aws-samples / aws-samples/aws-security-reference-architecture-examples

[FEATURE] Parameterise whether Windows/Linux/Posix Web ACL rulesets should be deployed to Firewall Manager

Open
#303 0 comments 0 reactions 0 assignees View on GitHub
feature
Dominant language
Python
Stars
1.2k
Forks
303
Avg merge
3d 9h
Merged PRs (30d)
1

Description

### Is your feature request related to a problem? Please describe

We have an AWS Organization running a set of serverless workloads. Workloads use APIGateways which are fronted by CloudFront. In order to protect workloads, we enable AWS-managed Web ACL rulesets, which are deployed via the firewall-manager-org SRA solution. Those rulesets are enabled on APIGateways and CloudFront.

The firewall-manager-org SRA solution deploys other rulesets for Windows/Linux/Posix which we do not use. At a cost of $5 per ruleset, per month this greatly increases the cost of the out-of-the-box solution, when we do not use the functionality.

### Describe the solution you'd like

In order to reduce costs and make management simpler, I would like to suggest having 3 new parameters that when set to `false` would drive conditions that prevented the deployment of the Windows/Linux/Posix rulesets.

These parameters would be passed through to the **sra-firewall-manager-org-waf-policy.yaml** stackset creation from the **sra-firewall-manager-org-main-ssm.yaml** stack.

```
pEnableWindowsPolicy:
Type: String
Default: 'true'
AllowedValues: ['true', 'false']
Description: Set to true to enable the Windows WAF policy
pEnableLinuxPolicy:
Type: String
Default: 'true'
AllowedValues: ['true', 'false']
Description: Set to true to enable the Linux WAF policy
pEnablePosixPolicy:
Type: String
Default: 'true'
AllowedValues: ['true', 'false']
Description: Set to true to enable the Posix WAF policy

Conditions:
cCreateCFRuleGroup: !Equals [!Ref 'AWS::Region', 'us-east-1']
cCreateWindowsPolicy: !Equals [!Ref pEnableWindowsPolicy, 'true']
cCreateLinuxPolicy: !Equals [!Ref pEnableLinuxPolicy, 'true']
cCreatePosixPolicy: !Equals [!Ref pEnablePosixPolicy, 'true']

Resources:
...

rFmsRegionalWafWindowsPolicy:
Type: AWS::FMS::Policy
Condition: cCreateWindowsPolicy
...
```

### Describe alternatives you've considered

There are not really alternatives to preventing the deployment of these rulesets. It would be possible to manually delete them after deployment, but in my case, the CfCT would later kick in and redeploy them if it found the stack had drifted.

### Additional context

Deployed via the CfCT v2.8.1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.