Creating Groups for Distributed Cloud Firewall

SmartGroups

A Distributed Cloud Firewall (DCF) SmartGroup contains one or more filters to identify cloud endpoints that map to an app domain. A filter specifies resource matching criteria. Matching criteria could be a cloud tag; a resource attribute (such as account name or region); a list of IP prefixes; or a Site2Cloud external connection. All conditions within the filter must be satisfied to be matched. A tag or resource attribute-based filter must be associated with a resource type (VPC/VNet, subnet, or VM).

CoPilot UI
Terraform

For the steps to create SmartGroups in the CoPilot UI, see Creating SmartGroups .

Define a SmartGroup with the aviatrix_smart_group resource. Each match_expressions block is a filter; add more than one block to match on multiple criteria such as account name, region, tags, or a CIDR range.

Add the SmartGroup resource

Add the following aviatrix_smart_group resource block to your Terraform configuration file:

resource "aviatrix_smart_group" "protected_vpcs" {
  name = "protected-vpcs"

  selector {
    match_expressions {
      type         = "vpc"
      account_name = "prod-account"
      region       = "us-east-1"
      tags = {
        env = "production"
      }
    }

    match_expressions {
      cidr = "10.0.0.0/16"
    }
  }
}

Verify and Apply the Configuration

Run terraform plan, review the planned changes, and run terraform apply.

WebGroups

A DCF WebGroup contains one or more domain names or URLs that assists in filtering (and providing security to) Internet-bound traffic.

CoPilot UI
Terraform

For the steps to create WebGroups in the CoPilot UI, see Creating WebGroups .

Define a WebGroup with the aviatrix_web_group resource. Use snifilter to match on a domain name, or urlfilter to match on a specific URL path. A match_expressions block cannot combine both filters.

Add the WebGroup resource

Add the following aviatrix_web_group resource block to your Terraform configuration file:

resource "aviatrix_web_group" "trusted_domains" {
  name = "trusted-domains"

  selector {
    match_expressions {
      snifilter = "aviatrix.com"
    }
  }
}

Verify and Apply the Configuration

Run terraform plan, review the planned changes, and run terraform apply.

ExternalGroups

An ExternalGroup can contain countries, threat feeds, and SaaS-based services (Azure and GitHub).

CoPilot UI
Terraform

For the steps to create ExternalGroups in the CoPilot UI, see Managing the Relationship Between Feeds and ExternalGroups .

ExternalGroups use the same aviatrix_smart_group resource as SmartGroups, with an external match expression instead of a cloud-resource filter. Set external to geo, threatiq, azureips, or githubips, and use ext_args for feed-specific arguments.

Add the ExternalGroup resource

Add the following aviatrix_smart_group resource block to your Terraform configuration file:

resource "aviatrix_smart_group" "blocked_countries" {
  name = "blocked-countries"

  selector {
    match_expressions {
      external = "geo"
      ext_args = {
        country_iso_code = "US"
      }
    }
  }
}

Verify and Apply the Configuration

Run terraform plan, review the planned changes, and run terraform apply.

Concepts & Architecture

Guides

Reference

Creating Groups for Distributed Cloud Firewall

SmartGroups

WebGroups

ExternalGroups

​SmartGroups

​WebGroups

​ExternalGroups

​Related Resources

SmartGroups

WebGroups

ExternalGroups

Related Resources