networkfirewall_rule_group

# Create a rule group
- name: Create a minimal AWS Network Firewall Rule Group
  community.aws.networkfirewall_rule_group:
    name: 'MinimalGroup'
    type: 'stateful'
    capacity: 200
    rule_strings:
        - 'pass tcp any any -> any any (sid:1000001;)'

# Create an example rule group using rule_list
- name: Create 5-tuple Rule List based rule group
  community.aws.networkfirewall_rule_group:
    name: 'ExampleGroup'
    type: 'stateful'
    description: 'My description'
    rule_order: default
    capacity: 100
    rule_list:
        - sid: 1
          direction: forward
          action: pass
          protocol: IP
          source: any
          source_port: any
          destination: any
          destination_port: any

# Create an example rule group using rule_list
- name: Create 5-tuple Rule List based rule group
  community.aws.networkfirewall_rule_group:
    name: 'ExampleGroup'
    type: 'stateful'
    description: 'My description'
    ip_variables:
        SOURCE_IPS: ['203.0.113.0/24', '198.51.100.42']
        DESTINATION_IPS: ['192.0.2.0/24', '198.51.100.48']
    port_variables:
        HTTP_PORTS: [80, 8080]
    rule_order: default
    capacity: 100
    rule_list:
        # Allow 'Destination Unreachable' traffic
        - sid: 1
          action: pass
          protocol: icmp
          source: any
          source_port: any
          destination: any
          destination_port: any
          rule_options:
            itype: 3
        - sid: 2
          action: drop
          protocol: tcp
          source: "$SOURCE_IPS"
          source_port: any
          destination: "$DESTINATION_IPS"
          destination_port: "$HTTP_PORTS"
          rule_options:
            urilen: ["20<>40"]
            # Where only a keyword is needed, add the keword, but no value
            http_uri:
            # Settings where Suricata expects raw strings (like the content
            # keyword) will need to have the double-quotes explicitly escaped and
            # passed because there's no practical way to distinguish between them
            # and flags.
            content: '"index.php"'

# Create an example rule group using Suricata rule strings
- name: Create Suricata rule string based rule group
  community.aws.networkfirewall_rule_group:
    name: 'ExampleSuricata'
    type: 'stateful'
    description: 'My description'
    capacity: 200
    ip_variables:
        EXAMPLE_IP: ['203.0.113.0/24', '198.51.100.42']
        ANOTHER_EXAMPLE: ['192.0.2.0/24', '198.51.100.48']
    port_variables:
        EXAMPLE_PORT: [443, 22]
    rule_strings:
        - 'pass tcp any any -> $EXAMPLE_IP $EXAMPLE_PORT (sid:1000001;)'
        - 'pass udp any any -> $ANOTHER_EXAMPLE any (sid:1000002;)'

# Create an example Domain List based rule group
- name: Create Domain List based rule group
  community.aws.networkfirewall_rule_group:
    name: 'ExampleDomainList'
    type: 'stateful'
    description: 'My description'
    capacity: 100
    domain_list:
        domain_names:
            - 'example.com'
            - '.example.net'
        filter_https: true
        filter_http: true
        action: allow
        source_ips: '192.0.2.0/24'

# Update the description of a rule group
- name: Update the description of a rule group
  community.aws.networkfirewall_rule_group:
    name: 'MinimalGroup'
    type: 'stateful'
    description: 'Another description'

# Update IP Variables for a rule group
- name: Update IP Variables
  community.aws.networkfirewall_rule_group:
    name: 'ExampleGroup'
    type: 'stateful'
    ip_variables:
        EXAMPLE_IP: ['192.0.2.0/24', '203.0.113.0/24', '198.51.100.42']
    purge_ip_variables: false

# Delete a rule group
- name: Delete a rule group
  community.aws.networkfirewall_rule_group:
    name: 'MinimalGroup'
    type: 'stateful'
    state: absent