Amazon VPC network access control list (ACL) policies
This section covers how Amazon Firewall Manager network ACL policies work and provides guidance for using them. For guidance creating a network ACL policy using the console, see Creating a network ACL policy.
For information about Amazon VPC network access control lists (ACLs), see Control traffic to subnets using network ACLs in the Amazon VPC User Guide.
You can use Firewall Manager network ACL policies to manage Amazon Virtual Private Cloud (Amazon VPC) network access control lists (ACLs) for your organization in Amazon Organizations. You define the policy's network ACL rule settings and the accounts and subnets where you want the settings enforced. Firewall Manager continuously applies your policy settings to accounts and subnets as they are added or updated across your organization. For information about policy scope and Amazon Organizations, see Amazon Firewall Manager policy scope and the Amazon Organizations User Guide.
When you define a Firewall Manager network ACL policy, in addition to the standard Firewall Manager policy settings, such as name and scope, you provide the following:
First and last rules for inbound and outbound traffic handling. Firewall Manager enforces the presence and ordering of these in the network ACLs that are in scope of the policy, or reports noncompliance. Your individual accounts can create custom rules to run in between the policy's first and last rules.
Whether to force remediation when remediation would result in traffic management conflicts between the rules in the network ACL. This applies only when remediation is enabled for the policy.
Firewall Manager network ACL rules and tagging
This section describes the network ACL policy rule specifications and the network ACLs that are managed by Firewall Manager.
Tagging on a managed network ACL
Firewall Manager tags a managed network ACL with a FMManaged tag that has a value of true. Firewall Manager only
performs remediation on network ACLs that have this tag setting.
Rules that you define in the policy
In your network ACL policy specification, you define the rules that you want to run first and last for inbound traffic and the rules that you want to run first and last for outbound traffic.
By default, you can define up to 5 inbound rules, for use in any combination of first and last rules in the policy. Similarly, you can define up to 5 outbound rules. For more about these limits, see Soft quotas. For information about the general limits on network ACLs, see Amazon VPC quotas on network ACLs in the Amazon VPC User Guide.
You don't assign rule numbers to the policy rules. Instead, you specify the rules in the order you want them to be evaluated, and Firewall Manager uses that ordering to assign rule numbers in the network ACLs that it manages.
Other than this, you manage the policy's network ACL rules specifications as you would manage the rules in a network ACL through Amazon VPC. For information about network ACL management in Amazon VPC, see Control traffic to subnets using network ACLs and Work with network ACLs in the Amazon VPC User Guide.
Rules in a managed network ACL
Firewall Manager configures the rules in a network ACL that it manages by placing the policy's first and last rules before and after any custom rules that an individual account manager defines. Firewall Manager preserves the order of the custom rules. Network ACLs are evaluated starting with the lowest numbered rule.
When Firewall Manager first creates a network ACL, it defines the rules with the following numbering:
First rules: 1, 2, ... – Defined by you in the Firewall Manager network ACL policy.
Firewall Manager assigns rule numbers starting from 1 with increments of 1, with the rules ordered as you have ordered them in the policy specification.
Custom rules: 5,000, 5,100, ... – Managed by individual account managers through Amazon VPC.
Firewall Manager assigns numbers to these rules starting from 5,000 and incrementing by 100 for each subsequent rule.
Last rules: ... 32,765, 32,766 – Defined by you in the Firewall Manager network ACL policy.
Firewall Manager assigns rule numbers that end at the highest possible number, 32766 with increments of 1, with the rules ordered as you have ordered them in the policy specification.
After network ACL initialization, Firewall Manager doesn't control changes that individual accounts make in its managed network ACLs. Individual accounts can change a network ACL without taking it out of compliance, providing any custom rules remain numbered in between the policy's first and last rules, and the first and last rules maintain their specified ordering. As a best practice, when managing custom rules, adhere to the numbering described in this section.
How Firewall Manager initiates network ACL management for a subnet
Firewall Manager begins management of the network ACL for a subnet when it associates the subnet with a network ACL that Firewall Manager has created and
tagged with FMManaged set to true.
Compliance with a network ACL policy requires the subnet's network ACL to have the policy's first rules positioned first, in the order specified in the policy, the last rules positioned last, in order, and any other custom rules positioned in the middle. These requirements can be satisfied by an unmanaged network ACL that the subnet is already associated with or by a managed network ACL.
When Firewall Manager applies a network ACL policy to a subnet that's associated with an unmanaged network ACL, Firewall Manager checks the following in order, stopping when it identifies a viable option:
The associated network ACL is already compliant – If the network ACL that's currently associated with the subnet is compliant, then Firewall Manager leaves that association in place and does not start network ACL management for the subnet.
Firewall Manager doesn't alter or otherwise manage a network ACL that it doesn't own, but as long as it's compliant, Firewall Manager leaves it in place and just monitors it for policy compliance.
A compliant managed network ACL is available – If Firewall Manager is already managing a network ACL that complies with the required configuration, then this is an option. If remediation is enabled, Firewall Manager associates the subnet to it. If remediation is disabled, Firewall Manager marks the subnet noncompliant and offers replacing the network ACL association as a remediation option.
Create a new compliant managed network ACL – If remediation is enabled, Firewall Manager creates a new network ACL and associates it with the subnet. Otherwise, Firewall Manager marks the subnet noncompliant and offers the remediation options of creating the new network ACL and replacing the network ACL association.
If these steps fail, Firewall Manager reports noncompliance for the subnet.
Firewall Manager follows these steps when a subnet first comes into scope and when a subnet's unmanaged network ACL is out of compliance.
How Firewall Manager remediates noncompliant managed network ACLs
This section describes how Firewall Manager remediates its managed network ACLs when they're out of compliance with the policy. Firewall Manager
only remediates managed network ACLs—with the FMManaged tag set to true. For
network ACLs that aren't managed by Firewall Manager, see Initial network ACL management.
Remediation restores the relative locations of the first, custom, and last rules and restores the ordering for first and last rules. During remediation, Firewall Manager won't necessarily move rules to the rule numbers that it uses in network ACL initialization. For the initial number settings and descriptions of these rule categories, see Initial network ACL management.
In order to establish compliant rules and rule ordering, Firewall Manager might need to move rules around inside the network ACL. As much as possible, Firewall Manager preserves the network ACL's protections by maintaining existing compliant rule ordering as it does this. For example, it might temporarily duplicate rules to new locations, and then perform an ordered removal of the original rules, preserving relative locations during the process.
This approach protects your settings, but it also requires space in the network ACL for the interim rules. If Firewall Manager hits the limit for rules in a network ACL, it will halt remediation. When this happens, the network ACL remains out of compliance and Firewall Manager reports the reason.
If an account adds custom rules to a network ACL that's managed by Firewall Manager, and those rules interfere with Firewall Manager remediation, Firewall Manager stops any remediation activities on the network ACL and reports the conflict.
Forced remediation
If you choose auto remediation for the policy, you also specify whether to force remediation for the first rules or last rules.
When Firewall Manager encounters a conflict in traffic handling between a custom rule and a policy rule, it refers to the corresponding forced remediation setting. If forced remediation is enabled, Firewall Manager applies the remediation, in spite of the conflict. If this option isn't enabled, Firewall Manager halts remediation. In either case, Firewall Manager reports the rule conflict and offers remediation options.
Rule count requirements and limitations
During remediation, Firewall Manager might temporarily duplicate rules in order to move them without altering the protections that they provide.
For either inbound or outbound rules, the greatest number of rules that Firewall Manager might require to perform remediation is the following:
2 * (the number of rules defined in the policy for the traffic direction) + the number of custom rules defined in the network ACL for the traffic direction
Network ACLs and network ACL policies are bound by mutable rule limits. If Firewall Manager hits a limit in its remediation efforts, it stops trying to remediate and reports the noncompliance.
To make room for Firewall Manager to perform its remediation activities, you might request a limit increase. Alternately, you can change the configuration in the policy or network ACL to reduce the number of rules used.
For information about the network ACL limits, see Amazon VPC quotas on network ACLs in the Amazon VPC User Guide.
When remediation fails
While updating a network ACL, if Firewall Manager needs to stop for any reason, it
doesn't roll back the changes, but instead leaves the network ACL in an
interim state. If you see duplicate rules in a network ACL that has
the FMManaged tag set to true, Firewall Manager
is probably in the middle of remediating it. Changes might be partially complete for a period, but because of the
approach Firewall Manager takes to remediation, this won't
interrupt traffic or reduce the protection for associated subnets.
When Firewall Manager doesn't completely remediate network ACLs that are out of compliance, it reports the noncompliance for the associated subnets and suggests possible remediation options.
Retrying after remediation fails
In most cases, if Firewall Manager fails to complete remediation changes to a network ACL, it will eventually retry the change.
The exception to this is when remediation reaches the network ACL rule count limit or the VPC network ACL count limit. Firewall Manager can't perform remediation activities that take Amazon resources over their limit settings. In these cases, you need to reduce counts or increase limits in order to proceed. For information about the limits, see Amazon VPC quotas on network ACLs in the Amazon VPC User Guide.
Firewall Manager network ACL compliance reporting
Firewall Manager monitors and reports compliance for all network ACLs that are attached to in-scope subnets.
Generally speaking, noncompliance occurs for situations such as incorrect rule ordering or a conflict in traffic handling behavior between policy rules and custom rules. Noncompliance reporting includes compliance violations and remediation options.
Firewall Manager reports compliance violations for a network ACL policy in the same way as for other policy types. For information about compliance reporting, see Viewing compliance information for an Amazon Firewall Manager policy.
Noncompliance during policy updates
After you modify a network ACL policy, until Firewall Manager updates the network ACLs that are in scope of the policy, Firewall Manager marks those network ACLs noncompliant. Firewall Manager does this even if the network ACLs might, strictly speaking, be in compliance.
For example, if you remove rules from the policy specification, while in-scope network ACLs still have the extra rules, their rule definitions might still comply with the policy. However, since the extra rules are part of the rules that Firewall Manager is managing, Firewall Manager views them as violations of current policy settings. This is different from how Firewall Manager views custom rules that you add to the Firewall Manager managed network ACLs.
Best practices for using Firewall Manager network ACL policies
This section lists recommendations for working with Firewall Manager network ACL policies and managed network ACLs.
Refer to the FMManaged tag to identify network ACLs that are managed by Firewall Manager
The network ACLs that Firewall Manager manages have the FMManaged tag set to
true. Use this tag to help distinguish your own custom network ACLs
from those that you're managing through Firewall Manager.
Don't modify the value of the FMManaged tag on a network ACL
Firewall Manager uses this tag to set and determine its management status with a network ACL.
Don't modify the associations for subnets that have Firewall Manager managed network ACLs
Don't manually change the associations between your subnets and
any network ACLs that are managed by Firewall Manager. Doing so can disable the ability of Firewall Manager to
manage protections for those subnets. You can identify network ACLs that are managed by Firewall Manager by looking
for the FMManaged tag settings of true.
To remove a subnet from Firewall Manager policy management, use the Firewall Manager policy scope settings to exclude the subnet. For example, you can tag the subnet and then exclude that tag from policy scope. For more information, see Amazon Firewall Manager policy scope.
When you update a managed network ACL, don't modify the rules that are managed by Firewall Manager
In a network ACL that's managed by Firewall Manager, keep your custom rules separated from the policy rules by adhering to the numbering scheme described in Firewall Manager network ACL rules and tagging. Only add or modify rules that have numbers between 5,000 and 32,000.
Avoid adding too many rules for your account limits
During remediation of a network ACL, Firewall Manager usually increases the network ACL rule count temporarily. To avoid noncompliance problems, make sure you have enough room for the rules you're using. For more information, see How Firewall Manager remediates noncompliant managed network ACLs.
Start with automatic remediation disabled
Start with automatic remediation disabled, and then review the policy details information to determine the effects that automatic remediation would have. When you are satisfied that the changes are what you want, edit the policy to enable automatic remediation.
Firewall Manager network ACL policy caveats
This section lists the caveats and limitations for using Firewall Manager network ACL policies.
-
Slower update times than with other policies – Firewall Manager generally applies network ACL policies and policy changes more slowly than with other Firewall Manager policies, due to limitations in the rate at which the Amazon EC2 network ACL APIs are able to process requests. You might notice that policy changes take longer than similar changes with other Firewall Manager policies, in particular when you first add a policy.
-
For initial subnet protection, Firewall Manager prefers older policies – This applies only to subnets that aren't yet protected by a Firewall Manager network ACL policy. If a subnet comes into scope of more than one network ACL policy at the same time, then Firewall Manager uses the oldest policy to protect the subnet.
-
Reasons for a policy to stop protecting a subnet – A policy that's managing the network ACL for a subnet retains management until one of the following happens:
-
The subnet goes out of scope of the policy.
-
The policy is deleted.
-
You manually change the subnet's association to a network ACL that's managed by a different Firewall Manager policy and for which the subnet is in scope.
-
Deleting a Firewall Manager network ACL policy
When you delete a Firewall Manager network ACL policy, Firewall Manager changes the FMManaged tag values to false on all network ACLs that it's been managing for the policy.
Additionally, you can choose whether to clean up the resources created by the policy. If you choose clean up, Firewall Manager tries the following steps in order:
Put the association back to the original – Firewall Manager tries to associate the subnet back to the network ACL that it was associated with before Firewall Manager started managing it.
Remove first and last rules from the network ACL – If it can't change the association, Firewall Manager tries to remove the policy's first and last rules, leaving only the custom rules in the network ACL that's associated with the subnet.
Do nothing to the rules or the association – If it can't do either of the above things, Firewall Manager leaves the network ACL and its association as they are.
If you don't choose the cleanup option, you'll need to manually manage each network ACL after the policy is deleted. For most situations, choosing the cleanup option is the simplest approach.