AWS network-firewall documentation change

Service: network-firewall · 2026-01-28 · Documentation low

File: network-firewall/latest/developerguide/rule-group-stateful-creating.md

Summary

Added documentation for Geographic IP filtering and URL/Domain Category filtering options in stateful rule groups

Security assessment

The change adds documentation for new filtering capabilities (geographic and category-based) which are security features, but there's no evidence of addressing a specific vulnerability or incident. These features enhance security posture by allowing traffic filtering based on country and web content categories.

Diff

diff --git a/network-firewall/latest/developerguide/rule-group-stateful-creating.md b/network-firewall/latest/developerguide/rule-group-stateful-creating.md
index f9bbc6b91..478d80d13 100644
--- a//network-firewall/latest/developerguide/rule-group-stateful-creating.md
+++ b//network-firewall/latest/developerguide/rule-group-stateful-creating.md
@@ -70,0 +71,38 @@ To add one or more references to IP set resources, such as Amazon VPC prefix lis
+For enhanced filtering options, you can specify the following:
+
+**Geographic IP filtering -** To filter traffic based on country:
+
+       * Choose to enable **Geographic IP filtering**
+
+       * Select the matching option:
+
+         * Match only selected countries
+
+         * Match all but selected countries
+
+       * Choose the **Geographic IP traffic direction** (source, destination, or any)
+
+       * Choose the **Country codes** from the dropdown list 
+
+       * For more information, see [Geographic IP filtering in Suricata compatible AWS Network Firewall rule groups](./rule-groups-geo-ip-filtering.html)
+
+**URL and Domain Category filtering -** To filter traffic based on web content categories:
+
+       * Choose to enable **URL and Domain Category filtering**
+
+       * Select the matching option:
+
+         * Match all selected categories
+
+         * Match all unselected categories
+
+       * Choose the **AWS category type:**
+
+         * aws_url_category (for HTTP protocol, requires TLS inspection for HTTPS)
+
+         * aws_domain_category (for TLS and HTTP protocols)
+
+       * Choose the **categories** from the dropdown list 
+
+       * For more information, see [URL and Domain Category Filtering in Suricata compatible AWS Network Firewall rule groups ](./rule-groups-url-filtering.html)
+