firewallFilteringRule.go

// Code generated by the Pulumi Terraform Bridge (tfgen) Tool DO NOT EDIT.
// *** WARNING: Do not edit by hand unless you're certain you know what you are doing! ***

package zia

import (
	"context"
	"reflect"

	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
	"github.com/zscaler/pulumi-zia/sdk/go/zia/internal"
)

// The **zia_firewall_filtering_rule** resource allows the creation and management of ZIA Cloud Firewall filtering rules in the Zscaler Internet Access.
//
// ## Example Usage
//
// <!--Start PulumiCodeChooser -->
// ```go
// package main
//
// import (
//
//	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
//	"github.com/zscaler/pulumi-zia/sdk/go/zia"
//
// )
//
//	func main() {
//		pulumi.Run(func(ctx *pulumi.Context) error {
//			zscalerProxyNwServices, err := zia.LookupFirewallFilteringNetworkServices(ctx, &zia.LookupFirewallFilteringNetworkServicesArgs{
//				Name: pulumi.StringRef("ZSCALER_PROXY_NW_SERVICES"),
//			}, nil)
//			if err != nil {
//				return err
//			}
//			engineering, err := zia.GetDepartmentManagement(ctx, &zia.GetDepartmentManagementArgs{
//				Name: pulumi.StringRef("Engineering"),
//			}, nil)
//			if err != nil {
//				return err
//			}
//			normalInternet, err := zia.GetGroupManagement(ctx, &zia.GetGroupManagementArgs{
//				Name: pulumi.StringRef("Normal_Internet"),
//			}, nil)
//			if err != nil {
//				return err
//			}
//			workHours, err := zia.GetTimeWindow(ctx, &zia.GetTimeWindowArgs{
//				Name: pulumi.StringRef("Work hours"),
//			}, nil)
//			if err != nil {
//				return err
//			}
//			_, err = zia.NewFirewallFilteringRule(ctx, "example", &zia.FirewallFilteringRuleArgs{
//				Description:       pulumi.String("Example"),
//				Action:            pulumi.String("ALLOW"),
//				State:             pulumi.String("ENABLED"),
//				Order:             pulumi.Int(1),
//				EnableFullLogging: pulumi.Bool(true),
//				NwServices: &zia.FirewallFilteringRuleNwServicesArgs{
//					Ids: pulumi.IntArray{
//						pulumi.Int(zscalerProxyNwServices.Id),
//					},
//				},
//				Departments: &zia.FirewallFilteringRuleDepartmentsArgs{
//					Ids: pulumi.IntArray{
//						pulumi.Int(engineering.Id),
//					},
//				},
//				Groups: &zia.FirewallFilteringRuleGroupsArgs{
//					Ids: pulumi.IntArray{
//						pulumi.Int(normalInternet.Id),
//					},
//				},
//				TimeWindows: &zia.FirewallFilteringRuleTimeWindowsArgs{
//					Ids: pulumi.IntArray{
//						pulumi.Int(workHours.Id),
//					},
//				},
//			})
//			if err != nil {
//				return err
//			}
//			return nil
//		})
//	}
//
// ```
// <!--End PulumiCodeChooser -->
//
// ## Import
//
// Zscaler offers a dedicated tool called Zscaler-Terraformer to allow the automated import of ZIA configurations into Terraform-compliant HashiCorp Configuration Language.
//
// # Visit
//
// **zia_firewall_filtering_rule** can be imported by using `<RULE ID>` or `<RULE NAME>` as the import ID.
//
// For example:
//
// ```sh
// $ pulumi import zia:index/firewallFilteringRule:FirewallFilteringRule example <rule_id>
// ```
//
// or
//
// ```sh
// $ pulumi import zia:index/firewallFilteringRule:FirewallFilteringRule example <rule_name>
// ```
type FirewallFilteringRule struct {
	pulumi.CustomResourceState

	// Choose the action of the service when packets match the rule. The following actions are accepted: `ALLOW`, `BLOCK_DROP`, `BLOCK_RESET`, `BLOCK_ICMP`, `EVAL_NWAPP`
	Action pulumi.StringPtrOutput `pulumi:"action"`
	// Application service groups on which this rule is applied
	AppServiceGroups FirewallFilteringRuleAppServiceGroupsOutput `pulumi:"appServiceGroups"`
	// Application services on which this rule is applied
	AppServices FirewallFilteringRuleAppServicesOutput `pulumi:"appServices"`
	// If set to true, the default rule is applied
	DefaultRule pulumi.BoolPtrOutput `pulumi:"defaultRule"`
	// Apply to any number of departments When not used it implies `Any` to apply the rule to all departments.
	Departments FirewallFilteringRuleDepartmentsOutput `pulumi:"departments"`
	// Enter additional notes or information. The description cannot exceed 10,240 characters.
	Description pulumi.StringPtrOutput `pulumi:"description"`
	// ** - (Optional) -  IP addresses and fully qualified domain names (FQDNs), if the domain has multiple destination IP addresses or if its IP addresses may change. For IP addresses, you can enter individual IP addresses, subnets, or address ranges. If adding multiple items, hit Enter after each entry.
	DestAddresses pulumi.StringArrayOutput `pulumi:"destAddresses"`
	// ** - (Optional) Identify destinations based on the location of a server, select Any to apply the rule to all countries or select the countries to which you want to control traffic.
	DestCountries pulumi.StringArrayOutput `pulumi:"destCountries"`
	// ** - (Optional) identify destinations based on the URL category of the domain, select Any to apply the rule to all categories or select the specific categories you want to control.
	DestIpCategories pulumi.StringArrayOutput `pulumi:"destIpCategories"`
	// ** - (Optional) Any number of destination IP address groups that you want to control with this rule.
	DestIpGroups FirewallFilteringRuleDestIpGroupsOutput `pulumi:"destIpGroups"`
	// This field is applicable for devices that are managed using Zscaler Client Connector.
	DeviceGroups FirewallFilteringRuleDeviceGroupsOutput `pulumi:"deviceGroups"`
	// List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed
	// using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the
	// Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
	DeviceTrustLevels pulumi.StringArrayOutput `pulumi:"deviceTrustLevels"`
	// Name-ID pairs of devices for which rule must be applied.
	Devices           FirewallFilteringRuleDevicesOutput `pulumi:"devices"`
	EnableFullLogging pulumi.BoolPtrOutput               `pulumi:"enableFullLogging"`
	// You can manually select up to `8` groups. When not used it implies `Any` to apply the rule to all groups.
	Groups FirewallFilteringRuleGroupsOutput `pulumi:"groups"`
	// Labels that are applicable to the rule.
	Labels FirewallFilteringRuleLabelsOutput `pulumi:"labels"`
	// You can manually select up to `32` location groups. When not used it implies `Any` to apply the rule to all location groups.
	LocationGroups FirewallFilteringRuleLocationGroupsOutput `pulumi:"locationGroups"`
	// You can manually select up to `8` locations. When not used it implies `Any` to apply the rule to all groups.
	Locations FirewallFilteringRuleLocationsOutput `pulumi:"locations"`
	// The name of the workload group
	//
	// * `Other Exported Arguments`
	Name pulumi.StringOutput `pulumi:"name"`
	// Any number of application groups that you want to control with this rule. The service provides predefined applications that you can group, but not modify
	NwApplicationGroups FirewallFilteringRuleNwApplicationGroupsOutput `pulumi:"nwApplicationGroups"`
	// When not used it applies the rule to all applications. The service provides predefined applications, which you can group, but not modify.
	//
	// `source ip addresses` supports the following attributes:
	NwApplications pulumi.StringArrayOutput `pulumi:"nwApplications"`
	// Any number of predefined or custom network service groups to which the rule applies.
	NwServiceGroups FirewallFilteringRuleNwServiceGroupsOutput `pulumi:"nwServiceGroups"`
	// When not used it applies the rule to all network services or you can select specific network services. The Zscaler firewall has predefined services and you can configure up to `1,024` additional custom services.
	//
	// `network applications` supports the following attributes:
	NwServices FirewallFilteringRuleNwServicesOutput `pulumi:"nwServices"`
	// Policy rules are evaluated in ascending numerical order (Rule 1 before Rule 2, and so on), and the Rule Order reflects this rule's place in the order.
	Order pulumi.IntPtrOutput `pulumi:"order"`
	// If set to true, a predefined rule is applied
	Predefined pulumi.BoolPtrOutput `pulumi:"predefined"`
	// By default, the admin ranking is disabled. To use this feature, you must enable admin rank. The default value is `7`.
	//
	// `Who, Where and When` supports the following attributes:
	Rank   pulumi.IntPtrOutput `pulumi:"rank"`
	RuleId pulumi.IntOutput    `pulumi:"ruleId"`
	// Any number of source IP address groups that you want to control with this rule.
	SrcIpGroups FirewallFilteringRuleSrcIpGroupsOutput `pulumi:"srcIpGroups"`
	// You can enter individual IP addresses, subnets, or address ranges.
	SrcIps pulumi.StringArrayOutput `pulumi:"srcIps"`
	// An enabled rule is actively enforced. A disabled rule is not actively enforced but does not lose its place in the Rule Order. The service skips it and moves to the next rule.
	State pulumi.StringPtrOutput `pulumi:"state"`
	// You can manually select up to `2` time intervals. When not used it implies `always` to apply the rule to all time intervals.
	TimeWindows FirewallFilteringRuleTimeWindowsOutput `pulumi:"timeWindows"`
	// You can manually select up to `4` general and/or special users. When not used it implies `Any` to apply the rule to all users.
	Users FirewallFilteringRuleUsersOutput `pulumi:"users"`
	// The list of preconfigured workload groups to which the policy must be applied
	WorkloadGroups FirewallFilteringRuleWorkloadGroupArrayOutput `pulumi:"workloadGroups"`
	// The list of ZPA Application Segments for which this rule is applicable. This field is applicable only for the ZPA
	// Gateway forwarding method.
	ZpaAppSegments FirewallFilteringRuleZpaAppSegmentArrayOutput `pulumi:"zpaAppSegments"`
}

// NewFirewallFilteringRule registers a new resource with the given unique name, arguments, and options.
func NewFirewallFilteringRule(ctx *pulumi.Context,
	name string, args *FirewallFilteringRuleArgs, opts ...pulumi.ResourceOption) (*FirewallFilteringRule, error) {
	if args == nil {
		args = &FirewallFilteringRuleArgs{}
	}

	opts = internal.PkgResourceDefaultOpts(opts)
	var resource FirewallFilteringRule
	err := ctx.RegisterResource("zia:index/firewallFilteringRule:FirewallFilteringRule", name, args, &resource, opts...)
	if err != nil {
		return nil, err
	}
	return &resource, nil
}

// GetFirewallFilteringRule gets an existing FirewallFilteringRule resource's state with the given name, ID, and optional
// state properties that are used to uniquely qualify the lookup (nil if not required).
func GetFirewallFilteringRule(ctx *pulumi.Context,
	name string, id pulumi.IDInput, state *FirewallFilteringRuleState, opts ...pulumi.ResourceOption) (*FirewallFilteringRule, error) {
	var resource FirewallFilteringRule
	err := ctx.ReadResource("zia:index/firewallFilteringRule:FirewallFilteringRule", name, id, state, &resource, opts...)
	if err != nil {
		return nil, err
	}
	return &resource, nil
}

// Input properties used for looking up and filtering FirewallFilteringRule resources.
type firewallFilteringRuleState struct {
	// Choose the action of the service when packets match the rule. The following actions are accepted: `ALLOW`, `BLOCK_DROP`, `BLOCK_RESET`, `BLOCK_ICMP`, `EVAL_NWAPP`
	Action *string `pulumi:"action"`
	// Application service groups on which this rule is applied
	AppServiceGroups *FirewallFilteringRuleAppServiceGroups `pulumi:"appServiceGroups"`
	// Application services on which this rule is applied
	AppServices *FirewallFilteringRuleAppServices `pulumi:"appServices"`
	// If set to true, the default rule is applied
	DefaultRule *bool `pulumi:"defaultRule"`
	// Apply to any number of departments When not used it implies `Any` to apply the rule to all departments.
	Departments *FirewallFilteringRuleDepartments `pulumi:"departments"`
	// Enter additional notes or information. The description cannot exceed 10,240 characters.
	Description *string `pulumi:"description"`
	// ** - (Optional) -  IP addresses and fully qualified domain names (FQDNs), if the domain has multiple destination IP addresses or if its IP addresses may change. For IP addresses, you can enter individual IP addresses, subnets, or address ranges. If adding multiple items, hit Enter after each entry.
	DestAddresses []string `pulumi:"destAddresses"`
	// ** - (Optional) Identify destinations based on the location of a server, select Any to apply the rule to all countries or select the countries to which you want to control traffic.
	DestCountries []string `pulumi:"destCountries"`
	// ** - (Optional) identify destinations based on the URL category of the domain, select Any to apply the rule to all categories or select the specific categories you want to control.
	DestIpCategories []string `pulumi:"destIpCategories"`
	// ** - (Optional) Any number of destination IP address groups that you want to control with this rule.
	DestIpGroups *FirewallFilteringRuleDestIpGroups `pulumi:"destIpGroups"`
	// This field is applicable for devices that are managed using Zscaler Client Connector.
	DeviceGroups *FirewallFilteringRuleDeviceGroups `pulumi:"deviceGroups"`
	// List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed
	// using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the
	// Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
	DeviceTrustLevels []string `pulumi:"deviceTrustLevels"`
	// Name-ID pairs of devices for which rule must be applied.
	Devices           *FirewallFilteringRuleDevices `pulumi:"devices"`
	EnableFullLogging *bool                         `pulumi:"enableFullLogging"`
	// You can manually select up to `8` groups. When not used it implies `Any` to apply the rule to all groups.
	Groups *FirewallFilteringRuleGroups `pulumi:"groups"`
	// Labels that are applicable to the rule.
	Labels *FirewallFilteringRuleLabels `pulumi:"labels"`
	// You can manually select up to `32` location groups. When not used it implies `Any` to apply the rule to all location groups.
	LocationGroups *FirewallFilteringRuleLocationGroups `pulumi:"locationGroups"`
	// You can manually select up to `8` locations. When not used it implies `Any` to apply the rule to all groups.
	Locations *FirewallFilteringRuleLocations `pulumi:"locations"`
	// The name of the workload group
	//
	// * `Other Exported Arguments`
	Name *string `pulumi:"name"`
	// Any number of application groups that you want to control with this rule. The service provides predefined applications that you can group, but not modify
	NwApplicationGroups *FirewallFilteringRuleNwApplicationGroups `pulumi:"nwApplicationGroups"`
	// When not used it applies the rule to all applications. The service provides predefined applications, which you can group, but not modify.
	//
	// `source ip addresses` supports the following attributes:
	NwApplications []string `pulumi:"nwApplications"`
	// Any number of predefined or custom network service groups to which the rule applies.
	NwServiceGroups *FirewallFilteringRuleNwServiceGroups `pulumi:"nwServiceGroups"`
	// When not used it applies the rule to all network services or you can select specific network services. The Zscaler firewall has predefined services and you can configure up to `1,024` additional custom services.
	//
	// `network applications` supports the following attributes:
	NwServices *FirewallFilteringRuleNwServices `pulumi:"nwServices"`
	// Policy rules are evaluated in ascending numerical order (Rule 1 before Rule 2, and so on), and the Rule Order reflects this rule's place in the order.
	Order *int `pulumi:"order"`
	// If set to true, a predefined rule is applied
	Predefined *bool `pulumi:"predefined"`
	// By default, the admin ranking is disabled. To use this feature, you must enable admin rank. The default value is `7`.
	//
	// `Who, Where and When` supports the following attributes:
	Rank   *int `pulumi:"rank"`
	RuleId *int `pulumi:"ruleId"`
	// Any number of source IP address groups that you want to control with this rule.
	SrcIpGroups *FirewallFilteringRuleSrcIpGroups `pulumi:"srcIpGroups"`
	// You can enter individual IP addresses, subnets, or address ranges.
	SrcIps []string `pulumi:"srcIps"`
	// An enabled rule is actively enforced. A disabled rule is not actively enforced but does not lose its place in the Rule Order. The service skips it and moves to the next rule.
	State *string `pulumi:"state"`
	// You can manually select up to `2` time intervals. When not used it implies `always` to apply the rule to all time intervals.
	TimeWindows *FirewallFilteringRuleTimeWindows `pulumi:"timeWindows"`
	// You can manually select up to `4` general and/or special users. When not used it implies `Any` to apply the rule to all users.
	Users *FirewallFilteringRuleUsers `pulumi:"users"`
	// The list of preconfigured workload groups to which the policy must be applied
	WorkloadGroups []FirewallFilteringRuleWorkloadGroup `pulumi:"workloadGroups"`
	// The list of ZPA Application Segments for which this rule is applicable. This field is applicable only for the ZPA
	// Gateway forwarding method.
	ZpaAppSegments []FirewallFilteringRuleZpaAppSegment `pulumi:"zpaAppSegments"`
}

type FirewallFilteringRuleState struct {
	// Choose the action of the service when packets match the rule. The following actions are accepted: `ALLOW`, `BLOCK_DROP`, `BLOCK_RESET`, `BLOCK_ICMP`, `EVAL_NWAPP`
	Action pulumi.StringPtrInput
	// Application service groups on which this rule is applied
	AppServiceGroups FirewallFilteringRuleAppServiceGroupsPtrInput
	// Application services on which this rule is applied
	AppServices FirewallFilteringRuleAppServicesPtrInput
	// If set to true, the default rule is applied
	DefaultRule pulumi.BoolPtrInput
	// Apply to any number of departments When not used it implies `Any` to apply the rule to all departments.
	Departments FirewallFilteringRuleDepartmentsPtrInput
	// Enter additional notes or information. The description cannot exceed 10,240 characters.
	Description pulumi.StringPtrInput
	// ** - (Optional) -  IP addresses and fully qualified domain names (FQDNs), if the domain has multiple destination IP addresses or if its IP addresses may change. For IP addresses, you can enter individual IP addresses, subnets, or address ranges. If adding multiple items, hit Enter after each entry.
	DestAddresses pulumi.StringArrayInput
	// ** - (Optional) Identify destinations based on the location of a server, select Any to apply the rule to all countries or select the countries to which you want to control traffic.
	DestCountries pulumi.StringArrayInput
	// ** - (Optional) identify destinations based on the URL category of the domain, select Any to apply the rule to all categories or select the specific categories you want to control.
	DestIpCategories pulumi.StringArrayInput
	// ** - (Optional) Any number of destination IP address groups that you want to control with this rule.
	DestIpGroups FirewallFilteringRuleDestIpGroupsPtrInput
	// This field is applicable for devices that are managed using Zscaler Client Connector.
	DeviceGroups FirewallFilteringRuleDeviceGroupsPtrInput
	// List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed
	// using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the
	// Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
	DeviceTrustLevels pulumi.StringArrayInput
	// Name-ID pairs of devices for which rule must be applied.
	Devices           FirewallFilteringRuleDevicesPtrInput
	EnableFullLogging pulumi.BoolPtrInput
	// You can manually select up to `8` groups. When not used it implies `Any` to apply the rule to all groups.
	Groups FirewallFilteringRuleGroupsPtrInput
	// Labels that are applicable to the rule.
	Labels FirewallFilteringRuleLabelsPtrInput
	// You can manually select up to `32` location groups. When not used it implies `Any` to apply the rule to all location groups.
	LocationGroups FirewallFilteringRuleLocationGroupsPtrInput
	// You can manually select up to `8` locations. When not used it implies `Any` to apply the rule to all groups.
	Locations FirewallFilteringRuleLocationsPtrInput
	// The name of the workload group
	//
	// * `Other Exported Arguments`
	Name pulumi.StringPtrInput
	// Any number of application groups that you want to control with this rule. The service provides predefined applications that you can group, but not modify
	NwApplicationGroups FirewallFilteringRuleNwApplicationGroupsPtrInput
	// When not used it applies the rule to all applications. The service provides predefined applications, which you can group, but not modify.
	//
	// `source ip addresses` supports the following attributes:
	NwApplications pulumi.StringArrayInput
	// Any number of predefined or custom network service groups to which the rule applies.
	NwServiceGroups FirewallFilteringRuleNwServiceGroupsPtrInput
	// When not used it applies the rule to all network services or you can select specific network services. The Zscaler firewall has predefined services and you can configure up to `1,024` additional custom services.
	//
	// `network applications` supports the following attributes:
	NwServices FirewallFilteringRuleNwServicesPtrInput
	// Policy rules are evaluated in ascending numerical order (Rule 1 before Rule 2, and so on), and the Rule Order reflects this rule's place in the order.
	Order pulumi.IntPtrInput
	// If set to true, a predefined rule is applied
	Predefined pulumi.BoolPtrInput
	// By default, the admin ranking is disabled. To use this feature, you must enable admin rank. The default value is `7`.
	//
	// `Who, Where and When` supports the following attributes:
	Rank   pulumi.IntPtrInput
	RuleId pulumi.IntPtrInput
	// Any number of source IP address groups that you want to control with this rule.
	SrcIpGroups FirewallFilteringRuleSrcIpGroupsPtrInput
	// You can enter individual IP addresses, subnets, or address ranges.
	SrcIps pulumi.StringArrayInput
	// An enabled rule is actively enforced. A disabled rule is not actively enforced but does not lose its place in the Rule Order. The service skips it and moves to the next rule.
	State pulumi.StringPtrInput
	// You can manually select up to `2` time intervals. When not used it implies `always` to apply the rule to all time intervals.
	TimeWindows FirewallFilteringRuleTimeWindowsPtrInput
	// You can manually select up to `4` general and/or special users. When not used it implies `Any` to apply the rule to all users.
	Users FirewallFilteringRuleUsersPtrInput
	// The list of preconfigured workload groups to which the policy must be applied
	WorkloadGroups FirewallFilteringRuleWorkloadGroupArrayInput
	// The list of ZPA Application Segments for which this rule is applicable. This field is applicable only for the ZPA
	// Gateway forwarding method.
	ZpaAppSegments FirewallFilteringRuleZpaAppSegmentArrayInput
}

func (FirewallFilteringRuleState) ElementType() reflect.Type {
	return reflect.TypeOf((*firewallFilteringRuleState)(nil)).Elem()
}

type firewallFilteringRuleArgs struct {
	// Choose the action of the service when packets match the rule. The following actions are accepted: `ALLOW`, `BLOCK_DROP`, `BLOCK_RESET`, `BLOCK_ICMP`, `EVAL_NWAPP`
	Action *string `pulumi:"action"`
	// Application service groups on which this rule is applied
	AppServiceGroups *FirewallFilteringRuleAppServiceGroups `pulumi:"appServiceGroups"`
	// Application services on which this rule is applied
	AppServices *FirewallFilteringRuleAppServices `pulumi:"appServices"`
	// If set to true, the default rule is applied
	DefaultRule *bool `pulumi:"defaultRule"`
	// Apply to any number of departments When not used it implies `Any` to apply the rule to all departments.
	Departments *FirewallFilteringRuleDepartments `pulumi:"departments"`
	// Enter additional notes or information. The description cannot exceed 10,240 characters.
	Description *string `pulumi:"description"`
	// ** - (Optional) -  IP addresses and fully qualified domain names (FQDNs), if the domain has multiple destination IP addresses or if its IP addresses may change. For IP addresses, you can enter individual IP addresses, subnets, or address ranges. If adding multiple items, hit Enter after each entry.
	DestAddresses []string `pulumi:"destAddresses"`
	// ** - (Optional) Identify destinations based on the location of a server, select Any to apply the rule to all countries or select the countries to which you want to control traffic.
	DestCountries []string `pulumi:"destCountries"`
	// ** - (Optional) identify destinations based on the URL category of the domain, select Any to apply the rule to all categories or select the specific categories you want to control.
	DestIpCategories []string `pulumi:"destIpCategories"`
	// ** - (Optional) Any number of destination IP address groups that you want to control with this rule.
	DestIpGroups *FirewallFilteringRuleDestIpGroups `pulumi:"destIpGroups"`
	// This field is applicable for devices that are managed using Zscaler Client Connector.
	DeviceGroups *FirewallFilteringRuleDeviceGroups `pulumi:"deviceGroups"`
	// List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed
	// using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the
	// Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
	DeviceTrustLevels []string `pulumi:"deviceTrustLevels"`
	// Name-ID pairs of devices for which rule must be applied.
	Devices           *FirewallFilteringRuleDevices `pulumi:"devices"`
	EnableFullLogging *bool                         `pulumi:"enableFullLogging"`
	// You can manually select up to `8` groups. When not used it implies `Any` to apply the rule to all groups.
	Groups *FirewallFilteringRuleGroups `pulumi:"groups"`
	// Labels that are applicable to the rule.
	Labels *FirewallFilteringRuleLabels `pulumi:"labels"`
	// You can manually select up to `32` location groups. When not used it implies `Any` to apply the rule to all location groups.
	LocationGroups *FirewallFilteringRuleLocationGroups `pulumi:"locationGroups"`
	// You can manually select up to `8` locations. When not used it implies `Any` to apply the rule to all groups.
	Locations *FirewallFilteringRuleLocations `pulumi:"locations"`
	// The name of the workload group
	//
	// * `Other Exported Arguments`
	Name *string `pulumi:"name"`
	// Any number of application groups that you want to control with this rule. The service provides predefined applications that you can group, but not modify
	NwApplicationGroups *FirewallFilteringRuleNwApplicationGroups `pulumi:"nwApplicationGroups"`
	// When not used it applies the rule to all applications. The service provides predefined applications, which you can group, but not modify.
	//
	// `source ip addresses` supports the following attributes:
	NwApplications []string `pulumi:"nwApplications"`
	// Any number of predefined or custom network service groups to which the rule applies.
	NwServiceGroups *FirewallFilteringRuleNwServiceGroups `pulumi:"nwServiceGroups"`
	// When not used it applies the rule to all network services or you can select specific network services. The Zscaler firewall has predefined services and you can configure up to `1,024` additional custom services.
	//
	// `network applications` supports the following attributes:
	NwServices *FirewallFilteringRuleNwServices `pulumi:"nwServices"`
	// Policy rules are evaluated in ascending numerical order (Rule 1 before Rule 2, and so on), and the Rule Order reflects this rule's place in the order.
	Order *int `pulumi:"order"`
	// If set to true, a predefined rule is applied
	Predefined *bool `pulumi:"predefined"`
	// By default, the admin ranking is disabled. To use this feature, you must enable admin rank. The default value is `7`.
	//
	// `Who, Where and When` supports the following attributes:
	Rank *int `pulumi:"rank"`
	// Any number of source IP address groups that you want to control with this rule.
	SrcIpGroups *FirewallFilteringRuleSrcIpGroups `pulumi:"srcIpGroups"`
	// You can enter individual IP addresses, subnets, or address ranges.
	SrcIps []string `pulumi:"srcIps"`
	// An enabled rule is actively enforced. A disabled rule is not actively enforced but does not lose its place in the Rule Order. The service skips it and moves to the next rule.
	State *string `pulumi:"state"`
	// You can manually select up to `2` time intervals. When not used it implies `always` to apply the rule to all time intervals.
	TimeWindows *FirewallFilteringRuleTimeWindows `pulumi:"timeWindows"`
	// You can manually select up to `4` general and/or special users. When not used it implies `Any` to apply the rule to all users.
	Users *FirewallFilteringRuleUsers `pulumi:"users"`
	// The list of preconfigured workload groups to which the policy must be applied
	WorkloadGroups []FirewallFilteringRuleWorkloadGroup `pulumi:"workloadGroups"`
	// The list of ZPA Application Segments for which this rule is applicable. This field is applicable only for the ZPA
	// Gateway forwarding method.
	ZpaAppSegments []FirewallFilteringRuleZpaAppSegment `pulumi:"zpaAppSegments"`
}

// The set of arguments for constructing a FirewallFilteringRule resource.
type FirewallFilteringRuleArgs struct {
	// Choose the action of the service when packets match the rule. The following actions are accepted: `ALLOW`, `BLOCK_DROP`, `BLOCK_RESET`, `BLOCK_ICMP`, `EVAL_NWAPP`
	Action pulumi.StringPtrInput
	// Application service groups on which this rule is applied
	AppServiceGroups FirewallFilteringRuleAppServiceGroupsPtrInput
	// Application services on which this rule is applied
	AppServices FirewallFilteringRuleAppServicesPtrInput
	// If set to true, the default rule is applied
	DefaultRule pulumi.BoolPtrInput
	// Apply to any number of departments When not used it implies `Any` to apply the rule to all departments.
	Departments FirewallFilteringRuleDepartmentsPtrInput
	// Enter additional notes or information. The description cannot exceed 10,240 characters.
	Description pulumi.StringPtrInput
	// ** - (Optional) -  IP addresses and fully qualified domain names (FQDNs), if the domain has multiple destination IP addresses or if its IP addresses may change. For IP addresses, you can enter individual IP addresses, subnets, or address ranges. If adding multiple items, hit Enter after each entry.
	DestAddresses pulumi.StringArrayInput
	// ** - (Optional) Identify destinations based on the location of a server, select Any to apply the rule to all countries or select the countries to which you want to control traffic.
	DestCountries pulumi.StringArrayInput
	// ** - (Optional) identify destinations based on the URL category of the domain, select Any to apply the rule to all categories or select the specific categories you want to control.
	DestIpCategories pulumi.StringArrayInput
	// ** - (Optional) Any number of destination IP address groups that you want to control with this rule.
	DestIpGroups FirewallFilteringRuleDestIpGroupsPtrInput
	// This field is applicable for devices that are managed using Zscaler Client Connector.
	DeviceGroups FirewallFilteringRuleDeviceGroupsPtrInput
	// List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed
	// using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the
	// Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
	DeviceTrustLevels pulumi.StringArrayInput
	// Name-ID pairs of devices for which rule must be applied.
	Devices           FirewallFilteringRuleDevicesPtrInput
	EnableFullLogging pulumi.BoolPtrInput
	// You can manually select up to `8` groups. When not used it implies `Any` to apply the rule to all groups.
	Groups FirewallFilteringRuleGroupsPtrInput
	// Labels that are applicable to the rule.
	Labels FirewallFilteringRuleLabelsPtrInput
	// You can manually select up to `32` location groups. When not used it implies `Any` to apply the rule to all location groups.
	LocationGroups FirewallFilteringRuleLocationGroupsPtrInput
	// You can manually select up to `8` locations. When not used it implies `Any` to apply the rule to all groups.
	Locations FirewallFilteringRuleLocationsPtrInput
	// The name of the workload group
	//
	// * `Other Exported Arguments`
	Name pulumi.StringPtrInput
	// Any number of application groups that you want to control with this rule. The service provides predefined applications that you can group, but not modify
	NwApplicationGroups FirewallFilteringRuleNwApplicationGroupsPtrInput
	// When not used it applies the rule to all applications. The service provides predefined applications, which you can group, but not modify.
	//
	// `source ip addresses` supports the following attributes:
	NwApplications pulumi.StringArrayInput
	// Any number of predefined or custom network service groups to which the rule applies.
	NwServiceGroups FirewallFilteringRuleNwServiceGroupsPtrInput
	// When not used it applies the rule to all network services or you can select specific network services. The Zscaler firewall has predefined services and you can configure up to `1,024` additional custom services.
	//
	// `network applications` supports the following attributes:
	NwServices FirewallFilteringRuleNwServicesPtrInput
	// Policy rules are evaluated in ascending numerical order (Rule 1 before Rule 2, and so on), and the Rule Order reflects this rule's place in the order.
	Order pulumi.IntPtrInput
	// If set to true, a predefined rule is applied
	Predefined pulumi.BoolPtrInput
	// By default, the admin ranking is disabled. To use this feature, you must enable admin rank. The default value is `7`.
	//
	// `Who, Where and When` supports the following attributes:
	Rank pulumi.IntPtrInput
	// Any number of source IP address groups that you want to control with this rule.
	SrcIpGroups FirewallFilteringRuleSrcIpGroupsPtrInput
	// You can enter individual IP addresses, subnets, or address ranges.
	SrcIps pulumi.StringArrayInput
	// An enabled rule is actively enforced. A disabled rule is not actively enforced but does not lose its place in the Rule Order. The service skips it and moves to the next rule.
	State pulumi.StringPtrInput
	// You can manually select up to `2` time intervals. When not used it implies `always` to apply the rule to all time intervals.
	TimeWindows FirewallFilteringRuleTimeWindowsPtrInput
	// You can manually select up to `4` general and/or special users. When not used it implies `Any` to apply the rule to all users.
	Users FirewallFilteringRuleUsersPtrInput
	// The list of preconfigured workload groups to which the policy must be applied
	WorkloadGroups FirewallFilteringRuleWorkloadGroupArrayInput
	// The list of ZPA Application Segments for which this rule is applicable. This field is applicable only for the ZPA
	// Gateway forwarding method.
	ZpaAppSegments FirewallFilteringRuleZpaAppSegmentArrayInput
}

func (FirewallFilteringRuleArgs) ElementType() reflect.Type {
	return reflect.TypeOf((*firewallFilteringRuleArgs)(nil)).Elem()
}

type FirewallFilteringRuleInput interface {
	pulumi.Input

	ToFirewallFilteringRuleOutput() FirewallFilteringRuleOutput
	ToFirewallFilteringRuleOutputWithContext(ctx context.Context) FirewallFilteringRuleOutput
}

func (*FirewallFilteringRule) ElementType() reflect.Type {
	return reflect.TypeOf((**FirewallFilteringRule)(nil)).Elem()
}

func (i *FirewallFilteringRule) ToFirewallFilteringRuleOutput() FirewallFilteringRuleOutput {
	return i.ToFirewallFilteringRuleOutputWithContext(context.Background())
}

func (i *FirewallFilteringRule) ToFirewallFilteringRuleOutputWithContext(ctx context.Context) FirewallFilteringRuleOutput {
	return pulumi.ToOutputWithContext(ctx, i).(FirewallFilteringRuleOutput)
}

// FirewallFilteringRuleArrayInput is an input type that accepts FirewallFilteringRuleArray and FirewallFilteringRuleArrayOutput values.
// You can construct a concrete instance of `FirewallFilteringRuleArrayInput` via:
//
//	FirewallFilteringRuleArray{ FirewallFilteringRuleArgs{...} }
type FirewallFilteringRuleArrayInput interface {
	pulumi.Input

	ToFirewallFilteringRuleArrayOutput() FirewallFilteringRuleArrayOutput
	ToFirewallFilteringRuleArrayOutputWithContext(context.Context) FirewallFilteringRuleArrayOutput
}

type FirewallFilteringRuleArray []FirewallFilteringRuleInput

func (FirewallFilteringRuleArray) ElementType() reflect.Type {
	return reflect.TypeOf((*[]*FirewallFilteringRule)(nil)).Elem()
}

func (i FirewallFilteringRuleArray) ToFirewallFilteringRuleArrayOutput() FirewallFilteringRuleArrayOutput {
	return i.ToFirewallFilteringRuleArrayOutputWithContext(context.Background())
}

func (i FirewallFilteringRuleArray) ToFirewallFilteringRuleArrayOutputWithContext(ctx context.Context) FirewallFilteringRuleArrayOutput {
	return pulumi.ToOutputWithContext(ctx, i).(FirewallFilteringRuleArrayOutput)
}

// FirewallFilteringRuleMapInput is an input type that accepts FirewallFilteringRuleMap and FirewallFilteringRuleMapOutput values.
// You can construct a concrete instance of `FirewallFilteringRuleMapInput` via:
//
//	FirewallFilteringRuleMap{ "key": FirewallFilteringRuleArgs{...} }
type FirewallFilteringRuleMapInput interface {
	pulumi.Input

	ToFirewallFilteringRuleMapOutput() FirewallFilteringRuleMapOutput
	ToFirewallFilteringRuleMapOutputWithContext(context.Context) FirewallFilteringRuleMapOutput
}

type FirewallFilteringRuleMap map[string]FirewallFilteringRuleInput

func (FirewallFilteringRuleMap) ElementType() reflect.Type {
	return reflect.TypeOf((*map[string]*FirewallFilteringRule)(nil)).Elem()
}

func (i FirewallFilteringRuleMap) ToFirewallFilteringRuleMapOutput() FirewallFilteringRuleMapOutput {
	return i.ToFirewallFilteringRuleMapOutputWithContext(context.Background())
}

func (i FirewallFilteringRuleMap) ToFirewallFilteringRuleMapOutputWithContext(ctx context.Context) FirewallFilteringRuleMapOutput {
	return pulumi.ToOutputWithContext(ctx, i).(FirewallFilteringRuleMapOutput)
}

type FirewallFilteringRuleOutput struct{ *pulumi.OutputState }

func (FirewallFilteringRuleOutput) ElementType() reflect.Type {
	return reflect.TypeOf((**FirewallFilteringRule)(nil)).Elem()
}

func (o FirewallFilteringRuleOutput) ToFirewallFilteringRuleOutput() FirewallFilteringRuleOutput {
	return o
}

func (o FirewallFilteringRuleOutput) ToFirewallFilteringRuleOutputWithContext(ctx context.Context) FirewallFilteringRuleOutput {
	return o
}

// Choose the action of the service when packets match the rule. The following actions are accepted: `ALLOW`, `BLOCK_DROP`, `BLOCK_RESET`, `BLOCK_ICMP`, `EVAL_NWAPP`
func (o FirewallFilteringRuleOutput) Action() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.StringPtrOutput { return v.Action }).(pulumi.StringPtrOutput)
}

// Application service groups on which this rule is applied
func (o FirewallFilteringRuleOutput) AppServiceGroups() FirewallFilteringRuleAppServiceGroupsOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleAppServiceGroupsOutput { return v.AppServiceGroups }).(FirewallFilteringRuleAppServiceGroupsOutput)
}

// Application services on which this rule is applied
func (o FirewallFilteringRuleOutput) AppServices() FirewallFilteringRuleAppServicesOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleAppServicesOutput { return v.AppServices }).(FirewallFilteringRuleAppServicesOutput)
}

// If set to true, the default rule is applied
func (o FirewallFilteringRuleOutput) DefaultRule() pulumi.BoolPtrOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.BoolPtrOutput { return v.DefaultRule }).(pulumi.BoolPtrOutput)
}

// Apply to any number of departments When not used it implies `Any` to apply the rule to all departments.
func (o FirewallFilteringRuleOutput) Departments() FirewallFilteringRuleDepartmentsOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleDepartmentsOutput { return v.Departments }).(FirewallFilteringRuleDepartmentsOutput)
}

// Enter additional notes or information. The description cannot exceed 10,240 characters.
func (o FirewallFilteringRuleOutput) Description() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.StringPtrOutput { return v.Description }).(pulumi.StringPtrOutput)
}

// ** - (Optional) -  IP addresses and fully qualified domain names (FQDNs), if the domain has multiple destination IP addresses or if its IP addresses may change. For IP addresses, you can enter individual IP addresses, subnets, or address ranges. If adding multiple items, hit Enter after each entry.
func (o FirewallFilteringRuleOutput) DestAddresses() pulumi.StringArrayOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.StringArrayOutput { return v.DestAddresses }).(pulumi.StringArrayOutput)
}

// ** - (Optional) Identify destinations based on the location of a server, select Any to apply the rule to all countries or select the countries to which you want to control traffic.
func (o FirewallFilteringRuleOutput) DestCountries() pulumi.StringArrayOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.StringArrayOutput { return v.DestCountries }).(pulumi.StringArrayOutput)
}

// ** - (Optional) identify destinations based on the URL category of the domain, select Any to apply the rule to all categories or select the specific categories you want to control.
func (o FirewallFilteringRuleOutput) DestIpCategories() pulumi.StringArrayOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.StringArrayOutput { return v.DestIpCategories }).(pulumi.StringArrayOutput)
}

// ** - (Optional) Any number of destination IP address groups that you want to control with this rule.
func (o FirewallFilteringRuleOutput) DestIpGroups() FirewallFilteringRuleDestIpGroupsOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleDestIpGroupsOutput { return v.DestIpGroups }).(FirewallFilteringRuleDestIpGroupsOutput)
}

// This field is applicable for devices that are managed using Zscaler Client Connector.
func (o FirewallFilteringRuleOutput) DeviceGroups() FirewallFilteringRuleDeviceGroupsOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleDeviceGroupsOutput { return v.DeviceGroups }).(FirewallFilteringRuleDeviceGroupsOutput)
}

// List of device trust levels for which the rule must be applied. This field is applicable for devices that are managed
// using Zscaler Client Connector. The trust levels are assigned to the devices based on your posture configurations in the
// Zscaler Client Connector Portal. If no value is set, this field is ignored during the policy evaluation.
func (o FirewallFilteringRuleOutput) DeviceTrustLevels() pulumi.StringArrayOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.StringArrayOutput { return v.DeviceTrustLevels }).(pulumi.StringArrayOutput)
}

// Name-ID pairs of devices for which rule must be applied.
func (o FirewallFilteringRuleOutput) Devices() FirewallFilteringRuleDevicesOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleDevicesOutput { return v.Devices }).(FirewallFilteringRuleDevicesOutput)
}

func (o FirewallFilteringRuleOutput) EnableFullLogging() pulumi.BoolPtrOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.BoolPtrOutput { return v.EnableFullLogging }).(pulumi.BoolPtrOutput)
}

// You can manually select up to `8` groups. When not used it implies `Any` to apply the rule to all groups.
func (o FirewallFilteringRuleOutput) Groups() FirewallFilteringRuleGroupsOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleGroupsOutput { return v.Groups }).(FirewallFilteringRuleGroupsOutput)
}

// Labels that are applicable to the rule.
func (o FirewallFilteringRuleOutput) Labels() FirewallFilteringRuleLabelsOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleLabelsOutput { return v.Labels }).(FirewallFilteringRuleLabelsOutput)
}

// You can manually select up to `32` location groups. When not used it implies `Any` to apply the rule to all location groups.
func (o FirewallFilteringRuleOutput) LocationGroups() FirewallFilteringRuleLocationGroupsOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleLocationGroupsOutput { return v.LocationGroups }).(FirewallFilteringRuleLocationGroupsOutput)
}

// You can manually select up to `8` locations. When not used it implies `Any` to apply the rule to all groups.
func (o FirewallFilteringRuleOutput) Locations() FirewallFilteringRuleLocationsOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleLocationsOutput { return v.Locations }).(FirewallFilteringRuleLocationsOutput)
}

// The name of the workload group
//
// * `Other Exported Arguments`
func (o FirewallFilteringRuleOutput) Name() pulumi.StringOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.StringOutput { return v.Name }).(pulumi.StringOutput)
}

// Any number of application groups that you want to control with this rule. The service provides predefined applications that you can group, but not modify
func (o FirewallFilteringRuleOutput) NwApplicationGroups() FirewallFilteringRuleNwApplicationGroupsOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleNwApplicationGroupsOutput {
		return v.NwApplicationGroups
	}).(FirewallFilteringRuleNwApplicationGroupsOutput)
}

// When not used it applies the rule to all applications. The service provides predefined applications, which you can group, but not modify.
//
// `source ip addresses` supports the following attributes:
func (o FirewallFilteringRuleOutput) NwApplications() pulumi.StringArrayOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.StringArrayOutput { return v.NwApplications }).(pulumi.StringArrayOutput)
}

// Any number of predefined or custom network service groups to which the rule applies.
func (o FirewallFilteringRuleOutput) NwServiceGroups() FirewallFilteringRuleNwServiceGroupsOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleNwServiceGroupsOutput { return v.NwServiceGroups }).(FirewallFilteringRuleNwServiceGroupsOutput)
}

// When not used it applies the rule to all network services or you can select specific network services. The Zscaler firewall has predefined services and you can configure up to `1,024` additional custom services.
//
// `network applications` supports the following attributes:
func (o FirewallFilteringRuleOutput) NwServices() FirewallFilteringRuleNwServicesOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleNwServicesOutput { return v.NwServices }).(FirewallFilteringRuleNwServicesOutput)
}

// Policy rules are evaluated in ascending numerical order (Rule 1 before Rule 2, and so on), and the Rule Order reflects this rule's place in the order.
func (o FirewallFilteringRuleOutput) Order() pulumi.IntPtrOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.IntPtrOutput { return v.Order }).(pulumi.IntPtrOutput)
}

// If set to true, a predefined rule is applied
func (o FirewallFilteringRuleOutput) Predefined() pulumi.BoolPtrOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.BoolPtrOutput { return v.Predefined }).(pulumi.BoolPtrOutput)
}

// By default, the admin ranking is disabled. To use this feature, you must enable admin rank. The default value is `7`.
//
// `Who, Where and When` supports the following attributes:
func (o FirewallFilteringRuleOutput) Rank() pulumi.IntPtrOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.IntPtrOutput { return v.Rank }).(pulumi.IntPtrOutput)
}

func (o FirewallFilteringRuleOutput) RuleId() pulumi.IntOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.IntOutput { return v.RuleId }).(pulumi.IntOutput)
}

// Any number of source IP address groups that you want to control with this rule.
func (o FirewallFilteringRuleOutput) SrcIpGroups() FirewallFilteringRuleSrcIpGroupsOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleSrcIpGroupsOutput { return v.SrcIpGroups }).(FirewallFilteringRuleSrcIpGroupsOutput)
}

// You can enter individual IP addresses, subnets, or address ranges.
func (o FirewallFilteringRuleOutput) SrcIps() pulumi.StringArrayOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.StringArrayOutput { return v.SrcIps }).(pulumi.StringArrayOutput)
}

// An enabled rule is actively enforced. A disabled rule is not actively enforced but does not lose its place in the Rule Order. The service skips it and moves to the next rule.
func (o FirewallFilteringRuleOutput) State() pulumi.StringPtrOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) pulumi.StringPtrOutput { return v.State }).(pulumi.StringPtrOutput)
}

// You can manually select up to `2` time intervals. When not used it implies `always` to apply the rule to all time intervals.
func (o FirewallFilteringRuleOutput) TimeWindows() FirewallFilteringRuleTimeWindowsOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleTimeWindowsOutput { return v.TimeWindows }).(FirewallFilteringRuleTimeWindowsOutput)
}

// You can manually select up to `4` general and/or special users. When not used it implies `Any` to apply the rule to all users.
func (o FirewallFilteringRuleOutput) Users() FirewallFilteringRuleUsersOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleUsersOutput { return v.Users }).(FirewallFilteringRuleUsersOutput)
}

// The list of preconfigured workload groups to which the policy must be applied
func (o FirewallFilteringRuleOutput) WorkloadGroups() FirewallFilteringRuleWorkloadGroupArrayOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleWorkloadGroupArrayOutput { return v.WorkloadGroups }).(FirewallFilteringRuleWorkloadGroupArrayOutput)
}

// The list of ZPA Application Segments for which this rule is applicable. This field is applicable only for the ZPA
// Gateway forwarding method.
func (o FirewallFilteringRuleOutput) ZpaAppSegments() FirewallFilteringRuleZpaAppSegmentArrayOutput {
	return o.ApplyT(func(v *FirewallFilteringRule) FirewallFilteringRuleZpaAppSegmentArrayOutput { return v.ZpaAppSegments }).(FirewallFilteringRuleZpaAppSegmentArrayOutput)
}

type FirewallFilteringRuleArrayOutput struct{ *pulumi.OutputState }

func (FirewallFilteringRuleArrayOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*[]*FirewallFilteringRule)(nil)).Elem()
}

func (o FirewallFilteringRuleArrayOutput) ToFirewallFilteringRuleArrayOutput() FirewallFilteringRuleArrayOutput {
	return o
}

func (o FirewallFilteringRuleArrayOutput) ToFirewallFilteringRuleArrayOutputWithContext(ctx context.Context) FirewallFilteringRuleArrayOutput {
	return o
}

func (o FirewallFilteringRuleArrayOutput) Index(i pulumi.IntInput) FirewallFilteringRuleOutput {
	return pulumi.All(o, i).ApplyT(func(vs []interface{}) *FirewallFilteringRule {
		return vs[0].([]*FirewallFilteringRule)[vs[1].(int)]
	}).(FirewallFilteringRuleOutput)
}

type FirewallFilteringRuleMapOutput struct{ *pulumi.OutputState }

func (FirewallFilteringRuleMapOutput) ElementType() reflect.Type {
	return reflect.TypeOf((*map[string]*FirewallFilteringRule)(nil)).Elem()
}

func (o FirewallFilteringRuleMapOutput) ToFirewallFilteringRuleMapOutput() FirewallFilteringRuleMapOutput {
	return o
}

func (o FirewallFilteringRuleMapOutput) ToFirewallFilteringRuleMapOutputWithContext(ctx context.Context) FirewallFilteringRuleMapOutput {
	return o
}

func (o FirewallFilteringRuleMapOutput) MapIndex(k pulumi.StringInput) FirewallFilteringRuleOutput {
	return pulumi.All(o, k).ApplyT(func(vs []interface{}) *FirewallFilteringRule {
		return vs[0].(map[string]*FirewallFilteringRule)[vs[1].(string)]
	}).(FirewallFilteringRuleOutput)
}

func init() {
	pulumi.RegisterInputType(reflect.TypeOf((*FirewallFilteringRuleInput)(nil)).Elem(), &FirewallFilteringRule{})
	pulumi.RegisterInputType(reflect.TypeOf((*FirewallFilteringRuleArrayInput)(nil)).Elem(), FirewallFilteringRuleArray{})
	pulumi.RegisterInputType(reflect.TypeOf((*FirewallFilteringRuleMapInput)(nil)).Elem(), FirewallFilteringRuleMap{})
	pulumi.RegisterOutputType(FirewallFilteringRuleOutput{})
	pulumi.RegisterOutputType(FirewallFilteringRuleArrayOutput{})
	pulumi.RegisterOutputType(FirewallFilteringRuleMapOutput{})
}