How can I use custom policy rules with my Firewall Manager content audit security group policy?
I want to use custom policy rules with my AWS Firewall Manager content audit security group policy.
"I want to use custom policy rules with my AWS Firewall Manager content audit security group policy.Short descriptionYou can use Firewall Manager content audit security group policies to check and manage rules that are in use in your organization's security groups. Content audit security group policies apply to all security groups in use in your organization in AWS Organizations. You can create custom policy rules for your content audit security group policy for your use case.For more information, see Content audit security group policies.ResolutionComplete the Firewall Manager prerequisites, and then create the audit security group and policyBefore you begin, complete the Firewall Manager prerequisites.Create an audit security group with your Firewall Manager administrator account. Follow the best practices for security group policies and the security group policy limitations.Follow the steps for creating Firewall Manager content audit security group policy.Important: It's a best practice to create an audit security group policy with automatic remediation deactivated. Review the effects of policy creation before activating automatic remediation. After you review the expected effects, you can edit the policy and then activate automatic remediation. When automatic remediation is activated, Firewall Manager updates or removes rules that are noncompliant with in-scope security groups."Allow only the rules defined in the audit security groups" policy ruleThis rule states that all in-scope security groups must only have rules that are within the allowed range of the policy's audit security group rules. In this case, the policy's security group rules provide the example of what's acceptable to do.Example use caseTo allow SSH from allow-listed CIDRs in the range 10.0.0.0/16, use an inbound rule allowing SSH (TCP port 22) from 10.0.0.0/16 only. Security group rules allowing SSH from other CIDRs in another range (for example, 10.0.0.0/8) aren't allowed.For more information, see Content audit security group policies."Deny the use of any rules defined in the audit security groups" policy ruleThis rule states that all in-scope security groups must only have rules that aren't within the allowed range of the policy's audit security group rules. In this case, the policy's security group provides the example of what's not acceptable to do.Example use caseTo deny inbound TCP access on the port range 1024 to 65535, use an inbound rule allowing TCP traffic in the range 0.0.0.0/0. Security group rules allowing TCP traffic in the port range 1024 to 65535 from any CIDR aren't allowed.Related informationHow do I set up AWS Firewall Manager for my AWS account?Follow"