Focus

Cloud NGFW for AWS

Cross-Account Role CFT Permissions for Cloud NGFW

Table of Contents

Cross-Account Role CFT Permissions for Cloud NGFW

Cloud NGFW for AWS requires permissions to access AWS accounts, read VPC info, create/manage endpoints, access logging destinations, and decrypt traffic.

Cloud NGFW requires permissions to access information and resources associated with your AWS accounts. When you onboard an AWS account, a CloudFormation Template (CFT) is provided to help you enable the permissions. When you deploy the CFT, it creates a cross-account IAM role in your AWS account. This IAM role provides Cloud NGFW with the permissions necessary to read VPC information required to create and manage endpoints, send logs to logging destinations, and access certificates in the AWS Secrets Manager for traffic decryption.

Endpoint Configuration

The cross-account IAM role requires permissions to read information about your VPC resources, allowing you to configure NGFW endpoints in your AWS environment.

{
    "Sid": "Allow Cloud NGFW to read VPC resources",
    "Effect": "Allow",
    "Action": [
        # The first four permission are the minimum needed
        "ec2:DescribeVpcs",
        "ec2:DescribeSubnets",
        "ec2:DescribeAvailabilityZones        
        "ec2:DescribeVpcEndpoints",
    ],
    "Resource": "*"
}

Endpoint Creation

(Optional) You can configure Cloud NGFW to create and manage NGFW endpoints in your AWS account. If you choose not to configure there permissions, you must manually create NGFW endpoints after deploying your NGFW.

{
    "Sid": "Allow Cloud NGFW to manage NGFW endpoints",
    "Effect": "Allow",
    "Action": [
        "ec2:deleleVpcEndpoints"
        "ec2:CreateVpcEndpoints"
    ],
    "Resource": "*"
}

Logging and Metric Management

(Optional) The cross-account role includes permissions required for logging and metrics management. The template does not create the logging destinations; instead, it provides the necessary permissions to access the specified logging destinations. You must create the logging destinations you specify in the template.

The template provides the default value PaloAltoCloudNGFW for a Cloudwatch Namespace and Kinesis Date Firehose. The template does not provide a default value for an S3 Bucket. You can replace the default value with the value of a corresponding logging destination in your AWS account.

{
    "Sid": "Allow Cloud NGFW access to one Cloudwatch Namespace",
     "Effect": "Allow",
     "Resource": "*",
     "Action": "cloudwatch:PutMetricData",
     "Condition": {
         "StringEquals": {
             "cloudwatch:namespace": "PaloAltoCloudNGFW" 
          }
     }
}{
   "Sid":"Allow Cloud NGFW access to write logs in one LogGroup",
   "Action": [
        "logs:CreateLogStream",
        "logs:DescribeLogStreams",
        "logs:PutLogEvents",
   ],
   "Effect": "Allow",
   "Resource": [            
          "arn:aws:logs:*:*:log-group:PaloAltoCloudNGFW"
          "arn:aws:logs:*:*:log-group:PaloAltoCloudNGFW:log-stream:*"
    ],
}{
    "Sid": "Optionally, Allow Cloud NGFW to write logs to one S3 bucket",
    "Effect": "Allow",
    "Action": [
        "s3:putObject"
     ],
     "Resource": [  
          # this is proposal #1 - name is coded based on externalid
          "arn:aws:s3:::<PaloAltoCloudNGFW-ExternalD>/*"
          # this is proposal #2 - name is provided by customer in CFT.
           'arn:aws:s3:::${S3Bucket}/*'
     ]
}{
    "Sid": " Optionally, Allow Cloud NGFW to write logs to Streams",
    "Effect": "Allow",
    "Action": [
"firehose:putRecordBatch"
     ],
    "Resource": [   
      "arn:aws:kinesis:region:account:deliveryStream/PaloAltoCloudNGFW*"
     ],
}

Decryption

(Optional) The cross-account role includes permissions for Cloud NGFW to retrieve certificates from the Secrets Manager in your AWS account and use it to decrypt traffic flowing through your NGFW. These permissions use the attribute-based access control (ABAC) mechanism by specifying a tag for access. These permissions are optional and you can choose not to configure them when you deploy the template.

{
    "Sid": "Allow Cloud NGFW to pick up certificates",
    "Effect": "Allow",
    "Action": [
            "secretsmanager:GetSecretValue"
    ],
    "Resource": "*",
    "Condition": {
         "StringEquals": {
            "aws:ResourceTag/PaloAltoCloudNGFW": "true"
          }
     }        
}

Account Monitoring

(Optional) The existing CloudFormation template (CFT) of your onboarded AWS account can have Account Monitoring permissions added to it.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "ec2:DescribeVpcs",
                "ec2:DescribeNetworkInterfaces",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeInstances",
                "ec2:DescribeVpcEndpoints",
                "ec2:DescribeSubnets",
                "ec2:DescribeManagedPrefixLists",
                "elasticloadbalancing:DescribeLoadBalancers",
                "elasticloadbalancing:DescribeTags"
            ],
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": [
                "ec2:GetManagedPrefixListAssociations",
                "ec2:GetManagedPrefixListEntries"
            ],
            "Resource": [
                "arn:aws:ec2:*:*:prefix-list/*"
            ],
            "Effect": "Allow"
        }
    ]
}

Locate Your Cloud NGFW for AWS Serial Number

Invite Users to Cloud NGFW for AWS