AWS Enhances Network Firewall with Rule Hit Count Feature

AWS has launched a new capability for its Network Firewall that allows security teams to see which stateful firewall rules are actively matching traffic. This feature, enabled by default, helps organizations identify unused or misconfigured rules without the need for extensive log reviews. The capability applies to both custom and managed rule groups, but does not support stateless rules. The introduction of this feature aims to improve the efficiency of firewall management and enhance security posture by ensuring that security controls are functioning as intended. This update comes at no additional cost for the Network Firewall service, although standard charges for storage still apply.

Key Points: • AWS Network Firewall now includes a rule hit count feature for better visibility. • The feature helps identify active, inactive, and misconfigured firewall rules. • No additional cost for the feature, but standard storage charges apply.