AWS Network Firewall limiations

You are right regarding trying to manage all stateful managed rule group will hit the 30000 hard limit. You can think rule groups as containers of rule groups, therefore you can group your rule groups by functionality (for example botnet, malware) and type (stateful/stateless) under separate policies which will give you the flexibility:

• not to hit the limits
• manage your rule groups and policies easily

There have been some updates since this question was originally posted that are worth highlighting.

Rule group limits

You can still associate a maximum of 20 stateful rule groups with a single firewall policy, and any single stateful rule group can have up to 30,000 stateful rules. However, the maximum number of stateful rules per firewall policy per account per Region can now be increased from 30,000 (default) to 50,000. This means you can have up to 50,000 stateful rules spread across the 20 stateful rule groups associated to the firewall policy. This limit can be increased directly from the Service Quotas console — look for the quota named Stateful rules per policy.

Rule optimization

Two other quotas worth keeping in mind are the maximum character length of a Suricata rule (8,192) and the maximum size of a Suricata-compatible rules string for a rule group (2,000,000 bytes). When writing your own Suricata rule strings, you can look for ways to maximize the use of these per-rule limits. For example:

• Rather than writing one pass tls rule for each allowed domain, you can use Perl Compatible Regular Expressions (PCRE) in a single rule to match on multiple domains — reducing your overall stateful rule count.
• In a strict order policy, you can use the alert; keyword on a pass rule to alert on pass when needed, instead of adding a duplicate alert rule above the pass rule.

Managed rule groups

Rather than adding all available managed rule groups, the recommendation is to only add the ones that provide a security benefit to your specific environment. Adding every managed rule group may be casting too wide of a net. A balance between managed and custom rule groups allows you to tailor the firewall policy to your environment's actual needs, while staying within the rule group and capacity limits.

Since this question was first asked, Network Firewall has also added new paid managed rule group options:

• Active Threat Defense — Provides automated, intelligence-driven protection against dynamic, ongoing threat activities observed across AWS infrastructure. Announcement
• Partner Managed Rule Groups — Deploy expert-curated, automatically updated security rules from AWS Partners directly within your firewall policies via AWS Marketplace. Announcement