AWS Network Firewall launches next-generation firewall policy

AWS Network Firewall now offers a next-generation firewall (NGFW) policy model that separates firewall and intrusion prevention system (IPS) rules, improving security management and capacity allocation. The new model enforces deny-by-default access control, allowing traffic only to approved domains while enabling stateful rule evaluation with full connection context for consistent traffic handling. Security teams can leverage managed rule groups from AWS or partners, which update automatically against emerging threats, alongside custom rule groups for tailored protection.

The NGFW policy model eliminates the need to trade off between firewall and IPS rule capacity, as each now has dedicated capacity without sharing limits. Embedded rule groups allow on-demand capacity allocation for rules not shared across policies, reducing pre-allocation requirements and improving operational flexibility. Existing policies remain unaffected and continue to function without changes, ensuring backward compatibility with prior configurations.

All rules under the NGFW policy are stateful, evaluating traffic with complete connection context to deliver predictable and consistent security outcomes. Managed IPS rule groups from AWS or AWS Marketplace partners update automatically as new threats are identified, reducing manual maintenance for security teams. Custom IPS rule groups can also be created to address specific organizational security requirements beyond standard protections.

The NGFW policy is available at no additional charge in all commercial AWS Regions and AWS GovCloud (US) Regions. Organizations can review supported regions via the AWS Capabilities by Region page, while additional details are available on the AWS Network Firewall product page and documentation.