RuleGroup

Source: src/AWS/NetworkFirewall/RuleGroup.ts

An AWS Network Firewall rule group — a reusable collection of stateless or stateful network traffic inspection rules referenced by firewall policies.

Creating Rule Groups

Stateless Rule Group

import * as NetworkFirewall from "alchemy/AWS/NetworkFirewall";

const stateless = yield* NetworkFirewall.RuleGroup("AllowHttp", {
  type: "STATELESS",
  capacity: 10,
  ruleGroup: {
    RulesSource: {
      StatelessRulesAndCustomActions: {
        StatelessRules: [
          {
            Priority: 1,
            RuleDefinition: {
              Actions: ["aws:pass"],
              MatchAttributes: {
                Protocols: [6],
                DestinationPorts: [{ FromPort: 80, ToPort: 80 }],
              },
            },
          },
        ],
      },
    },
  },
});

Stateful Rule Group (Suricata rules)

const stateful = yield* NetworkFirewall.RuleGroup("BlockDomains", {
  type: "STATEFUL",
  capacity: 100,
  rules: 'drop tcp any any -> any any (msg:"drop all tcp"; sid:1; rev:1;)',
});

Stateful Domain List

const domains = yield* NetworkFirewall.RuleGroup("DenyList", {
  type: "STATEFUL",
  capacity: 100,
  ruleGroup: {
    RulesSource: {
      RulesSourceList: {
        Targets: [".example.com"],
        TargetTypes: ["TLS_SNI", "HTTP_HOST"],
        GeneratedRulesType: "DENYLIST",
      },
    },
  },
});