How to assign Rule Variables and IP Set References in AWS Network Firewall Rule Groups?

Question

I'm implementing AWS Network Firewall to secure traffic flowing to and from EC2 instances in a VPC.

So far, I've successfully created rule variables and used them in my stateless rule group by referencing them with the $ symbol (e.g., $HOME_NET).

However, I also want to use an IP set reference (like a managed prefix list) in my rule group.

And my question is:
How do I assign an IP set reference in a rule group?

Specifically:

How can I use it in my rule group similar to how I use rule variables?

I couldn’t find a clear example in the docs that show using prefix lists or IP set references inside rule groups.

Would appreciate an example or a pointer if anyone has done this before!

Alon Shrestha · Accepted Answer

I was able to solve this issue with help from the AWS Support team.

To assign an IP set reference in an AWS Network Firewall rule group, you can use the @ symbol, similar to how $ is used for rule variables.

For example, in the rule definition you can do something like:
"Source": "@MyIPSet"

This allowed me to reference a prefix list that I had defined in the name in IP set references section.

However, I couldn’t find this usage clearly documented in the official AWS documentation. If anyone has a direct link or official example, I’d love to see it.

Hope this helps others trying to use IP set references inside rule groups!

I’ll also be sharing a full step-by-step guide on this in a blog post soon — will update this thread with the link.

mofaized-AWS · Answer

Glad you found an answer. It looks like this is the document you were looking for: https://docs.aws.amazon.com/network-firewall/latest/developerguide/suricata-examples.html#suricata-example-rule-with-ip-set-reference

mofaized-AWS

answered a year ago

How to assign Rule Variables and IP Set References in AWS Network Firewall Rule Groups?

Add your answer

Relevant content