Programmatic Access for Cloud NGFW

hparandekar — Tue, 05 Apr 2022 01:27:47 GMT

Where can I find more information about programmatic access for Cloud NGFW? Also can I use AWS Cloudformation Templates to create and manage Cloud NGFW resources?

Note that I have already enabled the "Programmatic Access" button in the Cloud NGFW UI.

Re: Programmatic Access for Cloud NGFW

gsekar — Wed, 06 Apr 2022 17:36:54 GMT

Hello hparandekar,

I saw your post and have a few recommendations for you.

Programmatic Access: This feature is to provide capability for customers to access the backend API's directly, so that they can create FW resource and rulestacks

Flow

Customer Enables Programmatic Access from UI
Customer adds Principle Tags to IAM roles in their account
1. Under TAG add:
  1. Key=NGFWaasRole, Value=CloudFirewallAdmin
  2. Key=NGFWaasRole, Value=CloudRulestackAdmin
2. Under Trusted Relationship add IAM user
IAM User in customer account can now call sts_client.asume_role(RoleArn="arn:value") → produces a set of keys
These keys can now be used to call API below to get a JWT Token: (keep in mind you must generate a Signature V4 Header to authenticate to this API, see https://docs.aws.amazon.com/general/latest/gr/sigv4-signed-request-examples.html)
1. GET:/v1/mgmt/tokens/cloudfirewalladmin
2. GET:/v1/mgmt/tokens/cloudrulestackadmin
Step 4 produces a token-id, this token-id is now good to use on Firewall CRUD API's or Rulestack API's listed below. Must use "Authorization" : "token-id" in header.

If you want more clarification on programmatic access please go through the below link.

https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html

Yes you can use AWS Cloudformation Templates to create and manage Cloud NGFW resources.

You can create a template that describes all the AWS resources that you want (like Amazon EC2 instances or Amazon RDS DB instances), and CloudFormation takes care of provisioning and configuring those resources for you. You don't need to individually create and configure AWS resources and figure out what's dependent on what; CloudFormation handles that.

Thanks and Regards,

Gopinath Sekar

Palo Alto Networks Technical Support Engineer

topic Programmatic Access for Cloud NGFW in Cloud NGFW for AWS Discussions

Programmatic Access for Cloud NGFW

Re: Programmatic Access for Cloud NGFW