Lesson 03 — AWS Network Firewall & AWS Firewall Manager

Learning Path

☁️ Phase 02 – AWS Cloud Security

📘 Module 08 – Network Protection

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand AWS Network Firewall.
Deploy stateful and stateless firewall rules.
Protect VPC traffic using enterprise firewall architecture.
Manage firewall policies centrally using AWS Firewall Manager.
Build scalable firewall solutions for AWS Organizations.
Design enterprise network inspection architecture.

📚 Lesson Information

Estimated Time: 3 Hours

Difficulty: Intermediate–Advanced

Prerequisites: Lesson 02 – AWS WAF, AWS Shield & Route 53 Security

Hands-on Lab: Yes

💼 Business Scenario

CloudNova Technologies has expanded rapidly.

The company now operates:

25 AWS Accounts
6 Production VPCs
3 Development VPCs
Multiple Kubernetes Clusters
Shared Services VPC
Security Inspection VPC

Although AWS WAF protects public web applications, security engineers discover a new concern.

Internal workloads are communicating with:

Unknown IP addresses
Suspicious domains
Unauthorized applications
Unapproved outbound destinations

The CISO asks:

“How can we inspect and control traffic travelling inside our AWS network—not just traffic coming from the Internet?”

As the Cloud Security Engineer, your responsibility is to deploy enterprise-grade network inspection and centrally enforce firewall policies across every AWS account.

Enterprise Firewall Strategy

CloudNova uses multiple security layers.

Internet
      │
AWS Shield
      │
Route 53
      │
AWS WAF
      │
Application Load Balancer
      │
AWS Network Firewall
      │
Private Applications
      │
Amazon RDS

AWS WAF protects web requests.

AWS Network Firewall protects network traffic inside AWS.

What is AWS Network Firewall?

AWS Network Firewall is a managed network security service that filters traffic entering, leaving and moving between VPCs.

Unlike Security Groups or Network ACLs, Network Firewall performs deep packet inspection using enterprise firewall capabilities.

It helps organisations:

Inspect network traffic
Block malicious destinations
Filter protocols
Detect suspicious connections
Apply enterprise firewall rules

Why Not Just Use Security Groups?

Security Groups and Network ACLs control access.

AWS Network Firewall performs inspection.

Service	Primary Purpose
Security Groups	Instance-level filtering
Network ACLs	Subnet-level filtering
AWS Network Firewall	Deep packet inspection
AWS WAF	HTTP/HTTPS protection

Each service protects a different layer.

AWS Network Firewall Architecture

Internet
      │
Internet Gateway
      │
Firewall Subnet
      │
AWS Network Firewall
      │
Transit Gateway
      │
Application VPC
      │
Database

Every packet can be inspected before reaching production workloads.

Components of AWS Network Firewall

A firewall deployment consists of:

Firewall
Firewall Policy
Rule Groups
Endpoints
Logging Configuration

Together these components inspect and filter network traffic.

Stateless Rules

Stateless rules inspect individual packets.

Examples:

Allow HTTPS
Allow DNS
Block Telnet
Block FTP

Example flow:

Packet

↓

Evaluate Rule

↓

Allow or Drop

Stateless rules are fast and efficient.

Stateful Rules

Stateful rules analyse complete network sessions.

Examples:

HTTP Sessions
TLS Connections
Malware Signatures
Command & Control Traffic
Domain Filtering

Example:

Client

↓

TCP Session

↓

Firewall Inspection

↓

Allow or Block

Stateful inspection provides deeper security analysis.

Rule Groups

Rules are organised into Rule Groups.

Example:

Domain Blocking

↓

Malicious IP Blocking

↓

Application Rules

↓

Threat Signatures

Grouping rules simplifies administration.

Domain Filtering

Example rule:

Block

malware.example

↓

Drop Connection

Useful for preventing compromised workloads from contacting malicious infrastructure.

Threat Signatures

AWS Network Firewall supports intrusion detection signatures.

Example:

Known Attack Pattern

↓

Detected

↓

Blocked

↓

Alert Generated

This provides additional protection against common network attacks.

Firewall Logging

AWS Network Firewall supports logging to:

Amazon S3
Amazon CloudWatch Logs
Amazon Kinesis Data Firehose

Typical logged information:

Allowed traffic
Blocked traffic
Rule matches
Source IP
Destination IP
Protocol
Timestamp

These logs support investigations and compliance.

AWS Firewall Manager

Managing dozens of firewalls manually quickly becomes difficult.

AWS Firewall Manager allows security teams to centrally manage security policies across multiple AWS accounts.

Firewall Manager Architecture

AWS Organizations
          │
Firewall Manager
          │
────────────────────────
│          │          │
Account A  Account B  Account C
│          │          │
VPC        VPC        VPC

One policy can automatically apply across the organisation.

Firewall Manager Policies

Firewall Manager can centrally manage:

AWS WAF Policies
AWS Shield Advanced Protections
AWS Network Firewall Policies
Security Group Policies

This reduces administrative effort and improves consistency.

Enterprise Multi-Account Architecture

                 AWS Organizations
                         │
               Firewall Manager
                         │
        ┌────────────────┼────────────────┐
        │                │                │
   Production       Development      Shared Services
      Account          Account            Account
        │                │                │
   Network Firewall  Network Firewall  Network Firewall
        │                │                │
       VPC              VPC              VPC

Every account follows the same security standards.

Enterprise Best Practices

CloudNova standards include:

Deploy Network Firewall in dedicated firewall subnets.
Centralise policy management with Firewall Manager.
Use AWS Organizations for policy enforcement.
Enable firewall logging.
Review blocked traffic regularly.
Restrict outbound Internet access.
Block known malicious domains.
Test firewall rules before production deployment.
Implement change control for firewall policies.

🛠 Lab 01 — Deploy AWS Network Firewall

Navigate to:

AWS Console

↓

VPC

↓

Network Firewall

↓

Create Firewall

Configure:

Firewall Name
VPC
Firewall Subnet
Availability Zones

Verify the firewall endpoint is created successfully.

🛠 Lab 02 — Create Stateless Rule Group

Create rules that:

Allow HTTPS
Allow DNS
Block Telnet (Port 23)
Block FTP (Port 21)

Associate the rule group with the firewall policy.

Test network connectivity.

🛠 Lab 03 — Create Stateful Rule Group

Create rules to:

Block a test domain
Allow approved domains
Detect suspicious outbound traffic

Verify rule behaviour using test workloads.

🛠 Lab 04 — Enable Firewall Logging

Configure logging to:

Amazon CloudWatch Logs

Review:

Source IP
Destination IP
Protocol
Action
Matched Rule

Generate traffic and verify log entries.

🛠 Lab 05 — Configure AWS Firewall Manager

Prerequisite:

AWS Organizations enabled.

Navigate to:

AWS Console

↓

Firewall Manager

↓

Create Policy

Create a policy that deploys the same firewall configuration across multiple AWS accounts.

Review compliance status.

🛠 Lab 06 — Enterprise Firewall Validation

Perform the following tests:

Test	Expected Result
HTTPS Traffic	Allowed
DNS Queries	Allowed
FTP Connection	Blocked
Telnet Connection	Blocked
Blocked Domain	Blocked
Allowed Domain	Allowed

Document your observations.

💻 AWS CLI Lab

List Firewalls

aws network-firewall list-firewalls

Describe Firewall

aws network-firewall describe-firewall \
    --firewall-name CloudNova-Firewall

List Firewall Policies

aws network-firewall list-firewall-policies

List Rule Groups

aws network-firewall list-rule-groups

View Firewall Logging

aws network-firewall describe-logging-configuration \
    --firewall-name CloudNova-Firewall

✅ Verification

Verify that you can:

✔ Explain AWS Network Firewall.

✔ Differentiate Security Groups, Network ACLs and Network Firewall.

✔ Explain stateless and stateful inspection.

✔ Create firewall rule groups.

✔ Configure firewall logging.

✔ Explain AWS Firewall Manager.

✔ Describe enterprise firewall management.

🔍 Troubleshooting

Problem

Traffic is unexpectedly blocked.

Check:

Rule order
Firewall policy association
Route tables
Stateful rule evaluation

Problem

Firewall logs are empty.

Verify:

Logging configuration
CloudWatch Log Group
Network traffic is passing through the firewall endpoint

Problem

Firewall Manager policy is not applied.

Verify:

AWS Organizations is configured.
Target accounts are in scope.
Required IAM permissions are granted.

🚫 Common Mistakes

❌ Deploying Network Firewall without updating route tables.

❌ Assuming Security Groups replace Network Firewall.

❌ Forgetting to enable firewall logging.

❌ Creating firewall rules without testing.

❌ Managing firewall rules manually across dozens of AWS accounts.

❌ Ignoring outbound traffic inspection.

🧪 DIY Challenge

CloudNova plans to expand into 50 AWS accounts.

Design an enterprise firewall architecture that:

Uses AWS Network Firewall for traffic inspection.
Uses Firewall Manager for central policy management.
Blocks malicious outbound domains.
Allows only approved Internet access.
Generates centralised firewall logs.
Supports future growth without manual firewall administration.

Create an architecture diagram explaining traffic flow, firewall placement and policy enforcement.

📊 Knowledge Check

What problem does AWS Network Firewall solve?
How does AWS Network Firewall differ from Security Groups?
What is the difference between stateless and stateful rules?
What are Rule Groups?
Why is firewall logging important?
What is AWS Firewall Manager?
Why is Firewall Manager valuable in large AWS Organizations?
Which AWS services can Firewall Manager manage?
Why should outbound traffic be inspected?
How does centralised firewall management improve security?

💡 Key Takeaways

After completing this lesson, you should understand:

AWS Network Firewall provides enterprise-grade network traffic inspection beyond the capabilities of Security Groups and Network ACLs.
Stateless rules evaluate individual packets, while stateful rules inspect complete network sessions for more advanced threat detection.
Firewall logging is essential for troubleshooting, compliance and security investigations.
AWS Firewall Manager enables centralised management of firewall and security policies across multiple AWS accounts within an AWS Organization.
Enterprise environments benefit from consistent firewall policies, automated deployment and continuous monitoring to maintain a strong security posture.

🚀 Next Lesson

➡️ Lesson 04 — Enterprise Network Security Architecture