AWS Network Firewall logging

The version of Suricata used by Network Firewall now supports the alert; keyword on pass rules, enabling an "alert then pass" behavior within a single rule. This generates an alert before passing the traffic. For strict order firewall policies, this provides an alternative to the existing approach of positioning a separate alert rule above the corresponding pass rule, effectively halving the rule capacity required for pass-with-alert scenarios. The alert-above-pass approach remains a valid configuration. Firewall flow logs are useful for troubleshooting but do not indicate which rule was matched or what action was taken — though some context can be inferred from flow direction, TCP flags, packet/byte counts, age, etc.

To see the allowed request traffic in CloudWatch with your current setup, you'll need to adjust your logging configuration. Currently, you've only enabled Alert logging, which captures traffic that matches stateful rules with actions set to Alert, Drop, or Reject. This is why you're only seeing the denied requests (www.test.com) in CloudWatch.

To capture the allowed traffic (www.example.com), you should enable Flow logging in addition to Alert logging. Flow logging provides information on all network traffic that passes through the stateful rules engine, including allowed traffic.

Here's how you can modify your logging configuration:

1. Go to the AWS Management Console and navigate to the Network Firewall section.
2. Select your firewall and go to the Firewall details tab.
3. In the Logging section, choose Edit.
4. In addition to Alert, select Flow under Log type.
5. Configure the destination for Flow logs (you can use the same CloudWatch log group or a different one).
6. Save your changes.

After making these changes, you should be able to see logs for both allowed and denied traffic in CloudWatch. The Flow logs will capture the allowed requests to www.example.com, while the Alert logs will continue to capture the denied requests to www.test.com.

Remember that enabling additional logging may increase your CloudWatch costs, so monitor your usage accordingly. Also, note that there might be a short delay before the new logging configuration takes effect.
Sources
Logging network traffic from AWS Network Firewall - AWS Network Firewall
Firewall settings in AWS Network Firewall - AWS Network Firewall
Updating a AWS Network Firewall logging configuration - AWS Network Firewall