Creating an AWS Firewall Manager policy
The steps for creating a policy vary between the different policy types. Make sure to use the procedure for the type of policy that you need.
Important
AWS Firewall Manager doesn't support Amazon Route 53 or AWS Global Accelerator. If you want to protect these resources with Shield Advanced, you can't use a Firewall Manager policy. Instead, follow the instructions in Adding AWS Shield Advanced protection to AWS resources.
Topics
- Creating an AWS Firewall Manager policy for AWS WAF
- Creating an AWS Firewall Manager policy for AWS WAF Classic
- Creating an AWS Firewall Manager policy for AWS Shield Advanced
- Creating an AWS Firewall Manager common security group policy
- Creating an AWS Firewall Manager content audit security group policy
- Creating an AWS Firewall Manager usage audit security group policy
- Creating an AWS Firewall Manager network ACL policy
- Creating an AWS Firewall Manager policy for AWS Network Firewall
- Creating an AWS Firewall Manager policy for Amazon Route 53 Resolver DNS Firewall
- Creating an AWS Firewall Manager policy for Palo Alto Networks Cloud NGFW
- Creating an AWS Firewall Manager policy for Fortigate Cloud Native Firewall (CNF) as a Service
Creating an AWS Firewall Manager policy for AWS WAF
In a Firewall Manager AWS WAF policy, you can use managed rule groups, which AWS and AWS Marketplace sellers create and maintain for you. You can also create and use your own rule groups. For more information about rule groups, see AWS WAF rule groups.
If you want to use your own rule groups, create those before you create your Firewall Manager AWS WAF policy. For guidance, see Managing your own rule groups. To use an individual custom rule, you must define your own rule group, define your rule within that, and then use the rule group in your policy.
For information about Firewall Manager AWS WAF policies, see AWS WAF policies.
To create a Firewall Manager policy for AWS WAF (console)
-
Sign in to the AWS Management Console using your Firewall Manager administrator account, and then open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2
. For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites. Note
For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites.
-
In the navigation pane, choose Security policies.
-
Choose Create policy.
-
For Policy type, choose AWS WAF.
-
For Region, choose an AWS Region. To protect Amazon CloudFront distributions, choose Global.
To protect resources in multiple Regions (other than CloudFront distributions), you must create separate Firewall Manager policies for each Region.
-
Choose Next.
-
For Policy name, enter a descriptive name. Firewall Manager includes the policy name in the names of the web ACLs that it manages. The web ACL names have
FMManagedWebACLV2-
followed by the policy name that you enter here,-
, and the web ACL creation timestamp, in UTC milliseconds. For example,FMManagedWebACLV2-MyWAFPolicyName-1621880374078
. -
For Web request body inspection, optionally change the body size limit. For information about body inspection size limits, including pricing considerations, see Managing body inspection size limits in the AWS WAF Developer Guide.
-
Under Policy rules, add the rule groups that you want AWS WAF to evaluate first and last in the web ACL. To use AWS WAF managed rule group versioning, toggle Enable versioning. The individual account managers can add rules and rule groups in between your first rule groups and your last rule groups. For more information about using AWS WAF rule groups in Firewall Manager policies for AWS WAF, see AWS WAF policies.
(Optional) To customize how your web ACL uses the rule group, choose Edit. The following are common customization settings:
-
For managed rule groups, override the rule actions for some or all rules. If you don't define an override action for a rule, the evaluation uses the rule action that's defined inside the rule group. For information about this option, see Action override options for rule groups in the AWS WAF Developer Guide.
-
Some managed rule groups require you to provide additional configuration. See the documentation from your managed rule group provider. For information specific to the AWS Managed Rules rule groups, see AWS Managed Rules for AWS WAF in the AWS WAF Developer Guide.
When you're finished with your settings, choose Save rule.
-
-
Set the default action for the web ACL. This is the action that AWS WAF takes when a web request doesn't match any of the rules in the web ACL. You can add custom headers with the Allow action, or custom responses for the Block action. For more information about default web ACL actions, see The web ACL default action. For information about setting custom web requests and responses, see Customized web requests and responses in AWS WAF.
-
For Logging configuration, choose Enable logging to turn on logging. Logging provides detailed information about traffic that is analyzed by your web ACL. Choose the Logging destination, and then choose the logging destination that you configured. You must choose a logging destination whose name begins with
aws-waf-logs-
. For information about configuring a AWS WAF logging destination, see Configuring logging for an AWS WAF policy. (Optional) If you don't want certain fields and their values included in the logs, redact those fields. Choose the field to redact, and then choose Add. Repeat as necessary to redact additional fields. The redacted fields appear as
REDACTED
in the logs. For example, if you redact the URI field, the URI field in the logs will beREDACTED
.-
(Optional) If you don't want to send all requests to the logs, add your filtering criteria and behavior. Under Filter logs, for each filter that you want to apply, choose Add filter, then choose your filtering criteria and specify whether you want to keep or drop requests that match the criteria. When you finish adding filters, if needed, modify the Default logging behavior. For more information, see Web ACL logging configuration in the AWS WAF Developer Guide.
-
You can define a Token domain list to enable token sharing between protected applications. Tokens are used by the CAPTCHA and Challenge actions and by the application integration SDKs that you implement when you use the AWS Managed Rules rule groups for AWS WAF Fraud Control account takeover prevention (ATP) and AWS WAF Bot Control.
Public suffixes aren't allowed. For example, you can't use
gov.au
orco.uk
as a token domain.By default, AWS WAF accepts tokens only for the domain of the protected resource. If you add token domains in this list, AWS WAF accepts tokens for all domains in the list and for the domain of the associated resource. For more information, see AWS WAF web ACL token domain list configuration in the AWS WAF Developer Guide.
You can only change the web ACL's CAPTCHA and challenge immunity times when you edit an existing web ACL. You can find these settings under the Firewall Manager Policy details page. For information about these settings, see Timestamp expiration: AWS WAF token immunity times. If you update the Association config, CAPTCHA, Challenge, or Token domain list settings in an existing policy, Firewall Manager will overwrite the your local web ACLs with the new values. However, if you don't update the policy's Association config, CAPTCHA, Challenge, or Token domain list settings, then the values in your local web ACLs will remain unchanged. For information about this option, see CAPTCHA and Challenge in AWS WAF in the AWS WAF Developer Guide.
-
Under Web ACL management, if you want Firewall Manager to manage unassociated web ACLs, then enable Manage unassociated web ACLs. With this option, Firewall Manager creates web ACLs in the accounts within policy scope only if the web ACLs will be used by at least one resource. If at any time an account comes into policy scope, Firewall Manager automatically creates a web ACL in the account if at least one resource will use the web ACL. Upon enablement of this option, Firewall Manager performs a one-time cleanup of unassociated web ACLs in your account. The cleanup process can take several hours. If a resource leaves policy scope after Firewall Manager creates a web ACL, Firewall Manager disassociates the resource from the web ACL, but won't clean up the unassociated web ACL. Firewall Manager only cleans up unassociated web ACLs when you first enable management of unassociated web ACLs in a policy.
-
For Policy action, if you want to create a web ACL in each applicable account within the organization, but not apply the web ACL to any resources yet, choose Identify resources that don't comply with the policy rules, but don't auto remediate and don't choose Manage unassociated web ACLs. You can change these options later.
If instead you want to automatically apply the policy to existing in-scope resources, choose Auto remediate any noncompliant resources. If Manage unassociated web ACLs is disabled, the Auto remediate any noncompliant resources option creates a web ACL in each applicable account within the organization and associates the web ACL with the resources in the accounts. If Manage unassociated web ACLs is enabled, the Auto remediate any noncompliant resources option only creates and associates a web ACL in accounts that have resources eligible for association to the web ACL.
When you choose Auto remediate any noncompliant resources, you can also choose to remove existing web ACL associations from in-scope resources, for the web ACLs that aren't managed by another active Firewall Manager policy. If you choose this option, Firewall Manager first associates the policy's web ACL with the resources, and then removes the prior associations. If a resource has an association with another web ACL that's managed by a different active Firewall Manager policy, this choice doesn't affect that association.
-
Choose Next.
-
For AWS accounts this policy applies to, choose the option as follows:
-
If you want to apply the policy to all accounts in your organization, leave the default selection, Include all accounts under my AWS organization.
If you want to apply the policy only to specific accounts or accounts that are in specific AWS Organizations organizational units (OUs), choose Include only the specified accounts and organizational units, and then add the accounts and OUs that you want to include. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
If you want to apply the policy to all but a specific set of accounts or AWS Organizations organizational units (OUs), choose Exclude the specified accounts and organizational units, and include all others, and then add the accounts and OUs that you want to exclude. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can only choose one of the options.
After you apply the policy, Firewall Manager automatically evaluates any new accounts against your settings. For example, if you include only specific accounts, Firewall Manager doesn't apply the policy to any new accounts. As another example, if you include an OU, when you add an account to the OU or to any of its child OUs, Firewall Manager automatically applies the policy to the new account.
-
-
For Resource type, choose the types of resources that you want to protect.
-
For Resources, you can narrow the scope of the policy using tagging, by either including or excluding resources with the tags that you specify. You can use inclusion or exclusion, and not both. For more information about tags, see Working with Tag Editor.
If you enter more than one tag, a resource must have all of the tags to be included or excluded.
Resource tags can only have non-null values. If you omit the value for a tag, Firewall Manager saves the tag with an empty string value: "". Resource tags only match with tags that have the same key and the same value.
-
Choose Next.
-
For Policy tags, add any identifying tags that you want to add to the Firewall Manager policy resource. For more information about tags, see Working with Tag Editor.
-
Choose Next.
-
Review the new policy settings and return to any pages where you need to any adjustments.
When you are satisfied with the policy, choose Create policy. In the AWS Firewall Manager policies pane, your policy should be listed. It will probably indicate Pending under the accounts headings and it will indicate the status of the Automatic remediation setting. The creation of a policy can take several minutes. After the Pending status is replaced with account counts, you can choose the policy name to explore the compliance status of the accounts and resources. For information, see Viewing compliance information for an AWS Firewall Manager policy
Creating an AWS Firewall Manager policy for AWS WAF Classic
To create a Firewall Manager policy for AWS WAF Classic (console)
-
Sign in to the AWS Management Console using your Firewall Manager administrator account, and then open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2
. For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites. Note
For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites.
-
In the navigation pane, choose Security policies.
-
Choose Create policy.
-
For Policy type, choose AWS WAF Classic.
-
If you already created the AWS WAF Classic rule group that you want to add to the policy, choose Create an AWS Firewall Manager policy and add existing rule groups. If you want to create a new rule group, choose Create a Firewall Manager policy and add a new rule group.
-
For Region, choose an AWS Region. To protect Amazon CloudFront resources, choose Global.
To protect resources in multiple Regions (other than CloudFront resources), you must create separate Firewall Manager policies for each Region.
-
Choose Next.
-
If you are creating a rule group, follow the instructions in Creating an AWS WAF Classic rule group. After you create the rule group, continue with the following steps.
-
Enter a policy name.
-
If you are adding an existing rule group, use the dropdown menu to select a rule group to add, and then choose Add rule group.
-
A policy has two possible actions: Action set by rule group and Count. If you want to test the policy and rule group, set the action to Count. This action overrides any block action specified by the rules in the rule group. That is, if the policy's action is set to Count, those requests are only counted and not blocked. Conversely, if you set the policy's action to Action set by rule group, actions of the rule group rules are used. Choose the appropriate action.
-
Choose Next.
-
For AWS accounts this policy applies to, choose the option as follows:
-
If you want to apply the policy to all accounts in your organization, leave the default selection, Include all accounts under my AWS organization.
-
If you want to apply the policy only to specific accounts or accounts that are in specific AWS Organizations organizational units (OUs), choose Include only the specified accounts and organizational units, and then add the accounts and OUs that you want to include. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
-
If you want to apply the policy to all but a specific set of accounts or AWS Organizations organizational units (OUs), choose Exclude the specified accounts and organizational units, and include all others, and then add the accounts and OUs that you want to exclude. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can only choose one of the options.
After you apply the policy, Firewall Manager automatically evaluates any new accounts against your settings. For example, if you include only specific accounts, Firewall Manager doesn't apply the policy to any new accounts. As another example, if you include an OU, when you add an account to the OU or to any of its child OUs, Firewall Manager automatically applies the policy to the new account.
-
-
Choose the type of resource that you want to protect.
-
For Resources, you can narrow the scope of the policy using tagging, by either including or excluding resources with the tags that you specify. You can use inclusion or exclusion, and not both. For more information about tags, see Working with Tag Editor.
If you enter more than one tag, a resource must have all of the tags to be included or excluded.
Resource tags can only have non-null values. If you omit the value for a tag, Firewall Manager saves the tag with an empty string value: "". Resource tags only match with tags that have the same key and the same value.
-
If you want to automatically apply the policy to existing resources, choose Create and apply this policy to existing and new resources.
This option creates a web ACL in each applicable account within an AWS organization and associates the web ACL with the resources in the accounts. This option also applies the policy to all new resources that match the preceding criteria (resource type and tags). Alternatively, if you choose Create policy but do not apply the policy to existing or new resources, Firewall Manager creates a web ACL in each applicable account within the organization, but doesn't apply the web ACL to any resources. You must apply the policy to resources later. Choose the appropriate option.
-
For Replace existing associated web ACLs, you can choose to remove any web ACL associations that are currently defined for in-scope resources, and then replace them with associations to the web ACLs that you are creating with this policy. By default, Firewall Manager doesn't remove existing web ACL associations before it adds the new ones. If you want to remove the existing ones, choose this option.
-
Choose Next.
-
Review the new policy. To make any changes, choose Edit. When you are satisfied with the policy, choose Create and apply policy.
Creating an AWS Firewall Manager policy for AWS Shield Advanced
To create a Firewall Manager policy for Shield Advanced (console)
-
Sign in to the AWS Management Console using your Firewall Manager administrator account, and then open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2
. For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites. Note
For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites.
-
In the navigation pane, choose Security policies.
-
Choose Create policy.
-
For Policy type, choose Shield Advanced.
To create a Shield Advanced policy, you must be subscribed to Shield Advanced. If you are not subscribed, you are prompted to do so. For information about the cost for subscribing, see AWS Shield Advanced Pricing
. -
For Region, choose an AWS Region. To protect Amazon CloudFront distributions, choose Global.
For Region choices other than Global, to protect resources in multiple Regions, you must create a separate Firewall Manager policy for each Region.
-
Choose Next.
-
For Name, enter a descriptive name.
-
For Global Region policies only, you can choose whether you want to manage Shield Advanced automatic application layer DDoS mitigation. For information about this Shield Advanced feature, see Shield Advanced automatic application layer DDoS mitigation.
You can choose to enable or disable automatic mitigation, or you can choose to ignore it. If you choose to ignore it, Firewall Manager doesn't manage automatic mitigation at all for the Shield Advanced protections. For more information about these policy options, see Automatic application layer DDoS mitigation.
-
Under Web ACL management, if you want Firewall Manager to manage unassociated web ACLs, then enable Manage unassociated web ACLs. With this option, Firewall Manager creates web ACLs in the accounts within policy scope only if the web ACLs will be used by at least one resource. If at any time an account comes into policy scope, Firewall Manager automatically creates a web ACL in the account if at least one resource will use the web ACL. Upon enablement of this option, Firewall Manager performs a one-time cleanup of unassociated web ACLs in your account. The cleanup process can take several hours. If a resource leaves policy scope after Firewall Manager creates a web ACL, Firewall Manager will not disassociate the resource from the web ACL. To include the web ACL in the one-time cleanup, you must first manually disassociate the resources from the web ACL and then enable Manage unassociated web ACLs.
-
For Policy action, we recommend creating the policy with the option that doesn't automatically remediate noncompliant resources. When you disable automatic remediation, you can assess the effects of your new policy before you apply it. When you are satisfied that the changes are what you want, then edit the policy and change the policy action to enable automatic remediation.
If instead you want to automatically apply the policy to existing in-scope resources, choose Auto remediate any noncompliant resources. This option applies Shield Advanced protections for each applicable account within the AWS organization and each applicable resource in the accounts.
For Global Region policies only, if you choose Auto remediate any noncompliant resources, you can also choose to have Firewall Manager automatically replace any existing AWS WAF Classic web ACL associations with new associations to web ACLs that were created using the latest version of AWS WAF (v2). If you choose this, Firewall Manager removes the associations with the earlier version web ACLs and creates new associations with latest version web ACLs, after creating new empty web ACLs in any in-scope accounts that don't already have them for the policy. For more information about this option, see Replace AWS WAF Classic web ACLs with latest version web ACLs.
-
Choose Next.
-
For AWS accounts this policy applies to, choose the option as follows:
-
If you want to apply the policy to all accounts in your organization, keep the default selection, Include all accounts under my AWS organization.
-
If you want to apply the policy only to specific accounts or accounts that are in specific AWS Organizations organizational units (OUs), choose Include only the specified accounts and organizational units, and then add the accounts and OUs that you want to include. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
-
If you want to apply the policy to all but a specific set of accounts or AWS Organizations organizational units (OUs), choose Exclude the specified accounts and organizational units, and include all others, and then add the accounts and OUs that you want to exclude. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can only choose one of the options.
After you apply the policy, Firewall Manager automatically evaluates any new accounts against your settings. For example, if you include only specific accounts, Firewall Manager doesn't apply the policy to any new accounts. As another example, if you include an OU, when you add an account to the OU or to any of its child OUs, Firewall Manager automatically applies the policy to the new account.
-
-
Choose the type of resource that you want to protect.
Firewall Manager does not support Amazon Route 53 or AWS Global Accelerator. If you need to use Shield Advanced to protect resources from these services, you can't use a Firewall Manager policy. Instead, follow the Shield Advanced guidance at Adding AWS Shield Advanced protection to AWS resources.
-
For Resources, you can narrow the scope of the policy using tagging, by either including or excluding resources with the tags that you specify. You can use inclusion or exclusion, and not both. For more information about tags, see Working with Tag Editor.
If you enter more than one tag, a resource must have all of the tags to be included or excluded.
Resource tags can only have non-null values. If you omit the value for a tag, Firewall Manager saves the tag with an empty string value: "". Resource tags only match with tags that have the same key and the same value.
-
Choose Next.
-
For Policy tags, add any identifying tags that you want to add to the Firewall Manager policy resource. For more information about tags, see Working with Tag Editor.
-
Choose Next.
-
Review the new policy settings and return to any pages where you need to any adjustments.
When you are satisfied with the policy, choose Create policy. In the AWS Firewall Manager policies pane, your policy should be listed. It will probably indicate Pending under the accounts headings and it will indicate the status of the Automatic remediation setting. The creation of a policy can take several minutes. After the Pending status is replaced with account counts, you can choose the policy name to explore the compliance status of the accounts and resources. For information, see Viewing compliance information for an AWS Firewall Manager policy
Creating an AWS Firewall Manager common security group policy
For information about how common security group policies work, see Common security group policies.
To create a common security group policy, you must have a security group already created in your Firewall Manager administrator account that you want to use as the primary for your policy. You can manage security groups through Amazon Virtual Private Cloud (Amazon VPC) or Amazon Elastic Compute Cloud (Amazon EC2). For information, see Working with Security Groups in the Amazon VPC User Guide.
To create a common security group policy (console)
-
Sign in to the AWS Management Console using your Firewall Manager administrator account, and then open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2
. For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites. Note
For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites.
-
In the navigation pane, choose Security policies.
-
Choose Create policy.
-
For Policy type, choose Security group.
-
For Security group policy type, choose Common security groups.
-
For Region, choose an AWS Region.
-
Choose Next.
-
For Policy name, enter a friendly name.
-
For Policy rules, do the following:
-
From the rules option, choose the restrictions that you want to apply to the security group rules and the resources that are within policy scope. If you choose Distribute tags from the primary security group to the security groups created by this policy, then you must also select Identify and report when the security groups created by this policy become non-compliant.
Important
Firewall Manager won't distribute system tags added by AWS services into the replica security groups. System tags begin with the
aws:
prefix. Additionally, Firewall Manager won't update the tags of existing security groups or create new security groups if the policy has tags that conflict with the organization's tag policy. For information about tag policies, see Tag policies in the AWS Organizations User Guide.If you choose Distribute security group references from the primary security group to the security groups created by this policy, Firewall Manager only distributes the security group references if they have an active peering connection in Amazon VPC. For information about this option, see Policy rules settings.
-
For Primary security groups, choose Add security groups, and then choose the security groups that you want to use. Firewall Manager populates the list of security groups from all Amazon VPC instances in the Firewall Manager administrator account.
By default, the maximum number of primary security groups per policy is 3. For information about this setting, see AWS Firewall Manager quotas.
-
For Policy action, we recommend creating the policy with the option that doesn't automatically remediate. This allows you to assess the effects of your new policy before you apply it. When you are satisfied that the changes are what you want, then edit the policy and change the policy action to enable automatic remediation of noncompliant resources.
-
-
Choose Next.
-
For AWS accounts this policy applies to, choose the option as follows:
-
If you want to apply the policy to all accounts in your organization, leave the default selection, Include all accounts under my AWS organization.
-
If you want to apply the policy only to specific accounts or accounts that are in specific AWS Organizations organizational units (OUs), choose Include only the specified accounts and organizational units, and then add the accounts and OUs that you want to include. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
-
If you want to apply the policy to all but a specific set of accounts or AWS Organizations organizational units (OUs), choose Exclude the specified accounts and organizational units, and include all others, and then add the accounts and OUs that you want to exclude. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can only choose one of the options.
After you apply the policy, Firewall Manager automatically evaluates any new accounts against your settings. For example, if you include only specific accounts, Firewall Manager doesn't apply the policy to any new accounts. As another example, if you include an OU, when you add an account to the OU or to any of its child OUs, Firewall Manager automatically applies the policy to the new account.
-
-
For Resource type, choose the types of resources that you want to protect.
For the resource type EC2 instance, you can choose to remediate all Amazon EC2 instances or only remediate instances that have just the default, primary elastic network interface (ENI). For the latter option, Firewall Manager doesn't remediate instances that have additional ENI attachments. Instead, when automatic remediation is enabled, Firewall Manager only marks the compliance status of these EC2 instances, and doesn't apply any remediation actions. See additional caveats and limitations for the Amazon EC2 resource type at Security group policy caveats and limitations.
-
For Resources, you can narrow the scope of the policy using tagging, by either including or excluding resources with the tags that you specify. You can use inclusion or exclusion, and not both. For more information about tags, see Working with Tag Editor.
If you enter more than one tag, a resource must have all of the tags to be included or excluded.
Resource tags can only have non-null values. If you omit the value for a tag, Firewall Manager saves the tag with an empty string value: "". Resource tags only match with tags that have the same key and the same value.
-
For Shared VPC resources, if you want to apply the policy to resources in shared VPCs, in addition to the VPCs that the accounts own, select Include resources from shared VPCs.
-
Choose Next.
-
Review the policy settings to be sure they're what you want, and then choose Create policy.
Firewall Manager creates a replica of the primary security group in every Amazon VPC instance contained within the in-scope accounts up to the supported Amazon VPC maximum quota per account. Firewall Manager associates the replica security groups to the resources that are within policy scope for each in-scope account. For more information about how this policy works, see Common security group policies.
Creating an AWS Firewall Manager content audit security group policy
For information about how content audit security group policies work, see Content audit security group policies.
For some content audit policy settings, you must provide an audit security group for Firewall Manager to use as a template. For example, you might have an audit security group that contains all of the rules that you don't allow in any security group. You must create these audit security groups using your Firewall Manager administrator account, before you can use them in your policy. You can manage security groups through Amazon Virtual Private Cloud (Amazon VPC) or Amazon Elastic Compute Cloud (Amazon EC2). For information, see Working with Security Groups in the Amazon VPC User Guide.
To create a content audit security group policy (console)
-
Sign in to the AWS Management Console using your Firewall Manager administrator account, and then open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2
. For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites. Note
For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites.
-
In the navigation pane, choose Security policies.
-
Choose Create policy.
-
For Policy type, choose Security group.
-
For Security group policy type, choose Auditing and enforcement of security group rules.
-
For Region, choose an AWS Region.
-
Choose Next.
-
For Policy name, enter a friendly name.
-
For Policy rules, choose the managed or custom policy rules option that you want to use.
For Configure managed audit policy rules, do the following:
-
For Configure security group rules to audit, select the type of security group rules that you want your audit policy to apply to.
-
If you want to do things like audit rules based on the protocols, ports, and CIDR range settings that in your security groups, choose Audit overly permissive security group rules and select the options that you want.
For the selection Rule allows all traffic, you can provide a custom application list to designate the applications that you want to audit. For information about custom application lists and how to use them in your policy, see Managed lists and Using managed lists.
For selections that use protocol lists, you can use existing lists and you can create new lists. For information about protocol lists and how to use them in your policy, see Managed lists and Using managed lists.
-
If you want to audit high-risk based on their access to either reserved or non-reserved CIDR ranges, choose Audit high risk applications and select the options that you want.
The following selections are mutually exclusive: Applications that can access only reserved CIDR ranges and Applications allowed to access non-reserved CIDR ranges. You can select at most one of them in any policy.
For selections that use application lists, you can use existing lists and you can create new lists. For information about application lists and how to use them in your policy, see Managed lists and Using managed lists.
-
Use the Overrides settings to explicitly override other settings in the policy. You can choose to always allow or always deny specific security group rules, regardless of whether they comply with the other options that you've set for the policy.
For this option, you provide an audit security group as your allowed rules or denied rules template. For Audit security groups, choose Add audit security groups, and then choose the security group that you want to use. Firewall Manager populates the list of audit security groups from all Amazon VPC instances in the Firewall Manager administrator account. The default maximum quota for the number of audit security groups for a policy is one. For information about increasing the quota, see AWS Firewall Manager quotas.
-
For Configure custom policy rules, do the following:
-
From the rules options, choose whether to allow only the rules defined in the audit security groups or deny all the rules. For information about this choice, see Content audit security group policies.
-
For Audit security groups, choose Add audit security groups, and then choose the security group that you want to use. Firewall Manager populates the list of audit security groups from all Amazon VPC instances in the Firewall Manager administrator account. The default maximum quota for the number of audit security groups for a policy is one. For information about increasing the quota, see AWS Firewall Manager quotas.
-
For Policy action, you must create the policy with the option that doesn't automatically remediate. This allows you to assess the effects of your new policy before you apply it. When you are satisfied that the changes are what you want, edit the policy and change the policy action to enable automatic remediation of noncompliant resources.
-
-
Choose Next.
-
For AWS accounts this policy applies to, choose the option as follows:
-
If you want to apply the policy to all accounts in your organization, leave the default selection, Include all accounts under my AWS organization.
-
If you want to apply the policy only to specific accounts or accounts that are in specific AWS Organizations organizational units (OUs), choose Include only the specified accounts and organizational units, and then add the accounts and OUs that you want to include. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
-
If you want to apply the policy to all but a specific set of accounts or AWS Organizations organizational units (OUs), choose Exclude the specified accounts and organizational units, and include all others, and then add the accounts and OUs that you want to exclude. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can only choose one of the options.
After you apply the policy, Firewall Manager automatically evaluates any new accounts against your settings. For example, if you include only specific accounts, Firewall Manager doesn't apply the policy to any new accounts. As another example, if you include an OU, when you add an account to the OU or to any of its child OUs, Firewall Manager automatically applies the policy to the new account.
-
-
For Resource type, choose the types of resource that you want to protect.
-
For Resources, you can narrow the scope of the policy using tagging, by either including or excluding resources with the tags that you specify. You can use inclusion or exclusion, and not both. For more information about tags, see Working with Tag Editor.
If you enter more than one tag, a resource must have all of the tags to be included or excluded.
Resource tags can only have non-null values. If you omit the value for a tag, Firewall Manager saves the tag with an empty string value: "". Resource tags only match with tags that have the same key and the same value.
-
Choose Next.
-
Review the policy settings to be sure they're what you want, and then choose Create policy.
Firewall Manager compares the audit security group against the in-scope security groups in your AWS organization, according to your policy rules settings. You can review the policy status in the AWS Firewall Manager policy console. After the policy is created, you can edit it and enable automatic remediation to put your auditing security group policy into effect. For more information about how this policy works, see Content audit security group policies.
Creating an AWS Firewall Manager usage audit security group policy
For information about how usage audit security group policies work, see Usage audit security group policies.
To create a usage audit security group policy (console)
-
Sign in to the AWS Management Console using your Firewall Manager administrator account, and then open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2
. For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites. Note
For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites.
-
In the navigation pane, choose Security policies.
-
Choose Create policy.
-
For Policy type, choose Security group.
-
For Security group policy type, choose Auditing and cleanup of unassociated and redundant security groups.
-
For Region, choose an AWS Region.
-
Choose Next.
-
For Policy name, enter a friendly name.
-
For Policy rules, choose one or both of the options available.
-
If you choose Security groups within this policy scope must be used by at least one resource, Firewall Manager removes any security groups that it determines are unused. When this rule is enabled, Firewall Manager runs it last when you save the policy.
For details about how Firewall Manager determines usage and the timing of the remediation, see Usage audit security group policies.
Note
When you use this usage audit security group policy type, avoid making multiple changes to the association status of in-scope security groups in a short amount of time. Doing so can cause Firewall Manager to miss corresponding events.
By default, Firewall Manager considers security groups as noncompliant with this policy rule as soon as they're unused. You can optionally specify a number of minutes that a security group can exist unused before it's considered noncompliant, up to 525,600 minutes (365 days). You can use this setting to allow yourself time to associate new security groups with resources.
Important
If you specify a number of minutes other than the default value of zero, you must enable indirect relationships in AWS Config. Otherwise, your usage audit security group policies will not work as intended. For information about indirect relationships in AWS Config, see Indirect Relationships in AWS Config in the AWS Config Developer Guide.
-
If you choose Security groups within this policy scope must be unique, Firewall Manager consolidates redundant security groups, so that only one is associated with any resources. If you choose this, Firewall Manager runs it first when you save the policy.
-
-
For Policy action, we recommend creating the policy with the option that doesn't automatically remediate. This allows you to assess the effects of your new policy before you apply it. When you are satisfied that the changes are what you want, then edit the policy and change the policy action to enable automatic remediation of noncompliant resources.
-
Choose Next.
-
For AWS accounts this policy applies to, choose the option as follows:
-
If you want to apply the policy to all accounts in your organization, leave the default selection, Include all accounts under my AWS organization.
-
If you want to apply the policy only to specific accounts or accounts that are in specific AWS Organizations organizational units (OUs), choose Include only the specified accounts and organizational units, and then add the accounts and OUs that you want to include. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
-
If you want to apply the policy to all but a specific set of accounts or AWS Organizations organizational units (OUs), choose Exclude the specified accounts and organizational units, and include all others, and then add the accounts and OUs that you want to exclude. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can only choose one of the options.
After you apply the policy, Firewall Manager automatically evaluates any new accounts against your settings. For example, if you include only specific accounts, Firewall Manager doesn't apply the policy to any new accounts. As another example, if you include an OU, when you add an account to the OU or to any of its child OUs, Firewall Manager automatically applies the policy to the new account.
-
-
For Resources, you can narrow the scope of the policy using tagging, by either including or excluding resources with the tags that you specify. You can use inclusion or exclusion, and not both. For more information about tags, see Working with Tag Editor.
If you enter more than one tag, a resource must have all of the tags to be included or excluded.
Resource tags can only have non-null values. If you omit the value for a tag, Firewall Manager saves the tag with an empty string value: "". Resource tags only match with tags that have the same key and the same value.
-
Choose Next.
-
If you haven't excluded the Firewall Manager administrator account from the policy scope, Firewall Manager prompts you to do this. Doing this leaves the security groups in the Firewall Manager administrator account, which you use for common and audit security group policies, under your manual control. Choose the option you want in this dialogue.
-
Review the policy settings to be sure they're what you want, and then choose Create policy.
If you chose to require unique security groups, Firewall Manager scans for redundant security groups in each in-scope Amazon VPC instance. Then, if you chose to require that each security group be used by at least one resource, Firewall Manager scans for security groups that have remained unused for the minutes specified in the rule. You can review the policy status in the AWS Firewall Manager policy console. For more information about how this policy works, see Usage audit security group policies.
Creating an AWS Firewall Manager network ACL policy
For information about how network ACL policies work, see Network ACL policies.
To create a network ACL policy, you must know how to define a network ACL for use with your Amazon VPC subnets. For information, see Control traffic to subnets using network ACLs and Work with network ACLs in the Amazon VPC User Guide.
To create a network ACL policy (console)
-
Sign in to the AWS Management Console using your Firewall Manager administrator account, and then open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2
. For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites. Note
For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites.
-
In the navigation pane, choose Security policies.
-
Choose Create policy.
-
For Policy type, choose Network ACL.
-
For Region, choose an AWS Region.
-
Choose Next.
-
For Policy name, enter a descriptive name.
-
For Policy rules, define the rules that you want to always run in the network ACLs that Firewall Manager manages for you. Network ACLs monitor and handle inbound and outbound traffic, so in your policy, you define the rules for both directions.
For either direction, you define rules that you want to always run first and rules you want to always run last. In the network ACLs that Firewall Manager manages, account owners can define custom rules to run in between these first and last rules.
-
For Policy action, if you want to identify noncompliant subnets and network ACLs, but not take any corrective action yet, choose Identify resources that don't comply with the policy rules, but don't auto remediate. You can change these options later.
If instead you want to automatically apply the policy to existing in-scope subnets, choose Auto remediate any noncompliant resources. With this option, you also specify whether to force remediation when the traffic handling behavior of policy rules conflicts with custom rules that are in the network ACL. Regardless of whether you force remediation, Firewall Manager reports conflicting rules in its compliance violations.
-
Choose Next.
-
For AWS accounts this policy applies to, choose the option as follows:
-
If you want to apply the policy to all accounts in your organization, leave the default selection, Include all accounts under my AWS organization.
-
If you want to apply the policy only to specific accounts or accounts that are in specific AWS Organizations organizational units (OUs), choose Include only the specified accounts and organizational units, and then add the accounts and OUs that you want to include. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
-
If you want to apply the policy to all but a specific set of accounts or AWS Organizations organizational units (OUs), choose Exclude the specified accounts and organizational units, and include all others, and then add the accounts and OUs that you want to exclude. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can only choose one of the options.
After you apply the policy, Firewall Manager automatically evaluates any new accounts against your settings. For example, if you include only specific accounts, Firewall Manager doesn't apply the policy to any different, new accounts. As another example, if you include an OU, when you add an account to the OU or to any of its child OUs, Firewall Manager automatically applies the policy to the new account.
-
-
For Resource type, the setting is fixed at Subnets.
-
For Resources, you can narrow the scope of the policy using tagging, by either including or excluding resources with the tags that you specify. You can use inclusion or exclusion, and not both. For more information about tags, see Working with Tag Editor.
If you enter more than one tag, a resource must have all of the tags to be included or excluded.
Resource tags can only have non-null values. If you omit the value for a tag, Firewall Manager saves the tag with an empty string value: "". Resource tags only match with tags that have the same key and the same value.
-
Choose Next.
-
Review the policy settings to be sure they're what you want, and then choose Create policy.
Firewall Manager creates the policy and begins monitoring and managing the in scope network ACLs according to your settings. For more information about how this policy works, see Network ACL policies.
Creating an AWS Firewall Manager policy for AWS Network Firewall
In a Firewall Manager Network Firewall policy, you use rule groups that you manage in AWS Network Firewall. For information about managing your rule groups, see AWS Network Firewall rule groups in the Network Firewall Developer Guide.
For information about Firewall Manager Network Firewall policies, see AWS Network Firewall policies.
To create a Firewall Manager policy for AWS Network Firewall (console)
-
Sign in to the AWS Management Console using your Firewall Manager administrator account, and then open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2
. For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites. Note
For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites.
-
In the navigation pane, choose Security policies.
-
Choose Create policy.
-
For Policy type, choose AWS Network Firewall.
-
Under Firewall management type, choose how you'd like Firewall Manager to manage the policy's firewalls. Choose from the following options:
-
Distributed - Firewall Manager creates and maintains firewall endpoints in each VPC that's in the policy scope.
-
Centralized - Firewall Manager creates and maintains endpoints in a single inspection VPC.
-
Import existing firewalls - Firewall Manager imports existing firewalls from Network Firewall using resource sets. For information about resource sets, see Working with resource sets in Firewall Manager.
-
-
For Region, choose an AWS Region. To protect resources in multiple Regions, you must create separate policies for each Region.
-
Choose Next.
-
For Policy name, enter a descriptive name. Firewall Manager includes the policy name in the names of the Network Firewall firewalls and firewall policies that it creates.
-
In the AWS Network Firewall policy configuration, configure the firewall policy as you would in Network Firewall. Add your stateless and stateful rule groups and specify the policy's default actions. You can optionally set the policy's stateful rule evaluation order and default actions, as well as logging configuration. For information about Network Firewall firewall policy management, see AWS Network Firewall firewall policies in the AWS Network Firewall Developer Guide.
When you create the Firewall Manager Network Firewall policy, Firewall Manager creates firewall policies for the accounts that are within scope. Individual account managers can add rule groups to the firewall policies, but they can't change the configuration that you provide here.
-
Choose Next.
-
Do one of the following, depending on the Firewall management type you selected in the previous step:
-
If you're using a distributed firewall management type, in AWS Firewall Manager endpoint configuration under Firewall endpoint location, choose one of the following options:
-
Custom endpoint configuration - Firewall Manager creates firewalls for each VPC within the policy scope, in the Availability Zones that you specify. Each firewall contains at least one firewall endpoint.
-
Under Availability Zones, select which Availability Zones to create firewall endpoints in. You can select Availability Zones by Availability Zone name or by Availability Zone ID.
-
If you want to provide the CIDR blocks for Firewall Manager to use for firewall subnets in your VPCs, they must all be /28 CIDR blocks. Enter one block per line. If you omit these, Firewall Manager chooses IP addresses for you from those that are available in the VPCs.
Note
Auto remediation happens automatically for AWS Firewall Manager Network Firewall policies, so you won't see an option to choose not to auto remediate here.
-
-
Automatic endpoint configuration - Firewall Manager automatically creates firewall endpoints in the Availability Zones with public subnets in your VPC.
-
For the Firewall endpoints configuration, specify how you want the firewall endpoints to be managed by Firewall Manager. We recommend using multiple endpoints for high availability.
-
-
-
If you're using a centralized firewall management type, in AWS Firewall Manager endpoint configuration under Inspection VPC configuration, enter the AWS account ID of the owner of the inspection VPC, and the VPC ID of the inspection VPC.
-
Under Availability Zones, select which Availability Zones to create firewall endpoints in. You can select Availability Zones by Availability Zone name or by Availability Zone ID.
-
If you want to provide the CIDR blocks for Firewall Manager to use for firewall subnets in your VPCs, they must all be /28 CIDR blocks. Enter one block per line. If you omit these, Firewall Manager chooses IP addresses for you from those that are available in the VPCs.
Note
Auto remediation happens automatically for AWS Firewall Manager Network Firewall policies, so you won't see an option to choose not to auto remediate here.
-
-
If you're using a import existing firewalls firewall management type, in Resource sets add one or more resource sets. A resource set defines the existing Network Firewall firewalls owned by your organization's account that you want to centrally manage in this policy. To add a resource set to the policy, you must first create a resource set using the console or the PutResourceSet API. For information about resource sets, see Working with resource sets in Firewall Manager. For more information about importing existing firewalls from Network Firewall, see import existing firewalls.
-
-
Choose Next.
-
If your policy uses a distributed firewall management type, under Route management, choose whether or not Firewall Manager will monitor and alert on the traffic that must be routed through the respective firewall endpoints.
Note
If you choose Monitor, you can't change the setting to Off at a later date. Monitoring continues until you delete the policy.
-
For Traffic type, optionally add the traffic endpoints that you want to route traffic through for firewall inspection.
-
For Allow required cross-AZ traffic, if you enable this option then Firewall Manager treats as compliant routing that sends traffic out of an Availability Zone for inspection, for Availability Zones that don't have their own firewall endpoint. Availability Zones that have endpoints must always inspect their own traffic.
-
Choose Next.
-
For Policy scope, under AWS accounts this policy applies to, choose the option as follows:
-
If you want to apply the policy to all accounts in your organization, leave the default selection, Include all accounts under my AWS organization.
-
If you want to apply the policy only to specific accounts or accounts that are in specific AWS Organizations organizational units (OUs), choose Include only the specified accounts and organizational units, and then add the accounts and OUs that you want to include. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
-
If you want to apply the policy to all but a specific set of accounts or AWS Organizations organizational units (OUs), choose Exclude the specified accounts and organizational units, and include all others, and then add the accounts and OUs that you want to exclude. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can only choose one of the options.
After you apply the policy, Firewall Manager automatically evaluates any new accounts against your settings. For example, if you include only specific accounts, Firewall Manager doesn't apply the policy to any new accounts. As another example, if you include an OU, when you add an account to the OU or to any of its child OUs, Firewall Manager automatically applies the policy to the new account.
-
-
The Resource type for Network Firewall policies is VPC.
-
For Resources, you can narrow the scope of the policy using tagging, by either including or excluding resources with the tags that you specify. You can use inclusion or exclusion, and not both. For more information about tags, see Working with Tag Editor.
If you enter more than one tag, a resource must have all of the tags to be included or excluded.
Resource tags can only have non-null values. If you omit the value for a tag, Firewall Manager saves the tag with an empty string value: "". Resource tags only match with tags that have the same key and the same value.
-
Choose Next.
-
For Policy tags, add any identifying tags that you want to add to the Firewall Manager policy resource. For more information about tags, see Working with Tag Editor.
-
Choose Next.
-
Review the new policy settings and return to any pages where you need to any adjustments.
When you are satisfied with the policy, choose Create policy. In the AWS Firewall Manager policies pane, your policy should be listed. It will probably indicate Pending under the accounts headings and it will indicate the status of the Automatic remediation setting. The creation of a policy can take several minutes. After the Pending status is replaced with account counts, you can choose the policy name to explore the compliance status of the accounts and resources. For information, see Viewing compliance information for an AWS Firewall Manager policy
Creating an AWS Firewall Manager policy for Amazon Route 53 Resolver DNS Firewall
In a Firewall Manager DNS Firewall policy, you use rule groups that you manage in Amazon Route 53 Resolver DNS Firewall. For information about managing your rule groups, see Managing rule groups and rules in DNS Firewall in the Amazon Route 53 Developer Guide.
For information about Firewall Manager DNS Firewall policies, see Amazon Route 53 Resolver DNS Firewall policies.
To create a Firewall Manager policy for Amazon Route 53 Resolver DNS Firewall (console)
-
Sign in to the AWS Management Console using your Firewall Manager administrator account, and then open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2
. For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites. Note
For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites.
-
In the navigation pane, choose Security policies.
-
Choose Create policy.
-
For Policy type, choose Amazon Route 53 Resolver DNS Firewall.
-
For Region, choose an AWS Region. To protect resources in multiple Regions, you must create separate policies for each Region.
-
Choose Next.
-
For Policy name, enter a descriptive name.
-
In the policy configuration, add the rule groups that you want DNS Firewall to evaluate first and last among your VPCs' rule group associations. You can add up to two rule groups to the policy.
When you create the Firewall Manager DNS Firewall policy, Firewall Manager creates the rule group associations, with the association priorities that you've provided, for the VPCs and accounts that are within scope. The individual account managers can add rule group associations in between your first and last associations, but they can't change the associations that you define here. For more information, see Amazon Route 53 Resolver DNS Firewall policies.
-
Choose Next.
-
For AWS accounts this policy applies to, choose the option as follows:
-
If you want to apply the policy to all accounts in your organization, leave the default selection, Include all accounts under my AWS organization.
-
If you want to apply the policy only to specific accounts or accounts that are in specific AWS Organizations organizational units (OUs), choose Include only the specified accounts and organizational units, and then add the accounts and OUs that you want to include. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
-
If you want to apply the policy to all but a specific set of accounts or AWS Organizations organizational units (OUs), choose Exclude the specified accounts and organizational units, and include all others, and then add the accounts and OUs that you want to exclude. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can only choose one of the options.
After you apply the policy, Firewall Manager automatically evaluates any new accounts against your settings. For example, if you include only specific accounts, Firewall Manager doesn't apply the policy to any new accounts. As another example, if you include an OU, when you add an account to the OU or to any of its child OUs, Firewall Manager automatically applies the policy to the new account.
-
-
The Resource type for DNS Firewall policies is VPC.
-
For Resources, you can narrow the scope of the policy using tagging, by either including or excluding resources with the tags that you specify. You can use inclusion or exclusion, and not both. For more information about tags, see Working with Tag Editor.
If you enter more than one tag, a resource must have all of the tags to be included or excluded.
Resource tags can only have non-null values. If you omit the value for a tag, Firewall Manager saves the tag with an empty string value: "". Resource tags only match with tags that have the same key and the same value.
-
Choose Next.
-
For Policy tags, add any identifying tags that you want to add to the Firewall Manager policy resource. For more information about tags, see Working with Tag Editor.
-
Choose Next.
-
Review the new policy settings and return to any pages where you need to any adjustments.
When you are satisfied with the policy, choose Create policy. In the AWS Firewall Manager policies pane, your policy should be listed. It will probably indicate Pending under the accounts headings and it will indicate the status of the Automatic remediation setting. The creation of a policy can take several minutes. After the Pending status is replaced with account counts, you can choose the policy name to explore the compliance status of the accounts and resources. For information, see Viewing compliance information for an AWS Firewall Manager policy
Creating an AWS Firewall Manager policy for Palo Alto Networks Cloud NGFW
With a Firewall Manager policy for Palo Alto Networks Cloud Next Generation Firewall (Palo Alto Networks Cloud NGFW), you use Firewall Manager to deploy Palo Alto Networks Cloud NGFW resources, and manage NGFW rulestacks centrally across all of your AWS accounts.
For information about Firewall Manager Palo Alto Networks Cloud NGFW policies, see Palo Alto Networks Cloud NGFW policies. For information about how to configure and manage Palo Alto Networks Cloud NGFW for Firewall Manager, see the
Palo
Alto Networks Palo Alto Networks Cloud NGFW on AWS
Prerequisites
There are several mandatory steps to prepare your account for AWS Firewall Manager. Those steps are described in AWS Firewall Manager prerequisites. Complete all the prerequisites before proceeding to the next step.
To create a Firewall Manager policy for Palo Alto Networks Cloud NGFW (console)
-
Sign in to the AWS Management Console using your Firewall Manager administrator account, and then open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2
. For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites. Note
For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites.
-
In the navigation pane, choose Security policies.
-
Choose Create policy.
-
For Policy type, choose Palo Alto Networks Cloud NGFW. If you haven't already subscribed to the Palo Alto Networks Cloud NGFW service in the AWS Marketplace, you'll need to do that first. To subscribe in the AWS Marketplace, choose View AWS Marketplace details.
For Deployment model, choose either the Distributed model or Centralized model. The deployment model determines how Firewall Manager manages endpoints for the policy. With the distributed model, Firewall Manager maintains firewall endpoints in each VPC that's within policy scope. With the centralized model, Firewall Manager maintains a single endpoint in an inspection VPC.
-
For Region, choose an AWS Region. To protect resources in multiple Regions, you must create separate policies for each Region.
-
Choose Next.
-
For Policy name, enter a descriptive name.
-
In the policy configuration, choose the Palo Alto Networks Cloud NGFW firewall policy to associate with this policy. The list of Palo Alto Networks Cloud NGFW firewall policies contains all of the Palo Alto Networks Cloud NGFW firewall policies that are associated with your Palo Alto Networks Cloud NGFW tenant. For information about creating and managing Palo Alto Networks Cloud NGFW firewall policies, see the Deploy Palo Alto Networks Cloud NGFW for AWS with the AWS Firewall Manager
topic in the Palo Alto Networks Cloud NGFW for AWS deployment guide. -
For Palo Alto Networks Cloud NGFW logging - optional, optionally choose which Palo Alto Networks Cloud NGFW log type(s) to log for your policy. For information about Palo Alto Networks Cloud NGFW log types, see Configure Logging for Palo Alto Networks Cloud NGFW on AWS
in the Palo Alto Networks Cloud NGFW for AWS deployment guide. For log destination, specify when Firewall Manager should write logs to.
-
Choose Next.
-
Under Configure third-party firewall endpoint do one of the following, depending on whether you're using the distributed or centralized deployment model to create your firewall endpoints:
-
If you're using the distributed deployment model for this policy, under Availability Zones, select which Availability Zones to create firewall endpoints in. You can select Availability Zones by Availability Zone name or by Availability Zone ID.
-
If you're using the centralized deployment model for this policy, in AWS Firewall Manager endpoint configuration under Inspection VPC configuration, enter the AWS account ID of the owner of the inspection VPC, and the VPC ID of the inspection VPC.
-
Under Availability Zones, select which Availability Zones to create firewall endpoints in. You can select Availability Zones by Availability Zone name or by Availability Zone ID.
-
-
-
If you want to provide the CIDR blocks for Firewall Manager to use for firewall subnets in your VPCs, they must all be /28 CIDR blocks. Enter one block per line. If you omit these, Firewall Manager chooses IP addresses for you from those that are available in the VPCs.
Note
Auto remediation happens automatically for AWS Firewall Manager Network Firewall policies, so you won't see an option to choose not to auto remediate here.
-
Choose Next.
-
For Policy scope, under AWS accounts this policy applies to, choose the option as follows:
-
If you want to apply the policy to all accounts in your organization, leave the default selection, Include all accounts under my AWS organization.
-
If you want to apply the policy only to specific accounts or accounts that are in specific AWS Organizations organizational units (OUs), choose Include only the specified accounts and organizational units, and then add the accounts and OUs that you want to include. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
-
If you want to apply the policy to all but a specific set of accounts or AWS Organizations organizational units (OUs), choose Exclude the specified accounts and organizational units, and include all others, and then add the accounts and OUs that you want to exclude. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can only choose one of the options.
After you apply the policy, Firewall Manager automatically evaluates any new accounts against your settings. For example, if you include only specific accounts, Firewall Manager doesn't apply the policy to any new accounts. As another example, if you include an OU, when you add an account to the OU or to any of its child OUs, Firewall Manager automatically applies the policy to the new account.
-
-
The Resource type for Network Firewall policies is VPC.
-
For Resources, you can narrow the scope of the policy using tagging, by either including or excluding resources with the tags that you specify. You can use inclusion or exclusion, and not both. For more information about tags, see Working with Tag Editor.
If you enter more than one tag, a resource must have all of the tags to be included or excluded.
Resource tags can only have non-null values. If you omit the value for a tag, Firewall Manager saves the tag with an empty string value: "". Resource tags only match with tags that have the same key and the same value.
-
For Grant cross-account access, choose Download AWS CloudFormation template. This downloads a AWS CloudFormation template that you can use to create a AWS CloudFormation stack. This stack creates an AWS Identity and Access Management role that grants Firewall Manager cross-account permissions to manage Palo Alto Networks Cloud NGFW resources. For information about stacks, see Working with stacks in the AWS CloudFormation User Guide.
-
Choose Next.
-
For Policy tags, add any identifying tags that you want to add to the Firewall Manager policy resource. For more information about tags, see Working with Tag Editor.
-
Choose Next.
-
Review the new policy settings and return to any pages where you need to any adjustments.
When you are satisfied with the policy, choose Create policy. In the AWS Firewall Manager policies pane, your policy should be listed. It will probably indicate Pending under the accounts headings and it will indicate the status of the Automatic remediation setting. The creation of a policy can take several minutes. After the Pending status is replaced with account counts, you can choose the policy name to explore the compliance status of the accounts and resources. For information, see Viewing compliance information for an AWS Firewall Manager policy
Creating an AWS Firewall Manager policy for Fortigate Cloud Native Firewall (CNF) as a Service
With a Firewall Manager policy for Fortigate CNF, you can use Firewall Manager to deploy and manage Fortigate CNF resources across all of your AWS accounts.
For information about Firewall Manager Fortigate CNF policies, see Fortigate Cloud Native Firewall (CNF) as a Service policies. For information about how to configure Fortigate CNF for use with Firewall Manager, see the Fortinet documentation
Prerequisites
There are several mandatory steps to prepare your account for AWS Firewall Manager. Those steps are described in AWS Firewall Manager prerequisites. Complete all the prerequisites before proceeding to the next step.
To create a Firewall Manager policy for Fortigate CNF (console)
-
Sign in to the AWS Management Console using your Firewall Manager administrator account, and then open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2
. For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites. Note
For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites.
-
In the navigation pane, choose Security policies.
-
Choose Create policy.
-
For Policy type, choose Fortigate Cloud Native Firewall (CNF) as a Service. If you haven't already subscribed to the Fortigate CNF service in the AWS Marketplace
, you'll need to do that first. To subscribe in the AWS Marketplace, choose View AWS Marketplace details. For Deployment model, choose either the Distributed model or Centralized model. The deployment model determines how Firewall Manager manages endpoints for the policy. With the distributed model, Firewall Manager maintains firewall endpoints in each VPC that's within policy scope. With the centralized model, Firewall Manager maintains a single endpoint in an inspection VPC.
-
For Region, choose an AWS Region. To protect resources in multiple Regions, you must create separate policies for each Region.
-
Choose Next.
-
For Policy name, enter a descriptive name.
-
In the policy configuration, choose the Fortigate CNF firewall policy to associate with this policy. The list of Fortigate CNF firewall policies contains all of the Fortigate CNF firewall policies that are associated with your Fortigate CNF tenant. For information about creating and managing Fortigate CNF tenants, see the Fortinet documentation
. -
Choose Next.
-
Under Configure third-party firewall endpoint do one of the following, depending on whether you're using the distributed or centralized deployment model to create your firewall endpoints:
-
If you're using the distributed deployment model for this policy, under Availability Zones, select which Availability Zones to create firewall endpoints in. You can select Availability Zones by Availability Zone name or by Availability Zone ID.
-
If you're using the centralized deployment model for this policy, in AWS Firewall Manager endpoint configuration under Inspection VPC configuration, enter the AWS account ID of the owner of the inspection VPC, and the VPC ID of the inspection VPC.
-
Under Availability Zones, select which Availability Zones to create firewall endpoints in. You can select Availability Zones by Availability Zone name or by Availability Zone ID.
-
-
-
If you want to provide the CIDR blocks for Firewall Manager to use for firewall subnets in your VPCs, they must all be /28 CIDR blocks. Enter one block per line. If you omit these, Firewall Manager chooses IP addresses for you from those that are available in the VPCs.
Note
Auto remediation happens automatically for AWS Firewall Manager Network Firewall policies, so you won't see an option to choose not to auto remediate here.
-
Choose Next.
-
For Policy scope, under AWS accounts this policy applies to, choose the option as follows:
-
If you want to apply the policy to all accounts in your organization, leave the default selection, Include all accounts under my AWS organization.
-
If you want to apply the policy only to specific accounts or accounts that are in specific AWS Organizations organizational units (OUs), choose Include only the specified accounts and organizational units, and then add the accounts and OUs that you want to include. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
-
If you want to apply the policy to all but a specific set of accounts or AWS Organizations organizational units (OUs), choose Exclude the specified accounts and organizational units, and include all others, and then add the accounts and OUs that you want to exclude. Specifying an OU is the equivalent of specifying all accounts in the OU and in any of its child OUs, including any child OUs and accounts that are added at a later time.
You can only choose one of the options.
After you apply the policy, Firewall Manager automatically evaluates any new accounts against your settings. For example, if you include only specific accounts, Firewall Manager doesn't apply the policy to any new accounts. As another example, if you include an OU, when you add an account to the OU or to any of its child OUs, Firewall Manager automatically applies the policy to the new account.
-
-
The Resource type for Network Firewall policies is VPC.
-
For Resources, you can narrow the scope of the policy using tagging, by either including or excluding resources with the tags that you specify. You can use inclusion or exclusion, and not both. For more information about tags, see Working with Tag Editor.
If you enter more than one tag, a resource must have all of the tags to be included or excluded.
Resource tags can only have non-null values. If you omit the value for a tag, Firewall Manager saves the tag with an empty string value: "". Resource tags only match with tags that have the same key and the same value.
-
For Grant cross-account access, choose Download AWS CloudFormation template. This downloads a AWS CloudFormation template that you can use to create a AWS CloudFormation stack. This stack creates an AWS Identity and Access Management role that grants Firewall Manager cross-account permissions to manage Fortigate CNF resources. For information about stacks, see Working with stacks in the AWS CloudFormation User Guide. To create a stack, you'll need the account ID from the Fortigate CNF portal.
-
Choose Next.
-
For Policy tags, add any identifying tags that you want to add to the Firewall Manager policy resource. For more information about tags, see Working with Tag Editor.
-
Choose Next.
-
Review the new policy settings and return to any pages where you need to any adjustments.
When you are satisfied with the policy, choose Create policy. In the AWS Firewall Manager policies pane, your policy should be listed. It will probably indicate Pending under the accounts headings and it will indicate the status of the Automatic remediation setting. The creation of a policy can take several minutes. After the Pending status is replaced with account counts, you can choose the policy name to explore the compliance status of the accounts and resources. For information, see Viewing compliance information for an AWS Firewall Manager policy