Next Generation policies in Amazon Network Firewall

An Amazon Network Firewall Next Generation policy (the FirewallPolicyV2 resource) is a firewall policy that filters traffic using two separate inspection engines: a firewall engine for access control and an IPS engine for intrusion detection and prevention. Next Generation policies are a separate resource type from the Classic Network Firewall policies described in Classic Network Firewall policies. The two policy types exist side by side, and a firewall uses one or the other. For an overview of how the two policy types compare, see Amazon Network Firewall firewall policy versions.

Like a Classic Network Firewall policy, a Next Generation policy defines the monitoring and protection behavior for a firewall. The details of the behavior are defined in the rule groups that you add to the policy's two sections, and in the policy's default settings. Within either section, you can reference reusable rule groups or author embedded rules (also called inline rules) directly in the policy; for how to add rules to a section, see The firewall section and the IPS section. To use a firewall policy, you associate it with one or more firewall endpoints or firewall endpoint associations.