Send alerts from AWS Network Firewall to a Slack channel

Created by Venki Srivatsav (AWS) and Aromal Raj Jayarajan (AWS)

Summary

This pattern describes how to deploy a firewall by using Amazon Web Services (AWS) Network Firewall with the distributed deployment model and how to propagate the alerts generated by AWS Network Firewall to a configurable Slack channel. 

Compliance standards such as Payment Card Industry Data Security Standard (PCI DSS) require that you install and maintain a firewall to protect customer data. In the AWS Cloud, a virtual private cloud (VPC) is considered the same as a physical network in the context of these compliance requirements. You can use Network Firewall to monitor network traffic between VPCs and to protect your workloads that run in VPCs governed by a compliance standard. Network Firewall blocks access or generates alerts when it detects unauthorized access from other VPCs in the same account. However, Network Firewall supports a limited number of destinations for delivering the alerts. These destinations include Amazon Simple Storage Service (Amazon S3) buckets, Amazon CloudWatch log groups, and Amazon Data Firehose delivery streams. Any further action on these notifications requires offline analysis by using either Amazon Athena or Amazon Kinesis. 

This pattern provides a method for propagating alerts that are generated by Network Firewall to a configurable Slack channel for further action in near real time. You can also extend the functionality to other alerting mechanisms such as PagerDuty, Jira, and email. (Those customizations are outside the scope of this pattern.) 

Prerequisites and limitations

Prerequisites 

Limitations 

Architecture

Target technology stack

All components except for the Slack channel are provisioned by the CloudFormation templates and the Lambda function that are provided with this pattern (see the Code section).

Target architecture 

This pattern sets up a decentralized network firewall with Slack integration. This architecture consists of a VPC with two Availability Zones. The VPC includes two protected subnets and two firewall subnets with network firewall endpoints. All traffic going into and out of the protected subnets can be monitored by creating firewall policies and rules. The network firewall is configured to place all alerts in an S3 bucket. This S3 bucket is configured to call a Lambda function when it receives a put event. The Lambda function fetches the configured Slack URL from Secrets Manager and sends the notification message to the Slack workspace.

For more information about this architecture, see the AWS blog post Deployment models for AWS Network Firewall.

Tools

AWS services

Code 

The code for this pattern is available on GitHub, in the Network Firewall Slack Integration repository. In the src folder of the repository, you’ll find:

To use these files, follow the instructions in the next section.

Epics

#!/bin/bash
yum install httpd -y
systemctl start httpd
systemctl stop firewalld
cd /var/www/html
echo "Hello!! this is a NFW alert test page, 200 OK" > index.html

Source: 0.0.0.0/0
Destination 10.0.3.65/32 (private IP of the EC2 instance)
Action: Forward 

Protocol: HTTP
Source ip/port: Any / Any
Destination ip/port: Any /Any

Hello!! this is a NFW alert test page, 200 OK 

Related resources

Additional information

CloudFormation parameters

Filter behavior

If you haven’t configured any filters in AWS Lambda, all generated alerts are sent to your Slack channel. The source and destination IPs of the generated alerts are matched against the CIDR ranges you configured when you deployed the CloudFormation template. If a match is found, the condition is applied. If either the source or the destination falls within the configured CIDR range and at least one of them is configured with the condition include, an alert is generated. The following tables provide examples of CIDR values, conditions, and results.