AWS Network Firewall

What it is

AWS Network Firewall is a StatefulKeeping track of earlier requests or connections. A stateful firewall, such as a security group, remembers allowed connections and lets their return traffic back in automatically.Glossary entry, managed network firewall and intrusion detection and prevention (IDS (Intrusion detection system)A system that watches network traffic or servers for signs of attack or misuse and raises alerts. It detects; an intrusion prevention system (IPS) also blocks.Glossary entry/IPS (Intrusion prevention system)A system that inspects traffic for attacks and blocks matching traffic automatically, rather than only raising alerts. AWS Network Firewall can act as an IPS with Suricata-compatible rules.Glossary entry) service for your VPCs. It filters traffic at the perimeter of your VPC: traffic to and from an internet gateway, a NAT gatewayA managed VPC component that lets instances in private subnets start connections to the internet or other networks, while blocking connections started from outside. It is billed per hour and per gigabyte processed.Glossary entry, a VPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entry, or Direct Connect, and between VPCs through a transit gateway. It uses the open-source Suricata engine for stateful inspection and supports Suricata-compatible rules.

Choose Network Firewall when a question asks to inspect and filter VPC traffic beyond what Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry and Network ACLA stateless firewall for a subnet, with numbered allow and deny rules checked in order. Because it is stateless, return traffic needs its own rule, usually for a range of ephemeral ports.Glossary entry can do: domain-name filtering for outbound traffic, intrusion prevention signatures, deep packet inspection, or a central inspection VPC for many VPCs.

Concepts

Firewall and firewall endpoints: a firewall uses a SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry for a firewall endpoint in each AZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entry you protect. Traffic is steered through the firewall endpoints by editing VPC route tables.
Firewall policy: the set of rule groups and default actions that a firewall uses.
StatelessKeeping no memory of earlier requests, so that each one is handled on its own. Any copy of a stateless web server can handle any request, which makes scaling easy; a stateless firewall, such as a network ACL, needs a rule for return traffic too.Glossary entry rule groups: inspect each packet on its own, by 5-tuple (source, destination, ports, protocol), and pass, drop, or forward to the stateful engine.
Stateful rule groups: inspect traffic in the context of its flow:
- Suricata-compatible IPS rules.
- Domain list rules, to allow or deny access to domains such as .example.com, often for egress filtering.
- 5-tuple rules.
Uses include:
- Allow traffic only to known AWS service domains or IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry.
- Block known bad domains.
- Deep packet inspection.
- Detecting protocols such as HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry regardless of port.
Centralized deployment: put the firewall in an inspection VPC attached to AWS Transit Gateway, or use transit gateway-attached firewalls, so traffic between VPCs and to the internet is inspected in one place.
Logging: the stateful engine records flow logs (standard traffic flow logs) and alert logs (traffic that matched rules with an alert action); CloudWatch metrics cover both engines.

Security, resilience, performance, and cost

Security: IPS signatures, domain filtering, and stateful rules give layered defense alongside security groups and network ACLs.
Resilience: deploy firewall endpoints in every Availability Zone you use, and route each zone's traffic to its local endpoint.
Cost: pay for firewall endpoints and per GB of traffic processed.
Management: deploy firewalls and policies across accounts with AWS Firewall Manager.

Network Firewall or another option?

If the requirement is	Choose
Stateful filtering and IPS for all VPC traffic	AWS Network Firewall
Allow outbound HTTPS only to approved domains	Network Firewall domain list rules
Central inspection for many VPCs	Network Firewall in an inspection VPC with Transit Gateway
Instance-level allow rules	Security groups
Subnet-level stateless allow and deny	Network ACLs
Block SQL injectionAn attack that slips SQL code into form fields or parameters so that an application runs it against its database, for example to read or delete data. Parameterized queries prevent it, and AWS WAF can block common patterns.Glossary entry in HTTP (Hypertext Transfer Protocol)The protocol that web browsers and APIs use to send requests, such as GET and POST, and receive responses. On its own it is not encrypted; HTTPS adds TLS.Glossary entry requests	AWS WAF
Block DNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entry queries to malicious domains	Route 53 Resolver DNS Firewall
Insert third-party appliances	Gateway Load Balancer

Reverse mindmap: when the question points here

Is it AWS Network Firewall?

Yes, when the question says
- Stateful firewall for the VPC perimeter leads to Network Firewall
- Intrusion prevention with Suricata rules leads to Network Firewall
- Restrict outbound traffic to allowed domains leads to Domain list rule group
- Deep packet inspection of VPC traffic leads to Network Firewall
- Inspect traffic between many VPCs centrally leads to Inspection VPC with Transit Gateway
Make it work
- Send traffic through the firewall leads to Update route tables to firewall endpoints
- High availability leads to Endpoint in each AZ
- Deploy across accounts leads to Firewall Manager
No, when the question says
- HTTP attacks like XSS leads to WAF
- Allow port 443 to one instance leads to Security group

Key takeaways

Network Firewall is a managed stateful firewall and IPS for VPCs, built on Suricata.
Traffic is routed through firewall endpoints in each Availability Zone by editing route tables.
Stateless rules filter packets; stateful rules support Suricata IPS signatures, domain lists, and 5-tuple rules.
Use an inspection VPC with Transit Gateway for central inspection; manage at scale with Firewall Manager.
Security groups, network ACLs, WAF, and DNS Firewall each cover a different layer.