Rule groups for Next Generation policies in Amazon Network Firewall

Next Generation policies use two rule group types, one for each inspection engine: firewall rule groups for the firewall engine and IPS rule groups for the IPS engine. These rule group types use the same RuleGroup resource and the same API operations as the stateless and stateful rule groups described in Managing your rule groups—CreateRuleGroup, UpdateRuleGroup, DescribeRuleGroup, DeleteRuleGroup, and ListRuleGroups. You select the rule group type when you create the rule group, and you can't change it afterward.

As with stateless and stateful rule groups, you can share firewall and IPS rule groups across accounts using Amazon Resource Access Manager, and you can reference the same rule group from multiple policies. For information about sharing, see Sharing Network Firewall resources. For the maximum number of rules per policy and other quotas, see Amazon Network Firewall quotas.