Security Specialty
AWS WAF vs Shield vs Network Firewall vs Firewall Manager: Four Services, Four Jobs
AWS WAF filters web requests, Shield protects against DDoS attacks, Network Firewall inspects and filters traffic at the perimeter of your VPC, and Firewall Manager applies and manages those protections across accounts and resources.
The four services compared
| Service | What it does | Key facts |
|---|---|---|
| AWS WAF | Web application firewall. Monitors the web requests your users send to your applications and controls access to your content. | Rate-based rules count requests and limit those arriving too fast. |
| AWS Shield | Protection against distributed denial of service (DDoS) attacks. | Everyone gets automatic protection against common volumetric attacks such as UDP reflection and TCP SYN floods. Shield Advanced adds DDoS detection, mitigation and response at layers 3, 4 and 7. |
| AWS Network Firewall | Stateful, managed network firewall and intrusion detection and prevention service for your VPC. | Filters traffic at the perimeter of the VPC, including traffic to and from an internet gateway, NAT gateway, VPN or Direct Connect. Uses the Suricata IPS and supports Suricata-compatible rules. |
| AWS Firewall Manager | Central management of protections across multiple accounts and resources. | Covers AWS WAF, Shield Advanced, VPC security groups and network ACLs, Network Firewall and Route 53 Resolver DNS Firewall. Works with AWS Organizations and adds protection to new resources automatically. |
Source: docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html
Sources: What are AWS WAF, Shield Advanced and Firewall Manager?, AWS Shield, AWS Firewall Manager and What is AWS Network Firewall?.
Pick the right service
| Scenario | Service |
|---|---|
| Block malicious web requests or limit the request rate from a client | AWS WAF |
| Protect an internet-facing application from DDoS attacks, with extra detection and response | AWS Shield Advanced |
| Inspect and filter VPC traffic with stateful rules or an intrusion prevention system, such as limiting traffic to known bad domains | AWS Network Firewall |
| Apply the same WAF, Shield or security group rules to every account in the organization | AWS Firewall Manager |
| Allow or deny traffic at the subnet or instance level | Network ACLs and security groups (see the security groups vs NACLs table) |
They are designed to work together
AWS says you can use AWS WAF, Shield and Firewall Manager together to create a comprehensive security solution. A common mental model for the exam: WAF at the application layer, Shield against DDoS, Network Firewall inside the network, and Firewall Manager to roll them out and keep them consistent.
For the exam tasks that name these services, see Domain 3: Infrastructure Security and Domain 6: Governance. Compare also the detection services in GuardDuty vs Inspector vs Macie vs Security Hub.
WAF details worth remembering
- A rate-based rule costs 2 WCU as a base, plus 30 WCU for each custom aggregation key, plus the cost of its scope-down statement.
- A rate-based rule cannot be nested inside other statements, and each web ACL that uses it gets its own instance with its own counting.
- Edge controls tested in the exam include CloudFront headers, AWS WAF, OWASP Top 10 protection, geography-based rules and rate limiting.
Frequently asked questions
What is the difference between AWS WAF and Shield?
AWS WAF filters web requests to your applications. Shield protects against DDoS attacks; Shield Advanced adds extra DDoS detection, mitigation and response.
Does AWS Shield cost extra?
AWS provides automatic protection against common volumetric DDoS attacks at no additional cost. Shield Advanced is the additional managed threat protection service.
What does AWS Network Firewall use for inspection?
It uses the open source Suricata intrusion prevention system and supports Suricata-compatible rules.
What can AWS Firewall Manager manage?
AWS WAF, Shield Advanced, VPC security groups and network ACLs, AWS Network Firewall and Route 53 Resolver DNS Firewall, across accounts.
Sources
- What are AWS WAF, Shield Advanced and Firewall Manager? (AWS)
- AWS Shield (AWS)
- AWS Firewall Manager (AWS)
- What is AWS Network Firewall? (AWS)
- Rate-based rule statements (AWS)
AWS updates its programs and documentation. Check the linked official pages for the latest details before you decide or pay.
Practice for your AWS exam
Free practice tests with instant explanations and spaced repetition. No sign-up.
Keep reading
- Security Specialty
AWS GuardDuty vs Inspector vs Macie vs Security Hub
Compare GuardDuty, Inspector, Macie, Security Hub, Detective and Security Lake in one table, with exam-style scenarios to pick the right one.
3 min read - Security Specialty
SCS-C03 In-Scope AWS Services: The Official List
Every AWS service on the Security Specialty exam, grouped by category, plus what is out of scope and the concepts AWS says to know.
2 min read - Security Specialty
AWS Security Specialty Study Plan: A 4-Week Roadmap
A week-by-week SCS-C03 study plan built from the domain weights: what to read, what to practice and how to finish with a timed test.
3 min read