AWS network-firewall documentation change
Summary
Added new section 'How Network Firewall scaling works' describing automatic scaling behavior, per-AZ scaling, scale-up/down behavior, fail-close behavior, and recommendation to contact AWS Support for planned traffic events.
Security assessment
This change adds documentation about Network Firewall's automatic scaling behavior and performance characteristics. It mentions fail-close behavior (dropping traffic rather than allowing uninspected traffic), which is a security design principle, but this is documenting existing behavior rather than addressing a security vulnerability. The change is primarily about performance and scalability documentation.
Diff
diff --git a/network-firewall/latest/developerguide/troubleshooting-general-issues.md b/network-firewall/latest/developerguide/troubleshooting-general-issues.md index 10b412553..aff4179ee 100644 --- a//network-firewall/latest/developerguide/troubleshooting-general-issues.md +++ b//network-firewall/latest/developerguide/troubleshooting-general-issues.md @@ -7 +7 @@ -Firewall endpoint creation or deletion failsAvailability Zone is unsupportedHow do I check if I have asymmetric routing?I'm using Network Firewall with AWS Transit Gateway and Network Firewall is dropping trafficHigh latency and intermittent packet drops when traffic passes through Network Firewall +Firewall endpoint creation or deletion failsAvailability Zone is unsupportedHow do I check if I have asymmetric routing?I'm using Network Firewall with AWS Transit Gateway and Network Firewall is dropping trafficHigh latency and intermittent packet drops when traffic passes through Network FirewallHow Network Firewall scaling works @@ -189,0 +190,21 @@ To prevent this from happening, we recommend either configuring the **TCP keep-a +## How Network Firewall scaling works + +AWS Network Firewall is a fully managed service that scales automatically to meet traffic demand. It continuously monitors traffic flowing through your firewall endpoints and adjusts capacity, with each endpoint scaling independently up to 100 Gbps. Automatic scaling is always enabled and requires no configuration. + +###### Scaling considerations + + 1. **Per-AZ scaling** – Each firewall endpoint is zonal and scales independently based on the traffic it processes. + + 2. **Scale-up behavior** – When Network Firewall detects increased traffic, it provisions additional capacity automatically. Scaling typically completes within minutes, though very rapid or large traffic increases may take longer. + + 3. **Scale-down behavior** – After traffic decreases, Network Firewall does not immediately remove capacity. It monitors utilization and gradually reduces capacity over a period of hours, only after confirming it is no longer needed. + + 4. **Fail-close behavior** – Sudden, large traffic spikes may briefly exceed available capacity, which can result in some packet drops. Network Firewall drops traffic rather than allowing it to pass uninspected (fail-close behavior). + + + + +###### Note + +If you are planning a traffic event that may cause a rapid increase in traffic, such as a product launch, marketing campaign, or workload migration, contact [AWS Support](https://aws.amazon.com/premiumsupport) ahead of time to discuss your scaling needs. +