LoggingConfiguration

Source: src/AWS/NetworkFirewall/LoggingConfiguration.ts

The logging configuration of an AWS Network Firewall Firewall — routes the firewall’s ALERT, FLOW, and TLS logs to S3, CloudWatch Logs, or Kinesis Data Firehose destinations.

A firewall has exactly one logging configuration; deleting this resource resets it to no logging.

Configuring Logging

Flow logs to CloudWatch Logs

import * as Logs from "alchemy/AWS/Logs";
import * as NetworkFirewall from "alchemy/AWS/NetworkFirewall";

const logGroup = yield* Logs.LogGroup("FirewallLogs");

yield* NetworkFirewall.LoggingConfiguration("Logging", {
  firewallArn: firewall.firewallArn,
  logDestinationConfigs: [
    {
      LogType: "FLOW",
      LogDestinationType: "CloudWatchLogs",
      LogDestination: { logGroup: logGroup.logGroupName },
    },
  ],
});

Alert logs to S3

yield* NetworkFirewall.LoggingConfiguration("Logging", {
  firewallArn: firewall.firewallArn,
  logDestinationConfigs: [
    {
      LogType: "ALERT",
      LogDestinationType: "S3",
      LogDestination: { bucketName: bucket.bucketName, prefix: "alerts" },
    },
  ],
});