Interface INfwRuleGroupConfig

NetworkConfig / CentralNetworkServicesConfig / NfwConfig / NfwRuleGroupConfig

Network Firewall rule group configuration.

Description

Use this configuration to define stateful and stateless rule groups for Network Firewall. An AWS Network Firewall rule group is a reusable set of criteria for inspecting and handling network traffic. You add one or more rule groups to a firewall policy as part of policy configuration.

See

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-networkfirewall-rulegroup.html

Example

Stateful rule group:

- name: accelerator-stateful-group
  regions:
    - us-east-1
  capacity: 100
  type: STATEFUL
  ruleGroup:
    rulesSource:
      rulesFile: path/to/rules.txt
  shareTargets:
    organizationalUnits:
      - Root
  tags: []
Copy

Stateless rule group:

- name: accelerator-stateless-group
  regions:
    - us-east-1
  capacity: 100
  type: STATELESS
  ruleGroup:
    rulesSource:
      statelessRulesAndCustomActions:
        statelessRules:
          - priority: 100
            ruleDefinition:
              actions: ['aws:pass']
              matchAttributes:
                sources:
                  - 10.1.0.0/16
                sourcePorts:
                  - fromPort: 1024
                    toPort: 65535
                destinations:
                  - 10.0.0.0/16
                destinationPorts:
                  - fromPort: 22
                    toPort: 22
  shareTargets:
    organizationalUnits:
      - Root
  tags: []
Copy