AWS Network Firewall

What is AWS Network Firewall?

Managed service from AWS that provides network protections for all VPCs and having rule engine which let us define the firewall rules, import rules already written in common open source rule formats as well as enable integrations with managed intelligence feeds sourced by AWS partners.

Also provides protection from common network threats, you can filter traffic at the perimeter of your VPC. This includes filtering traffic going to and coming from an internet gateway, NAT gateway, or over VPN or AWS Direct Connect

What can be protected and Monitored?

AWS Network Firewall’s intrusion prevention system (IPS) provides active traffic flow inspection used detect vulnerability exploit using signature-based detection.

AWS Network Firewall can be configured to allow the traffic only from known AWS service domains or IP address and web filtering allows or filter protocols like HTTPS, known ports

Implementing AWS Network Firewall using Terraform

From Terraform v0.12 version, you can use the AWS Network Firewall resource to deploy and below is sample configuration to deploy AWS VPC with AWS Network Firewall using Terraform

data “aws_availability_zones” “available” {

state = “available”

}

resource “aws_vpc” “example” {

cidr_block = “10.0.0.0/16”

}

resource “aws_internet_gateway” “example” {

vpc_id = aws_vpc.example.id

}

resource “aws_subnet” “application” {

availability_zone = data.aws_availability_zones.available.names[0]

cidr_block = “10.0.1.0/24”

vpc_id = aws_vpc.example.id

}

resource “aws_subnet” “firewall” {

availability_zone = data.aws_availability_zones.available.names[0]

cidr_block = “10.0.0.0/24”

vpc_id = aws_vpc.example.id

}

resource “aws_networkfirewall_rule_group” “example” {

capacity = 1000

name = “example”

type = “STATELESS”

rule_group {

rules_source {

stateless_rules_and_custom_actions {

stateless_rule {

priority = 5

rule_definition {

actions = [“aws:pass”]

match_attributes {

source {

address_definition = “10.0.0.0/8”

}

source {

address_definition = “192.168.0.0/16”

}

}

}

}

}

}

}

}

resource “aws_networkfirewall_firewall_policy” “example” {

name = “example”

firewall_policy {

stateless_default_actions = [“aws:drop”]

stateless_fragment_default_actions = [“aws:drop”]

stateless_rule_group_reference {

priority = 20

resource_arn = aws_networkfirewall_rule_group.example.arn

}

}

}

resource “aws_networkfirewall_firewall” “example” {

firewall_policy_arn = aws_networkfirewall_firewall_policy.example.arn

name = “example”

vpc_id = aws_vpc.example.id

subnet_mapping {

subnet_id = aws_subnet.firewall.id

}

}

resource “aws_network_interface” “firewall” {

subnet_id = aws_subnet.firewall.id

}

resource “aws_network_interface” “application” {

subnet_id = aws_subnet.application.id

}

data “aws_network_interface” “firewall” {

id = aws_network_interface.firewall.id

}

data “aws_network_interface” “application” {

id = aws_network_interface.application.id

}

resource “aws_route_table” “application” {

vpc_id = aws_vpc.example.id

route {

cidr_block = “0.0.0.0/0”

network_interface_id = data.aws_network_interface.application.id

}

}

resource “aws_route_table_association” “application” {

route_table_id = aws_route_table.application.id

subnet_id = aws_subnet.application.id

}

resource “aws_route_table” “gateway” {

vpc_id = aws_vpc.example.id

route {

cidr_block = aws_subnet.application.cidr_block

network_interface_id = data.aws_network_interface.firewall.id

}

}

resource “aws_route_table_association” “gateway” {

gateway_id = aws_internet_gateway.example.id

route_table_id = aws_route_table.gateway.id

}

Conclusion

AWS Network Firewall used to inspect your AWS VPC traffic, Filter outbound traffic and Internet traffic. Enables network protection for AWS VPC and provides consistent firewall policy management across VPCs and accounts

--

--