Network Firewall

AWS Network Firewall is a managed firewall that sits inside a VPC and inspects traffic passing through it at the network level. The platform builds it into the hub VPC as centralized egress inspection for every spoke, switched per region and off by default.

What it does

Network Firewall places firewall endpoints in dedicated subnets, one per Availability Zone, and route tables send traffic through them. A firewall policy holds stateless rules (fast, per packet) and stateful rules (per connection, aware of protocol and domain names). In STRICT_ORDER mode the stateful rules are evaluated in the order written, so a policy can be built as "allow these, drop and alert on everything else". AWS also publishes managed rule groups with threat-intelligence domain lists. The firewall writes alert logs for rule matches and flow logs for every connection.

How BuiltForProd uses it

The network-firewall unit (module modules/network-firewall, listed by every region's core/network/<region> stack file) reads enable_network_firewall from that region's network.hcl. With the switch off, the default, the unit creates nothing and the hub routes exactly as described in Transit Gateway. With it on:

• The hub VPC gains per-AZ firewall subnets (firewall_cidr_0..2 from the VPC map), which exist for nothing but the endpoints.
• A STRICT_ORDER stateful policy passes HTTPS and HTTP (or only an optional domain allow-list in allowed_domains), DNS and NTP, plus any additional_egress_tcp_ports, and drops and alerts on everything else. Optional AWS managed threat-intelligence groups can be listed in managed_rule_groups.
• Alert and flow logs go to CloudWatch with 365-day retention.
• Routing is symmetric per AZ: the Transit Gateway attachment subnets send 0.0.0.0/0 to the firewall endpoint of their AZ; the firewall subnets send 0.0.0.0/0 to the NAT Gateway and the spoke CIDRs back to the Transit Gateway; the public subnets send spoke CIDRs to the firewall endpoint. The hub attachment uses appliance mode so both directions of a flow stay in one AZ.

The hub VPC is prepared for this even while the switch is off: it creates one route table per subnet in every tier, so enabling inspection installs per-AZ routes without rebuilding tables. The unit header documents the enable order (VPC, Transit Gateway, Transit Gateway routes, then the firewall) and warns of a few minutes without egress in between.

The reason it is off is cost. The switch file and the design decisions record it beside the setting: $0.395 per endpoint-hour, about $865 per month for three AZs, plus $0.065 per GB inspected. NAT Gateway charges are waived against firewall usage in the same account. Inspection is the control most frameworks ask for once workloads carry regulated data; the platform makes it a switch so a small deployment can add it later without redesigning the network.

Terms you will see

Term	Meaning
Firewall endpoint	The per-AZ network interface that traffic is routed through for inspection.
Firewall policy	The set of stateless and stateful rule groups the firewall applies.
Stateful rule	A rule evaluated per connection, able to match protocols and domain names.
STRICT_ORDER	Evaluate stateful rules in the order written; allows an explicit default drop.
Domain allow-list	An optional list of hostnames web egress is limited to.
Appliance mode	The Transit Gateway attachment setting that keeps a flow in one AZ.
Alert log and flow log	Rule-match records and per-connection records, both sent to CloudWatch.

Where to read more

• AWS Baseline overview for the network switches and their prices.
• VPC for the hub VPC and its subnet tiers.
• Transit Gateway for the routing the firewall inserts itself into.