Discovery of Cloud NGFW for AWS on Strata Cloud Manager
Use Strata Cloud Manager to automatically detect and visualize Cloud NGFW for AWS
resources and their network topology.
| Where Can I Use This? | What Do I Need? |
|---|
- Cloud NGFW for AWS (Managed by Strata Cloud Manager)
|
- AWS cloud accounts onboarded onto Strata Cloud Manager with
discovery enabled
- Cross-account IAM permissions granted for AWS visibility
|
The discovery service on Strata Cloud Manager provides a unified, topological view of
your cloud infrastructure, mapping network dependencies and traffic flows. For existing
deployments of Cloud NGFW for AWS resources—whether deployed manually or via
Terraform—Strata Cloud Manager automatically detects these resources and visualizes
their protection status.
After you onboard your Cloud NGFW for AWS account, Strata Cloud Manager orchestrates
the following backend services to populate your dashboard:
- Asset inventory: Strata Cloud Manager scans your AWS account to collect VPC
endpoints, subnets, Elastic Network Interfaces (ENIs), and Transit Gateways
(TGWs).
- Service name retrieval: Strata Cloud Manager retrieves the specific service
names associated with your AWS account ID and region.
- Mapping and tagging: Strata Cloud Manager matches discovered VPC endpoints
to the retrieved Cloud NGFW service names, automatically flags subnets containing
matched endpoints as Security Subnets, and verifies whether compute resources (such
as EC2 or Lambda) are present in those subnets. If a subnet is empty of compute
resources, the VPC is marked as a Security VPC.
Prerequisites
Before Cloud NGFW for AWS resources appear in the Strata Cloud Manager discovery
view, ensure the following requirements are met:
- Account onboarding: Onboard your AWS cloud accounts to Strata Cloud
Manager with the discovery feature enabled. In Strata Cloud Manager, go to
Cloud Account Onboarding and select
AWS. For more information, see Deploy Cloud NGFW from
Strata Cloud Manager. For more information, see Onboard Cloud NGFW from Strata Cloud
Manager.
- Cross-account IAM permissions: Grant the required cross-account IAM
permissions to enable visibility. Discovery requires read-only access for
monitoring cloud assets, fully orchestrated Security VPCs and Transit Gateways
to identify VPC relationships, and automated traffic redirection permissions if
you want Strata Cloud Manager to manage routing to your existing firewalls. For
more information, see cross-account access using AWS IAM roles. For more
information, see cross-account access using AWS IAM
roles.
Discover Cloud NGFW for AWS Resources
Strata Cloud Manager surfaces discovered Cloud NGFW for AWS resources through the
following interactive views.
Application-centric view
Select .
The application-centric view places applications at the center of the traffic flow
and visualizes traffic paths to users, models, plugins and datasets, and the
internet.
Traffic flow status labels each path as Protected, Partially
Protected, or Unprotected based on whether traffic is routed through
a Cloud NGFW.
Cloud Asset Map (infrastructure-centric view)
The Cloud Asset Map displays a regional map showing connectivity between Application
VPCs, Transit Gateways, and firewall clusters. Click a specific VPC to see a
detailed breakdown of Availability Zones (AZs), subnets, and individual firewall
endpoints.
Firewall Cluster panel
The Firewall Cluster panel provides the following metrics for each discovered
resource:
- Health metrics: Shows the status of your existing firewall instances
(Healthy or Unhealthy). In AWS, a firewall cluster is considered healthy only
if it has instances in every AZ where application traffic is being protected,
as Cloud NGFW for AWS does not support cross-zone load balancing.
- Throughput data: Displays real-time inbound and outbound traffic metrics
in GBs.
Important Considerations
- Network changes in AWS can take up to 10 minutes to reflect in the Strata
Cloud Manager discovery view due to the polling interval.
- When you add an application in a new AZ to an existing firewall, the new
firewall instances can take 20–30 minutes to become fully operational.
- If you initially granted read-only access, Strata Cloud Manager may prompt for
additional permissions if you later enable automated traffic redirection or CIDR
management.
- A VPC that contains compute resources (such as EC2 or EKS) within its security
subnets does not qualify as a Security VPC.
