AWS Network Firewall Deployment models with Terraform
Info
This project contains Terraform resources to deploy AWS Network Firewall with the following Architecture Models.
- Distributed
- Centralised
AWS has published detailed blog posts about the Network Firewall Architectures Deployment models for AWS Network Firewall
1. Distributed
For the distributed deployment model, we deploy AWS Network Firewall into each VPC which requires protection. Each VPC is protected individually and blast radius is reduced through VPC isolation. Each VPC does not require connectivity to any other VPC or AWS Transit Gateway. Each AWS Network Firewall can have its own firewall policy or share a policy through common rule groups (reusable collections of rules) across multiple firewalls.
2. Centralized
For centralized deployment model, AWS Transit Gateway is a prerequisite. AWS Transit Gateway acts as a network hub and simplifies the connectivity between VPCs as well as on-premises networks. AWS Transit Gateway also provides inter-region peering capabilities to other Transit Gateways to establish a global network using AWS backbone.
Directory Structure
terraform-aws-network-firewall-deployment-models
├── centralized - Terraform resources to deploy the Centralised Deployment Model
└── distributed - Terraform resources to deploy the Distributed Deployment Model