AWS WAF and Network Firewall

The console can block addresses in AWS WAF (layer 7) and AWS Network Firewall (layer 3/4), manage WAF rule exceptions and managed rule groups, and show AWS security telemetry.

Settings

Setting	Needed for
AWS_REGION	Everything. Setting a region turns the AWS console modules on
AWS_ASSUME_ROLE_ARN	Preferred: a role in your account that the stack assumes
AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY	Instead of a role, or to assume it
WAF_WEB_ACL_NAME (or WAF_WEB_ACL_ID)	WAF blocking and the WAF page
WAF_BLOCKLIST_IP_SET_NAME (default Blocked), WAF_BLOCKLIST_IP_SET_ID	The IP set that holds blocked addresses
NETWORK_FW_RULE_GROUP_NAME	Network Firewall blocking and the Firewall page
AWS_TELEMETRY_SERVICES	The AWS telemetry page, for example guardduty,inspector,cloudtrail
PERIMETER_VENDORS	Set by the console: every blocking vendor set up, for example aws or aws,cloudflare

Each layer is used only when configured: WAF needs the Web ACL, Network Firewall needs the rule group. Set these in the console under Admin → Integrations → Amazon Web Services, then Test connection and Save; the change is applied within a minute. Secrets are never shown again.

The IAM permissions needed follow from what you enable: read and update the Web ACL and its IP set (WAFv2), read and update the Network Firewall rule group, and read access to the telemetry services you list. Scope them to those resources.

Cloud → WAF

WAF management, two tabs:

Management

• Blacklist (layer 7): Add to blacklist an IP or CIDR with an optional reason; remove it, optionally also from the Network Firewall.
• Whitelist: AWS WAF has no global allow-list. Allowing an address is a per-rule exception: the panel lists the rules that support exceptions and links to Signatures.

Signatures

• The AWS managed rule groups on the Web ACL (IP reputation, common attacks, anonymous IP, Linux, Unix, known bad inputs). Add or Remove a group.
• Manage a group: set a rule to Block (enforcing) or Count (monitoring only), reset it, and edit the rule's IP or domain exceptions.
• Geo-restrictions: the checked countries are allowed, all others blocked.

Cloud → Firewall

Firewall management for AWS Network Firewall:

• Network firewall: an allow list and a block list (drag addresses between them), counts of addresses blocked on one or both layers, Add to WAF per address, Sync from AWS.
• Configuration: a read-only summary of how enforcement is set up.

Response → Blocked IPs

All blocked addresses on both layers in one list. See Response.

Cloud → AWS

Read-only AWS telemetry: overview, Inspector, GuardDuty, CloudTrail, WAF, Network Firewall.

The stack collects these itself once you list them in AWS_TELEMETRY_SERVICES (cloudtrail, guardduty, waf, inspector, network_firewall) and say where they are:

Service	Where it is read from	Setting
CloudTrail, GuardDuty, WAF logs	an S3 bucket	AWS_LOGS_BUCKET, or one bucket each: AWS_CLOUDTRAIL_BUCKET, AWS_GUARDDUTY_BUCKET, AWS_WAF_BUCKET (optional _PREFIX each)
Inspector	the Inspector API in AWS_REGION	none
Network Firewall alerts	a CloudWatch Logs group	AWS_NFW_LOG_GROUP

Collection runs every AWS_TELEMETRY_INTERVAL (10 minutes by default) and only reads. Give it a read-only role (AWS_TELEMETRY_ROLE_ARN; otherwise AWS_ASSUME_ROLE_ARN is used) with s3:GetObject and s3:ListBucket on the buckets, Inspector list and read access, and logs:FilterLogEvents on the log group. AWS delivers S3 logs with a delay of minutes to hours.

Microsoft 365 audit logs

The Office 365 page (Cloud Management) shows Microsoft 365 activity: sign-ins, Exchange, SharePoint and data loss prevention events. To collect them, register an app in Entra ID with the Office 365 Management API permission ActivityFeed.Read (application, admin consent), turn on audit logging in Microsoft Purview. Then, in the console, Admin → Integrations → Microsoft 365 audit logs: fill in Entra tenant id, App (client) id and Client secret (optionally Audit streams to collect fewer), Test connection and Save. Events appear within a few minutes; only new events are collected.

Protected addresses

No path blocks a protected IP. Add your own egress addresses there first.