Network Firewall

AWS Network Firewall — firewalls, policies, and rule groups driven end-to-end by the real networkfirewall SDK

Emulates AWS Network Firewall — the managed stateful/stateless firewall you attach to a VPC across subnets to inspect traffic against rule groups. It is a distinct service with its own AWS JSON API, separate from the EC2 VPC networking surface: you create reusable rule groups, reference them from a firewall policy, and attach that policy to a firewall spanning your subnets.

Reach for it in tests when your code provisions firewalls, policies, or rule groups, or toggles delete protection and logging — so you can exercise those control-plane paths without a real Network Firewall deployment. This is a control-plane emulation: it models the resources and their relationships, not live packet inspection. Network Firewall is AWS-only; there is no Azure or GCP equivalent.

Provider	Service	SDK-compat	Driver
AWS	Network Firewall	✓ Live	`aws.NetworkFirewall`

Drive it with the real SDK#

Drop the SDK-compat server in front of cloudemu and point the real networkfirewall client at it — the emulator speaks AWS JSON 1.0 on the NetworkFirewall_20201112. target prefix, so a real aws-sdk-go-v2/service/networkfirewall client works with only its endpoint rewritten. Build bottom-up: a rule group, then a policy, then the firewall:

import (
    "github.com/aws/aws-sdk-go-v2/aws"
    "github.com/aws/aws-sdk-go-v2/service/networkfirewall"
    nftypes "github.com/aws/aws-sdk-go-v2/service/networkfirewall/types"
    "github.com/stackshy/cloudemu/v2"
    awsserver "github.com/stackshy/cloudemu/v2/server/aws"
)

cloud := cloudemu.NewAWS()
ts := httptest.NewServer(awsserver.New(awsserver.Drivers{NetworkFirewall: cloud.NetworkFirewall}))
defer ts.Close()

client := networkfirewall.NewFromConfig(cfg, func(o *networkfirewall.Options) {
    o.BaseEndpoint = aws.String(ts.URL)
})

rg, _ := client.CreateRuleGroup(ctx, &networkfirewall.CreateRuleGroupInput{
    RuleGroupName: aws.String("rg-1"), Type: nftypes.RuleGroupTypeStateful,
    Capacity: aws.Int32(100), Description: aws.String("stateful rules"),
})

pol, _ := client.CreateFirewallPolicy(ctx, &networkfirewall.CreateFirewallPolicyInput{
    FirewallPolicyName: aws.String("pol-1"),
    FirewallPolicy: &nftypes.FirewallPolicy{
        StatelessDefaultActions:         []string{"aws:forward_to_sfe"},
        StatelessFragmentDefaultActions: []string{"aws:forward_to_sfe"},
    },
})

client.CreateFirewall(ctx, &networkfirewall.CreateFirewallInput{
    FirewallName:      aws.String("fw-1"),
    FirewallPolicyArn: pol.FirewallPolicyResponse.FirewallPolicyArn,
    VpcId:             aws.String("vpc-123"),
    SubnetMappings:    []nftypes.SubnetMapping{{SubnetId: aws.String("subnet-a")}},
})

Call the driver directly#

Skip the HTTP hop for cloudemu-only setup code. The driver exposes the same three resource families — firewalls, firewall policies, and rule groups — with full lifecycle management plus policy and subnet association, delete protection, logging configuration, and tagging:

import nfdriver "github.com/stackshy/cloudemu/v2/services/networkfirewall/driver"

rg, _ := aws.NetworkFirewall.CreateRuleGroup(ctx, nfdriver.CreateRuleGroupConfig{
    Name: "rg-1", Type: "STATEFUL", Capacity: 100,
})

pol, _ := aws.NetworkFirewall.CreateFirewallPolicy(ctx, nfdriver.CreateFirewallPolicyConfig{
    Name: "pol-1", StatelessDefaultActions: []string{"aws:forward_to_sfe"},
})

fw, _ := aws.NetworkFirewall.CreateFirewall(ctx, nfdriver.CreateFirewallConfig{
    Name: "fw-1", PolicyARN: pol.ARN, VPCID: "vpc-123", SubnetIDs: []string{"subnet-a"},
})

// Re-associate a policy, extend subnets, and lock deletion.
aws.NetworkFirewall.AssociateFirewallPolicy(ctx, fw.Name, pol.ARN)
aws.NetworkFirewall.AssociateSubnets(ctx, fw.Name, []string{"subnet-b"})
aws.NetworkFirewall.UpdateFirewallDeleteProtection(ctx, fw.Name, true)

// Logging config and tags.
aws.NetworkFirewall.UpdateLoggingConfiguration(ctx, fw.Name, []string{"FLOW", "ALERT"})
aws.NetworkFirewall.TagResource(ctx, fw.ARN, map[string]string{"env": "test"})

Behavior & fidelity#

Behavior	What happens
Resources compose by ARN	A policy references rule groups and a firewall references a policy, so associating a policy or extending subnets updates the firewall live.
Delete protection is enforced	With it on, a firewall can't be deleted until the protection flag is cleared — the same guard the real API applies.
Rule groups are typed	Each is `STATEFUL` or `STATELESS` with a declared capacity, and reads take the type to disambiguate.

SDK-compat — Live#

The real networkfirewall client drives the emulator end-to-end over AWS JSON 1.0 (target prefix NetworkFirewall_20201112.). See SDK-Compat for the full operation list.

← Networking Monitoring →

Drive it with the real SDK#

Call the driver directly#

Behavior & fidelity#

SDK-compat — Live#

On this page