AWS Network Firewall and Firewal Manager

AWS provides different services to strengthen network and application layer security. Two of the most important are AWS Network Firewall and AWS Firewall Manager. They complement each other but serve different purposes.​

AWS Network Firewall

A managed network firewall service for your Amazon VPC. It enables fine‑grained control over Layer 3–7 traffic.

Key Features:

• Distributed, Scalable: Deploys automatically across multiple Availability Zones in a VPC for resilience.
• Traffic Filtering Rules:
  • Stateless rules → evaluated individually for each packet.
  • Stateful rules → track connections and apply deep packet inspection.
• Rule Sources:
  • Custom rules (IPs, ports, protocols).
  • Suricata-compatible rules (open‑source threat detection).
  • Intrusion Protection / Detection System (IDS/IPS) functionality.
• Use Cases:
  • Block known malicious IPs/domains.
  • Detect & stop port scanning.
  • Enforce domain filtering via intelligence feeds.
  • Provide east–west (VPC internal) as well as north–south (internet-facing) inspection.

Integration:

• Works at VPC subnet boundaries via VPC routing.
• Integrates with AWS Transit Gateway for centralized architectures.
• Logs can be sent to Amazon S3, CloudWatch Logs, or Kinesis Data Firehose.

AWS Firewall Manager

A security management service that centralizes administration of firewall rules and security policies across all AWS accounts and resources in an AWS Organization.

Key Features:

• Central Policy Management: Define firewall/security rules once, apply across accounts, VPCs, and regions.
• Supported Services:
  • AWS WAF (Web ACLs and rules).
  • AWS Shield Advanced protections.
  • AWS Security Groups (enforce known-good SG rules).
  • AWS Network Firewall policies.
• Compliance Enforcement: Automatically audits for resources that are non‑compliant (e.g., an unprotected CloudFront distribution).
• Simplified Operations:
  • Central dashboard for visibility.
  • Auto-remediation against out‑of‑policy resources.

Use Cases:

• Enforce a global WAF rule set (such as blocking known bad IP ranges) across hundreds of CloudFront distributions.
• Require all VPCs in all AWS accounts to use AWS Network Firewall.
• Automatically protect new applications/accounts with Shield Advanced policies.

How They Work Together

• AWS Network Firewall is the enforcement mechanism inside individual VPCs, stopping malicious or unwanted traffic.
• AWS Firewall Manager is the central governance layer that ensures firewall policies (WAF, Shield Advanced, Network Firewall, SG rules) are consistently applied across your AWS Organization.

Best Practices

• Use AWS Network Firewall in transit VPCs or at subnet boundaries to provide deep packet inspection and IPS functionality.
• Use AWS Firewall Manager to ensure organization-wide consistency, auto‑remediation, and compliance enforcement.
• Forward firewall logs to SIEM platforms or CloudWatch/S3 for continuous monitoring.
• Combine these with AWS WAF (L7) and Shield Advanced for full coverage (L3–L7).