AWS Network Firewall
AWS Network Firewall is a managed service for deploying network protections across Amazon VPCs.
What AWS Network Firewall is
AWS Network Firewall is a managed service for deploying network protections across Amazon VPCs. Its stateful firewall can inspect packets deeply and apply rules based on IP addresses, ports, protocols, and traffic direction. It also supports filtering by HTTP headers, SNI, and domain, plus an explicit forward proxy for managing outbound internet traffic. AWS-managed intrusion prevention signatures and malicious-domain rule groups are included at no additional cost. TLS inspection can analyze encrypted traffic inside a VPC, with an additional hourly charge for Advanced Inspection. The service integrates with Transit Gateway, VPC, IAM, and CloudWatch, and AWS Firewall Manager can centrally manage policies across accounts and VPCs. Logs can go to Amazon S3, Kinesis, or CloudWatch. Capacity scales automatically, and the service supports high availability across Availability Zones. AWS states a 99.99% uptime commitment under its service-level agreement. It is cloud-based and costs include endpoint-hour and per-GB processing charges that vary by region and Availability Zone. AWS says it is not designed to mitigate volumetric denial-of-service attacks.
Good
- Supports deep packet inspection and traffic rules
- Includes AWS-managed intrusion signatures
- Scales capacity automatically across Availability Zones
- Offers centralized policy management through Firewall Manager
Watch out
- Not designed to mitigate volumetric denial-of-service attacks
- Advanced Inspection has an additional hourly charge
- Marketplace managed rules may add seller-set fees
Who it suits
It suits organizations protecting VPC boundaries, filtering inbound or outbound traffic, or inspecting traffic between VPCs. Teams seeking centralized policy management across accounts can use AWS Firewall Manager with the service.
Verdict
AWS Network Firewall combines traffic inspection, filtering, logging, and centralized policy options for VPC environments. Its stated limitation around volumetric denial-of-service attacks is important when evaluating protection needs.
Plans and prices
From AWS Network Firewall's own pricing page, checked 21 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Firewall endpoint | $0.40 a month | Managed firewall endpoint · $0.395 for each hour the firewall endpoint is provisioned in US East (N. Virginia) |
| Traffic processing | $0.07 a month | Network Firewall data processing · $0.065 for 1 GB of data processed in US East (N. Virginia) |
| Pay-as-you-go | — | Advanced inspection and active threat defense may add charges · AWS Marketplace managed rules may cost extra · Hourly per firewall endpoint, plus per-GB traffic processing; rates vary by region and Availability Zone. Pricing examples show $0.395 per endpoint-hour and $0.065 per GB. |
The facts
Each one read from AWS Network Firewall's own pages, with the date it was checked.
What it does
- Availability and scaling
- The service automatically scales capacity and supports high availability across Availability Zones.checked 30 Sep 2026
- AWS integrations
- AWS identifies Transit Gateway, VPC, IAM, and CloudWatch as native service integrations.checked 30 Sep 2026
- Central management and logging
- AWS Firewall Manager can centrally manage policies across accounts and VPCs, while alert and flow logs can be stored in Amazon S3, Kinesis, or CloudWatch.checked 30 Sep 2026
- Encrypted traffic
- TLS inspection can analyze encrypted traffic within the VPC and has an additional hourly charge for Advanced Inspection.checked 30 Sep 2026
- Intended users
- AWS describes use cases including protecting VPC boundaries, filtering inbound and outbound traffic, and inspecting traffic between VPCs.checked 30 Sep 2026
- Notable limitation
- AWS says Network Firewall is not designed to mitigate volumetric denial-of-service attacks.checked 30 Sep 2026
- Partner integrations
- AWS Marketplace partners offer managed rule groups that can be deployed in Network Firewall policies, with additional seller-set fees.checked 30 Sep 2026
- Purpose
- AWS Network Firewall is a managed service for deploying network protections across Amazon VPCs.checked 30 Sep 2026
- Support commitment
- AWS states that Network Firewall has a 99.99% uptime commitment under its service-level agreement.checked 30 Sep 2026
- Threat protection
- AWS-managed intrusion prevention signatures and malicious domain rule groups are included at no additional cost.checked 30 Sep 2026
- Traffic controls
- Its stateful firewall supports deep packet inspection and rules based on IP addresses, ports, protocols, and traffic direction.checked 30 Sep 2026
- Web filtering and proxy
- It supports HTTP header, SNI, and domain filtering, and an explicit forward proxy for controlling outbound internet traffic.checked 30 Sep 2026
Money
- Free plan
- Nochecked 21 Sep 2026
The company
- Maker
- Amazon states that its principal corporate offices are in Seattle, Washington, and that it was incorporated in 1994.checked 30 Sep 2026
Alternatives to AWS Network Firewall
- 1
Barracuda Secure SD-WAN
APILinuxmacOSSelf-hosted6.6 - 2
Google Cloud Secret Manager
Free planWeb6.5From $0.02 a month - 3
Cisco Catalyst Center
WebAPILinuxmacOS6.2 - 4
FortiGate
Self-hosted6.1 - 5
Forcepoint Next Generation Firewall
AndroidAPILinuxmacOS5.9 - 65.9