AWS Network Firewall
Network SecurityAWS Network Firewall is a managed firewall service that provides network traffic filtering for VPCs. It sits in its own subnet and inspects traffic passing through it.
Capabilities
- Stateful Inspection: track connection state for TCP, UDP, ICMP
- Domain Filtering: allow or deny outbound traffic based on domain names (e.g., allow
*.amazonaws.comonly) - Intrusion Prevention (IPS): Suricata-compatible rules for deep packet inspection
- TLS Inspection: decrypt and inspect HTTPS traffic (requires certificate)
- Managed Rule Groups: AWS-curated threat intelligence rules
Architecture Patterns
- Centralized Inspection: deploy in a dedicated inspection VPC with Transit Gateway routing all traffic through it
- Per-VPC Deployment: deploy firewall endpoints in each VPC for isolated inspection
- East-West Traffic: inspect traffic between VPCs (lateral movement prevention)
Related AWS Services
Related Terms
A firewall that filters HTTP/HTTPS traffic to web applications, blocking common attacks like SQL injection, XSS, and bot traffic using customizable rules.
Dividing a network into isolated segments (subnets, VPCs) to limit lateral movement and contain the blast radius of a security breach.
A network hub that connects VPCs, VPN connections, and Direct Connect gateways through a central point, simplifying network architecture at scale.
A Distributed Denial of Service attack that overwhelms a target with traffic from multiple sources, making it unavailable to legitimate users.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.