Welcome to Solving with AWS Solutions.
Your deep dive into reference architectures
built by AWS that are ready to deploy
instantly in the cloud.
I'm Ashley and I'm joined by
Solution Developer Lalit.
Today we're going to talk about the AWS
Network Firewall Deployment Automations for
AWS Transit Gateway implementation.
Thanks, Ashley.
Security is the top priority for all of these
services and features.
This solution saves you time by automating the
provisioning of centralized model to inspect
your VPC to VPC traffic.
Sounds like we have lots to explore.
So let's dive in.
Lalit, tell me about the solution.
How do we get started?
So you start with the landing page.
All of our solutions have a landing page which
helps you set up, which provides you
an implementation guide.
It also provides you basic information about
the solution, as well as
an architecture diagram.
Now, if you want to dive deeper, you can look
at the source code or if you just want to
launch the solution, you can just click on on
launch here and it will deploy the
solution for you.
Perfect.
Can you tell me how it's architected?
Sure.
So let me walk you through this.
As part of the solution.
We deploy a Dev Ops structure for your
infrastructure for you.
There is a Code Commit Repository.
We use Code Pipeline as a target for that.
And the compute is being done in
the code build.
Once we deploy the solution, the inspection
VPC gets deployed for you.
The pipeline events and executes validates the
example configuration, which is stored in the
code commit repository.
And the the network firewall endpoint is
created for you.
And all the network plumbing is also
done for you.
So it's as easy as just click and deploy.
And the pipeline will take care of setting up
a basic default pass all policy.
Are there any other things that come
with this, other services?
Yes.
So you can of course, by default we encrypt
everything with the KMS key, which is also
deployed with the solution.
IAM roles to to use for specific actions.
And then you also get to choose which
destination would you like to choose for your
network firewall logs?
If you provide a Transit Gateway ID that you
already have, then we also plan your
inspection BPC with the transit gateway so you
can start monitoring your network.
All right.
So to get to that point, after I've actually
deployed it and I want to start monitoring
my network, can I play around with this
without impacting my network first?
Absolutely.
So if you do not provide a Transit Gateway
when you deploy, the solution will deploy and
deploy pretty much everything except that the
existing network that you have you see here in
Transit Gateway will not be attached to
your inspection VPC.
Perfect.
So tell me about updating my configuration.
How would I do that?
Let me walk you through that.
Perfect.
So in the Code Pipeline console, as you
can see, when the president executes for the
very first time, but with the
default configuration, the pass all policy is
reviewed in the validation stage, which is
where if you modify it in future, we will make
sure that there are no errors, that JSON
structure is intact.
And in the last stage is where we deploy
all the configurations.
Your firewall endpoints are being created.
Your network changes are being done.
Your policy and room groups are
also being created.
So if I'd like to update my configuration,
how do I do that here?
That's pretty easy.
Let me take you to to my console.
So I've already set up this environment.
So out of the box, you can see the firewall
configuration is already set up for you with
all the the protections deployed for
you.
Right.
But if you want to change any any of
these configurations, you can easily do that.
You can if you want to change any of
these properties, it's very easy to just
change it and then commit that code.
Now, the policy, as I mentioned earlier,
is pass all.
So this is out of the box configuration,
as you can see.
But the key thing here is we also provide an
example directory inside
your example configuration.
In this directory, you will see all the
examples that you can use to modify
your default configuration.
OK, so tell me about the rules.
So if I wanted to import, for instance,
my existing Suricata rules, is that possible?
Absolutely.
So let's say you have your multiple Suricata
rule files, right.
So let me walk you through quickly a
sample policy here.
So this sample policy shows you that you can
set up a stateless rule groups.
You can set up stateful rule groups as
well.
Right.
Inside your stateful rule group reference we
want you to to create a certain structure for
your Suricata reference.
And then once that path of the country,
the automation will take care of finding this
file and applying those changes as part of the
the API calls.
Right.
So let's quickly go to
these Suricata reference.
Once I open that file, you can see that you
can set the capacity, you can set your
description as you prefer.
But you if you already have a rules file that
you're already using, you can reference that
here and store that.
Just don't forget to to store it here,
because if you do, the validation stage will
find that error for you and tell you that
you're missing a file.
So here is a sample Suricata file for you.
So if you already have a file that looks
like it, you just have to copy.
Paste it in here.
Store it and then just commit that
into your configuration.
The pipeline will take care of the rest.
Oh, sounds pretty simple then.
Yes, it is.
What value does this have for businesses?
So what we wanted to make sure that you get
the benefit out of this by not doing much when
you want to deploy network firewall in your
in your environment.
Right.
We wanted to make it easy for you to just
launch and rest will be done for you.
But also thinking from a perspective,
how would you continue to manage that
firewall?
Right.
You get to centrally manage your network.
Your configuration lives in
a centralized location.
You were able to provide to audit and
track the changes.
Right.
So the version control that Git
provides here, the dev ops workflow will will
take care of the rest for you.
So as a business, you will be able to do all
of this with just a few clicks.
I love the simplification of this.
Thank you so much for showing me
the solution today.
Thank you.
Well, there you have it.
The AWS Network Firewall Deployment Automation
for AWS Transit Gateway implementation,
a solution that helps you automate and manage
your network's firewall configuration to
filter your traffic.
Check out the solution and many more on the
AWS Solutions website.
Thanks for watching.