AWS Network Firewall needs waiters

[ajupatil]

Describe the feature

Hi ya'll. AWS Network Firewall has no waiters according to the service doc: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/network-firewall.html

Is this in the works or something I could contribute to?

I have custom resource logic in CloudFormation where I need to check the status of deployment for firewall endpoints before requesting the endpoint list. Network Firewall takes several minutes to deploy a new endpoint or assign an endpoint id. I'd imagine that there are usually post-creation steps users would want to carry out past this point in a build script such as checking if Firewall is in PROVISIONED state or all subnets are in associated state before fetching the information on endpoints.

Use Case

Anyone trying to build an install script or custom resource in Cloudformation for a complete install might want to poll the firewall before continuing to the next service request/call.

Proposed Solution

Create a waiter for create-firewall, associate-subnets, and disassociate-subnets per the standard in botocore.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

SDK version used

1.28.19

Environment details (OS name and version, etc.)

Python 3.11 Lambda runtime

[tim-finnigan]

Hi @ajupatil thanks for the feature request. Waiters are owned and implemented by service teams because they are used across AWS SDKs. So we can forward this feature request to the Network Firewall team for consideration. (Or if you have a support plan we recommend reaching out through AWS Support with feature requests like this.)

If you would like to design custom waiters for this service you could look at other services like EC2 for reference. But for a long-term solution these waiters would need to be implemented upstream by the service team.

Just to confirm, it sounds like you're requesting the following waiters:

• FirewallCreated
• SubnetsAssociated
• SubnetsDisassociated

Please let me know if you'd like to elaborate on any of these or provide more details regarding your use cases.

[ajupatil]

@tim-finnigan Thanks.. I will reach out to support team. I have custom resource that is dependent on the state of Firewall endpoints. The firewall endpoints deployed at any time change based on a parameter i.e. Multi-AZ(True/False). I want to wait for Firewall to associate or disassociate the endpoints before fetching the endpoint information using custom resource.

[tim-finnigan]

Thanks for letting us know and sharing your use case. If you want to share any updates here on what you hear back from Support, please do for anyone else in who might be interested in this. But I'm going to close this issue as it is not something the Boto3 team will track as directly planned work.