Flash card
AWS Network Firewall: managed stateful and stateless inspection at VPC subnet boundaries.
- Deploys firewall endpoints into dedicated subnets, with VPC route tables sending traffic through them, so the routing is part of the design.
- Runs both stateless rule groups and stateful ones, the latter accepting Suricata-compatible rules.
- Supports domain-name filtering, which is the usual answer for allowing egress only to an approved list of destinations.
- Inspects all IP traffic, not just HTTP, so it reaches protocols WAF never sees.
- Centralisable behind a Transit Gateway so many VPCs are inspected by one firewall rather than one each.
Pick it when
Pick it when the requirement is filtering or inspecting traffic across a VPC, and especially when egress must be restricted to named domains. Pick it over WAF when the traffic is not HTTP or the boundary is the network rather than an application front door.
It's the wrong answer when
It is the wrong answer for HTTP exploit protection on a public application, which is WAF, and for simple instance-to-instance rules that a security group already expresses. Deploying it to control which tier reaches which is a lot of machinery for something a security group reference does for free.