Palo Alto Networks Cloud NGFW for AWS v0.1.1, Mar 15 25

Palo Alto Networks Cloud NGFW for AWS v0.1.1 published on Saturday, Mar 15, 2025 by Pulumi

cloudngfwaws.AccountOnboardingStack

Explore with Pulumi AI

Palo Alto Networks Cloud NGFW for AWS v0.1.1 published on Saturday, Mar 15, 2025 by Pulumi

Admin Permission Type

Rulestack (for scope="Local")
Global Rulestack (for scope="Global")

Create AccountOnboardingStack Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

new AccountOnboardingStack(name: string, args: AccountOnboardingStackArgs, opts?: CustomResourceOptions);

@overload
def AccountOnboardingStack(resource_name: str,
                           args: AccountOnboardingStackArgs,
                           opts: Optional[ResourceOptions] = None)

@overload
def AccountOnboardingStack(resource_name: str,
                           opts: Optional[ResourceOptions] = None,
                           external_id: Optional[str] = None,
                           trusted_account: Optional[str] = None,
                           cft_role_name: Optional[str] = None,
                           account_id: Optional[str] = None,
                           sns_topic_arn: Optional[str] = None,
                           onboarding_cft: Optional[str] = None,
                           cloudwatch_log_group: Optional[str] = None,
                           endpoint_mode: Optional[str] = None,
                           kinesis_firehose: Optional[str] = None,
                           decryption_cert: Optional[str] = None,
                           s3_bucket: Optional[str] = None,
                           cloudwatch_namespace: Optional[str] = None,
                           stack_id: Optional[str] = None,
                           stack_status: Optional[str] = None,
                           auditlog_group: Optional[str] = None)

func NewAccountOnboardingStack(ctx *Context, name string, args AccountOnboardingStackArgs, opts ...ResourceOption) (*AccountOnboardingStack, error)

public AccountOnboardingStack(string name, AccountOnboardingStackArgs args, CustomResourceOptions? opts = null)

public AccountOnboardingStack(String name, AccountOnboardingStackArgs args)
public AccountOnboardingStack(String name, AccountOnboardingStackArgs args, CustomResourceOptions options)

type: cloudngfwaws:AccountOnboardingStack
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name string: The unique name of the resource.
args AccountOnboardingStackArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

resource_name str: The unique name of the resource.
args AccountOnboardingStackArgs: The arguments to resource properties.
opts ResourceOptions: Bag of options to control resource's behavior.

ctx Context: Context object for the current deployment.
name string: The unique name of the resource.
args AccountOnboardingStackArgs: The arguments to resource properties.
opts ResourceOption: Bag of options to control resource's behavior.

name string: The unique name of the resource.
args AccountOnboardingStackArgs: The arguments to resource properties.
opts CustomResourceOptions: Bag of options to control resource's behavior.

name String: The unique name of the resource.
args AccountOnboardingStackArgs: The arguments to resource properties.
options CustomResourceOptions: Bag of options to control resource's behavior.

Constructor example

The following reference example uses placeholder values for all input properties.

TypeScript
Python
Go
C#
Java
YAML

var accountOnboardingStackResource = new CloudNgfwAws.AccountOnboardingStack("accountOnboardingStackResource", new()
{
    ExternalId = "string",
    TrustedAccount = "string",
    CftRoleName = "string",
    AccountId = "string",
    SnsTopicArn = "string",
    OnboardingCft = "string",
    CloudwatchLogGroup = "string",
    EndpointMode = "string",
    KinesisFirehose = "string",
    DecryptionCert = "string",
    S3Bucket = "string",
    CloudwatchNamespace = "string",
    StackId = "string",
    StackStatus = "string",
    AuditlogGroup = "string",
});

example, err := cloudngfwaws.NewAccountOnboardingStack(ctx, "accountOnboardingStackResource", &cloudngfwaws.AccountOnboardingStackArgs{
	ExternalId:          pulumi.String("string"),
	TrustedAccount:      pulumi.String("string"),
	CftRoleName:         pulumi.String("string"),
	AccountId:           pulumi.String("string"),
	SnsTopicArn:         pulumi.String("string"),
	OnboardingCft:       pulumi.String("string"),
	CloudwatchLogGroup:  pulumi.String("string"),
	EndpointMode:        pulumi.String("string"),
	KinesisFirehose:     pulumi.String("string"),
	DecryptionCert:      pulumi.String("string"),
	S3Bucket:            pulumi.String("string"),
	CloudwatchNamespace: pulumi.String("string"),
	StackId:             pulumi.String("string"),
	StackStatus:         pulumi.String("string"),
	AuditlogGroup:       pulumi.String("string"),
})

var accountOnboardingStackResource = new AccountOnboardingStack("accountOnboardingStackResource", AccountOnboardingStackArgs.builder()
    .externalId("string")
    .trustedAccount("string")
    .cftRoleName("string")
    .accountId("string")
    .snsTopicArn("string")
    .onboardingCft("string")
    .cloudwatchLogGroup("string")
    .endpointMode("string")
    .kinesisFirehose("string")
    .decryptionCert("string")
    .s3Bucket("string")
    .cloudwatchNamespace("string")
    .stackId("string")
    .stackStatus("string")
    .auditlogGroup("string")
    .build());

account_onboarding_stack_resource = cloudngfwaws.AccountOnboardingStack("accountOnboardingStackResource",
    external_id="string",
    trusted_account="string",
    cft_role_name="string",
    account_id="string",
    sns_topic_arn="string",
    onboarding_cft="string",
    cloudwatch_log_group="string",
    endpoint_mode="string",
    kinesis_firehose="string",
    decryption_cert="string",
    s3_bucket="string",
    cloudwatch_namespace="string",
    stack_id="string",
    stack_status="string",
    auditlog_group="string")

const accountOnboardingStackResource = new cloudngfwaws.AccountOnboardingStack("accountOnboardingStackResource", {
    externalId: "string",
    trustedAccount: "string",
    cftRoleName: "string",
    accountId: "string",
    snsTopicArn: "string",
    onboardingCft: "string",
    cloudwatchLogGroup: "string",
    endpointMode: "string",
    kinesisFirehose: "string",
    decryptionCert: "string",
    s3Bucket: "string",
    cloudwatchNamespace: "string",
    stackId: "string",
    stackStatus: "string",
    auditlogGroup: "string",
});

type: cloudngfwaws:AccountOnboardingStack
properties:
    accountId: string
    auditlogGroup: string
    cftRoleName: string
    cloudwatchLogGroup: string
    cloudwatchNamespace: string
    decryptionCert: string
    endpointMode: string
    externalId: string
    kinesisFirehose: string
    onboardingCft: string
    s3Bucket: string
    snsTopicArn: string
    stackId: string
    stackStatus: string
    trustedAccount: string

AccountOnboardingStack Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The AccountOnboardingStack resource accepts the following input properties:

AccountId string: The account IDs
CftRoleName string: Role name to run the account onboarding CFT in each account to be onboarded.
ExternalId string: External Id of the onboarded account
OnboardingCft string: Role name to run the account onboarding CFT in each account to be onboarded.
SnsTopicArn string: SNS topic ARN to publish the role ARNs
TrustedAccount string: PANW Cloud NGFW trusted account Id
AuditlogGroup string: Audit Log Group Name
CloudwatchLogGroup string: Cloudwatch Log Group
CloudwatchNamespace string: Cloudwatch Namespace
DecryptionCert string: The CloudNGFW can decrypt inbound and outbound traffic by providing a certificate stored in secret Manager. The role allows the service to access a certificate configured in the rulestack. Only certificated tagged with PaloAltoCloudNGFW can be accessed
EndpointMode string: Controls whether cloud NGFW will create firewall endpoints automatitically in customer subnets
KinesisFirehose string: Kinesis Firehose for logging
S3Bucket string: S3 Bucket Name for Logging. Logging roles provide access to create log contents in this bucket.
StackId string: ID of the account onboarding CFT stack
StackStatus string: Status of the account onboarding CFT stack.

AccountId string: The account IDs
CftRoleName string: Role name to run the account onboarding CFT in each account to be onboarded.
ExternalId string: External Id of the onboarded account
OnboardingCft string: Role name to run the account onboarding CFT in each account to be onboarded.
SnsTopicArn string: SNS topic ARN to publish the role ARNs
TrustedAccount string: PANW Cloud NGFW trusted account Id
AuditlogGroup string: Audit Log Group Name
CloudwatchLogGroup string: Cloudwatch Log Group
CloudwatchNamespace string: Cloudwatch Namespace
DecryptionCert string: The CloudNGFW can decrypt inbound and outbound traffic by providing a certificate stored in secret Manager. The role allows the service to access a certificate configured in the rulestack. Only certificated tagged with PaloAltoCloudNGFW can be accessed
EndpointMode string: Controls whether cloud NGFW will create firewall endpoints automatitically in customer subnets
KinesisFirehose string: Kinesis Firehose for logging
S3Bucket string: S3 Bucket Name for Logging. Logging roles provide access to create log contents in this bucket.
StackId string: ID of the account onboarding CFT stack
StackStatus string: Status of the account onboarding CFT stack.

accountId String: The account IDs
cftRoleName String: Role name to run the account onboarding CFT in each account to be onboarded.
externalId String: External Id of the onboarded account
onboardingCft String: Role name to run the account onboarding CFT in each account to be onboarded.
snsTopicArn String: SNS topic ARN to publish the role ARNs
trustedAccount String: PANW Cloud NGFW trusted account Id
auditlogGroup String: Audit Log Group Name
cloudwatchLogGroup String: Cloudwatch Log Group
cloudwatchNamespace String: Cloudwatch Namespace
decryptionCert String: The CloudNGFW can decrypt inbound and outbound traffic by providing a certificate stored in secret Manager. The role allows the service to access a certificate configured in the rulestack. Only certificated tagged with PaloAltoCloudNGFW can be accessed
endpointMode String: Controls whether cloud NGFW will create firewall endpoints automatitically in customer subnets
kinesisFirehose String: Kinesis Firehose for logging
s3Bucket String: S3 Bucket Name for Logging. Logging roles provide access to create log contents in this bucket.
stackId String: ID of the account onboarding CFT stack
stackStatus String: Status of the account onboarding CFT stack.

accountId string: The account IDs
cftRoleName string: Role name to run the account onboarding CFT in each account to be onboarded.
externalId string: External Id of the onboarded account
onboardingCft string: Role name to run the account onboarding CFT in each account to be onboarded.
snsTopicArn string: SNS topic ARN to publish the role ARNs
trustedAccount string: PANW Cloud NGFW trusted account Id
auditlogGroup string: Audit Log Group Name
cloudwatchLogGroup string: Cloudwatch Log Group
cloudwatchNamespace string: Cloudwatch Namespace
decryptionCert string: The CloudNGFW can decrypt inbound and outbound traffic by providing a certificate stored in secret Manager. The role allows the service to access a certificate configured in the rulestack. Only certificated tagged with PaloAltoCloudNGFW can be accessed
endpointMode string: Controls whether cloud NGFW will create firewall endpoints automatitically in customer subnets
kinesisFirehose string: Kinesis Firehose for logging
s3Bucket string: S3 Bucket Name for Logging. Logging roles provide access to create log contents in this bucket.
stackId string: ID of the account onboarding CFT stack
stackStatus string: Status of the account onboarding CFT stack.

account_id str: The account IDs
cft_role_name str: Role name to run the account onboarding CFT in each account to be onboarded.
external_id str: External Id of the onboarded account
onboarding_cft str: Role name to run the account onboarding CFT in each account to be onboarded.
sns_topic_arn str: SNS topic ARN to publish the role ARNs
trusted_account str: PANW Cloud NGFW trusted account Id
auditlog_group str: Audit Log Group Name
cloudwatch_log_group str: Cloudwatch Log Group
cloudwatch_namespace str: Cloudwatch Namespace
decryption_cert str: The CloudNGFW can decrypt inbound and outbound traffic by providing a certificate stored in secret Manager. The role allows the service to access a certificate configured in the rulestack. Only certificated tagged with PaloAltoCloudNGFW can be accessed
endpoint_mode str: Controls whether cloud NGFW will create firewall endpoints automatitically in customer subnets
kinesis_firehose str: Kinesis Firehose for logging
s3_bucket str: S3 Bucket Name for Logging. Logging roles provide access to create log contents in this bucket.
stack_id str: ID of the account onboarding CFT stack
stack_status str: Status of the account onboarding CFT stack.

accountId String: The account IDs
cftRoleName String: Role name to run the account onboarding CFT in each account to be onboarded.
externalId String: External Id of the onboarded account
onboardingCft String: Role name to run the account onboarding CFT in each account to be onboarded.
snsTopicArn String: SNS topic ARN to publish the role ARNs
trustedAccount String: PANW Cloud NGFW trusted account Id
auditlogGroup String: Audit Log Group Name
cloudwatchLogGroup String: Cloudwatch Log Group
cloudwatchNamespace String: Cloudwatch Namespace
decryptionCert String: The CloudNGFW can decrypt inbound and outbound traffic by providing a certificate stored in secret Manager. The role allows the service to access a certificate configured in the rulestack. Only certificated tagged with PaloAltoCloudNGFW can be accessed
endpointMode String: Controls whether cloud NGFW will create firewall endpoints automatitically in customer subnets
kinesisFirehose String: Kinesis Firehose for logging
s3Bucket String: S3 Bucket Name for Logging. Logging roles provide access to create log contents in this bucket.
stackId String: ID of the account onboarding CFT stack
stackStatus String: Status of the account onboarding CFT stack.

Outputs

All input properties are implicitly available as output properties. Additionally, the AccountOnboardingStack resource produces the following output properties:

Id string: The provider-assigned unique ID for this managed resource.

Id string: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

id string: The provider-assigned unique ID for this managed resource.

id str: The provider-assigned unique ID for this managed resource.

id String: The provider-assigned unique ID for this managed resource.

Look up Existing AccountOnboardingStack Resource

Get an existing AccountOnboardingStack resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.

TypeScript
Python
Go
C#
Java
YAML

public static get(name: string, id: Input<ID>, state?: AccountOnboardingStackState, opts?: CustomResourceOptions): AccountOnboardingStack

@staticmethod
def get(resource_name: str,
        id: str,
        opts: Optional[ResourceOptions] = None,
        account_id: Optional[str] = None,
        auditlog_group: Optional[str] = None,
        cft_role_name: Optional[str] = None,
        cloudwatch_log_group: Optional[str] = None,
        cloudwatch_namespace: Optional[str] = None,
        decryption_cert: Optional[str] = None,
        endpoint_mode: Optional[str] = None,
        external_id: Optional[str] = None,
        kinesis_firehose: Optional[str] = None,
        onboarding_cft: Optional[str] = None,
        s3_bucket: Optional[str] = None,
        sns_topic_arn: Optional[str] = None,
        stack_id: Optional[str] = None,
        stack_status: Optional[str] = None,
        trusted_account: Optional[str] = None) -> AccountOnboardingStack

func GetAccountOnboardingStack(ctx *Context, name string, id IDInput, state *AccountOnboardingStackState, opts ...ResourceOption) (*AccountOnboardingStack, error)

public static AccountOnboardingStack Get(string name, Input<string> id, AccountOnboardingStackState? state, CustomResourceOptions? opts = null)

public static AccountOnboardingStack get(String name, Output<String> id, AccountOnboardingStackState state, CustomResourceOptions options)

resources:  _:    type: cloudngfwaws:AccountOnboardingStack    get:      id: ${id}

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

resource_name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

name: The unique name of the resulting resource.
id: The unique provider ID of the resource to lookup.
state: Any extra arguments used during the lookup.
opts: A bag of options that control this resource's behavior.

The following state arguments are supported:

AccountId string: The account IDs
AuditlogGroup string: Audit Log Group Name
CftRoleName string: Role name to run the account onboarding CFT in each account to be onboarded.
CloudwatchLogGroup string: Cloudwatch Log Group
CloudwatchNamespace string: Cloudwatch Namespace
DecryptionCert string: The CloudNGFW can decrypt inbound and outbound traffic by providing a certificate stored in secret Manager. The role allows the service to access a certificate configured in the rulestack. Only certificated tagged with PaloAltoCloudNGFW can be accessed
EndpointMode string: Controls whether cloud NGFW will create firewall endpoints automatitically in customer subnets
ExternalId string: External Id of the onboarded account
KinesisFirehose string: Kinesis Firehose for logging
OnboardingCft string: Role name to run the account onboarding CFT in each account to be onboarded.
S3Bucket string: S3 Bucket Name for Logging. Logging roles provide access to create log contents in this bucket.
SnsTopicArn string: SNS topic ARN to publish the role ARNs
StackId string: ID of the account onboarding CFT stack
StackStatus string: Status of the account onboarding CFT stack.
TrustedAccount string: PANW Cloud NGFW trusted account Id

AccountId string: The account IDs
AuditlogGroup string: Audit Log Group Name
CftRoleName string: Role name to run the account onboarding CFT in each account to be onboarded.
CloudwatchLogGroup string: Cloudwatch Log Group
CloudwatchNamespace string: Cloudwatch Namespace
DecryptionCert string: The CloudNGFW can decrypt inbound and outbound traffic by providing a certificate stored in secret Manager. The role allows the service to access a certificate configured in the rulestack. Only certificated tagged with PaloAltoCloudNGFW can be accessed
EndpointMode string: Controls whether cloud NGFW will create firewall endpoints automatitically in customer subnets
ExternalId string: External Id of the onboarded account
KinesisFirehose string: Kinesis Firehose for logging
OnboardingCft string: Role name to run the account onboarding CFT in each account to be onboarded.
S3Bucket string: S3 Bucket Name for Logging. Logging roles provide access to create log contents in this bucket.
SnsTopicArn string: SNS topic ARN to publish the role ARNs
StackId string: ID of the account onboarding CFT stack
StackStatus string: Status of the account onboarding CFT stack.
TrustedAccount string: PANW Cloud NGFW trusted account Id

accountId String: The account IDs
auditlogGroup String: Audit Log Group Name
cftRoleName String: Role name to run the account onboarding CFT in each account to be onboarded.
cloudwatchLogGroup String: Cloudwatch Log Group
cloudwatchNamespace String: Cloudwatch Namespace
decryptionCert String: The CloudNGFW can decrypt inbound and outbound traffic by providing a certificate stored in secret Manager. The role allows the service to access a certificate configured in the rulestack. Only certificated tagged with PaloAltoCloudNGFW can be accessed
endpointMode String: Controls whether cloud NGFW will create firewall endpoints automatitically in customer subnets
externalId String: External Id of the onboarded account
kinesisFirehose String: Kinesis Firehose for logging
onboardingCft String: Role name to run the account onboarding CFT in each account to be onboarded.
s3Bucket String: S3 Bucket Name for Logging. Logging roles provide access to create log contents in this bucket.
snsTopicArn String: SNS topic ARN to publish the role ARNs
stackId String: ID of the account onboarding CFT stack
stackStatus String: Status of the account onboarding CFT stack.
trustedAccount String: PANW Cloud NGFW trusted account Id

accountId string: The account IDs
auditlogGroup string: Audit Log Group Name
cftRoleName string: Role name to run the account onboarding CFT in each account to be onboarded.
cloudwatchLogGroup string: Cloudwatch Log Group
cloudwatchNamespace string: Cloudwatch Namespace
decryptionCert string: The CloudNGFW can decrypt inbound and outbound traffic by providing a certificate stored in secret Manager. The role allows the service to access a certificate configured in the rulestack. Only certificated tagged with PaloAltoCloudNGFW can be accessed
endpointMode string: Controls whether cloud NGFW will create firewall endpoints automatitically in customer subnets
externalId string: External Id of the onboarded account
kinesisFirehose string: Kinesis Firehose for logging
onboardingCft string: Role name to run the account onboarding CFT in each account to be onboarded.
s3Bucket string: S3 Bucket Name for Logging. Logging roles provide access to create log contents in this bucket.
snsTopicArn string: SNS topic ARN to publish the role ARNs
stackId string: ID of the account onboarding CFT stack
stackStatus string: Status of the account onboarding CFT stack.
trustedAccount string: PANW Cloud NGFW trusted account Id

account_id str: The account IDs
auditlog_group str: Audit Log Group Name
cft_role_name str: Role name to run the account onboarding CFT in each account to be onboarded.
cloudwatch_log_group str: Cloudwatch Log Group
cloudwatch_namespace str: Cloudwatch Namespace
decryption_cert str: The CloudNGFW can decrypt inbound and outbound traffic by providing a certificate stored in secret Manager. The role allows the service to access a certificate configured in the rulestack. Only certificated tagged with PaloAltoCloudNGFW can be accessed
endpoint_mode str: Controls whether cloud NGFW will create firewall endpoints automatitically in customer subnets
external_id str: External Id of the onboarded account
kinesis_firehose str: Kinesis Firehose for logging
onboarding_cft str: Role name to run the account onboarding CFT in each account to be onboarded.
s3_bucket str: S3 Bucket Name for Logging. Logging roles provide access to create log contents in this bucket.
sns_topic_arn str: SNS topic ARN to publish the role ARNs
stack_id str: ID of the account onboarding CFT stack
stack_status str: Status of the account onboarding CFT stack.
trusted_account str: PANW Cloud NGFW trusted account Id

accountId String: The account IDs
auditlogGroup String: Audit Log Group Name
cftRoleName String: Role name to run the account onboarding CFT in each account to be onboarded.
cloudwatchLogGroup String: Cloudwatch Log Group
cloudwatchNamespace String: Cloudwatch Namespace
decryptionCert String: The CloudNGFW can decrypt inbound and outbound traffic by providing a certificate stored in secret Manager. The role allows the service to access a certificate configured in the rulestack. Only certificated tagged with PaloAltoCloudNGFW can be accessed
endpointMode String: Controls whether cloud NGFW will create firewall endpoints automatitically in customer subnets
externalId String: External Id of the onboarded account
kinesisFirehose String: Kinesis Firehose for logging
onboardingCft String: Role name to run the account onboarding CFT in each account to be onboarded.
s3Bucket String: S3 Bucket Name for Logging. Logging roles provide access to create log contents in this bucket.
snsTopicArn String: SNS topic ARN to publish the role ARNs
stackId String: ID of the account onboarding CFT stack
stackStatus String: Status of the account onboarding CFT stack.
trustedAccount String: PANW Cloud NGFW trusted account Id

Package Details

Repository: cloudngfwaws pulumi/pulumi-cloudngfwaws
License: Apache-2.0
Notes: This Pulumi package is based on the cloudngfwaws Terraform Provider.

Palo Alto Networks Cloud NGFW for AWS v0.1.1 published on Saturday, Mar 15, 2025 by Pulumi

pulumi/pulumi-cloudngfwaws

cloudngfwaws.AccountOnboardingStack

On this page

On this page

Admin Permission Type

Create AccountOnboardingStack Resource

Constructor syntax

Parameters

Constructor example

AccountOnboardingStack Resource Properties

Inputs

Outputs

Look up Existing AccountOnboardingStack Resource

Package Details

On this page

On this page