Additional references

This page collects hands-on resources for learning and implementing AWS Network Firewall beyond the best practices covered in this guide: sample code repositories, workshops, video walkthroughs, blog posts, and official documentation links.

Sample code

Start here if you want working code to deploy or extend.

• Suricata Rule Generator for AWS Network Firewall - Open-source GUI application for writing, validating, and managing Suricata rules. Includes rule conflict analysis, bulk domain import, managed rule group filtering, CloudWatch usage analytics, and infrastructure export (CloudFormation, Terraform, direct API). Referenced throughout this guide.
• AWS Network Firewall CloudFormation Templates - CloudFormation templates for all deployment architectures (centralized, distributed, combined), the getting started policy, and a CloudWatch dashboard.
• AWS Network Firewall Terraform Templates - Terraform equivalents of the CloudFormation templates above, covering all deployment architectures and the getting started policy.
• AWS Network Firewall Automation Examples - Lambda-based automation patterns for dynamic rule updates, IP list synchronization, and event-driven rule management.

Workshops

AWS workshops are hands-on labs that walk you through deploying and configuring services in a sandbox AWS account.

The best way to experience these workshops is through the AWS Activation Day program. Activation Days are free, instructor-led events open to anyone. AWS Solutions Architects guide you through the workshop content in a live setting with a provisioned sandbox account at no cost. Check the program page for upcoming sessions covering AWS security, identity, and governance services.

If you are an AWS customer with an account team, you can also ask your Solutions Architect to set up a dedicated workshop event for your team. These use the same workshop content as Activation Days but are run privately for your organization.

If you prefer to deploy the workshop into your own environment, the open-source code repositories below contain the infrastructure as code to do so.

Workshop instructions

• AWS Advanced Network Security: Network Firewall and DNS Firewall - Comprehensive workshop covering both Network Firewall and DNS Firewall together. Walks through centralized deployment with Transit Gateway, Suricata rule writing, domain filtering, managed rules, and logging.
• Building Secure Networks with AWS Cloud WAN, Network Firewall, and DNS Firewall - Same Network Firewall and DNS Firewall content as above, but the centralized networking hub is Cloud WAN instead of Transit Gateway. Includes Cloud WAN service insertion concepts for routing traffic to the firewall.

Workshop source code

• sample-aws-network-security-workshop - IaC for the AWS Advanced Network Security workshop (Transit Gateway variant)
• sample-building-secure-global-hybrid-networks-on-aws-workshop - IaC for the Building Secure Networks workshop (Cloud WAN variant)

Videos

• Introduction, best practices and custom Suricata rules - Broad overview of Network Firewall architecture and rule writing fundamentals.
• AWS re:Inforce 2023 - Firewalls, and where to put them (NIS306) - Deployment architecture decision framework, covering when to use Network Firewall vs. WAF vs. security groups.
• Decrypt, inspect, and re-encrypt TLS egress traffic at scale - TLS inspection setup and operational considerations.
• Decrypt, inspect, and re-encrypt TLS traffic at scale - Extended TLS inspection walkthrough with inbound and outbound scenarios.
• AWS Network Firewall Suricata HOME_NET variable override - Visual demonstration of the HOME_NET misconfiguration and how to fix it.
• AWS Network Firewall support for reject action for TCP traffic - Reject action behavior and when to use it vs. drop.
• AWS Network Firewall tag-based resource groups - Organizing firewall resources with tags for multi-team environments.
• AWS Network Firewall console experience - Console walkthrough for visual learners who prefer the console over IaC.

Blogs

Architecture and deployment

• Deployment models for AWS Network Firewall - Original deployment model blog covering centralized, distributed, and combined architectures with diagrams.
• Deployment models for AWS Network Firewall: Transit Gateway attachment and multiple VPC endpoints - Updated deployment models covering the native TGW attachment and multi-endpoint features.
• Why and how to migrate to a Transit Gateway-attached AWS Network Firewall - Migration guide from inspection VPC to native TGW attachment.
• Reintroducing Network Firewall Proxy for Secure Egress Connectivity - Explicit proxy mode for Network Firewall with no-source-preservation architecture.
• How to deploy AWS Network Firewall by using AWS Firewall Manager - Multi-account deployment automation with Firewall Manager.
• Centralized outbound inspection architecture in AWS Cloud WAN - Cloud WAN service insertion with Network Firewall.

Rules and filtering

• From log analysis to rule creation: How AWS Network Firewall automates domain-based security for outbound traffic - Traffic Analysis Mode for automated domain discovery and rule generation.
• Introducing Prefix Lists in AWS Network Firewall Stateful Rule Groups - Using managed prefix lists as IP set references in rules.
• How to control non-HTTP and non-HTTPS traffic to a DNS domain with AWS Network Firewall and AWS Lambda - Filtering non-web protocols by domain using dynamic IP resolution.
• Use AWS Network Firewall to filter outbound HTTPS traffic from applications hosted on Amazon EKS and collect hostnames provided by SNI - EKS-specific egress filtering patterns.

TLS inspection

• TLS inspection configuration for encrypted traffic and AWS Network Firewall - Step-by-step inbound TLS inspection configuration.
• TLS inspection configuration for encrypted egress traffic and AWS Network Firewall - Step-by-step outbound TLS inspection configuration.

Logging and monitoring

• Cost considerations and common options for AWS Network Firewall log management - Log destination selection, cost optimization, and retention strategies.
• How to analyze AWS Network Firewall logs using Amazon OpenSearch Service (Part 1) - OpenSearch integration for log analysis and visualization.
• How to analyze AWS Network Firewall logs using Amazon OpenSearch Service (Part 2) - Advanced OpenSearch queries and dashboard creation.
• AWS Network Firewall now supports rule hit count - Per-rule traffic match reporting for finding dormant rules, validating new rules, and evidencing active controls.
• Introducing the AWS Network Firewall CloudWatch Dashboard - Native monitoring dashboard setup and usage.
• Use Contributor Insights to analyze AWS Network Firewall - CloudWatch Contributor Insights for top-N analysis.

AWS documentation

• AWS Network Firewall Developer Guide - Complete service documentation.
• Network Firewall FAQ - Common questions and answers.
• Network Firewall pricing - Current pricing for endpoints, processing, and TLS inspection.
• Suricata rule examples - Official AWS Suricata rule examples.
• Troubleshooting rules - Common rule issues and solutions.
• Evaluation order for stateful rule groups - How strict and action order modes work.
• Setting rule group capacity - How stateful and stateless rule group capacity is calculated.
• Network Firewall quotas - Adjustable and fixed service limits.
• Stream exception policy - Midstream flow handling options.
• TLS inspection configurations - TLS decryption setup reference.
• Troubleshooting AWS Network Firewall - General troubleshooting guide.

Related guides

• AWS Networking Best Practices - Security - Broader AWS networking security guidance.
• AWS Security Services Best Practices - Firewalls on AWS - Choosing between AWS firewall services (Network Firewall, WAF, security groups, DNS Firewall).
• AWS Security Services Best Practices - AWS WAF - Best practices for the complementary web application firewall.