AWS Network Firewall

AWS Network Firewall is a managed firewall service of Amazon Web Services that protects Amazon VPC resources from common network threats.

Key points

Implements fine-grained firewall rules that let you control which traffic is permitted and which should be blocked.
Protects VPCs from common network threats, including at the perimeter — traffic to/from an internet gateway, NAT gateway, or over VPN or Direct Connect.
Complements AWS WAF, which filters at the application layer (e.g. SQL injection); Network Firewall only inspects at the network layer and does not perform layer-7 application inspection itself.
Stateful, managed firewall (built on the open-source Suricata IPS engine) supporting Suricata-compatible rule groups, plus stateless rule groups; can filter traffic by source/destination IP address, port, protocol, and domain name.
Operates in source-preservation mode by default, preserving original source/destination IPs while inspecting traffic. A no-source-preservation mode (currently in preview, US East (Ohio)/us-east-2 only) runs the firewall as an explicit forward proxy behind a NAT gateway.
Operates at the VPC/network level, distinct from Security Groups and network ACLs, which apply at the instance and subnet level.
Centrally managed across accounts and VPCs through AWS Firewall Manager.