AWS Network Firewall Baseline Stack

AWS Network Firewall with Stateful Threat Rules

A CloudFormation stack that deploys AWS Network Firewall in a dedicated inspection VPC, pre-loaded with stateful Suricata rules covering common threat categories, and CloudWatch logging for every rule match — ready to slot into an existing Transit Gateway topology.

What's Included

• Dedicated inspection VPC with firewall subnets across two AZs
• Network Firewall with stateful rule group for threat detection
• Suricata-compatible rules for: known malware domains, cryptomining pools, common CVE exploit patterns, and outbound data exfiltration signatures
• Stateless pass rules for established return traffic
• CloudWatch log group for alert and flow logs with 30-day retention
• Transit Gateway attachment and route table entries to steer traffic through the firewall

What You Get

• network-firewall.yaml — main CloudFormation template
• rules/threats.rules — curated Suricata rule file you can extend
• parameters/ — parameter files for single-AZ and multi-AZ deployments
• README.md — traffic flow diagram, TGW integration steps, and rule customization guide

Requirements

• AWS account with CloudFormation, Network Firewall, and EC2 permissions
• Existing Transit Gateway if using the TGW integration (inspection slot)
• CloudWatch log group will be created by the stack