Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Network Firewall – New Managed Firewall Service in VPC

aws.amazon.com

Post reply on HN
Print view View original

21–29 of 29 posts

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#21

Post by schoolornot »

CorpOverreach wrote: post #6
coredog64 wrote: post #3

Almost $.40/hour, you need one per AZ, and it’s $.06/GB for network traffic. I’m happy to see the capability (mainly outbound URL filtering), but this looks like it’s going to be a hard sell to my managers. You’re probably looking at a grand per month per account. On the plus side, they don’t double charge for NAT gateway traffic.

For large enough enterprises, $1k a month is a rounding error. Also, depending on how you're provisioning accounts and laying out your networking, you may not want to be sticking one of these in every VPC. There's no one-size-fits-all, but in many cases a transit VPC that handles the egress centrally would make more sense.

Every place I've worked the AWS bill has always gone into a sort of a cost center blackhole. Finance would do their best in the beginning of the year to negotiate discounts & teams would do their best to keep costs low w/ reserved instances, etc.

Even though $1k is indeed a rounding error where I work vs. what we pay each month, it's becoming annoying how granular the billing for new setups is becoming. When I'm asked to compare TCO of an on-prem solution vs. a hosted one that includes all-of-the-above, I feel like I'm playing actuary and not cloud engineer.

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#22

Post by p0rkbelly »

therockspush wrote: post #9

Looking at the firewall vendors that are listed as official partners here, this looks like another pretty security-lite, native product for companies that are just looking to check a compliance box and not a real enterprise offering. Similar to the AWS WAF, this seems geared for a smaller team that can't afford the time to deploy and manage virtual security appliances. It looks like they're following the same formula…

Looks like it is built on the new Gateway Load-Balancer, which the Enterprise firewalls are a part of and auto-scale out. Meaning, third-parties have the same scaling capabilities now. So I see this as "Oh I don't need the big fancy palo alto crowd, just the basics". I've known a lot of people who spent a lot of time trying to get snort running proper in AWS, this seems to be geared at that. The Palo Altos of the world certainly aren't scared of competing with Snort.

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#23

Post by p0rkbelly »

therockspush wrote: post #11
russellendicott wrote: post #10

Earlier quoted context omitted.

It was a key dependency for this and they also broke it out into a separate product.

This was also something AWS was a couple years behind Azure on. Azure internal load balancers have some hang ups, but load balancing egress or east-west traffic across security appliances in AWS has always been diabolical in comparison. I've never used the Geneve protocol, so I can't really tell if this is going to affect which vendors can use the GWLB.

Azure had more specific routing capabilities, yes. But they can't do what this does and maintain the flow stickiness and sessions and scale out.

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#24

Post by p0rkbelly »

sneak wrote: post #16
CorpOverreach wrote: post #6

Earlier quoted context omitted.

For large enough enterprises, $1k a month is a rounding error. Also, depending on how you're provisioning accounts and laying out your networking, you may not want to be sticking one of these in every VPC. There's no one-size-fits-all, but in many cases a transit VPC that handles the egress centrally would make more sense.

For large enough enterprises, $1M a month is similarly irrelevant. Should security pricing only be accessible to businesses over a certain size? A monthly price floor on services like this is trash. It’s pay-what-you-use, so it should scale evenly down to $0, just like lambda or network transfer usage costs.

To be fair, you are ALWAYS using a security device even if your instance should not be doing anything. You want to know when something malicious is incoming from the internet, or when suddenly that malware calls out to a C2 server. You may think your instances are being quiet, but, that is why you have security tools for the abnormal behaviors and those can happen at anytime.

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#25

Post by qz2 »

schoolornot wrote: post #21
CorpOverreach wrote: post #6

Earlier quoted context omitted.

For large enough enterprises, $1k a month is a rounding error. Also, depending on how you're provisioning accounts and laying out your networking, you may not want to be sticking one of these in every VPC. There's no one-size-fits-all, but in many cases a transit VPC that handles the egress centrally would make more sense.

Every place I've worked the AWS bill has always gone into a sort of a cost center blackhole. Finance would do their best in the beginning of the year to negotiate discounts & teams would do their best to keep costs low w/ reserved instances, etc. Even though $1k is indeed a rounding error where I work vs. what we pay each month, it's becoming annoying how granular the billing for new setups is becoming. When I'm aske…

When asked to compare I always immediately get instructed by subordinates to apply the existing lies they were telling. That's how you manage cloud costs!

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#26

Post by vegardx »

coredog64 wrote: post #3

Almost $.40/hour, you need one per AZ, and it’s $.06/GB for network traffic. I’m happy to see the capability (mainly outbound URL filtering), but this looks like it’s going to be a hard sell to my managers. You’re probably looking at a grand per month per account. On the plus side, they don’t double charge for NAT gateway traffic.

Amazon often makes it a little too convenient to segment things more than you really need, which adds extra cost, like additional NAT gateways, or in this case, Managed Firewalls.

But you can use Shared VPCs that spans many accounts and drastically reduce the need for things like attachments to virtual gateways, nat gateways, service endpoints, and so on.

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#28

Post by sneak »

p0rkbelly wrote: post #24
sneak wrote: post #16

Earlier quoted context omitted.

For large enough enterprises, $1M a month is similarly irrelevant. Should security pricing only be accessible to businesses over a certain size? A monthly price floor on services like this is trash. It’s pay-what-you-use, so it should scale evenly down to $0, just like lambda or network transfer usage costs.

To be fair, you are ALWAYS using a security device even if your instance should not be doing anything. You want to know when something malicious is incoming from the internet, or when suddenly that malware calls out to a C2 server. You may think your instances are being quiet, but, that is why you have security tools for the abnormal behaviors and those can happen at anytime.

Similarly, the instance is ALWAYS connected to the internet, but I only have to pay for what I transfer. Same with Lambda and S3 and everything else AWS sells (except a few weird exceptions like this).

Re: AWS Network Firewall – New Managed Firewall Service in VPC

#29

Post by mwarkentin »

vegardx wrote: post #26
coredog64 wrote: post #3

Almost $.40/hour, you need one per AZ, and it’s $.06/GB for network traffic. I’m happy to see the capability (mainly outbound URL filtering), but this looks like it’s going to be a hard sell to my managers. You’re probably looking at a grand per month per account. On the plus side, they don’t double charge for NAT gateway traffic.

Amazon often makes it a little too convenient to segment things more than you really need, which adds extra cost, like additional NAT gateways, or in this case, Managed Firewalls. But you can use Shared VPCs that spans many accounts and drastically reduce the need for things like attachments to virtual gateways, nat gateways, service endpoints, and so on.

This can hook into Transit Gateway too if you're routing all of your VPC traffic through there I think.
Post reply on HN