Skip to main content
CloudCertPrep
Start Practicing

AWS WAF vs Network Firewall vs Shield: Three Layers of Network Defense

6 min read · Updated 2026-10-27

These three services get confused because all are 'firewall-ish.' The clean separation: Shield protects against DDoS (layers 3/4 volumetric + L7 with Advanced), WAF filters HTTP(S) requests at layer 7, and Network Firewall is a stateful network-layer inspection engine for VPC traffic.

AWS WAF — the web request gatekeeper

WAF attaches to CloudFront, ALB, API Gateway, AppSync, and Cognito. It inspects HTTP requests against rules: managed rule groups (OWASP Top 10, known bad inputs, IP reputation), rate-based rules, geo-matching, and custom conditions.

Choose WAF for: blocking SQLi/XSS patterns, rate-limiting abusive clients, geo-blocking, bot control. It sees requests only after TLS termination at the attached resource — it's an application-layer control.

AWS Network Firewall — the VPC traffic inspector

Network Firewall deploys into a dedicated subnet and inspects traffic flowing through it — stateful rules, domain filtering, Suricata-compatible IPS signatures, and TLS inspection (with ACM certs). It's the managed answer to 'run IDS/IPS across my VPCs,' typically in a centralized inspection VPC behind Transit Gateway.

Choose it for: egress filtering to approved domains, protocol enforcement, centralized deep-packet inspection across many VPCs. It operates at layers 3–7 on network flows, not just web requests.

AWS Shield — the DDoS absorber

Shield Standard is automatic and free on CloudFront, Route 53, ALB, and Global Accelerator — it absorbs common L3/L4 attacks. Shield Advanced adds 24/7 DDoS response team access, cost protection during attacks, enhanced visibility, and L7 mitigation when combined with WAF.

Shield isn't a firewall you configure rules for — it's always-on mitigation capacity. The decision is usually Standard (free, default) vs Advanced (paid, for high-availability or regulated workloads).

Layering them together

Exam tells: 'HTTP request filtering' → WAF. 'VPC-level IDS/IPS or domain-based egress control' → Network Firewall. 'DDoS resilience or response team' → Shield.

  • Edge DDoS protection for a public web app → Shield Standard on CloudFront + WAF rules
  • Regulated workload needing DRT support + cost protection → Shield Advanced
  • Inspect ALL outbound VPC traffic to unapproved domains → Network Firewall
  • Block SQL injection on an ALB → WAF (Network Firewall could, but WAF is the designed answer)
  • Defense in depth for a large org → all three, each covering its layer

Official references