Deploy your first network security protection

This tutorial walks you through deploying an AWS WAF web ACL using the AWS Network Security Manager console. You complete the following steps:

1. Create a rule

2. Create a template

3. Create a policy

4. Create a scope

5. Create and publish a deployment

6. Monitor synchronization status

In this tutorial, you create an AWS WAF web ACL that protects Application Load Balancers across your selected accounts. This process is largely identical for all security services and firewalls supported by AWS Network Security Manager.

Time to complete: approximately 10 minutes

Cost: This tutorial uses AWS services that might incur charges. For current pricing, see AWS Network Security Manager pricing on the AWS website.

Prerequisites

Before you begin, verify that you meet the following requirements:

• Completed setup steps as described in Setting up AWS Network Security Manager.

• An AWS Identity and Access Management (IAM) identity with AWS Network Security Manager permissions.

• An AWS Organizations organization with all features enabled and a designated AWS Network Security Manager administrator account (required for multi-account deployments).

• Access to the AWS Network Security Manager console.

Step 1: Create a rule

A rule is the building block of your security configuration. In this step, you create two AWS WAF rules: one that sets the default action and one that sets the visibility configuration. Default Action and VisibilityConfig are required fields for an AWS WAF web ACL.

To create the Default Action rule, follow these steps:

1. Open the AWS Network Security Manager console at https://console.aws.amazon.com/network-security-manager/.

2. In the navigation pane, choose Overview.

3. On the Overview page, choose Create rule.

4. For Rule name, enter a descriptive name, such as my-default-action-rule.

5. In the Rule definition section, for Firewall type, choose AWS WAF.

6. For Select type of rule, choose Configuration.

7. Choose Insert config types, then select Default Action. A JSON editor appears with a default configuration.

8. In the JSON editor, remove the Block section and keep only the Allow section.

9. Choose Create rule.

To create the VisibilityConfig rule, follow these steps:

1. In the navigation pane, choose Overview.

2. On the Overview page, choose Create rule.

3. For Rule name, enter a descriptive name, such as my-visibility-config-rule.

4. In the Rule definition section, for Firewall type, choose AWS WAF.

5. For Select type of rule, choose Configuration.

6. Choose Insert config types, then select VisibilityConfig. A JSON editor appears with a default configuration.

7. Choose Create rule.

AWS CLI alternative

You can also create rules with the AWS CLI:

aws network-security-manager create-rule \
    --rule-name "my-default-action-rule" \
    --firewall-type WAF \
    --rule-type CONFIGURATION \
    --configuration '{"DefaultAction": {"Allow": {}}}' \
    --is-published true

aws network-security-manager create-rule \
    --rule-name "my-visibility-config-rule" \
    --firewall-type WAF \
    --rule-type CONFIGURATION \
    --configuration '{"VisibilityConfig": {"SampledRequestsEnabled": true, "CloudWatchMetricsEnabled": true, "MetricName": "my-web-acl-metric"}}' \
    --is-published true

Step 2: Create a template

A template groups one or more rules for reuse across policies. In this step, you create a template that includes the rule from Step 1:

1. In the navigation pane, choose Overview.

2. On the Overview page, choose Create template.

3. For Template name, enter a descriptive name, such as my-waf-template.

4. For Firewall type, choose AWS WAF.

5. In the Rules section, choose Add rule and select the rules you created in Step 1.

6. Choose Create template.

AWS CLI alternative

You can also create a template with the AWS CLI:

aws network-security-manager create-template \
    --template-name "my-waf-template" \
    --firewall-type WAF \
    --associated-rule-list '[{"ruleIdentifier": "rule-arn-from-step-1"}]' \
    --is-published true

Step 3: Create a policy

A policy combines templates with enforcement settings. In this step, you create a policy that references your template and enables automatic remediation:

1. In the navigation pane, choose Overview.

2. On the Overview page, choose Create policy.

3. For Policy name, enter a descriptive name, such as my-waf-policy.

4. For Firewall type, choose AWS WAF.

5. In the Policy priority section, existing policies and their priorities display. Review the new policy's priority. If you need to adjust it, choose the priority field and change the value to 1 or any unused priority number.

6. In the Templates and rules section, choose Add template and select the template you created in Step 2.

7. For Remediation, select Enabled.

8. For Existing customer web ACL resolution, choose No remediation.

9. Choose Create policy.

AWS CLI alternative

You can also create a policy with the AWS CLI:

aws network-security-manager create-policy \
    --policy-name "my-waf-policy" \
    --firewall-type WAF \
    --priority 1 \
    --associated-template-and-rule-list '[{"templateIdentifier": "template-arn-from-step-2"}]' \
    --policy-configuration '{"remediationEnabled": true, "resourcesCleanUp": false, "wafConfig": {"existingCustomerWebACLResolution": "NO_REMEDIATION"}}' \
    --is-published true

Step 4: Create a scope

A scope defines where your protections apply. In this step, you create a scope that targets Application Load Balancers in your accounts:

1. In the navigation pane, choose Overview.

2. On the Overview page, choose Create scope.

3. For Scope name, enter a descriptive name, such as my-alb-scope.

4. (Optional) In the Account and organizational unit selection section, for Select method of controlling administrative scope, select Scope to entire AWS Organization (all OUs and accounts). Skip this step for single-account deployments.

5. In the Resources section, for Resource types, select Application Load Balancer.

6. Choose Create scope.

AWS CLI alternative

You can also create a scope with the AWS CLI:

aws network-security-manager create-scope \
    --scope-name "my-alb-scope" \
    --scope-configuration '{
        "accountFilter": {"includeAll": {}},
        "resourceScopes": {
            "AWS::ElasticLoadBalancingV2::LoadBalancer::application": {
                "includeAll": true
            }
        }
    }' \
    --is-published true

Step 5: Create and publish a deployment

A deployment binds policies to a scope and activates enforcement. To create and publish a deployment:

1. In the navigation pane, choose Overview.

2. On the Overview page, choose Create deployment.

3. For Deployment name, enter a descriptive name, such as my-first-deployment.

4. In the Policies section, choose Add policy and select the policy you created in Step 3.

5. In the Scopes section, choose Add scope and select the scope you created in Step 4.

6. Choose Create deployment.

AWS Network Security Manager begins discovering resources and applying protections. This process is asynchronous and might take a few minutes to complete.

AWS CLI alternative

You can also create and publish a deployment with the AWS CLI:

aws network-security-manager create-deployment \
    --deployment-name "my-first-deployment" \
    --associated-policy-list '[{"policyIdentifier": "policy-arn-from-step-3"}]' \
    --associated-scope-list '[{"scopeIdentifier": "scope-arn-from-step-4"}]' \
    --deployment-configuration '{"enableCrossAccountVisibility": true}' \
    --is-published true

Step 6: Monitor synchronization status

After you publish a deployment, AWS Network Security Manager discovers resources and synchronizes their configurations. To monitor the status of each resource:

1. In the navigation pane, choose Overview.

2. Choose the Deployments tab.

3. Choose the deployment you created in Step 5.

4. Choose the Synchronization tab.

5. Review the synchronization status for each resource:

   • IN_SYNC – The resource configuration matches your intended protection settings.

   • OUT_OF_SYNC – The resource configuration does not match. AWS Network Security Manager remediates this automatically when remediation is enabled.

   • NOT_APPLICABLE – The resource is in scope but cannot be evaluated by this deployment.

AWS CLI alternative

You can also check synchronization status with the AWS CLI:

aws network-security-manager list-resource-synchronization-statuses \
    --deployment-identifier "deployment-arn-from-step-5"

Step 7: Clean up

If you no longer need the resources you created, delete them in reverse order to stop enforcement and remove protections from in-scope resources:

The reverse order matters because these resources reference each other. To see what is associated with a resource before you delete it, call ListResourceAssociations with that resource's ARN. It returns each associated resource's ARN and resource type. For more information, see the AWS Network Security Manager API Reference.

1. In the navigation pane, choose Overview. Choose the Deployments tab. Select your deployment, choose Action, then choose Delete.

2. Choose the Scopes tab. Select your scope, choose Action, then choose Delete.

3. Choose the Policies tab. Select your policy, choose Action, then choose Delete.

4. Choose the Templates tab. Select your template, choose Action, then choose Delete.

5. Choose the Rules tab. Select your rule, choose Action, then choose Delete.

AWS CLI alternative

Before you delete a resource, check its associations to plan the delete order:

aws network-security-manager list-resource-associations \
    --resource-arn "resource-arn"

If a resource still has associations, remove or delete the associated resources first.

You can delete resources with the AWS CLI in reverse order:

aws network-security-manager delete-deployment \
    --deployment-identifier "deployment-arn"

aws network-security-manager delete-scope \
    --scope-identifier "scope-arn"

aws network-security-manager delete-policy \
    --policy-identifier "policy-arn"

aws network-security-manager delete-template \
    --template-identifier "template-arn"

aws network-security-manager delete-rule \
    --rule-identifier "rule-arn"

Next steps

Now that you have a working deployment, explore the following ways to expand your network security protection:

• Learn about the resource model and lifecycle in How AWS Network Security Manager works.

• Use the draft/publish workflow to stage changes before they take effect. For more information, see Draft and Active lifecycle.

• Create snapshots to preserve known-good configurations. For more information, see Versioning.

• Use GenerateRuleConfiguration to create rules from natural-language descriptions. For more information, see the AWS Network Security Manager API Reference.

• Explore managing AWS WAF and AWS Shield Advanced protections across your organization. For more information, see Managing firewalls and security services.