AWS Network Firewall

AWS Network Firewall is a stateful, managed network security service designed to provide advanced Layer 3 through Layer 7 traffic inspection and perimeter protection for Amazon Virtual Private Clouds (VPCs). Built natively into AWS infrastructure, the service automatically scales inspection capacity with traffic volume, eliminating the operational overhead of provisioning, clustering, and patching third-party virtual firewall appliances while maintaining high availability across multiple Availability Zones.

The service incorporates a flexible, open-source Suricata-compatible rule engine that supports stateful packet inspection, deep packet inspection (DPI), application protocol detection, intrusion detection and prevention (IDS/IPS), and outbound domain filtering. Organizations can enforce granular egress controls to restrict outbound HTTP/HTTPS traffic to approved domain lists, inspect bidirectional network flows for known exploit signatures, and prevent unauthorized data exfiltration. Furthermore, AWS Network Firewall supports TLS inspection, decrypting inbound and outbound encrypted sessions to detect hidden threats before re-encrypting traffic seamlessly. Firewall endpoints deploy directly within dedicated subnets across Amazon VPC topologies, integrating seamlessly with AWS Transit Gateway to establish centralized inspection architectures across entire multi-VPC organizations.

Core enterprise use cases include VPC perimeter defense, egress internet filtering, lateral movement inspection between VPCs, compliance auditing for PCI DSS and HIPAA, and network intrusion prevention. By combining stateful inspection with native cloud scalability, AWS Network Firewall delivers comprehensive network defense across enterprise cloud footprints.