AWS.NetworkFirewall reference

DescribeFirewall

Source: src/AWS/NetworkFirewall/DescribeFirewall.ts

Runtime binding for network-firewall:DescribeFirewall — read the bound Firewall’s configuration and status (sync states, endpoint ids, capacity usage); the firewall ARN is injected automatically.

Provide NetworkFirewall.DescribeFirewallHttp on the hosting Lambda Function to satisfy the requirement.

DescribeFirewall: Reading Firewall State

// init — grants network-firewall:DescribeFirewall on the firewall
const describeFirewall = yield* AWS.NetworkFirewall.DescribeFirewall(firewall);

// runtime
const { FirewallStatus } = yield* describeFirewall();

DescribeFirewallPolicy

Source: src/AWS/NetworkFirewall/DescribeFirewallPolicy.ts

Runtime binding for network-firewall:DescribeFirewallPolicy — read the bound FirewallPolicy’s definition (rule group references, default actions, engine options); the policy ARN is injected automatically.

Provide NetworkFirewall.DescribeFirewallPolicyHttp on the hosting Lambda Function to satisfy the requirement.

DescribeFirewallPolicy: Reading Policy State

// init — grants network-firewall:DescribeFirewallPolicy on the policy
const describeFirewallPolicy =
  yield* AWS.NetworkFirewall.DescribeFirewallPolicy(policy);

// runtime
const { FirewallPolicy } = yield* describeFirewallPolicy();

DescribeFlowOperation

Source: src/AWS/NetworkFirewall/DescribeFlowOperation.ts

Runtime binding for network-firewall:DescribeFlowOperation — read the status and definition of a flow capture/flush operation running on the bound Firewall; the firewall ARN is injected automatically.

Provide NetworkFirewall.DescribeFlowOperationHttp on the hosting Lambda Function to satisfy the requirement.

DescribeFlowOperation: Flow Operations

// init — grants network-firewall:DescribeFlowOperation on the firewall
const describeFlowOperation =
  yield* AWS.NetworkFirewall.DescribeFlowOperation(firewall);

// runtime
const { FlowOperationStatus } = yield* describeFlowOperation({
  FlowOperationId: flowOperationId,
});

DescribeRuleGroup

Source: src/AWS/NetworkFirewall/DescribeRuleGroup.ts

Runtime binding for network-firewall:DescribeRuleGroup — read the bound RuleGroup’s definition (rules source, variables, capacity); the rule group ARN is injected automatically.

Provide NetworkFirewall.DescribeRuleGroupHttp on the hosting Lambda Function to satisfy the requirement.

DescribeRuleGroup: Reading Rule Group State

// init — grants network-firewall:DescribeRuleGroup on the rule group
const describeRuleGroup =
  yield* AWS.NetworkFirewall.DescribeRuleGroup(ruleGroup);

// runtime
const { RuleGroup } = yield* describeRuleGroup();

DescribeRuleGroupMetadata

Source: src/AWS/NetworkFirewall/DescribeRuleGroupMetadata.ts

Runtime binding for network-firewall:DescribeRuleGroupMetadata — read the high-level metadata (type, capacity, last-modified time) of the bound RuleGroup without fetching the full rules definition; the rule group ARN is injected automatically.

Provide NetworkFirewall.DescribeRuleGroupMetadataHttp on the hosting Lambda Function to satisfy the requirement.

DescribeRuleGroupMetadata: Reading Rule Group State

// init — grants network-firewall:DescribeRuleGroupMetadata on the rule group
const describeRuleGroupMetadata =
  yield* AWS.NetworkFirewall.DescribeRuleGroupMetadata(ruleGroup);

// runtime
const { Capacity } = yield* describeRuleGroupMetadata();

DescribeRuleGroupSummary

Source: src/AWS/NetworkFirewall/DescribeRuleGroupSummary.ts

Runtime binding for network-firewall:DescribeRuleGroupSummary — read a per-rule summary (SID, message, metadata) of the bound stateful RuleGroup; the rule group ARN is injected automatically. Only supported for STATEFUL rule groups.

Provide NetworkFirewall.DescribeRuleGroupSummaryHttp on the hosting Lambda Function to satisfy the requirement.

DescribeRuleGroupSummary: Reading Rule Group State

// init — grants network-firewall:DescribeRuleGroupSummary on the rule group
const describeRuleGroupSummary =
  yield* AWS.NetworkFirewall.DescribeRuleGroupSummary(ruleGroup);

// runtime
const { Summary } = yield* describeRuleGroupSummary();

Firewall

Source: src/AWS/NetworkFirewall/Firewall.ts

An AWS Network Firewall firewall — provisions managed firewall endpoints into your VPC subnets and inspects traffic according to an associated FirewallPolicy.

Endpoint provisioning takes several minutes (typically 5-10), and deleting a firewall waits for the endpoints to deprovision.

Firewall: Creating Firewalls

import * as EC2 from "alchemy/AWS/EC2";
import * as NetworkFirewall from "alchemy/AWS/NetworkFirewall";

const vpc = yield* EC2.Vpc("Vpc", { cidrBlock: "10.0.0.0/16" });
const subnet = yield* EC2.Subnet("FirewallSubnet", {
  vpcId: vpc.vpcId,
  cidrBlock: "10.0.1.0/24",
});

const policy = yield* NetworkFirewall.FirewallPolicy("Policy", {
  firewallPolicy: {
    StatelessDefaultActions: ["aws:pass"],
    StatelessFragmentDefaultActions: ["aws:pass"],
  },
});

const firewall = yield* NetworkFirewall.Firewall("Firewall", {
  firewallPolicyArn: policy.firewallPolicyArn,
  vpcId: vpc.vpcId,
  subnetMappings: [{ SubnetId: subnet.subnetId }],
});

FirewallPolicy

Source: src/AWS/NetworkFirewall/FirewallPolicy.ts

An AWS Network Firewall policy — defines a firewall’s traffic inspection behavior as a collection of stateless and stateful rule group references plus default actions. One policy can be shared by multiple firewalls.

FirewallPolicy: Creating Policies

Pass-everything Policy

import * as NetworkFirewall from "alchemy/AWS/NetworkFirewall";

const policy = yield* NetworkFirewall.FirewallPolicy("Policy", {
  firewallPolicy: {
    StatelessDefaultActions: ["aws:pass"],
    StatelessFragmentDefaultActions: ["aws:pass"],
  },
});

Policy referencing Rule Groups

const stateless = yield* NetworkFirewall.RuleGroup("Stateless", {
  type: "STATELESS",
  capacity: 10,
  ruleGroup: { ... },
});

const policy = yield* NetworkFirewall.FirewallPolicy("Policy", {
  firewallPolicy: {
    StatelessDefaultActions: ["aws:forward_to_sfe"],
    StatelessFragmentDefaultActions: ["aws:forward_to_sfe"],
    StatelessRuleGroupReferences: [
      { ResourceArn: stateless.ruleGroupArn, Priority: 1 },
    ],
  },
});

GetAnalysisReportResults

Source: src/AWS/NetworkFirewall/GetAnalysisReportResults.ts

Runtime binding for network-firewall:GetAnalysisReportResults — read the results of a completed traffic analysis report on the bound Firewall; the firewall ARN is injected automatically.

Provide NetworkFirewall.GetAnalysisReportResultsHttp on the hosting Lambda Function to satisfy the requirement.

GetAnalysisReportResults: Analysis Reports

// init — grants network-firewall:GetAnalysisReportResults on the firewall
const getAnalysisReportResults =
  yield* AWS.NetworkFirewall.GetAnalysisReportResults(firewall);

// runtime
const { AnalysisReportResults } = yield* getAnalysisReportResults({
  AnalysisReportId: analysisReportId,
});

ListAnalysisReports

Source: src/AWS/NetworkFirewall/ListAnalysisReports.ts

Runtime binding for network-firewall:ListAnalysisReports — list the traffic analysis reports generated for the bound Firewall; the firewall ARN is injected automatically.

Provide NetworkFirewall.ListAnalysisReportsHttp on the hosting Lambda Function to satisfy the requirement.

ListAnalysisReports: Analysis Reports

// init — grants network-firewall:ListAnalysisReports on the firewall
const listAnalysisReports =
  yield* AWS.NetworkFirewall.ListAnalysisReports(firewall);

// runtime
const { AnalysisReports } = yield* listAnalysisReports();

ListFlowOperationResults

Source: src/AWS/NetworkFirewall/ListFlowOperationResults.ts

Runtime binding for network-firewall:ListFlowOperationResults — read the flows a completed flow capture/flush operation collected on the bound Firewall; the firewall ARN is injected automatically.

Provide NetworkFirewall.ListFlowOperationResultsHttp on the hosting Lambda Function to satisfy the requirement.

ListFlowOperationResults: Flow Operations

// init — grants network-firewall:ListFlowOperationResults on the firewall
const listFlowOperationResults =
  yield* AWS.NetworkFirewall.ListFlowOperationResults(firewall);

// runtime
const { Flows } = yield* listFlowOperationResults({
  FlowOperationId: flowOperationId,
});

ListFlowOperations

Source: src/AWS/NetworkFirewall/ListFlowOperations.ts

Runtime binding for network-firewall:ListFlowOperations — list the flow capture/flush operations that ran on the bound Firewall; the firewall ARN is injected automatically.

Provide NetworkFirewall.ListFlowOperationsHttp on the hosting Lambda Function to satisfy the requirement.

ListFlowOperations: Flow Operations

// init — grants network-firewall:ListFlowOperations on the firewall
const listFlowOperations =
  yield* AWS.NetworkFirewall.ListFlowOperations(firewall);

// runtime
const { FlowOperations } = yield* listFlowOperations({
  FlowOperationType: "FLOW_CAPTURE",
});

LoggingConfiguration

Source: src/AWS/NetworkFirewall/LoggingConfiguration.ts

The logging configuration of an AWS Network Firewall Firewall — routes the firewall’s ALERT, FLOW, and TLS logs to S3, CloudWatch Logs, or Kinesis Data Firehose destinations.

A firewall has exactly one logging configuration; deleting this resource resets it to no logging.

LoggingConfiguration: Configuring Logging

Flow logs to CloudWatch Logs

import * as Logs from "alchemy/AWS/Logs";
import * as NetworkFirewall from "alchemy/AWS/NetworkFirewall";

const logGroup = yield* Logs.LogGroup("FirewallLogs");

yield* NetworkFirewall.LoggingConfiguration("Logging", {
  firewallArn: firewall.firewallArn,
  logDestinationConfigs: [
    {
      LogType: "FLOW",
      LogDestinationType: "CloudWatchLogs",
      LogDestination: { logGroup: logGroup.logGroupName },
    },
  ],
});

Alert logs to S3

yield* NetworkFirewall.LoggingConfiguration("Logging", {
  firewallArn: firewall.firewallArn,
  logDestinationConfigs: [
    {
      LogType: "ALERT",
      LogDestinationType: "S3",
      LogDestination: { bucketName: bucket.bucketName, prefix: "alerts" },
    },
  ],
});

RuleGroup

Source: src/AWS/NetworkFirewall/RuleGroup.ts

An AWS Network Firewall rule group — a reusable collection of stateless or stateful network traffic inspection rules referenced by firewall policies.

RuleGroup: Creating Rule Groups

Stateless Rule Group

import * as NetworkFirewall from "alchemy/AWS/NetworkFirewall";

const stateless = yield* NetworkFirewall.RuleGroup("AllowHttp", {
  type: "STATELESS",
  capacity: 10,
  ruleGroup: {
    RulesSource: {
      StatelessRulesAndCustomActions: {
        StatelessRules: [
          {
            Priority: 1,
            RuleDefinition: {
              Actions: ["aws:pass"],
              MatchAttributes: {
                Protocols: [6],
                DestinationPorts: [{ FromPort: 80, ToPort: 80 }],
              },
            },
          },
        ],
      },
    },
  },
});

Stateful Rule Group (Suricata rules)

const stateful = yield* NetworkFirewall.RuleGroup("BlockDomains", {
  type: "STATEFUL",
  capacity: 100,
  rules: 'drop tcp any any -> any any (msg:"drop all tcp"; sid:1; rev:1;)',
});

Stateful Domain List

const domains = yield* NetworkFirewall.RuleGroup("DenyList", {
  type: "STATEFUL",
  capacity: 100,
  ruleGroup: {
    RulesSource: {
      RulesSourceList: {
        Targets: [".example.com"],
        TargetTypes: ["TLS_SNI", "HTTP_HOST"],
        GeneratedRulesType: "DENYLIST",
      },
    },
  },
});

StartAnalysisReport

Source: src/AWS/NetworkFirewall/StartAnalysisReport.ts

Runtime binding for network-firewall:StartAnalysisReport — generate a traffic analysis report (TLS_SNI or HTTP_HOST) for the bound Firewall; the firewall ARN is injected automatically. The firewall’s analysis settings must have the analysis type enabled.

Provide NetworkFirewall.StartAnalysisReportHttp on the hosting Lambda Function to satisfy the requirement.

StartAnalysisReport: Analysis Reports

// init — grants network-firewall:StartAnalysisReport on the firewall
const startAnalysisReport =
  yield* AWS.NetworkFirewall.StartAnalysisReport(firewall);

// runtime
const { AnalysisReportId } = yield* startAnalysisReport({
  AnalysisType: "TLS_SNI",
});

StartFlowCapture

Source: src/AWS/NetworkFirewall/StartFlowCapture.ts

Runtime binding for network-firewall:StartFlowCapture — begin a time-boxed capture of the flows the bound Firewall is tracking, according to the FlowFilters you define; the firewall ARN is injected automatically.

Provide NetworkFirewall.StartFlowCaptureHttp on the hosting Lambda Function to satisfy the requirement.

StartFlowCapture: Flow Operations

// init — grants network-firewall:StartFlowCapture on the firewall
const startFlowCapture = yield* AWS.NetworkFirewall.StartFlowCapture(firewall);

// runtime
const { FlowOperationId } = yield* startFlowCapture({
  FlowFilters: [{ SourceAddress: { AddressDefinition: "10.0.1.10/32" } }],
});

StartFlowFlush

Source: src/AWS/NetworkFirewall/StartFlowFlush.ts

Runtime binding for network-firewall:StartFlowFlush — flush matching flows from the bound Firewall’s flow table (impacted flows are re-evaluated as midstream traffic); the firewall ARN is injected automatically.

Provide NetworkFirewall.StartFlowFlushHttp on the hosting Lambda Function to satisfy the requirement.

StartFlowFlush: Flow Operations

// init — grants network-firewall:StartFlowFlush on the firewall
const startFlowFlush = yield* AWS.NetworkFirewall.StartFlowFlush(firewall);

// runtime
const { FlowOperationId } = yield* startFlowFlush({
  FlowFilters: [{ SourceAddress: { AddressDefinition: "10.0.1.10/32" } }],
});