View a markdown version of this page

Creating a Next Generation policy in Amazon Network Firewall - Amazon Network Firewall
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Creating a Next Generation policy in Amazon Network Firewall

To create a Next Generation policy in Network Firewall, you can reference firewall rule groups and IPS rule groups that you've already defined, author embedded rules directly in the policy, or both. For information about creating rule groups, see Working with firewall rule groups in Amazon Network Firewall and Working with IPS rule groups in Amazon Network Firewall.

If you want to use TLS inspection, you need to first create a TLS inspection configuration to use in the policy. Next Generation policies support session holding only. For information about authoring rules for TLS-inspected traffic in a Next Generation policy, see TLS inspection with a Next Generation policy in Amazon Network Firewall.

For a description of each policy setting, see Next Generation policy settings in Amazon Network Firewall.

The console takes you through the policy creation wizard one page at a time. The following procedure walks through the wizard in order—entering the policy details, setting the firewall default action and policy mode, configuring optional traffic inspection, adding rule groups, and reviewing and creating the policy. Choose Next to move from one page to the next.

To create a Next Generation policy in the console

  1. Sign in to the Amazon Web Services Management Console and open the Amazon VPC console at https://console.amazonaws.cn/vpc/.

    In the navigation pane, under Network Firewall, choose Firewall policies, and then choose Create firewall policy.

    On the Firewall policy details page, for Policy version, select Next Generation (recommended, and selected by default). To create a Classic Network Firewall policy instead, select Classic; for information about the policy types, see Amazon Network Firewall firewall policy versions. Enter a Name to identify the policy (you can't change the name after you create the policy) and an optional Description. Set the Firewall default action (Drop is recommended and selected by default), the Policy mode (Enforce by default), and the Stream exception setting (Reject is recommended and selected by default). Leave Enable Active Threat Defense selected (the default) to add the Amazon managed Active Threat Defense rule group to the policy, or clear it if you don't want it. Under Tags, add any tags that you want to apply to the policy. For a description of each setting, see Next Generation policy settings in Amazon Network Firewall. Then choose Next.

  2. On the Traffic inspection page, all settings are optional: turn on Route 53 Resolved IP validation to validate destination IP addresses against Amazon Route 53 resolved domains, attach a TLS inspection configuration under TLS inspection configurations to inspect SSL/TLS traffic (Next Generation policies support session holding only), and customize the TCP idle timeout under Idle timeouts. For a description of each setting, see Next Generation policy settings in Amazon Network Firewall. Then choose Next.

  3. On the Add firewall rule groups page, choose Add rule group, and then either choose Add existing rule group to select a firewall rule group that you've already created and assign it a priority, or choose Add embedded rules to author rules directly in the policy with the visual or text rule builder (see Embedded rules in a Next Generation policy). For more information, see Creating a rule group for a Next Generation policy. Then choose Next.

  4. On the Add IPS rule groups page, choose Add rule group, and then choose Add existing rule group to select an IPS rule group that you've already created, Add embedded rules to author rules directly in the policy (see Embedded rules in a Next Generation policy), or Add managed rule group to choose from the available Amazon managed rule groups (see Using managed rule groups). Then choose Next.

  5. (Optional) On the Network and encryption page, under Customer managed key customize the encryption settings to use a Amazon Key Management Service customer managed key (see Encryption at rest with Amazon Key Management Service), and for Policy variables enter any CIDR ranges that you want to use to override the Suricata HOME_NET variable. Choose Next, and then on the Review and create page, review your policy settings—choose Edit for any section you want to change—and choose Create firewall policy.

You can also create a Next Generation policy with the Amazon CLI. Each section can contain both referenced rule groups and embedded rule groups. A referenced entry uses a ResourceArn that points to an existing rule group, and an embedded entry uses an InlineRuleGroup whose rules are defined directly in the policy. The following example creates a policy in enforce mode with a drop default action, where the firewall section and the IPS section each have one referenced rule group and one embedded rule group. Firewall section entries have a unique Priority; IPS section entries don't. The policy definition is in a local file named policy.json:

{
    "FirewallRuleGroupEntries": [
        { "Priority": 1, "ResourceArn": "arn:aws:network-firewall:us-west-2:111122223333:firewall-rulegroup/example-firewall-rule-group" },
        {
            "Priority": 2,
            "InlineRuleGroup": {
                "RulesSource": {
                    "RulesString": "accept:flow tcp:all any any -> any 443 (sid:1001;)\n"
                }
            }
        }
    ],
    "IpsRuleGroupEntries": [
        { "ResourceArn": "arn:aws:network-firewall:us-west-2:111122223333:ips-rulegroup/example-ips-rule-group" },
        {
            "InlineRuleGroup": {
                "RulesSource": {
                    "RulesString": "drop http any any -> any any (msg:\"block evil host\"; http.host; content:\"evil.example.com\"; sid:2001; rev:1;)\n"
                }
            }
        }
    ],
    "PolicyMode": "ENFORCE",
    "FirewallDefaultAction": "DROP"
}
aws network-firewall create-firewall-policy-v2 \
--firewall-policy-v2-name example-policy \
--firewall-policy-v2 file://policy.json \
--region us-west-2

The following shows an example response. The UpdateToken is required for subsequent update and delete calls, and the ConsumedFirewallRuleCapacity and ConsumedIpsRuleCapacity fields report how much of each section's capacity the policy uses.

{
    "UpdateToken": "3e965e1d-2b9f-40c2-a218-5aabe88b4b2e",
    "FirewallPolicyV2Response": {
        "FirewallPolicyV2Name": "example-policy",
        "FirewallPolicyV2Arn": "arn:aws:network-firewall:us-west-2:111122223333:firewall-policy-v2/example-policy",
        "FirewallPolicyV2Id": "745d879a-7813-4839-af58-e129de777454",
        "FirewallPolicyV2Status": "ACTIVE",
        "ConsumedFirewallRuleCapacity": 101,
        "ConsumedIpsRuleCapacity": 101,
        "ConsumedIpsDomainCapacity": 0,
        "EncryptionConfiguration": { "KeyId": "AWS_OWNED_KMS_KEY", "Type": "AWS_OWNED_KMS_KEY" },
        "LastModifiedTime": "2026-10-15T20:50:42.409000+00:00"
    }
}
Note

A firewall rule group that you reference must already be active before you can reference it in a policy. The Next Generation policy operations use dedicated commands—create-firewall-policy-v2, describe-firewall-policy-v2, update-firewall-policy-v2, list-firewall-policies-v2, and delete-firewall-policy-v2. The commands for Classic Network Firewall policies don't operate on Next Generation policies.