AWS Network Firewall Specialized2020年〜
A managed firewall service for fine-grained control of VPC network traffic
What It Does
AWS Network Firewall is a fully managed firewall service that inspects and filters network traffic within VPCs. It provides stateful and stateless packet filtering, intrusion detection and prevention (IDS/IPS), and web filtering. It features a Suricata-compatible rule engine, making it possible to migrate existing on-premises firewall rules. It automatically scales with traffic volume, eliminating capacity planning.
Use Cases
Used for inter-VPC traffic control, filtering outbound internet traffic, blocking access to known malicious domains, network auditing for compliance requirements, detecting and blocking malware communications, and centralized network security management in multi-account environments.
Everyday Analogy
Think of it like a building security guard. If security groups are door locks for each room (port-level control), Network Firewall is the guard at the building entrance. They check visitors' IDs (packet contents), detect suspicious individuals (malicious traffic), and block them. The number of guards automatically adjusts based on building traffic.
What Is Network Firewall?
AWS Network Firewall is a service that inspects and controls network traffic at the VPC level. While security groups and NACLs (Network ACLs) provide basic filtering based on IP addresses and port numbers, Network Firewall can perform deep packet inspection (DPI) that examines packet contents (payload). This enables detection of application-layer threats and protocol anomalies. Integration with AWS Firewall Manager lets you centrally manage firewall policies across multiple accounts and VPCs.
Rule Engine and Inspection Features
Network Firewall's rule engine operates in a two-tier structure of stateless and stateful rules. Stateless rules perform fast filtering based on 5-tuples (source IP, destination IP, source port, destination port, protocol). Stateful rules support Suricata-compatible IPS rule formats, enabling domain filtering based on TLS SNI (Server Name Indication), HTTP header inspection, and protocol anomaly detection. AWS-provided managed rule groups let you easily apply rules based on the latest threat intelligence. To organize the concepts and techniques of the rule engine and inspection features, related books (Amazon) are handy.
Deployment Architecture
Network Firewall is deployed as an endpoint in a dedicated firewall subnet. You configure VPC route tables to route traffic to be inspected through the firewall endpoint. Combined with Transit Gateway, you can centrally inspect traffic from multiple VPCs in a hub-and-spoke architecture. Firewall logs can be output to S3, CloudWatch Logs, and Kinesis Data Firehose for security auditing and incident investigation.
Things to Watch Out For
- If security groups and NACLs are sufficient, there's no need to add Network Firewall. Consider it when deep packet inspection or IDS/IPS is required
- Firewall endpoints are created per AZ, so be aware that costs scale with the number of endpoints in multi-AZ configurations
