AWS Network Firewall
Network firewall for VPCs
A managed stateful firewall placed in your VPC that filters traffic into, out of, and between VPCs using 5-tuple rules, domain filtering, and Suricata-compatible IPS rules.
- Cost$$$ High
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsSAA · SOA
Think of it asLike a checkpoint at the gate of an industrial park that inspects every vehicle coming in and out.
When to use it
✓ Use it when
You need deeper network traffic filtering than security groups/NACLs, such as IDS/IPS or outbound domain filtering.
✗ Avoid it when
Protecting web apps from SQLi/XSS → WAF; basic port-based filtering → security group.
Common uses
- Block EC2 from reaching disallowed domains
- IPS inspection of inter-VPC traffic via Transit Gateway
- Centralized egress control
What does it cost?
- Pricing model: Charged per hour for each firewall endpoint per AZ, plus per GB of traffic processed.
⚠️ Cost traps
Endpoints across many AZs and many VPCs add up to a sizable fixed cost.
Related services
SAA-C03 study guide
Network Firewall is covered in these study modules: