AWS network-firewall documentation change
Summary
Added detailed instructions for creating transit gateway-attached firewalls and reorganized configuration steps
Security assessment
Changes expand operational guidance for firewall deployment options but don't address security vulnerabilities or introduce new security features. The encryption section references existing KMS documentation without adding new security content
Diff
diff --git a/network-firewall/latest/developerguide/creating-firewall.md b/network-firewall/latest/developerguide/creating-firewall.md index 4bca9e486..e1ead1b77 100644 --- a//network-firewall/latest/developerguide/creating-firewall.md +++ b//network-firewall/latest/developerguide/creating-firewall.md @@ -10,0 +11,13 @@ You can create a firewall in Network Firewall to start using the protections you +There are two ways you can create a firewall: + + * Create a VPC-attached firewall to protect a VPC + + * Create a transit gateway-attached firewall to enable centralized network inspection + + + + +###### Note + +To create a transit gateway-attached firewall, you can accept a transit gateway that has been shared with you through AWS RAM or a transit gateway that you own. + @@ -45 +58,39 @@ The subnets that you specify should be dedicated for Network Firewall firewall u - 10. (Optional) Under **Protection against changes** , optionally enable **Deletion protection** and **Subnet change protection** to protect your firewall against accidental changes. + 10. For **Attachment type** , choose either: + + * **VPC** \- Create a firewall in subnets in a VPC + + * **Transit Gateway** \- Create a firewall that automatically provisions networking components + + 11. Based on your attachment type selection: + + 1. If you selected **VPC** : + + 1. Choose your **VPC** from the dropdown list. + +###### Note + +You can't change the VPC after you create the firewall. + + 2. For **Firewall subnets** , choose the Availability Zones and subnets that you want to use for your firewall endpoints. + + 2. If you selected **Transit Gateway** : + + 1. For **Transit Gateway** , choose an existing transit gateway from the dropdown list. The list includes: + + * Any transit gateway attachment in your account (marked as "this account") + + * AWS Transit Gateways shared with you from other accounts (showing the owner account ID) + +###### Note + +If you need to create a new transit gateway, open the Transit Gateway console in a new tab. After creating the transit gateway, return to this page and refresh the Transit Gateway selector. + + 2. For **Availability Zones** , select the Availability Zones for your firewall. Consider: + + * To maintain Availability Zone isolation, enable the firewall in every Availability Zone where you have workloads + + * You must select at least one Availability Zone + + * You can modify Availability Zones later, but this may briefly disrupt traffic + + 12. (Optional) Under **Protection against changes** , optionally enable **Deletion protection** and **Subnet change protection** to protect your firewall against accidental changes. @@ -47 +98 @@ The subnets that you specify should be dedicated for Network Firewall firewall u - 11. (Optional) Under **Customer managed key** , optionally toggle **Customize encryption settings** to use a AWS Key Management Service customer managed key to encrypt your resources. For more information about this option, see [Encryption at rest with AWS Key Management Service](./kms-encryption-at-rest.html). + 13. (Optional) Under **Customer managed key** , optionally toggle **Customize encryption settings** to use a AWS Key Management Service customer managed key to encrypt your resources. For more information about this option, see [Encryption at rest with AWS Key Management Service](./kms-encryption-at-rest.html). @@ -49 +100 @@ The subnets that you specify should be dedicated for Network Firewall firewall u - 12. Choose **Next**. + 14. Choose **Next**. @@ -61 +112 @@ Network Firewall only starts collecting traffic analysis metrics when you enable - 13. For the **Associate firewall policy** section, choose the firewall policy that you want to associate with the firewall. + 15. For the **Associate firewall policy** section, choose the firewall policy that you want to associate with the firewall. @@ -63 +114 @@ Network Firewall only starts collecting traffic analysis metrics when you enable - 14. Choose **Create firewall**. + 16. Choose **Create firewall**.