How can I use Network Firewall managed rule groups in the LZA?

The managed rule groups I mentioned in step three are for AWS WAF you are correct.

The rest is applicable to the AWS Network Firewall.

Here is the link to the documentation for the cloudformation for a stateful rule

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-networkfirewall-rulegroup-statefulrule.html

Here is the same section in the API documentation

https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_StatefulRule.html

If none of the above steps resolve the issue, it may be necessary to contact AWS Support for further assistance. They can provide specific guidance based on your account and configuration.

The Landing Zone Accelerator (LZA) sample configurations don't explicitly show how to enable managed rule groups for AWS Network Firewall. This link shows how to update the network-config.yaml to add a transit gateway. It is a similar process to add managed rule groups.

https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/performing-administrator-tasks.html

1. First, ensure you have the Network Firewall configuration in your network-config.yaml file.

2. To add managed rule groups, you need to modify the statefulRuleGroups section.

3. You can add managed rule groups as needed. AWS provides several managed rule groups, including:

   • AWSManagedRulesATPRuleSet
   • AWSManagedRulesKnownBadInputsRuleSet
   • AWSManagedRulesSQLiRuleSet
   • AWSManagedRulesLinuxRuleSet
   • AWSManagedRulesWindowsRuleSet

4. For each rule group, you can specify:

   • name: The name of the managed rule group
   • priority: The priority of the rule group (lower numbers are evaluated first)
   • overrideAction: What action to take (ALERT or DROP)

5. After making these changes, commit and push your updated configuration files to your LZA configuration repository.

6. The LZA pipeline will detect the changes and update your Network Firewall policy to include these managed rule groups.

Remember, using managed rule groups may incur additional costs, so be sure to review the AWS pricing for Network Firewall and managed rule groups.

Also, it's a good practice to test these configurations in a non-production environment first to ensure they don't interfere with your legitimate traffic.

If you need to customize the behaviour of these managed rules or create your own stateful rules, you can do so by adding custom rule groups in addition to or instead of the managed ones.

If none of the above steps resolve the issue, it may be necessary to contact AWS Support for further assistance. They can provide specific guidance based on your account and configuration.