The firewall engine and the IPS engine

Firewall engine – An access-control engine that inspects traffic at connection-state hooks as a connection progresses through the protocol stack. One way to think about the firewall engine is that it models the state machine of each protocol: a connection moves from one protocol state to the next (for example, through the states of a TLS handshake), and the engine evaluates your rules at each state. The firewall engine is drop by default, so an explicit accept is required to advance from one state to the next; traffic that isn't accepted is handled by the policy's firewall default action. You use the firewall engine to define which traffic is allowed into your network. For information about authoring firewall rules, see Working with firewall rule groups in Amazon Network Firewall.

IPS engine – An intrusion detection and prevention engine that inspects traffic for threats using Suricata compatible rules, in the same way as the stateful rules engine in a Classic Network Firewall policy. The IPS engine is pass by default: traffic that doesn't match a rule is allowed. You use the IPS engine to detect and block known threats in traffic that the firewall engine has already allowed. For information about authoring IPS rules, see Working with IPS rule groups in Amazon Network Firewall.