Today, AWS announces next-generation firewall (NGFW) policy for AWS Network Firewall, a new policy model that provides security teams with a simpler policy structure and increased rule capacity. AWS Network Firewall is a managed network security service that protects your Amazon VPCs with access control and threat detection.
The new policy model strengthens your security posture by layering firewall and IPS protections instead of combining them, which also makes policies easier to manage. You author firewall rules that enforce deny-by-default access control, such as allowing traffic only to approved domains. For IPS rules, you can use managed rule groups from AWS or AWS Marketplace partners, which update automatically as new threats emerge. You can also create your own custom IPS rule groups. Firewall and IPS rules each have their own capacity, so you no longer trade one off against the other. For rules you don’t share across policies, you can create embedded rule groups that draw capacity on demand without pre-allocation. With NGFW policy, all rules are stateful and evaluate with full connection context, for consistent, predictable traffic handling. Your existing policies continue to operate without changes, and IPS rules remain backward compatible.
NGFW policy is available at no additional charge in all commercial AWS Regions and AWS GovCloud (US) Regions. For a full list of supported regions, visit the AWS Capabilities by Region page .
To learn more, see the AWS Network Firewall product page and documentation .