Controlling Traffic with AWS Network Firewall and Firewall Manager

Two services with different jobs

AWS Network Firewall and AWS Firewall Manager are often mentioned together, but they do different things:

• AWS Network Firewall is a managed, stateful network firewall and intrusion detection and prevention service for Amazon VPC. It inspects packets as they flow between your subnets and the internet, other VPCs, VPN or AWS Direct Connect.
• AWS Firewall Manager is a central policy service. It does not inspect traffic itself. It deploys and audits protections, including Network Firewall, across the accounts in an AWS Organizations organization.

Neither runs as an agent on your servers. Network Firewall sits in the network path, and Firewall Manager works through the APIs of the services it manages.

How AWS Network Firewall works

Network Firewall is built from four resources, described in What is AWS Network Firewall?:

• Firewall: the resource that ties everything to a VPC. It defines a subnet in each Availability Zone where Network Firewall places a firewall endpoint.
• Firewall policy: the rules and default actions the firewall applies. One policy can be shared by several firewalls.
• Rule groups: reusable sets of rules, either stateless or stateful.
• VPC endpoint associations: optional extra firewall endpoints in the same VPC or in other VPCs, using the same firewall’s logic.

Firewall subnets and routing

Creating a firewall does not, by itself, filter anything. You place firewall endpoints in dedicated firewall subnets and then change your VPC route tables so traffic goes through those endpoints, for example from your application subnets to the endpoint, and from the endpoint to the internet gateway or NAT gateway. AWS advises using firewall subnets only for Network Firewall, because an endpoint cannot filter traffic for the subnet it sits in.

Keep routing symmetric and per Availability Zone: send each zone’s traffic to the endpoint in that zone. Using an endpoint in another zone adds cross-zone data charges and makes the design depend on that zone.

For multi-VPC designs, there are two common patterns:

• Distributed: a firewall in each VPC that needs inspection.
• Centralized: traffic from many VPCs passes through one firewall. Since 2025, a firewall can attach directly to AWS Transit Gateway, with endpoints in an AWS-managed VPC, so you no longer have to build a separate inspection VPC. You still point Transit Gateway route tables at the firewall attachment.

Stateless and stateful rules

Each packet first meets the stateless engine, which looks at one packet at a time on 5-tuple values (source, destination, ports and protocol). Its actions are pass, drop, or forward to the stateful engine. In most designs the stateless default action is to forward everything to the stateful engine and do the real work there.

The stateful engine inspects traffic in the context of its flow. It uses the open source Suricata engine and accepts Suricata-compatible rules, as well as simpler domain list rules and 5-tuple rules. That lets you filter by protocol regardless of port, match on the TLS Server Name Indication or HTTP host, and run intrusion prevention signatures. A domain allow list for outbound HTTPS might start like this:

pass tls $HOME_NET any -> $EXTERNAL_NET 443 (tls.sni; content:".amazonaws.com"; endswith; nocase; flow:to_server, established; msg:"Allow AWS service endpoints"; sid:1000001; rev:1;)

For stateful rules, AWS recommends strict rule order, where rule groups and rules are evaluated in the order you set. Pair pass rules like the one above with a default action such as Drop established, so that anything not explicitly allowed is blocked while connection handshakes can still complete.

You do not have to write every rule yourself. AWS provides managed rule groups in three families (active threat defense, domain and IP, and threat signature) that you can add to a policy. Network Firewall can also decrypt and inspect TLS traffic if you set up a TLS inspection configuration with your own certificates.

Logging

The stateful engine can send three log types, per Logging network traffic:

• Flow logs for each flow the stateful engine processes.
• Alert logs for traffic that matches a rule with a drop, alert or reject action.
• TLS logs for TLS inspection events, if you use TLS inspection.

You can send each log type to Amazon S3, Amazon CloudWatch Logs or Amazon Data Firehose. Logging is only available for traffic that reaches the stateful engine, which is another reason to forward traffic there. Start a new policy with alert rules, check the alert logs, and switch rules to drop once you are sure they will not block legitimate traffic.

How AWS Firewall Manager works

Firewall Manager solves a different problem: keeping protections consistent when you have tens or hundreds of accounts. Before using it, AWS lists these prerequisites:

• The accounts must be in an AWS Organizations organization.
• You designate a Firewall Manager administrator account.
• AWS Config must be enabled in each account and Region you want to protect, because Firewall Manager uses it to find resources.
• For Network Firewall and DNS Firewall policies, resource sharing with AWS RAM must be enabled.

Policy types

According to Using AWS Firewall Manager policies, Firewall Manager supports these policy types:

• AWS WAF (and AWS WAF Classic) policies, which apply web ACLs with rule groups that run first and last, while account owners can add their own rules in between.
• AWS Shield Advanced policies.
• Amazon VPC security group policies, to apply baseline groups and audit rules across accounts.
• Amazon VPC network ACL policies.
• AWS Network Firewall policies.
• Amazon Route 53 Resolver DNS Firewall policies.
• Third-party firewall policies for Palo Alto Networks Cloud NGFW and Fortigate CNF, subscribed through AWS Marketplace.

Each policy has a scope: which accounts, organizational units, resource types and tags it covers. When a new account joins the organization, Firewall Manager applies in-scope policies to it automatically. For each policy you choose whether Firewall Manager only reports noncompliant resources or also remediates them.

Using the two together

A Firewall Manager Network Firewall policy lets you define the firewall policy once and have Firewall Manager create firewalls and endpoints in the VPCs in scope. A common split is to keep organization-wide rule groups, such as managed threat signatures and blocked domains, in the central policy, while application teams manage their own allow lists. Firewall Manager’s compliance view then shows any VPC in scope that is missing protection.

Where to start

• Map your traffic flows first: internet egress, ingress, VPC to VPC and on-premises.
• Choose distributed or centralized inspection, and check the routing for every Availability Zone.
• Start with alert rules and logging, then move to drop.
• If you run more than a handful of accounts, set up Firewall Manager early so new accounts are protected from day one.

9Acts is an AWS Advanced Tier Services Partner with the AWS Level 1 MSSP Competency. If you want help designing network inspection across your accounts, see our security and compliance services.