AWS Network Firewall

AWS Network Protection

To protect a network (VPC) in AWS, we can use:
- Network Access Control Lists (NACLs)
- Security Groups
- AWS WAF
- AWS Shield and Shield Advanced
- AWS Network Firewall
- AWS Firewall Manager to manage all the resources from above

Network Firewall Intro

Used to protect the entire VPC
Offers protection from Layer 3 to Layer 7
Can inspect traffic in any direction:
- VPC to VPC traffic
- Outbound to internet
- Inbound from the internet
- To/from Direct Connect and Site-to-Site VPN
Internally the AWS Network Firewall uses the AWS Gateway Load Balancer
Rules can be centrally managed cross-account by AWS Firewall Manager to apply to many VPCs

Fine Grained Control

Supports thousands of rules at the VPC level
Filtering can be done by:
- IP and port
- Protocol
- Stateful domain list rule groups
- General pattern matching using regex
Traffic filtering: Allow, drop or alert for the traffic that matches one of the rules the we set up
Active flow inspection: protects against network threats with intrusion-prevention capabilities (like Gateway Load Balancer, but all managed by AWS)
All the rule matches can be sent to Amazon S3, CloudWatch Logs or Kinesis Data Firehose