AWS Network Firewall
- What it is
- Managed, stateful network firewall and intrusion prevention system (IPS) for a VPC.
- Inspects all traffic in and out of a VPC — not just web traffic.
- Capabilities
- Stateful rules, Suricata-compatible IPS signatures, domain-name filtering, protocol detection.
- Scales automatically with traffic; deployed per-AZ in a dedicated firewall subnet.
- Not to be confused with
- security groups / network ACLs — free, basic allow/deny on IP and port. No deep packet inspection, no IPS signatures.
- AWS WAF — HTTP layer only, attached to CloudFront/ALB/API Gateway.
- AWS Firewall Manager — the policy manager that deploys Network Firewall, WAF, and Shield rules across many accounts.