Rule groups in AWS Network Firewall - AWS Network Firewall

Rule groups in AWS Network Firewall

An AWS Network Firewall rule group is a reusable set of criteria for inspecting and handling network traffic. You add one or more rule groups to a firewall policy as part of policy configuration. For more information about firewall policies and firewalls, see Firewall policies in AWS Network Firewall and Firewalls in AWS Network Firewall .

Network Firewall rule groups are either stateless or stateful. Stateless rule groups evaluate packets in isolation, while stateful rule groups evaluate them in the context of their traffic flow. You can create and manage the following categories of rule groups in Network Firewall:

  • Stateless – Defines standard, 5-tuple criteria for examining a packet on its own, with no additional context.

  • Stateful – Defines criteria for examining a packet in the context of traffic flow and of other traffic that's related to the packet.

    Network Firewall uses a Suricata rules engine to process all stateful rules. You can write any of your stateful rules in Suricata compatible format. Alternately, for domain list rules and for very basic rules, you can use an easy entry form provided by Network Firewall.

    Stateful rule groups are available in the following categories:

    • Suricata compatible IPS rules – Defines intrusion prevention system (IPS) rules in the rule group, in Suricata compatible format. You can provide all of your stateful rules through this method if you want to.

    • Domain list entry – Defines a list of domain names and specifies the protocol type to inspect.

    • Simple rules entry – Defines standard, 5-tuple criteria for examining a packet within the context of a traffic flow. This entry method is available with all of its options only through the API.

Depending on the type of rule group, you might also define rules inside the rule group. Rules provide detailed criteria for packet inspection and specify what to do when a packet matches the criteria. When Network Firewall finds a match between the criteria and a packet, we say that the packet matches the rule group.

This section provides guidance for creating and managing your rule groups.