AWS Network Firewall

AWS Network Firewall is a managed, network-level firewall service that provides stateful and stateless traffic filtering for Amazon VPCs. It operates by deploying firewall endpoints inside a VPC and enforcing rule groups on traffic routed to those endpoints. It normally fits in architectures as a VPC- or Transit Gateway-integrated inspection and enforcement point for east-west and north-south traffic.

🗂 Resource Category

Security, Identity, and Compliance • Networking and Content Delivery

🧠 Exam Memory Hook

Think: "VPC traffic inspection with stateful and stateless rule sets for centralised filtering = AWS Network Firewall"

📖 Ownership

Classification: AWS Managed Service

AWS responsibilities: AWS operates and manages the underlying service platform, control plane, and the physical infrastructure that hosts firewall endpoints. AWS is responsible for patching and maintaining the underlying hardware, network fabric, and the managed runtime that implements the firewall service. AWS provides APIs, console, and integration points for configuring firewall policies and exporting logs.

Customer responsibilities: The customer configures firewall policies, rule groups (managed and custom), routing to firewall endpoints, logging destinations, and access control via IAM. The customer secures and maintains the content of rules, monitors logs and metrics, handles policy lifecycle (create/update/delete), and integrates remediation workflows or automation where required. The customer is also responsible for network design (route tables or Transit Gateway attachments) that directs traffic through the firewall endpoints.

Patching responsibilities: AWS patches and maintains the physical infrastructure and the managed service platform including the firewall control plane and managed runtime. There is no customer guest operating system to patch for the managed firewall endpoints; customers must patch any EC2 instances or other compute resources they operate. Customers are responsible for patching application code, libraries, and any software they deploy into their accounts.

🏗 Typical Architecture

💡 Top 5 Features

Stateful rule engine that tracks connections and enforces stateful policies.
Stateless rule engine for high-performance packet filtering and forwarding decisions.
Support for managed rule groups and custom rule groups to combine vendor and customer rules.
Suricata-compatible rules and signature-based detection for intrusion detection/prevention style use cases.
Flexible logging options to Amazon CloudWatch Logs, Amazon S3, and Amazon Kinesis Data Firehose.

✅ Top 5 Use Cases

Centralised egress filtering for VPCs routed through a Transit Gateway to enforce outbound access policies.
East-west VPC traffic inspection to apply segmentation and detect/block malicious lateral movement between application tiers.
Applying managed threat rule groups to provide network-level threat detections alongside custom business rules.
Using AWS Firewall Manager with Network Firewall to enforce consistent firewall policies across multiple accounts and VPCs.
Protecting internet-facing application VPCs by routing inbound traffic through firewall endpoints for pre-application inspection.

🏗 Architecture Placement

AWS Network Firewall is deployed at the VPC level (firewall endpoints live in designated subnets) and is typically invoked by route table or Transit Gateway routing that sends traffic to those endpoints. It receives routed network traffic for inspection and then forwards allowed traffic to destination VPCs or attachments. Placement is regional and scoped to the VPCs and Transit Gateway attachments that are configured to send traffic to the firewall.

🎯 Commonly Used With

- Amazon VPC
- AWS Transit Gateway
- AWS Firewall Manager
- Amazon CloudWatch
- AWS Identity and Access Management

🌍 5 Real-World Examples

A bank routes all egress traffic from account VPCs through AWS Network Firewall to enforce approved destination lists and record logs for compliance.
A healthcare provider uses Network Firewall to segment and inspect traffic between application tiers to reduce risk to protected health data.
A retail company deploys managed threat rule groups with Network Firewall in front of its application VPCs to block known malicious network activity before it reaches web servers.
A telecommunications operator centralises perimeter inspection by routing customer-facing traffic through firewall endpoints attached to a Transit Gateway.
A government agency uses Network Firewall with Firewall Manager to apply and audit consistent network protection policies across multiple AWS accounts.

🎓 AWS Exam Clues

Used when you need VPC-level, network-layer filtering with both stateful and stateless rule capability.
Choose Network Firewall when centralised inspection via Transit Gateway or route tables is required across multiple VPCs.
Not a host-based firewall: use Network Firewall for network-path inspection rather than per-instance host firewalling.
Integrates with AWS Firewall Manager for organisation-wide policy enforcement and with CloudWatch/Firehose for log export.
Consider routing, endpoint placement, and logging costs when designing production deployments.

📝 Quick Revision

AWS Network Firewall provides managed, VPC-level stateful and stateless traffic inspection using rule groups and signature rules. Use it for centralised east-west or north-south inspection; plan routing, endpoint placement, logging, and policy management for production use.

🏷 Keywords

stateful inspection • stateless rules • managed rule groups • custom rule groups • Suricata rules • firewall endpoint • VPC route tables • Transit Gateway inspection • AWS Firewall Manager • CloudWatch Logs • Kinesis Data Firehose • Amazon S3 logging