AWS network-firewall medium security documentation change
Summary
Expanded documentation for sharing Network Firewall resources (firewalls, policies, rule groups) including new considerations and operational details. Added specifics about TLS inspection limitations, VPC endpoint associations, and unsharing impacts.
Security assessment
The change explicitly documents security-critical limitations: TLS inspection configurations cannot be shared and only work with same-account endpoints. This prevents insecure cross-account TLS decryption scenarios. The addition of firewall sharing mechanics (VPC endpoint associations) introduces new security boundary considerations for traffic processing across accounts.
Diff
diff --git a/network-firewall/latest/developerguide/sharing.md b/network-firewall/latest/developerguide/sharing.md index 2907b6536..e44e2e44a 100644 --- a//network-firewall/latest/developerguide/sharing.md +++ b//network-firewall/latest/developerguide/sharing.md @@ -5 +5 @@ -Prerequisites for sharing firewall policies and rule groupsRelated servicesSharing across Availability ZonesSharing a firewall policy or rule groupUnsharing a shared firewall policy or rule group +Prerequisites for sharing Network Firewall resourcesRelated servicesSharing across Availability ZonesSharing a Network Firewall resourceUnsharing a shared Network Firewall resource @@ -7 +7 @@ Prerequisites for sharing firewall policies and rule groupsRelated servicesShari -# Sharing AWS Network Firewall firewall policies and rule groups +# Sharing AWS Network Firewall resources @@ -9 +9 @@ Prerequisites for sharing firewall policies and rule groupsRelated servicesShari -You can share some Network Firewall resources with other accounts. This permits them to use the protections that you define and maintain to protect their resources too. +You can share Network Firewall firewalls, firewall policies, and rule groups with other AWS accounts. When you share a firewall, other accounts can use your firewall's protections in their VPCs through VPC endpoint associations. When you share firewall policies or rule groups, other accounts can use these resources in their own firewalls. @@ -11 +11 @@ You can share some Network Firewall resources with other accounts. This permits -The owner of a firewall policy or rule group can share a resource with: +The owner of a firewall, firewall policy, or rule group can share a resource with: @@ -22 +22 @@ The owner of a firewall policy or rule group can share a resource with: -###### Warning +###### Considerations @@ -24 +24,12 @@ The owner of a firewall policy or rule group can share a resource with: -You can't share a firewall policy that's configured to use a [TLS inspection configuration](./tls-inspection-configurations.html). +Consideration the following when sharing AWS Network Firewall resources: + + * Sharing a firewall enables other AWS accounts to create VPC endpoint associations in their VPCs. Each VPC endpoint association creates a new firewall endpoint that processes traffic according to the shared firewall's policy. + + * You can't share a firewall policy that's configured to use [TLS inspection](./tls-inspection-configurations.html). TLS inspection only works with primary VPC endpoints and same-account secondary endpoints. + + * The owner of a rule group can share a rule group that refers to a [resource group](./resource-groups.html), but can't share the resource group itself. + + + + +For additional details on shareable Network Firewall resources, see [Shareable resources](https://docs.aws.amazon.com/ram/latest/userguide/shareable.html#shareable-network-firewall) in the _AWS RAM User Guide_. @@ -28 +39 @@ You can't share a firewall policy that's configured to use a [TLS inspection con - * Prerequisites for sharing firewall policies and rule groups + * Prerequisites for sharing Network Firewall resources @@ -34 +45 @@ You can't share a firewall policy that's configured to use a [TLS inspection con - * Sharing a firewall policy or rule group + * Sharing a Network Firewall resource @@ -36 +47 @@ You can't share a firewall policy that's configured to use a [TLS inspection con - * Unsharing a shared firewall policy or rule group + * Unsharing a shared Network Firewall resource @@ -43 +54 @@ The owner of a rule group can share a rule group that refers to a [resource grou -## Prerequisites for sharing firewall policies and rule groups +## Prerequisites for sharing AWS Network Firewall resources @@ -45 +56 @@ The owner of a rule group can share a rule group that refers to a [resource grou - * To share a firewall policy or rule group, you must own it in your AWS account. You cannot share a firewall policy or rule group that has been shared with you. + * To share a firewall, firewall policy, or rule group, you must own it in your AWS account. You cannot share a firewall, firewall policy, or rule group that has been shared with you. @@ -47 +58 @@ The owner of a rule group can share a rule group that refers to a [resource grou - * To share a firewall policy or rule group with your organization or an organizational unit in AWS Organizations, you must enable sharing with AWS Organizations. For more information, see [ Enable Sharing with AWS Organizations](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs) in the _AWS RAM User Guide_. + * To share a firewall, firewall policy, or rule group with your organization or an organizational unit in AWS Organizations, you must enable sharing with AWS Organizations. For more information, see [Enable Sharing with AWS Organizations](https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs) in the _AWS RAM User Guide_. @@ -54 +65 @@ The owner of a rule group can share a rule group that refers to a [resource grou -Firewall policy and rule group sharing integrates with AWS Resource Access Manager (AWS RAM). AWS RAM is a service that enables you to share your AWS resources with any AWS account or through AWS Organizations. With AWS RAM, you share resources that you own by creating a _resource share_. A resource share specifies the resources to share, and the consumers with whom to share them. Consumers can be individual AWS accounts, organizational units, or an entire organization in AWS Organizations. +Firewall, firewall policy, and rule group sharing integrates with AWS Resource Access Manager (AWS RAM). AWS RAM is a service that enables you to share your AWS resources with any AWS account or through AWS Organizations. With AWS RAM, you share resources that you own by creating a _resource share_. A resource share specifies the resources to share, and the consumers with whom to share them. Consumers can be individual AWS accounts, organizational units, or an entire organization in AWS Organizations. @@ -62 +73 @@ To ensure that resources are distributed across the Availability Zones for a Reg -To identify the location of your firewall policy or rule group relative to your accounts, you must use the _Availability Zone ID_ (AZ ID). The AZ ID is a unique and consistent identifier for an Availability Zone across all AWS accounts. For example, `use1-az1` is an AZ ID for the `us-east-1` Region and it is the same location in every AWS account. +To identify the location of your firewall, firewall policy, or rule group relative to your accounts, you must use the _Availability Zone ID_ (AZ ID). The AZ ID is a unique and consistent identifier for an Availability Zone across all AWS accounts. For example, `use1-az1` is an AZ ID for the `us-east-1` Region and it is the same location in every AWS account. @@ -73 +84 @@ To identify the location of your firewall policy or rule group relative to your -## Sharing a firewall policy or rule group +## Sharing an AWS Network Firewall resource @@ -75 +86 @@ To identify the location of your firewall policy or rule group relative to your -To share a firewall policy or rule group, you must add it to a resource share. A resource share is an AWS RAM resource that lets you share your resources across AWS accounts. A resource share specifies the resources to share, and the consumers with whom they are shared. When you share a firewall policy or rule group using AWS Network Firewall, you add it to an existing resource share. To add the firewall policy or rule group to a new resource share, you must first create the resource share using the [AWS RAM console](https://console.aws.amazon.com/ram). +To share a firewall, firewall policy, or rule group, you must add it to a resource share. A resource share is an AWS RAM resource that lets you share your resources across AWS accounts. A resource share specifies the resources to share, and the consumers with whom they are shared. When you share a firewall, firewall policy, or rule group using AWS Network Firewall, you add it to an existing resource share. To add the firewall, firewall policy, or rule group to a new resource share, you must first create the resource share using the [AWS RAM console](https://console.aws.amazon.com/ram). @@ -77 +88 @@ To share a firewall policy or rule group, you must add it to a resource share. A -If you are part of an organization in AWS Organizations and sharing within your organization is enabled, consumers in your organization are automatically granted access to the shared firewall policies and rule groups. Otherwise, consumers receive an invitation to join the resource share and are granted access to the shared firewall policies and rule groups after accepting the invitation. +If you are part of an organization in AWS Organizations and sharing within your organization is enabled, consumers in your organization are automatically granted access to the shared firewalls, firewall policies, and rule groups. Otherwise, consumers receive an invitation to join the resource share and are granted access to the shared firewalls, firewall policies, and rule groups after accepting the invitation. @@ -79 +90 @@ If you are part of an organization in AWS Organizations and sharing within your -You can share a firewall policy or rule group that you own using the AWS RAM console, the AWS Network Firewall API, or the AWS CLI. +You can share any Network Firewall resource that you own using the AWS RAM console, the AWS Network Firewall API, or the AWS CLI. @@ -81 +92 @@ You can share a firewall policy or rule group that you own using the AWS RAM con -###### To share a firewall policy or rule group that you own using the AWS RAM console +###### To share a firewall, firewall policy, or rule group that you own using the AWS RAM console @@ -85 +96 @@ See [Creating a Resource Share](https://docs.aws.amazon.com/ram/latest/userguide -###### To share a firewall policy or rule group that you own using the AWS CLI +###### To share a firewall, firewall policy, or rule group that you own using the AWS CLI @@ -89 +100 @@ Use the [create-resource-share](https://docs.aws.amazon.com/cli/latest/reference -###### To share a firewall policy or rule group that you own using the Network Firewall API +###### To share a firewall, firewall policy, or rule group that you own using the Network Firewall API @@ -93 +104,18 @@ Use the `PutResourcePolicy` action. For information about how to use this, see [ -## Unsharing a shared firewall policy or rule group +You can see the sharing status of the firewalls that you own in the Network Firewall console on the firewall details page. + +## Unsharing a shared AWS Network Firewall resource + +When a firewall owner unshares a firewall, the following rules apply: + + * Existing VPC endpoint associations remain functional + + * The shared account (VPC endpoint association's account) cannot access or view firewall metadata + + * VPC endpoint association owners can still delete their associations + + * The firewall owner cannot delete their firewall until all VPC endpoint associations are deleted + + + + +To unshare a shared firewall, firewall policy, or rule group that you own, you must remove it from the resource share. You can do this using the AWS RAM console or the AWS CLI. @@ -95 +123 @@ Use the `PutResourcePolicy` action. For information about how to use this, see [ -To unshare a shared firewall policy or rule group that you own, you must remove it from the resource share. You can do this using the AWS RAM console or the AWS CLI. +For more information about the impacts of unsharing a firewall, see [Considerations for working with firewalls and firewall endpoints](./firewall-and-firewall-endpoints-considerations.html). @@ -97 +125 @@ To unshare a shared firewall policy or rule group that you own, you must remove -###### To unshare a shared firewall policy or rule group that you own using the AWS RAM console +###### To unshare a shared firewall, firewall policy, or rule group that you own using the AWS RAM console @@ -101 +129 @@ See [Updating a Resource Share](https://docs.aws.amazon.com/ram/latest/userguide -###### To unshare a shared firewall policy or rule group that you own using the AWS CLI +###### To unshare a shared firewall, firewall policy, or rule group that you own using the AWS CLI @@ -113 +141 @@ Deleting a TLS inspection configuration -Security in Network Firewall +Security in your use of the Network Firewall service