AWS First Steps
New feature

AWS Network Firewall Now Supports Stateful Rule Hit Counts

AWS Network Firewall introduces hit counts for stateful rules, enabling network administrators to monitor rule activity and improve policy visibility

AWS Network Firewall now includes hit counts for stateful rules, allowing administrators to see how often each rule matches traffic. This feature helps identify active rules, uncover policy gaps, and verify new rule deployments. Hit counts are enabled by default for both custom and managed rule groups, with metrics updating every five minutes. The capability is provided at no extra charge, though standard logging costs apply. It is available in all supported AWS regions except the Middle East (UAE) and Middle East (Bahrain) regions

Why it matters

This update targets network administrators and security engineers, helping them monitor firewall policy effectiveness and identify issues

Read the original AWS announcement

Related articles and terms

AWS Network FirewallA managed firewall service for fine-grained control of VPC network trafficCentralized Security Rules with AWS Firewall Manager - Deploying WAF and Security Groups Across Your OrganizationLearn how to centrally manage WAF rules, Security Groups, and Network Firewall policies across your entire organization, with automatic enforcement on new accounts to maintain a consistent security baseline.VPC Traffic Control with AWS Network Firewall - Stateful Rules and Domain FilteringControl VPC traffic with stateful/stateless rules and domain filtering. Learn how to leverage Suricata-compatible rules and managed rule groups.AWS Firewall ManagerA security management service that centrally applies and manages WAF, Shield Advanced, Security Group, and Network Firewall rules across multiple accounts and resources under OrganizationsAWS WAFA firewall service that protects web applications from malicious traffic