AWS Cloud WAN example: Service insertion firewalls between on-premises and VPCs - AWS Network Manager

AWS Cloud WAN example: Service insertion firewalls between on-premises and VPCs

In this policy, traffic on a segment named development is first sent to an Inspection VPC before being sent to a segment named production using a network function group named InspectionVPC. The on-premises attachment has already been set up and mapped to either the development or production segments. The segment action uses send-via, indicating that this is east-west traffic. The attachment policy rule uses the and condition logic with InspectionVpcs as the value of the key-value pair associated with the attachment.

{ "version": "2021.12", "core-network-configuration": { "vpn-ecmp-support": true, "inside-cidr-blocks": [ "10.0.0.0/16" ], "asn-ranges": [ "64512-65534" ], "edge-locations": [ { "location": "us-east-2" }, { "location": "us-west-2" } ] }, "segments": [ { "name": "development", "edge-locations": [ "us-east-2" ], "require-attachment-acceptance": true, "isolate-attachments": true }, { "name": "production", "edge-locations": [ "us-east-2" ], "require-attachment-acceptance": true, "isolate-attachments": true } ], "network-function-groups": [ { "name": "InspectionVPC", "description": "Route segment traffic to the inspection VPC", "require-attachment-acceptance": true } ], "segment-actions": [ { "action": "send-via", "segment": "development", "mode": "single-hop", "when-sent-to": { "segments": [ "production" ] }, "via": { "network-function-groups": [ "InspectionVPC" ] } } ], "attachment-policies": [ { "rule-number": 125, "condition-logic": "and", "conditions": [ { "type": "tag-exists", "key": "InspectionVpcs" } ], "action": { "add-to-network-function-group": "InspectionVPC" } } ] }