What is a firewall? Network security basics
A firewall is a security control that monitors and filters network traffic, allowing or blocking it based on a set of rules — a barrier between trusted and untrusted networks that decides what is permitted to pass. The idea predates the cloud by decades, but it remains one of the first lines of defence in any cloud architecture, sitting at the boundary of a network or an individual resource and enforcing what can talk to what. Cloud providers implement the concept in several forms, from simple rule sets attached to a virtual network to managed services purpose-built for filtering web traffic. This guide explains the plain idea behind a firewall, the main types you will meet, how the concept shows up as cloud-native services, why it is only one layer of a proper security strategy, and where it is tested in certification study.
The plain idea: rules that decide what passes
At its core, a firewall inspects traffic against a set of rules and either allows it through or blocks it. A typical rule considers things like the source address the traffic is coming from, the destination it is heading to, the port it is using, and the protocol involved. Traffic that matches an "allow" rule is permitted; everything else is either explicitly denied or, under a well-designed policy, denied by default.
That last point — default deny — is the foundation of sound firewall design: start by blocking everything, then open only the specific paths that are actually needed, rather than starting open and trying to block the paths you happen to think of.
Types of firewall
Firewalls operate at different layers of the network stack. A network firewall filters traffic based on addresses, ports and protocols without looking at what the traffic actually contains — fast, and sufficient for most perimeter filtering. An application-layer firewall, and specifically a web application firewall, goes further: it inspects the content of HTTP requests themselves, looking for patterns associated with attacks such as SQL injection or cross-site scripting, which a network-layer rule would never see.
A separate distinction is stateful versus stateless. A stateful firewall tracks the state of a connection and automatically allows the expected return traffic for a request it already permitted; a stateless firewall evaluates every packet independently against its rules, with no memory of what came before. Stateful inspection is the default in most modern firewalls because it is both more convenient and closes fewer accidental gaps.
How firewalls appear in the cloud
Cloud providers implement firewall concepts as native services rather than physical appliances. Inside a virtual network, security groups act as a stateful firewall attached to individual resources, and network ACLs act as a stateless firewall attached to a subnet — our explainers on virtual private clouds and subnets cover the surrounding network structure these attach to. Beyond that baseline, providers offer managed, purpose-built firewall services: AWS Network Firewall for network-layer filtering across a VPC and AWS WAF for web application protection, Azure Firewall as a managed network firewall service, and Google Cloud Firewall rules built into its networking layer. All implement the same underlying idea; the differences are in scope, manageability and how deeply they inspect traffic.
Firewalls and identity: complementary, not interchangeable
A firewall controls what can reach a resource over the network; it says nothing about who or what is making the request once traffic is allowed through. Identity and access management, covered in our explainers on IAM and zero-trust security, controls that other half — authenticating who is asking and authorising what they are allowed to do. A well-designed cloud architecture layers both: network rules that limit exposure in the first place, and identity checks that verify and authorise everything that does get through. Neither replaces the other.
One layer, not a complete strategy
It is worth being honest about the limits of a firewall. It filters traffic based on the rules it has been given; it cannot stop a legitimate-looking request that abuses a valid access path, a compromised credential being used exactly as intended, or an attack that does not touch the network boundary it is watching at all. Firewalls are one layer in a defence-in-depth strategy — combined with identity controls, encryption, monitoring and secure application design — not a single control that makes a system secure on its own.
Where firewalls appear in certification study
Network security is core territory across cloud certifications. Security groups, network ACLs and their equivalents appear from associate level up, and the AWS Security Specialty and Azure Administrator Associate exams both go deeper — expecting you to design layered filtering, choose between stateful and stateless controls, and recognise when a managed service like a WAF is the right tool rather than a network-layer rule. Firewall concepts also underpin many scenario questions on the broader Solutions Architect Associate exam, where they appear alongside subnet and routing design.
Original practice questions, timed mock exams and revision notes. No card, nothing to pay.