AWS network-firewall documentation change

Service: network-firewall · 2026-04-25 · Documentation low

File: network-firewall/latest/developerguide/suricata-limitations-caveats.md

Summary

Added documentation that xbits, hostbits with IP tracking, and tag:host are unsupported Suricata features in Network Firewall

Security assessment

The change documents service limitations/unsupported features but doesn't indicate any security vulnerability or add security guidance

Diff

diff --git a/network-firewall/latest/developerguide/suricata-limitations-caveats.md b/network-firewall/latest/developerguide/suricata-limitations-caveats.md
index 1d7cf09d6..e5c791b11 100644
--- a//network-firewall/latest/developerguide/suricata-limitations-caveats.md
+++ b//network-firewall/latest/developerguide/suricata-limitations-caveats.md
@@ -32,0 +33,4 @@ The following Suricata features are not supported by Network Firewall:
+  * `xbits` and `hostbits` with host or IP-level tracking (`track ip_src`, `track ip_dst`, or `track ip_pair`).
+
+  * `tag:host`.
+