TL;DR:
Managing AWS Network Firewall via Terraform often leads to a tug-of-war when external automation (like a Lambda) needs to update dynamic rules (e.g., FQDNs for ephemeral tenants).

In this post, I'll share an architecture that solves this by:



Decoupling Ownership: Splitting rule groups into "Self-Managed" (Terraform-owned) and...