new DNS Firewall policy.
	UnavailablePriorities []int32

	// Information about the VPC ID.
	ViolationTarget *string

	// A description of the violation that specifies the VPC and the rule group that's
	// already associated with it.
	ViolationTargetDescription *string
	// contains filtered or unexported fields
}

type EC2AssociateRouteTableAction struct {

	// The ID of the EC2 route table that is associated with the remediation action.
	//
	// This member is required.
	RouteTableId *ActionTarget

	// A description of the EC2 route table that is associated with the remediation
	// action.
	Description *string

	// The ID of the gateway to be used with the EC2 route table that is associated
	// with the remediation action.
	GatewayId *ActionTarget

	// The ID of the subnet for the EC2 route table that is associated with the
	// remediation action.
	SubnetId *ActionTarget
	// contains filtered or unexported fields
}

type EC2CopyRouteTableAction struct {

	// The ID of the copied EC2 route table that is associated with the remediation
	// action.
	//
	// This member is required.
	RouteTableId *ActionTarget

	// The VPC ID of the copied EC2 route table that is associated with the remediation
	// action.
	//
	// This member is required.
	VpcId *ActionTarget

	// A description of the copied EC2 route table that is associated with the
	// remediation action.
	Description *string
	// contains filtered or unexported fields
}

type EC2CreateRouteAction struct {

	// Information about the ID of the route table for the route.
	//
	// This member is required.
	RouteTableId *ActionTarget

	// A description of CreateRoute action in Amazon EC2.
	Description *string

	// Information about the IPv4 CIDR address block used for the destination match.
	DestinationCidrBlock *string

	// Information about the IPv6 CIDR block destination.
	DestinationIpv6CidrBlock *string

	// Information about the ID of a prefix list used for the destination match.
	DestinationPrefixListId *string

	// Information about the ID of an internet gateway or virtual private gateway
	// attached to your VPC.
	GatewayId *ActionTarget

	// Information about the ID of a VPC endpoint. Supported for Gateway Load Balancer
	// endpoints only.
	VpcEndpointId *ActionTarget
	// contains filtered or unexported fields
}

type EC2CreateRouteTableAction struct {

	// Information about the ID of a VPC.
	//
	// This member is required.
	VpcId *ActionTarget

	// A description of the CreateRouteTable action.
	Description *string
	// contains filtered or unexported fields
}

type EC2DeleteRouteAction struct {

	// Information about the ID of the route table.
	//
	// This member is required.
	RouteTableId *ActionTarget

	// A description of the DeleteRoute action.
	Description *string

	// Information about the IPv4 CIDR range for the route. The value you specify must
	// match the CIDR for the route exactly.
	DestinationCidrBlock *string

	// Information about the IPv6 CIDR range for the route. The value you specify must
	// match the CIDR for the route exactly.
	DestinationIpv6CidrBlock *string

	// Information about the ID of the prefix list for the route.
	DestinationPrefixListId *string
	// contains filtered or unexported fields
}

type EC2ReplaceRouteAction struct {

	// Information about the ID of the route table.
	//
	// This member is required.
	RouteTableId *ActionTarget

	// A description of the ReplaceRoute action in Amazon EC2.
	Description *string

	// Information about the IPv4 CIDR address block used for the destination match.
	// The value that you provide must match the CIDR of an existing route in the
	// table.
	DestinationCidrBlock *string

	// Information about the IPv6 CIDR address block used for the destination match.
	// The value that you provide must match the CIDR of an existing route in the
	// table.
	DestinationIpv6CidrBlock *string

	// Information about the ID of the prefix list for the route.
	DestinationPrefixListId *string

	// Information about the ID of an internet gateway or virtual private gateway.
	GatewayId *ActionTarget
	// contains filtered or unexported fields
}

type EC2ReplaceRouteTableAssociationAction struct {

	// Information about the association ID.
	//
	// This member is required.
	AssociationId *ActionTarget

	// Information about the ID of the new route table to associate with the subnet.
	//
	// This member is required.
	RouteTableId *ActionTarget

	// A description of the ReplaceRouteTableAssociation action in Amazon EC2.
	Description *string
	// contains filtered or unexported fields
}

type EvaluationResult struct {

	// Describes an Amazon Web Services account's compliance with the Firewall Manager
	// policy.
	ComplianceStatus PolicyComplianceStatusType

	// Indicates that over 100 resources are noncompliant with the Firewall Manager
	// policy.
	EvaluationLimitExceeded bool

	// The number of resources that are noncompliant with the specified policy. For WAF
	// and Shield Advanced policies, a resource is considered noncompliant if it is not
	// associated with the policy. For security group policies, a resource is
	// considered noncompliant if it doesn't comply with the rules of the policy and
	// remediation is disabled or not possible.
	ViolatorCount int64
	// contains filtered or unexported fields
}

type ExpectedRoute struct {

	// Information about the allowed targets.
	AllowedTargets []string

	// Information about the contributing subnets.
	ContributingSubnets []string

	// Information about the IPv4 CIDR block.
	IpV4Cidr *string

	// Information about the IPv6 CIDR block.
	IpV6Cidr *string

	// Information about the ID of the prefix list for the route.
	PrefixListId *string

	// Information about the route table ID.
	RouteTableId *string
	// contains filtered or unexported fields
}

type InternalErrorException struct {
	Message *string
	// contains filtered or unexported fields
}

type InvalidInputException struct {
	Message *string
	// contains filtered or unexported fields
}

type InvalidOperationException struct {
	Message *string
	// contains filtered or unexported fields
}

type InvalidTypeException struct {
	Message *string
	// contains filtered or unexported fields
}

type LimitExceededException struct {
	Message *string
	// contains filtered or unexported fields
}

type NetworkFirewallBlackHoleRouteDetectedViolation struct {

	// Information about the route table ID.
	RouteTableId *string

	// Information about the route or routes that are in violation.
	ViolatingRoutes []Route

	// The subnet that has an inactive state.
	ViolationTarget *string

	// Information about the VPC ID.
	VpcId *string
	// contains filtered or unexported fields
}

type NetworkFirewallInternetTrafficNotInspectedViolation struct {

	// The actual firewall subnet routes.
	ActualFirewallSubnetRoutes []Route

	// The actual internet gateway routes.
	ActualInternetGatewayRoutes []Route

	// Information about the subnet route table for the current firewall.
	CurrentFirewallSubnetRouteTable *string

	// The current route table for the internet gateway.
	CurrentInternetGatewayRouteTable *string

	// The expected endpoint for the current firewall.
	ExpectedFirewallEndpoint *string

	// The firewall subnet routes that are expected.
	ExpectedFirewallSubnetRoutes []ExpectedRoute

	// The internet gateway routes that are expected.
	ExpectedInternetGatewayRoutes []ExpectedRoute

	// The firewall subnet ID.
	FirewallSubnetId *string

	// The internet gateway ID.
	InternetGatewayId *string

	// Information about whether the route table is used in another Availability Zone.
	IsRouteTableUsedInDifferentAZ bool

	// Information about the route table ID.
	RouteTableId *string

	// The subnet Availability Zone.
	SubnetAvailabilityZone *string

	// The subnet ID.
	SubnetId *string

	// The route or routes that are in violation.
	ViolatingRoutes []Route

	// Information about the VPC ID.
	VpcId *string
	// contains filtered or unexported fields
}

type NetworkFirewallInvalidRouteConfigurationViolation struct {

	// The actual firewall endpoint.
	ActualFirewallEndpoint *string

	// The actual subnet ID for the firewall.
	ActualFirewallSubnetId *string

	// The actual firewall subnet routes that are expected.
	ActualFirewallSubnetRoutes []Route

	// The actual internet gateway routes.
	ActualInternetGatewayRoutes []Route

	// The subnets that are affected.
	AffectedSubnets []string

	// The subnet route table for the current firewall.
	CurrentFirewallSubnetRouteTable *string

	// The route table for the current internet gateway.
	CurrentInternetGatewayRouteTable *string

	// The firewall endpoint that's expected.
	ExpectedFirewallEndpoint *string

	// The expected subnet ID for the firewall.
	ExpectedFirewallSubnetId *string

	// The firewall subnet routes that are expected.
	ExpectedFirewallSubnetRoutes []ExpectedRoute

	// The expected routes for the internet gateway.
	ExpectedInternetGatewayRoutes []ExpectedRoute

	// The internet gateway ID.
	InternetGatewayId *string

	// Information about whether the route table is used in another Availability Zone.
	IsRouteTableUsedInDifferentAZ bool

	// The route table ID.
	RouteTableId *string

	// The route that's in violation.
	ViolatingRoute *Route

	// Information about the VPC ID.
	VpcId *string
	// contains filtered or unexported fields
}

type NetworkFirewallMissingExpectedRTViolation struct {

	// The Availability Zone of a violating subnet.
	AvailabilityZone *string

	// The resource ID of the current route table that's associated with the subnet, if
	// one is available.
	CurrentRouteTable *string

	// The resource ID of the route table that should be associated with the subnet.
	ExpectedRouteTable *string

	// The resource ID of the VPC associated with a violating subnet.
	VPC *string

	// The ID of the Network Firewall or VPC resource that's in violation.
	ViolationTarget *string
	// contains filtered or unexported fields
}

type NetworkFirewallMissingExpectedRoutesViolation struct {

	// The expected routes.
	ExpectedRoutes []ExpectedRoute

	// The target of the violation.
	ViolationTarget *string

	// Information about the VPC ID.
	VpcId *string
	// contains filtered or unexported fields
}

type NetworkFirewallMissingFirewallViolation struct {

	// The Availability Zone of a violating subnet.
	AvailabilityZone *string

	// The reason the resource has this violation, if one is available.
	TargetViolationReason *string

	// The resource ID of the VPC associated with a violating subnet.
	VPC *string

	// The ID of the Network Firewall or VPC resource that's in violation.
	ViolationTarget *string
	// contains filtered or unexported fields
}

type NetworkFirewallMissingSubnetViolation struct {

	// The Availability Zone of a violating subnet.
	AvailabilityZone *string

	// The reason the resource has this violation, if one is available.
	TargetViolationReason *string

	// The resource ID of the VPC associated with a violating subnet.
	VPC *string

	// The ID of the Network Firewall or VPC resource that's in violation.
	ViolationTarget *string
	// contains filtered or unexported fields
}

type NetworkFirewallPolicyDescription struct {

	// The stateful rule groups that are used in the Network Firewall firewall policy.
	StatefulRuleGroups []StatefulRuleGroup

	// Names of custom actions that are available for use in the stateless default
	// actions settings.
	StatelessCustomActions []string

	// The actions to take on packets that don't match any of the stateless rule
	// groups.
	StatelessDefaultActions []string

	// The actions to take on packet fragments that don't match any of the stateless
	// rule groups.
	StatelessFragmentDefaultActions []string

	// The stateless rule groups that are used in the Network Firewall firewall policy.
	StatelessRuleGroups []StatelessRuleGroup
	// contains filtered or unexported fields
}

type NetworkFirewallPolicyModifiedViolation struct {

	// The policy that's currently in use in the individual account.
	CurrentPolicyDescription *NetworkFirewallPolicyDescription

	// The policy that should be in use in the individual account in order to be
	// compliant.
	ExpectedPolicyDescription *NetworkFirewallPolicyDescription

	// The ID of the Network Firewall or VPC resource that's in violation.
	ViolationTarget *string
	// contains filtered or unexported fields
}

type NetworkFirewallUnexpectedFirewallRoutesViolation struct {

	// The endpoint of the firewall.
	FirewallEndpoint *string

	// The subnet ID for the firewall.
	FirewallSubnetId *string

	// The ID of the route table.
	RouteTableId *string

	// The routes that are in violation.
	ViolatingRoutes []Route

	// Information about the VPC ID.
	VpcId *string
	// contains filtered or unexported fields
}

type NetworkFirewallUnexpectedGatewayRoutesViolation struct {

	// Information about the gateway ID.
	GatewayId *string

	// Information about the route table.
	RouteTableId *string

	// The routes that are in violation.
	ViolatingRoutes []Route

	// Information about the VPC ID.
	VpcId *string
	// contains filtered or unexported fields
}

type PartialMatch struct {

	// The reference rule from the primary security group of the Firewall Manager
	// policy.
	Reference *string

	// The violation reason.
	TargetViolationReasons []string
	// contains filtered or unexported fields
}

type Policy struct {

	// If set to True, resources with the tags that are specified in the ResourceTag
	// array are not in scope of the policy. If set to False, and the ResourceTag array
	// is not null, only resources with the specified tags are in scope of the policy.
	//
	// This member is required.
	ExcludeResourceTags bool

	// The name of the Firewall Manager policy.
	//
	// This member is required.
	PolicyName *string

	// Indicates if the policy should be automatically applied to new resources.
	//
	// This member is required.
	RemediationEnabled bool

	// The type of resource protected by or in scope of the policy. This is in the
	// format shown in the Amazon Web Services Resource Types Reference
	// (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html).
	// To apply this policy to multiple resource types, specify a resource type of
	// ResourceTypeList and then specify the resource types in a ResourceTypeList. For
	// WAF and Shield Advanced, example resource types include
	// AWS::ElasticLoadBalancingV2::LoadBalancer and AWS::CloudFront::Distribution. For
	// a security group common policy, valid values are AWS::EC2::NetworkInterface and
	// AWS::EC2::Instance. For a security group content audit policy, valid values are
	// AWS::EC2::SecurityGroup, AWS::EC2::NetworkInterface, and AWS::EC2::Instance. For
	// a security group usage audit policy, the value is AWS::EC2::SecurityGroup. For
	// an Network Firewall policy or DNS Firewall policy, the value is AWS::EC2::VPC.
	//
	// This member is required.
	ResourceType *string

	// Details about the security service that is being used to protect the resources.
	//
	// This member is required.
	SecurityServicePolicyData *SecurityServicePolicyData

	// Specifies the Amazon Web Services account IDs and Organizations organizational
	// units (OUs) to exclude from the policy. Specifying an OU is the equivalent of
	// specifying all accounts in the OU and in any of its child OUs, including any
	// child OUs and accounts that are added at a later time. You can specify
	// inclusions or exclusions, but not both. If you specify an IncludeMap, Firewall
	// Manager applies the policy to all accounts specified by the IncludeMap, and does
	// not evaluate any ExcludeMap specifications. If you do not specify an IncludeMap,
	// then Firewall Manager applies the policy to all accounts except for those
	// specified by the ExcludeMap. You can specify account IDs, OUs, or a
	// combination:
	//
	// * Specify account IDs by setting the key to ACCOUNT. For example,
	// the following is a valid map: {“ACCOUNT” : [“accountID1”, “accountID2”]}.
	//
	// *
	// Specify OUs by setting the key to ORG_UNIT. For example, the following is a
	// valid map: {“ORG_UNIT” : [“ouid111”, “ouid112”]}.
	//
	// * Specify accounts and OUs
	// together in a single map, separated with a comma. For example, the following is
	// a valid map: {“ACCOUNT” : [“accountID1”, “accountID2”], “ORG_UNIT” : [“ouid111”,
	// “ouid112”]}.
	ExcludeMap map[string][]string

	// Specifies the Amazon Web Services account IDs and Organizations organizational
	// units (OUs) to include in the policy. Specifying an OU is the equivalent of
	// specifying all accounts in the OU and in any of its child OUs, including any
	// child OUs and accounts that are added at a later time. You can specify
	// inclusions or exclusions, but not both. If you specify an IncludeMap, Firewall
	// Manager applies the policy to all accounts specified by the IncludeMap, and does
	// not evaluate any ExcludeMap specifications. If you do not specify an IncludeMap,
	// then Firewall Manager applies the policy to all accounts except for those
	// specified by the ExcludeMap. You can specify account IDs, OUs, or a
	// combination:
	//
	// * Specify account IDs by setting the key to ACCOUNT. For example,
	// the following is a valid map: {“ACCOUNT” : [“accountID1”, “accountID2”]}.
	//
	// *
	// Specify OUs by setting the key to ORG_UNIT. For example, the following is a
	// valid map: {“ORG_UNIT” : [“ouid111”, “ouid112”]}.
	//
	// * Specify accounts and OUs
	// together in a single map, separated with a comma. For example, the following is
	// a valid map: {“ACCOUNT” : [“accountID1”, “accountID2”], “ORG_UNIT” : [“ouid111”,
	// “ouid112”]}.
	IncludeMap map[string][]string

	// The ID of the Firewall Manager policy.
	PolicyId *string

	// A unique identifier for each update to the policy. When issuing a PutPolicy
	// request, the PolicyUpdateToken in the request must match the PolicyUpdateToken
	// of the current policy version. To get the PolicyUpdateToken of the current
	// policy version, use a GetPolicy request.
	PolicyUpdateToken *string

	// An array of ResourceTag objects.
	ResourceTags []ResourceTag

	// An array of ResourceType objects. Use this only to specify multiple resource
	// types. To specify a single resource type, use ResourceType.
	ResourceTypeList []string
	// contains filtered or unexported fields
}

type PolicyComplianceDetail struct {

	// Indicates if over 100 resources are noncompliant with the Firewall Manager
	// policy.
	EvaluationLimitExceeded bool

	// A timestamp that indicates when the returned information should be considered
	// out of date.
	ExpiredAt *time.Time

	// Details about problems with dependent services, such as WAF or Config, and the
	// error message received that indicates the problem with the service.
	IssueInfoMap map[string]string

	// The Amazon Web Services account ID.
	MemberAccount *string

	// The ID of the Firewall Manager policy.
	PolicyId *string

	// The Amazon Web Services account that created the Firewall Manager policy.
	PolicyOwner *string

	// An array of resources that aren't protected by the WAF or Shield Advanced policy
	// or that aren't in compliance with the security group policy.
	Violators []ComplianceViolator
	// contains filtered or unexported fields
}

type PolicyComplianceStatus struct {

	// An array of EvaluationResult objects.
	EvaluationResults []EvaluationResult

	// Details about problems with dependent services, such as WAF or Config, and the
	// error message received that indicates the problem with the service.
	IssueInfoMap map[string]string

	// Timestamp of the last update to the EvaluationResult objects.
	LastUpdated *time.Time

	// The member account ID.
	MemberAccount *string

	// The ID of the Firewall Manager policy.
	PolicyId *string

	// The name of the Firewall Manager policy.
	PolicyName *string

	// The Amazon Web Services account that created the Firewall Manager policy.
	PolicyOwner *string
	// contains filtered or unexported fields
}

type PolicyComplianceStatusType string

const (
	PolicyComplianceStatusTypeCompliant    PolicyComplianceStatusType = "COMPLIANT"
	PolicyComplianceStatusTypeNonCompliant PolicyComplianceStatusType = "NON_COMPLIANT"
)

type PolicySummary struct {

	// The Amazon Resource Name (ARN) of the specified policy.
	PolicyArn *string

	// The ID of the specified policy.
	PolicyId *string

	// The name of the specified policy.
	PolicyName *string

	// Indicates if the policy should be automatically applied to new resources.
	RemediationEnabled bool

	// The type of resource protected by or in scope of the policy. This is in the
	// format shown in the Amazon Web Services Resource Types Reference
	// (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-template-resource-type-ref.html).
	// For WAF and Shield Advanced, examples include
	// AWS::ElasticLoadBalancingV2::LoadBalancer and AWS::CloudFront::Distribution. For
	// a security group common policy, valid values are AWS::EC2::NetworkInterface and
	// AWS::EC2::Instance. For a security group content audit policy, valid values are
	// AWS::EC2::SecurityGroup, AWS::EC2::NetworkInterface, and AWS::EC2::Instance. For
	// a security group usage audit policy, the value is AWS::EC2::SecurityGroup. For
	// an Network Firewall policy or DNS Firewall policy, the value is AWS::EC2::VPC.
	ResourceType *string

	// The service that the policy is using to protect the resources. This specifies
	// the type of policy that is created, either an WAF policy, a Shield Advanced
	// policy, or a security group policy.
	SecurityServiceType SecurityServiceType
	// contains filtered or unexported fields
}

type PossibleRemediationAction struct {

	// The ordered list of remediation actions.
	//
	// This member is required.
	OrderedRemediationActions []RemediationActionWithOrder

	// A description of the list of remediation actions.
	Description *string

	// Information about whether an action is taken by default.
	IsDefaultAction bool
	// contains filtered or unexported fields
}

type PossibleRemediationActions struct {

	// Information about the actions.
	Actions []PossibleRemediationAction

	// A description of the possible remediation actions list.
	Description *string
	// contains filtered or unexported fields
}

type ProtocolsListData struct {

	// The name of the Firewall Manager protocols list.
	//
	// This member is required.
	ListName *string

	// An array of protocols in the Firewall Manager protocols list.
	//
	// This member is required.
	ProtocolsList []string

	// The time that the Firewall Manager protocols list was created.
	CreateTime *time.Time

	// The time that the Firewall Manager protocols list was last updated.
	LastUpdateTime *time.Time

	// The ID of the Firewall Manager protocols list.
	ListId *string

	// A unique identifier for each update to the list. When you update the list, the
	// update token must match the token of the current version of the application
	// list. You can retrieve the update token by getting the list.
	ListUpdateToken *string

	// A map of previous version numbers to their corresponding protocol arrays.
	PreviousProtocolsList map[string][]string
	// contains filtered or unexported fields
}

type ProtocolsListDataSummary struct {

	// The Amazon Resource Name (ARN) of the specified protocols list.
	ListArn *string

	// The ID of the specified protocols list.
	ListId *string

	// The name of the specified protocols list.
	ListName *string

	// An array of protocols in the Firewall Manager protocols list.
	ProtocolsList []string
	// contains filtered or unexported fields
}

type RemediationAction struct {

	// A description of a remediation action.
	Description *string

	// Information about the AssociateRouteTable action in the Amazon EC2 API.
	EC2AssociateRouteTableAction *EC2AssociateRouteTableAction

	// Information about the CopyRouteTable action in the Amazon EC2 API.
	EC2CopyRouteTableAction *EC2CopyRouteTableAction

	// Information about the CreateRoute action in the Amazon EC2 API.
	EC2CreateRouteAction *EC2CreateRouteAction

	// Information about the CreateRouteTable action in the Amazon EC2 API.
	EC2CreateRouteTableAction *EC2CreateRouteTableAction

	// Information about the DeleteRoute action in the Amazon EC2 API.
	EC2DeleteRouteAction *EC2DeleteRouteAction

	// Information about the ReplaceRoute action in the Amazon EC2 API.
	EC2ReplaceRouteAction *EC2ReplaceRouteAction

	// Information about the ReplaceRouteTableAssociation action in the Amazon EC2 API.
	EC2ReplaceRouteTableAssociationAction *EC2ReplaceRouteTableAssociationAction
	// contains filtered or unexported fields
}

type RemediationActionType string

const (
	RemediationActionTypeRemove RemediationActionType = "REMOVE"
	RemediationActionTypeModify RemediationActionType = "MODIFY"
)

type RemediationActionWithOrder struct {

	// The order of the remediation actions in the list.
	Order int32

	// Information about an action you can take to remediate a violation.
	RemediationAction *RemediationAction
	// contains filtered or unexported fields
}

type ResourceNotFoundException struct {
	Message *string
	// contains filtered or unexported fields
}

type ResourceTag struct {

	// The resource tag key.
	//
	// This member is required.
	Key *string

	// The resource tag value.
	Value *string
	// contains filtered or unexported fields
}

type ResourceViolation struct {

	// Violation detail for an EC2 instance.
	AwsEc2InstanceViolation *AwsEc2InstanceViolation

	// Violation detail for a network interface.
	AwsEc2NetworkInterfaceViolation *AwsEc2NetworkInterfaceViolation

	// Violation detail for security groups.
	AwsVPCSecurityGroupViolation *AwsVPCSecurityGroupViolation

	// Violation detail for a DNS Firewall policy that indicates that a rule group that
	// Firewall Manager tried to associate with a VPC is already associated with the
	// VPC and can't be associated again.
	DnsDuplicateRuleGroupViolation *DnsDuplicateRuleGroupViolation

	// Violation detail for a DNS Firewall policy that indicates that the VPC reached
	// the limit for associated DNS Firewall rule groups. Firewall Manager tried to
	// associate another rule group with the VPC and failed.
	DnsRuleGroupLimitExceededViolation *DnsRuleGroupLimitExceededViolation

	// Violation detail for a DNS Firewall policy that indicates that a rule group that
	// Firewall Manager tried to associate with a VPC has the same priority as a rule
	// group that's already associated.
	DnsRuleGroupPriorityConflictViolation *DnsRuleGroupPriorityConflictViolation

	// Violation detail for an internet gateway route with an inactive state in the
	// customer subnet route table or Network Firewall subnet route table.
	NetworkFirewallBlackHoleRouteDetectedViolation *NetworkFirewallBlackHoleRouteDetectedViolation

	// Violation detail for the subnet for which internet traffic hasn't been
	// inspected.
	NetworkFirewallInternetTrafficNotInspectedViolation *NetworkFirewallInternetTrafficNotInspectedViolation

	// The route configuration is invalid.
	NetworkFirewallInvalidRouteConfigurationViolation *NetworkFirewallInvalidRouteConfigurationViolation

	// Violation detail for an Network Firewall policy that indicates that a subnet is
	// not associated with the expected Firewall Manager managed route table.
	NetworkFirewallMissingExpectedRTViolation *NetworkFirewallMissingExpectedRTViolation

	// Expected routes are missing from Network Firewall.
	NetworkFirewallMissingExpectedRoutesViolation *NetworkFirewallMissingExpectedRoutesViolation

	// Violation detail for an Network Firewall policy that indicates that a subnet has
	// no Firewall Manager managed firewall in its VPC.
	NetworkFirewallMissingFirewallViolation *NetworkFirewallMissingFirewallViolation

	// Violation detail for an Network Firewall policy that indicates that an
	// Availability Zone is missing the expected Firewall Manager managed subnet.
	NetworkFirewallMissingSubnetViolation *NetworkFirewallMissingSubnetViolation

	// Violation detail for an Network Firewall policy that indicates that a firewall
	// policy in an individual account has been modified in a way that makes it
	// noncompliant. For example, the individual account owner might have deleted a
	// rule group, changed the priority of a stateless rule group, or changed a policy
	// default action.
	NetworkFirewallPolicyModifiedViolation *NetworkFirewallPolicyModifiedViolation

	// There's an unexpected firewall route.
	NetworkFirewallUnexpectedFirewallRoutesViolation *NetworkFirewallUnexpectedFirewallRoutesViolation

	// There's an unexpected gateway route.
	NetworkFirewallUnexpectedGatewayRoutesViolation *NetworkFirewallUnexpectedGatewayRoutesViolation

	// A list of possible remediation action lists. Each individual possible
	// remediation action is a list of individual remediation actions.
	PossibleRemediationActions *PossibleRemediationActions
	// contains filtered or unexported fields
}

type Route struct {

	// The destination of the route.
	Destination *string

	// The type of destination for the route.
	DestinationType DestinationType

	// The route's target.
	Target *string

	// The type of target for the route.
	TargetType TargetType
	// contains filtered or unexported fields
}

type SecurityGroupRemediationAction struct {

	// Brief description of the action that will be performed.
	Description *string

	// Indicates if the current action is the default action.
	IsDefaultAction bool

	// The remediation action that will be performed.
	RemediationActionType RemediationActionType

	// The final state of the rule specified in the ViolationTarget after it is
	// remediated.
	RemediationResult *SecurityGroupRuleDescription
	// contains filtered or unexported fields
}

type SecurityGroupRuleDescription struct {

	// The start of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6
	// type number. A value of -1 indicates all ICMP/ICMPv6 types.
	FromPort *int64

	// The IPv4 ranges for the security group rule.
	IPV4Range *string

	// The IPv6 ranges for the security group rule.
	IPV6Range *string

	// The ID of the prefix list for the security group rule.
	PrefixListId *string

	// The IP protocol name (tcp, udp, icmp, icmpv6) or number.
	Protocol *string

	// The end of the port range for the TCP and UDP protocols, or an ICMP/ICMPv6 code.
	// A value of -1 indicates all ICMP/ICMPv6 codes.
	ToPort *int64
	// contains filtered or unexported fields
}

type SecurityServicePolicyData struct {

	// The service that the policy is using to protect the resources. This specifies
	// the type of policy that is created, either an WAF policy, a Shield Advanced
	// policy, or a security group policy. For security group policies, Firewall
	// Manager supports one security group for each common policy and for each content
	// audit policy. This is an adjustable limit that you can increase by contacting
	// Amazon Web Services Support.
	//
	// This member is required.
	Type SecurityServiceType

	// Details about the service that are specific to the service type, in JSON format.
	// For service type SHIELD_ADVANCED, this is an empty string.
	//
	// * Example:
	// DNS_FIREWALL"{\"type\":\"DNS_FIREWALL\",\"preProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-1\",\"priority\":10}],\"postProcessRuleGroups\":[{\"ruleGroupId\":\"rslvr-frg-2\",\"priority\":9911}]}"
	//
	// *
	// Example:
	// NETWORK_FIREWALL"{\"type\":\"NETWORK_FIREWALL\",\"networkFirewallStatelessRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-1:1234567891011:stateless-rulegroup/rulegroup2\",\"priority\":10}],\"networkFirewallStatelessDefaultActions\":[\"aws:pass\",\"custom1\"],\"networkFirewallStatelessFragmentDefaultActions\":[\"custom2\",\"aws:pass\"],\"networkFirewallStatelessCustomActions\":[{\"actionName\":\"custom1\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"dimension1\"}]}}},{\"actionName\":\"custom2\",\"actionDefinition\":{\"publishMetricAction\":{\"dimensions\":[{\"value\":\"dimension2\"}]}}}],\"networkFirewallStatefulRuleGroupReferences\":[{\"resourceARN\":\"arn:aws:network-firewall:us-west-1:1234567891011:stateful-rulegroup/rulegroup1\"}],\"networkFirewallOrchestrationConfig\":{\"singleFirewallEndpointPerVPC\":true,\"allowedIPV4CidrList\":[\"10.24.34.0/28\"]}
	// }"
	//
	// * Example:
	// WAFV2"{\"type\":\"WAFV2\",\"preProcessRuleGroups\":[{\"ruleGroupArn\":null,\"overrideAction\":{\"type\":\"NONE\"},\"managedRuleGroupIdentifier\":{\"version\":null,\"vendorName\":\"AWS\",\"managedRuleGroupName\":\"AWSManagedRulesAmazonIpReputationList\"},\"ruleGroupType\":\"ManagedRuleGroup\",\"excludeRules\":[]}],\"postProcessRuleGroups\":[],\"defaultAction\":{\"type\":\"ALLOW\"},\"overrideCustomerWebACLAssociation\":false,\"loggingConfiguration\":{\"logDestinationConfigs\":[\"arn:aws:firehose:us-west-2:12345678912:deliverystream/aws-waf-logs-fms-admin-destination\"],\"redactedFields\":[{\"redactedFieldType\":\"SingleHeader\",\"redactedFieldValue\":\"Cookies\"},{\"redactedFieldType\":\"Method\"}]}}"
	// In the loggingConfiguration, you can specify one logDestinationConfigs, you can
	// optionally provide up to 20 redactedFields, and the RedactedFieldType must be
	// one of URI, QUERY_STRING, HEADER, or METHOD.
	//
	// * Example: WAF Classic"{\"type\":
	// \"WAF\", \"ruleGroups\": [{\"id\":\"12345678-1bcd-9012-efga-0987654321ab\",
	// \"overrideAction\" : {\"type\": \"COUNT\"}}], \"defaultAction\": {\"type\":
	// \"BLOCK\"}}"
	//
	// * Example:
	// SECURITY_GROUPS_COMMON"{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false,
	// \"applyToAllEC2InstanceENIs\":false,\"securityGroups\":[{\"id\":\"
	// sg-000e55995d61a06bd\"}]}"
	//
	// * Example: Shared VPCs. Apply the preceding policy
	// to resources in shared VPCs as well as to those in VPCs that the account owns
	// "{\"type\":\"SECURITY_GROUPS_COMMON\",\"revertManualSecurityGroupChanges\":false,\"exclusiveResourceSecurityGroupManagement\":false,
	// \"applyToAllEC2InstanceENIs\":false,\"includeSharedVPC\":true,\"securityGroups\":[{\"id\":\"
	// sg-000e55995d61a06bd\"}]}"
	//
	// * Example:
	// SECURITY_GROUPS_CONTENT_AUDIT"{\"type\":\"SECURITY_GROUPS_CONTENT_AUDIT\",\"securityGroups\":[{\"id\":\"sg-000e55995d61a06bd\"}],\"securityGroupAction\":{\"type\":\"ALLOW\"}}"
	// The security group action for content audit can be ALLOW or DENY. For ALLOW, all
	// in-scope security group rules must be within the allowed range of the policy's
	// security group rules. For DENY, all in-scope security group rules must not
	// contain a value or a range that matches a rule value or range in the policy
	// security group.
	//
	// * Example:
	// SECURITY_GROUPS_USAGE_AUDIT"{\"type\":\"SECURITY_GROUPS_USAGE_AUDIT\",\"deleteUnusedSecurityGroups\":true,\"coalesceRedundantSecurityGroups\":true}"
	ManagedServiceData *string
	// contains filtered or unexported fields
}

type SecurityServiceType string

const (
	SecurityServiceTypeWaf                        SecurityServiceType = "WAF"
	SecurityServiceTypeWafv2                      SecurityServiceType = "WAFV2"
	SecurityServiceTypeShieldAdvanced             SecurityServiceType = "SHIELD_ADVANCED"
	SecurityServiceTypeSecurityGroupsCommon       SecurityServiceType = "SECURITY_GROUPS_COMMON"
	SecurityServiceTypeSecurityGroupsContentAudit SecurityServiceType = "SECURITY_GROUPS_CONTENT_AUDIT"
	SecurityServiceTypeSecurityGroupsUsageAudit   SecurityServiceType = "SECURITY_GROUPS_USAGE_AUDIT"
	SecurityServiceTypeNetworkFirewall            SecurityServiceType = "NETWORK_FIREWALL"
	SecurityServiceTypeDnsFirewall                SecurityServiceType = "DNS_FIREWALL"
)

type StatefulRuleGroup struct {

	// The resource ID of the rule group.
	ResourceId *string

	// The name of the rule group.
	RuleGroupName *string
	// contains filtered or unexported fields
}

type StatelessRuleGroup struct {

	// The priority of the rule group. Network Firewall evaluates the stateless rule
	// groups in a firewall policy starting from the lowest priority setting.
	Priority int32

	// The resource ID of the rule group.
	ResourceId *string

	// The name of the rule group.
	RuleGroupName *string
	// contains filtered or unexported fields
}

type Tag struct {

	// Part of the key:value pair that defines a tag. You can use a tag key to describe
	// a category of information, such as "customer." Tag keys are case-sensitive.
	//
	// This member is required.
	Key *string

	// Part of the key:value pair that defines a tag. You can use a tag value to
	// describe a specific value within a category, such as "companyA" or "companyB."
	// Tag values are case-sensitive.
	//
	// This member is required.
	Value *string
	// contains filtered or unexported fields
}

type TargetType string

const (
	TargetTypeGateway                   TargetType = "GATEWAY"
	TargetTypeCarrierGateway            TargetType = "CARRIER_GATEWAY"
	TargetTypeInstance                  TargetType = "INSTANCE"
	TargetTypeLocalGateway              TargetType = "LOCAL_GATEWAY"
	TargetTypeNatGateway                TargetType = "NAT_GATEWAY"
	TargetTypeNetworkInterface          TargetType = "NETWORK_INTERFACE"
	TargetTypeVPCEndpoint               TargetType = "VPC_ENDPOINT"
	TargetTypeVPCPeeringConnection      TargetType = "VPC_PEERING_CONNECTION"
	TargetTypeEgressOnlyInternetGateway TargetType = "EGRESS_ONLY_INTERNET_GATEWAY"
	TargetTypeTransitGateway            TargetType = "TRANSIT_GATEWAY"
)

type ViolationDetail struct {

	// The Amazon Web Services account that the violation details were requested for.
	//
	// This member is required.
	MemberAccount *string

	// The ID of the Firewall Manager policy that the violation details were requested
	// for.
	//
	// This member is required.
	PolicyId *string

	// The resource ID that the violation details were requested for.
	//
	// This member is required.
	ResourceId *string

	// The resource type that the violation details were requested for.
	//
	// This member is required.
	ResourceType *string

	// List of violations for the requested resource.
	//
	// This member is required.
	ResourceViolations []ResourceViolation

	// Brief description for the requested resource.
	ResourceDescription *string

	// The ResourceTag objects associated with the resource.
	ResourceTags []Tag
	// contains filtered or unexported fields
}

type ViolationReason string

const (
	ViolationReasonWebAclMissingRuleGroup                  ViolationReason = "WEB_ACL_MISSING_RULE_GROUP"
	ViolationReasonResourceMissingWebAcl                   ViolationReason = "RESOURCE_MISSING_WEB_ACL"
	ViolationReasonResourceIncorrectWebAcl                 ViolationReason = "RESOURCE_INCORRECT_WEB_ACL"
	ViolationReasonResourceMissingShieldProtection         ViolationReason = "RESOURCE_MISSING_SHIELD_PROTECTION"
	ViolationReasonResourceMissingWebaclOrShieldProtection ViolationReason = "RESOURCE_MISSING_WEB_ACL_OR_SHIELD_PROTECTION"
	ViolationReasonResourceMissingSecurityGroup            ViolationReason = "RESOURCE_MISSING_SECURITY_GROUP"
	ViolationReasonResourceViolatesAuditSecurityGroup      ViolationReason = "RESOURCE_VIOLATES_AUDIT_SECURITY_GROUP"
	ViolationReasonSecurityGroupUnused                     ViolationReason = "SECURITY_GROUP_UNUSED"
	ViolationReasonSecurityGroupRedundant                  ViolationReason = "SECURITY_GROUP_REDUNDANT"
	ViolationReasonFMSCreatedSecurityGroupEdited           ViolationReason = "FMS_CREATED_SECURITY_GROUP_EDITED"
	ViolationReasonMissingFirewall                         ViolationReason = "MISSING_FIREWALL"
	ViolationReasonMissingFirewallSubnetInAZ               ViolationReason = "MISSING_FIREWALL_SUBNET_IN_AZ"
	ViolationReasonMissingExpectedRouteTable               ViolationReason = "MISSING_EXPECTED_ROUTE_TABLE"
	ViolationReasonNetworkFirewallPolicyModified           ViolationReason = "NETWORK_FIREWALL_POLICY_MODIFIED"
	ViolationReasonInternetGatewayMissingExpectedRoute     ViolationReason = "INTERNET_GATEWAY_MISSING_EXPECTED_ROUTE"
	ViolationReasonFirewallSubnetMissingExpectedRoute      ViolationReason = "FIREWALL_SUBNET_MISSING_EXPECTED_ROUTE"
	ViolationReasonUnexpectedFirewallRoutes                ViolationReason = "UNEXPECTED_FIREWALL_ROUTES"
	ViolationReasonUnexpectedTargetGatewayRoutes           ViolationReason = "UNEXPECTED_TARGET_GATEWAY_ROUTES"
	ViolationReasonTrafficInspectionCrossesAZBoundary      ViolationReason = "TRAFFIC_INSPECTION_CROSSES_AZ_BOUNDARY"
	ViolationReasonInvalidRouteConfiguration               ViolationReason = "INVALID_ROUTE_CONFIGURATION"
	ViolationReasonMissingTargetGateway                    ViolationReason = "MISSING_TARGET_GATEWAY"
	ViolationReasonInternetTrafficNotInspected             ViolationReason = "INTERNET_TRAFFIC_NOT_INSPECTED"
	ViolationReasonBlackHoleRouteDetected                  ViolationReason = "BLACK_HOLE_ROUTE_DETECTED"
	ViolationReasonBlackHoleRouteDetectedInFirewallSubnet  ViolationReason = "BLACK_HOLE_ROUTE_DETECTED_IN_FIREWALL_SUBNET"
	ViolationReasonResourceMissingDnsFirewall              ViolationReason = "RESOURCE_MISSING_DNS_FIREWALL"
)