How to assign Rule Variables and IP Set References in AWS Network Firewall Rule Groups?
I'm implementing AWS Network Firewall to secure traffic flowing to and from EC2 instances in a VPC.
So far, I've successfully created rule variables and used them in my stateless rule group by referencing them with the $ symbol (e.g., $HOME_NET).
However, I also want to use an IP set reference (like a managed prefix list) in my rule group.
And my question is: How do I assign an IP set reference in a rule group?
Specifically:
How can I use it in my rule group similar to how I use rule variables?
I couldn’t find a clear example in the docs that show using prefix lists or IP set references inside rule groups.
Would appreciate an example or a pointer if anyone has done this before!
- Idioma
- English
feita há um ano487 visualizações
- Mais recentes
- Mais votos
- Mais comentários
Glad you found an answer. It looks like this is the document you were looking for: https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-examples.html#suricata-example-rule-with-ip-set-reference
respondido há um ano
I was able to solve this issue with help from the AWS Support team.
To assign an IP set reference in an AWS Network Firewall rule group, you can use the @ symbol, similar to how $ is used for rule variables.
For example, in the rule definition you can do something like: "Source": "@MyIPSet"
This allowed me to reference a prefix list that I had defined in the name in IP set references section.
However, I couldn’t find this usage clearly documented in the official AWS documentation. If anyone has a direct link or official example, I’d love to see it.
Hope this helps others trying to use IP set references inside rule groups!
I’ll also be sharing a full step-by-step guide on this in a blog post soon — will update this thread with the link.
Thank you for sharing the documents.