vRO workflow to add NSX Edge Firewall rules

I need an automated means to add rules to an NSX Edge devices that is automatically provisioned when a user requests a vRA catalog item containing an on-demand NAT network.  

Does any out of the box vRO workflows exist that can add a rule to an NSX Edge?  (For clarity, I do NOT want to add a rule to the distributed firewall, I want to add a rule to a specific NSX Edge)

Alternatively, can you point me to a script that I can use in a custom vRO workflow?

thanks