AWS network-firewall documentation change
Summary
Restructured and expanded documentation about Network Firewall rule groups, including clearer differentiation between stateless/stateful rules, Suricata integration details, and updated navigation links
Security assessment
The changes improve documentation about security features (firewall rule configuration) but do not address any specific vulnerability. Enhancements include clearer explanations of stateful inspection and rule types which help users implement proper security controls.
Diff
diff --git a/network-firewall/latest/developerguide/rule-groups.md b/network-firewall/latest/developerguide/rule-groups.md index 9e421ef30..e0283dfc7 100644 --- a//network-firewall/latest/developerguide/rule-groups.md +++ b//network-firewall/latest/developerguide/rule-groups.md @@ -5 +5 @@ -# Rule groups in AWS Network Firewall +# Managing your own rule groups in AWS Network Firewall @@ -7 +7 @@ -This section provides guidance for creating and managing your own rule groups in AWS Network Firewall. +A Network Firewall _rule group_ is a reusable set of criteria for inspecting and handling network traffic. You add one or more rule groups to a firewall policy as part of policy configuration. For more information about firewall policies and firewalls, see [Firewall policies](./firewall-policies.html) and [Firewalls and firewall endpoints](./firewalls.html). @@ -9 +9 @@ This section provides guidance for creating and managing your own rule groups in -A Network Firewall _rule group_ is a reusable set of criteria for inspecting and handling network traffic. You add one or more rule groups to a firewall policy as part of policy configuration. For more information about firewall policies and firewalls, see [Firewall policies in AWS Network Firewall](./firewall-policies.html) and [Firewalls and firewall endpoints in AWS Network Firewall](./firewalls.html). +You can use your own rule groups and you can use rule groups that are managed for you by AWS. For information on managed rule groups, see [Using AWS managed rule groups](./nwfw-managed-rule-groups.html). @@ -11 +11 @@ A Network Firewall _rule group_ is a reusable set of criteria for inspecting and -You can use your own rule groups and you can use rule groups that are managed for you by AWS. +Network Firewall rule groups are either _stateless_ or _stateful_. These rule groups determine how packets are evaluated in your network traffic inspection. @@ -13 +13 @@ You can use your own rule groups and you can use rule groups that are managed fo -Network Firewall rule groups are either _stateless_ or _stateful_. Stateless rule groups evaluate packets in isolation, while stateful rule groups evaluate them in the context of their traffic flow. You can create and manage the following categories of rule groups in Network Firewall: +Stateless rule groups @@ -15 +14,0 @@ Network Firewall rule groups are either _stateless_ or _stateful_. Stateless rul - * **Stateless** – Defines standard network connection attributes for examining a packet on its own, with no additional context. @@ -17 +16 @@ Network Firewall rule groups are either _stateless_ or _stateful_. Stateless rul - * **Stateful** – Defines criteria for examining a packet in the context of traffic flow and of other traffic that's related to the packet. +Stateless rule groups evaluate packets in isolation. They define standard network connection attributes for examining a packet on its own, without additional context from the broader traffic flow. @@ -19 +18,6 @@ Network Firewall rule groups are either _stateless_ or _stateful_. Stateless rul -Network Firewall uses a Suricata rules engine to process all stateful rules. You can write any of your stateful rules in Suricata compatible format. Alternately, for domain list rules and for very basic rules, you can use an easy entry form provided by Network Firewall. +Stateful rule groups + + +Stateful rule groups evaluate packets in the context of traffic flow. They define criteria for examining a packet within the context of its traffic flow and other related traffic. + +Network Firewall uses a Suricata rules engine to process all stateful rules. You can write any of your stateful rules in Suricata compatible format. Alternatively, for domain list rules and for very basic rules, you can use an easy entry form provided by Network Firewall. @@ -23 +27 @@ Stateful rule groups are available in the following categories: - * **Suricata compatible rule strings** – Provides match and action settings, in Suricata compatible format. You can provide all of your stateful rules through this method if you want to. + * **Standard stateful rules** – Defines standard network connection attributes for examining a packet within the context of a traffic flow. For more information, see [Standard stateful rule groups in AWS Network Firewall](./stateful-rule-groups-basic.html) @@ -25 +29 @@ Stateful rule groups are available in the following categories: - * **Domain list** – Defines a list of domain names and specifies the protocol type to inspect. You can create these rules from traffic analysis reports. For information, see [Creating stateful rule groups from reports](./reporting.html#creating-stateful-rule-groups-from-reports). + * **Domain list** – Defines a list of domain names and specifies the protocol type to inspect. You can create these rules from an traffic analysis report. For more information, see [Creating stateful rule groups from reports](./reporting.html#creating-stateful-rule-groups-from-reports). @@ -27 +31 @@ Stateful rule groups are available in the following categories: - * **Standard stateful rules** – Defines standard network connection attributes for examining a packet within the context of a traffic flow. + * **Suricata compatible rule strings** – Provides match and action settings, in Suricata compatible format. You can provide all of your stateful rules through this method if you want to. For more information, see [Suricata compatible rule strings in AWS Network Firewall](./stateful-rule-groups-suricata.html). @@ -31,0 +36,4 @@ Stateful rule groups are available in the following categories: +Depending on the type of rule group, you might also define rules inside the rule group. Rules provide detailed criteria for packet inspection and specify what to do when a packet matches the criteria. When Network Firewall finds a match between the criteria and a packet, we say that the packet matches the rule group. + +Follow the guidance in this section to manage your AWS Network Firewall rule groups. + @@ -36,2 +43,0 @@ This section and others that describe Suricata-based concepts are not intended t -Depending on the type of rule group, you might also define rules inside the rule group. Rules provide detailed criteria for packet inspection and specify what to do when a packet matches the criteria. When Network Firewall finds a match between the criteria and a packet, we say that the packet matches the rule group. - @@ -40 +46,9 @@ Depending on the type of rule group, you might also define rules inside the rule - * [Using AWS managed rule groups in AWS Network Firewall](./nwfw-managed-rule-groups.html) + * [Common rule group settings in AWS Network Firewall](./rule-group-settings.html) + + * [Options for stateful rules in Network Firewall](./stateful-rule-group-options.html) + + * [Working with stateful rule groups in AWS Network Firewall](./stateful-rule-groups-ips.html) + + * [Working with stateless rule groups in AWS Network Firewall](./stateless-rule-groups-standard.html) + + * [Defining rule actions in AWS Network Firewall](./rule-action.html) @@ -42 +56 @@ Depending on the type of rule group, you might also define rules inside the rule - * [Managing your own rule groups in AWS Network Firewall](./rule-group-managing.html) + * [Setting rule group capacity in AWS Network Firewall](./nwfw-rule-group-capacity.html) @@ -55 +69 @@ Deleting a firewall policy -Using AWS managed rule groups +Common rule group settings