Creating a rule group for a Next Generation policy
Use the following procedure to create a firewall rule group or an IPS rule group in the console. The pages that you see after you select the rule group type depend on the type and, for a firewall rule group, on the authoring format that you select.
To create a rule group for a Next Generation policy
-
Sign in to the Amazon Web Services Management Console and open the Amazon VPC console at https://console.amazonaws.cn/vpc/
. In the navigation pane, under Network Firewall, choose Network Firewall rule groups, and then choose Create rule group.
-
On the Describe rule group page, enter a Name to identify this rule group (you can't change the name after you create the rule group), and optionally a Description, a Amazon Key Management Service customer managed key under Customer managed key to encrypt your resources instead of using an Amazon owned key (see Encryption at rest with Amazon Key Management Service), and tags under Add tags (see Tagging Amazon Network Firewall resources). Then choose Next.
-
On the Choose rule group type page, for Rule group version, leave Next Generation selected (to create a Classic Network Firewall rule group instead, select Classic and follow the procedure in Creating a stateful rule group). Under Rule group type, select the inspection engine—Firewall rule group (the default) for the firewall engine or IPS rule group for the IPS engine. For Rule group format, select how to author the rules: a firewall rule group supports Visual rule builder (the default), Text rule builder, or Domain list, and an IPS rule group supports only Text rule builder. For information about the rule formats, see Authoring firewall rules and Generating firewall rules from domain names. Then choose Next.
-
(Optional) On the Rule group variables page, define the rule variables that your rules reference. For an IPS rule group, you can also define IP set references. Then choose Next. This page appears for the Visual rule builder and Text rule builder formats; it doesn't appear for the Domain list format.
-
On the Configure rules page, provide the rules for the rule group. For the Visual rule builder, build each rule from structured fields—choosing a rule template, action, protocol and connection state, action scope, source and destination, and rule options—and choose Add rule to add it to the Firewall rules table; for the Text rule builder, enter your rules under Suricata compatible rule string; and for a Domain list, enter the domain names and matching options. Then, in the Capacity section, set the capacity with Allow room to grow (recommended), Match current rules, or Custom capacity (a value from 1 to 30,000); you can't change the capacity after you create the rule group. For information about authoring rules, templates, and capacity, see Authoring firewall rules, Generating firewall rules from domain names, Setting rule group capacity in Amazon Network Firewall, and Amazon Network Firewall quotas. Then choose Next.
-
On the Review and create page, review the rule group, then choose Create.
You can also create a rule group with the Amazon CLI. Both rule group types use the create-rule-group command with the --type parameter: FIREWALL for a firewall rule group and IPS for an IPS rule group. The describe-rule-group, update-rule-group, and delete-rule-group commands require the matching --type.
The following example creates a firewall rule group from a rule string. The rule group definition is in a local file named firewall-rules.json:
{ "RulesSource": { "RulesString": "accept:flow tcp:all any any -> any 443 (sid:1001;)\n" } }
aws network-firewall create-rule-group \ --type FIREWALL --capacity 100 \ --rule-group-name example-firewall-rule-group \ --firewall-rule-group file://firewall-rules.json \ --region us-west-2
The following example creates an IPS rule group. The rules use the same Suricata-compatible syntax as a Classic Network Firewall stateful rule group, and the definition is in a local file named ips-rules.json:
{ "RulesSource": { "RulesString": "drop http any any -> any any (msg:\"block evil host\"; http.host; content:\"evil.example.com\"; sid:2001; rev:1;)\n" } }
aws network-firewall create-rule-group \ --type IPS --capacity 100 \ --rule-group-name example-ips-rule-group \ --ips-rule-group file://ips-rules.json \ --region us-west-2
Each create call returns an UpdateToken that you provide on a subsequent update-rule-group or delete-rule-group call for the rule group. The token changes with every update.