Firewall rule

Q: How deeply does Amazon Web Services in Action, Third Edition: An in-depth guide to AWS cover firewall rule?

Defines matching criteria, security-group defaults, least-privilege guidance, and troubleshooting, then contrasts stateful security groups with prioritized NACL rules.

As explained in Amazon Web Services in Action, Third Edition: An in-depth guide to AWS

A firewall rule is a configuration statement that allows or blocks network traffic according to specified criteria.

A firewall rule is a configuration statement that allows or denies network traffic according to its direction, protocol, port, and source or destination. Before traffic enters or leaves an EC2 instance, AWS inspects it against rules managed through security groups. section 5.4 section 5.4.1

Apply firewall rules narrowly to reduce exposure:

Open only required ports: a public web server commonly needs inbound TCP ports 80 and 443, while unnecessary ports should remain closed. section 5.4
Define traffic by direction, IP protocol, port, and IP address, IP range, or—within AWS—a source or destination security group. section 5.4.1
Remember the defaults: security groups deny inbound traffic unless rules allow it, but allow all outbound traffic unless that rule is replaced. section 5.4
Troubleshoot unexpected results with VPC Reachability Analyzer for simulated paths or VPC Flow Logs for aggregated rejected-connection messages. section 5.4

Allow HTTP to a web server

A CloudFormation security group rule permits inbound TCP traffic from 0.0.0.0/0 to port 80. The associated instance installs and starts Apache, allowing a browser to reach a basic test page. section 5.4.3

Listing 10.6 CloudFormation template extract: Firewall rules for an RDS database

DatabaseSecurityGroup:                                      #1
  Type: 'AWS::EC2::SecurityGroup'
  Properties:
    GroupDescription: 'awsinaction-db-sg'
    VpcId: !Ref VPC
    SecurityGroupIngress:
    - IpProtocol: tcp
      FromPort: 3306                                        #2
      ToPort: 3306
      SourceSecurityGroupId: !Ref WebServerSecurityGroup    #3

Inspect a CloudFormation extract that restricts MySQL traffic on port 3306 to instances attached to WebServerSecurityGroup. section 10.4.2

How Amazon Web Services in Action, Third Edition: An in-depth guide to AWS covers it

Cover of Amazon Web Services in Action, Third Edition: An in-depth guide to AWS

liveBook manning.com

Read Amazon Web Services in Action, Third Edition: An in-depth guide to AWS on liveBook Get the book at manning.com

Also explained in

liveBook manning.com

Cyber Threat HuntingA firewall rule is a configuration that specifies network traffic conditions and the action a firewall takes when those conditions match.

Compare how 2 books explain firewall rule →

Related concepts

firewallused by · A firewall is a network security system that monitors and filters communications according to rules governing which traffic is permitted or blocked.
Azure Storage firewallused by · Azure Storage firewall is a network access-control feature that restricts requests to Azure Storage accounts based on network locations and resource sources.
network security groupequivalent to · A network security group is an Azure access-control resource that filters inbound and outbound network traffic using prioritized security rules.
inbound connectionconfigures · An inbound connection is a network connection initiated from an external source toward a local host or service.
security groupequivalent to · A security group is a virtual firewall configuration that controls permitted inbound and outbound network traffic for associated cloud resources.

This explainer was generated by Manning's knowledge graph from the text of Amazon Web Services in Action, Third Edition: An in-depth guide to AWS. The section links point to the parts of the book it draws on.