What is Amazon Network Firewall?
Amazon Network Firewall is a stateful, managed, network firewall and intrusion detection and prevention service for your virtual private cloud (VPC) that you create in Amazon Virtual Private Cloud (Amazon VPC).
With Network Firewall, you can filter traffic at the perimeter of your VPC. This includes filtering traffic going to and coming from an internet gateway, NAT gateway, or over VPN or Amazon Direct Connect. Network Firewall uses the open source intrusion prevention system (IPS), Suricata, for stateful inspection. Network Firewall supports Suricata compatible rules. For more information, see Working with stateful rule groups in Amazon Network Firewall.
You can use Network Firewall to monitor and protect your Amazon VPC traffic in a number of ways, including the following:
-
Pass traffic through only from known Amazon service domains or IP address endpoints, such as Amazon S3.
-
Use custom lists of known bad domains to limit the types of domain names that your applications can access.
-
Perform deep packet inspection on traffic entering or leaving your VPC.
-
Use stateful protocol detection to filter protocols like HTTPS, independent of the port used.
To enable Network Firewall for your VPC, you perform steps in both Amazon VPC and in Network Firewall. For information about managing your Amazon Virtual Private Cloud VPC, see the Amazon Virtual Private Cloud User Guide. For more information about how Network Firewall works, see How Amazon Network Firewall works.
Network Firewall is supported by Amazon Firewall Manager. You can use Firewall Manager to centrally configure and manage your firewalls across your accounts and applications in Amazon Organizations. You can manage firewalls for multiple accounts using a single account in Firewall Manager. For more information, see Amazon Firewall Manager in the Amazon WAF, Amazon Firewall Manager, and Amazon Shield Advanced Developer Guide.
Topics
Amazon Network Firewall Amazon resources
Network Firewall manages the following Amazon resource types:
-
Firewall – Provides traffic filtering logic for the subnets in a VPC.
-
FirewallPolicy – Defines rules and other settings for a firewall to use to filter incoming and outgoing traffic in a VPC.
-
RuleGroup – Defines a set of rules to match against VPC traffic, and the actions to take when Network Firewall finds a match. Network Firewall uses stateless and stateful rule group types, each with its own Amazon Resource Name (ARN).
Amazon Network Firewall concepts
Amazon Network Firewall is a firewall service for Amazon Virtual Private Cloud (Amazon VPC). For information about managing your Amazon Virtual Private Cloud VPC, see the Amazon Virtual Private Cloud User Guide.
The following are the key concepts for Network Firewall:
-
Virtual private cloud (VPC) – A virtual network dedicated to your Amazon Web Services account.
-
Internet gateway – A gateway that you attach to your VPC to enable communication between resources in your VPC and the internet.
-
Subnet – A range of IP addresses in your VPC. Network Firewall creates firewall endpoints in subnets inside your VPC, to filter network traffic. In a VPC architecture that uses Network Firewall, the firewall endpoints sit between your protected subnets and locations outside your VPC.
-
Firewall subnet – A subnet that you've designated for exclusive use by Network Firewall for a firewall endpoint. A firewall endpoint can't filter traffic coming into or going out of the subnet in which it resides, so don't use your firewall subnets for anything other than Network Firewall.
-
Route table – A set of rules, called routes, that are used to determine where network traffic is directed. You modify your VPC route tables in Amazon VPC to direct traffic through your firewalls for filtering.
-
Network Firewall firewall – An Amazon resource that provides traffic filtering logic for the subnets in a VPC.
-
Network Firewall firewall policy – An Amazon resource that defines rules and other settings for a firewall to use to filter incoming and outgoing traffic in a VPC.
-
Network Firewall rule group – An Amazon resource that defines a set of rules to match against VPC traffic, and the actions to take when Network Firewall finds a match.
-
Stateless rules – Criteria for inspecting a single network traffic packet, without the context of the other packets in the traffic flow, the direction of flow, or any other information that's not provided by the packet itself.
-
Stateful rules – Criteria for inspecting network traffic packets in the context of their traffic flow.
Accessing Amazon Network Firewall
You can create, access, and manage your firewall, firewall policy, and rule group resources in Network Firewall using any of the following methods:
-
Amazon Web Services Management Console – Provides a web interface for managing the service. The procedures throughout this guide explain how to use the Amazon Web Services Management Console to perform tasks for Network Firewall. You can access the Amazon Web Services Management Console at http://www.amazonaws.cn/console
. To access Network Firewall using the console: https://<region>.console.aws.amazon.com/network-firewall/home -
Amazon Command Line Interface (Amazon CLI) – Provides commands for a broad set of Amazon services, including Network Firewall. The CLI is supported on Windows, macOS, and Linux. For more information, see the Amazon Command Line Interface User Guide. To access Network Firewall using the CLI endpoint:
aws network-firewall -
Amazon Network Firewall API – Provides a RESTful API. The REST API requires you to handle connection details, such as calculating signatures, handling request retries, and handling errors. For more information, see Amazon APIs and the Amazon Network Firewall API Reference. To access Network Firewall, use the following REST API endpoint:
https://network-firewall.<region>.amazonaws.com -
Amazon SDKs – Provide language-specific APIs. If you're using a programming language that Amazon provides an SDK for, you can use the SDK to access Amazon Network Firewall. The SDKs handle many of the connection details, such as calculating signatures, handling request retries, and handling errors. They integrate easily with your development environment, and provide easy access to Network Firewall commands. For more information, see Tools for Amazon Web Services
. -
Amazon CloudFormation – Helps you model and set up your Amazon Web Services resources so that you can spend less time managing those resources and more time focusing on your applications that run in Amazon. You create a template that describes all the Amazon resources that you want and Amazon CloudFormation takes care of provisioning and configuring those resources for you. For more information, see Network Firewall resource type reference in the Amazon CloudFormation User Guide.
-
Amazon Tools for Windows PowerShell – Let developers and administrators manage their Amazon services and resources in the PowerShell scripting environment. For more information, see the Amazon Tools for Windows PowerShell User Guide.
Regions and endpoints for Amazon Network Firewall
To reduce data latency in your applications, Amazon Network Firewall offers a regional endpoint to make your requests:
https://network-firewall.<region>.amazonaws.com
To view the complete list of Amazon Web Services Regions where Network Firewall is available, see Service endpoints and quotas in the Amazon General Reference.
Pricing for Amazon Network Firewall
For detailed information about pricing for Network Firewall, see Amazon Network Firewall pricing
Some configurations can incur additional costs, on top of the basic costs for using Network Firewall. For example, if you use a firewall endpoint in one Availability Zone to filter traffic from another zone, you can incur cross-zone traffic charges. If you enable logging, you incur additional charges according to factors such as the logging destination that you use and the amount of traffic that you choose to log.
Amazon Network Firewall quotas
Amazon Network Firewall defines maximum settings and other quotas on the number of Network Firewall resources that you can use. You can request an increase for some of these quotas. For more information, see Amazon Network Firewall quotas.
Amazon Network Firewall additional resources
To get a hands-on introduction to Amazon Network Firewall, complete Getting started with Amazon Network Firewall.
Use the following resources to get additional information and guidance for using Amazon Network Firewall.
-
Amazon discussion forums
– A community-based forum for discussing technical questions related to this and other Amazon services. -
Getting started resource center
– Information to help you get started building on Amazon. -
Amazon Web Services Support center
– The home page for Amazon Web Services Support. -
Contact Us
– A central contact point for inquiries concerning billing, accounts, and events.