topic Re: Cloudguard datacenter objects - AWS resources supported in Cloud Firewall

Cloudguard datacenter objects - AWS resources supported

tgross — Thu, 13 Jul 2023 01:39:40 GMT

Hi there,

We're trying to see what resources are supported for Cloudguard datacenter objects and AWS.

The documentation is not 100% clear on what is supported, e.g. https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_CloudGuard_Controller_AdminGuide/Topics-CGRDG/Supported-Data-Centers-AWS.htm

- this documentation says it supports tags, but not what resource from those tags, e.g. tags on EC2 instances or ENI network interfaces?

In our case we'd like to see if tags are supported on ENIs so that we can tag ENIs with particular groups that then can get used to allow in checkpoint for rules to allow traffic.

Cheers!

Re: Cloudguard datacenter objects - AWS resources supported

Chris_Atkinson — Thu, 13 Jul 2023 13:08:39 GMT

So to confirm your seeking further detail to clarify:

"Import all instances and Security Groups that have a specific Tag Key or Tag Value." ?

R81.20 What's New: New AWS resources - Load Balancer tags

Re: Cloudguard datacenter objects - AWS resources supported

tgross — Sun, 16 Jul 2023 23:34:41 GMT

Hi Chris,

We would like to tag ENIs if possible (AWS network interfaces), or else use security groups. From the documentation:

"Import all IP addresses that belong to a specific Security Group. The Security Group is used only as a container for the list of all IP addresses of Instances that are attached to this group."

Is this limited to EC2 instances, or does the checkpoint retrieve all IP addresses associated with the security group? What I'm trying to understand is whether it's limited to EC2's or if we can use that for any AWS resource using a network interface (IP address), like workspaces, lambdas, rds instances?

Thanks heaps for your help.

Re: Cloudguard datacenter objects - AWS resources supported

Shayro — Mon, 17 Jul 2023 13:34:58 GMT

Hi,
Unfortunately we do not support tags in ENIs, only in instances.

Re: Cloudguard datacenter objects - AWS resources supported

tgross — Mon, 17 Jul 2023 21:57:59 GMT

Thanks for letting me know - how about security groups: does the checkpoint get all IPs of a security group no matter what resource type it is?

Re: Cloudguard datacenter objects - AWS resources supported

Shayro — Wed, 19 Jul 2023 08:21:00 GMT

Are you looking for IP address for a specific resource type? I checked for ENI, you get its IP address in the security group.