Free tools Windows power users keep installed
One-click scans. No signup required.
Before deleting an AWS Network Firewall, remove its endpoint as a target from every VPC route table that uses it, and replace each route with the path your network should use afterward. Trace both directions of affected traffic, including routes in the firewall endpoint subnets and any additional VPCs reached through endpoint associations. Delete the firewall only after those references and its other deletion dependencies are cleared.
1. Inventory the firewall endpoints and associations
Start with the firewall’s subnet mappings: they identify the Availability Zones in which AWS Network Firewall created endpoints. Use DescribeFirewall to inspect the firewall and its status and mappings. Also identify any VPC endpoint associations, which can extend firewall use into VPCs beyond the firewall’s primary VPC; AWS documents association management in the DeleteVpcEndpointAssociation API reference.
As an Amazon Associate I earn from qualifying purchases.
Build an inventory of the relevant VPCs, Availability Zones, route tables, and endpoint targets before making changes. Include route tables for protected subnets, endpoint subnets, and other routing locations that send traffic to or receive traffic from the protected subnets. For an endpoint association, include route tables in the associated VPC as well.
Recommended Free Tools
2. Map the traffic paths before choosing replacement routes
Do not treat every endpoint route as interchangeable. First identify what traffic each route carries and where that traffic should go after the firewall is removed. The replacement target depends on the intended network design; there is no single target that is correct for every VPC.
#1 Best Overall
AWS’s documented internet-gateway example illustrates why both directions matter. A customer-subnet route can send internet-bound traffic to the firewall endpoint, while the internet-gateway route sends traffic bound for that customer subnet to the endpoint. The endpoint subnet’s own route table then provides the onward route, such as toward the internet gateway or a VPC-local destination. See AWS’s VPC route table configuration examples.
| Routing location | Role in the documented example | Decommissioning check |
|---|---|---|
| Customer subnet route table | Steers internet-bound traffic to the firewall endpoint. | Replace the endpoint target with the intended post-firewall path for that traffic. |
| Internet gateway route table | Steers traffic bound for the customer subnet to the firewall endpoint. | Update this direction too if the design currently sends return traffic through the firewall. |
| Firewall endpoint subnet route table | Provides the onward route from the endpoint subnet toward the internet gateway or a VPC-local destination. | Review it as part of the traffic path and change it if the post-firewall topology requires a different route. |
This is an example, not a universal topology. If a Transit Gateway attachment, shared-network arrangement, or other routing design is involved, inventory its relevant attachments and route tables as well; the cited AWS guidance does not define one teardown sequence for every such design.
3. Replace endpoint targets in Amazon VPC route tables
Edit the affected route tables in Amazon VPC so that routes no longer target the Network Firewall endpoint. For each entry, preserve the intended destination and choose a target appropriate to the route’s purpose in the post-decommission design. Do not simply remove a route if doing so would leave the destination without its required path, and do not assume a replacement used in one subnet or VPC is suitable for another.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsWhere the firewall was providing filtering in both directions, update both the outbound and return-path entries. Apply the same review to endpoint subnet routes that forwarded traffic onward. The AWS routing examples show these separate roles, but the appropriate replacement depends on the security controls and topology that will remain.
4. Verify that no route table still uses an endpoint
After editing, recheck route tables in every Availability Zone identified by the firewall’s subnet mappings. Repeat the check for every VPC endpoint association, including its associated VPC. AWS’s DeleteFirewall API reference says to remove endpoint routes first; its guidance is to delete safely only when route tables no longer use the firewall endpoints.
For each endpoint in your inventory, confirm that no route entry still names it as a target. If an endpoint association will also be removed, first remove that association’s endpoint from every route table that uses it, as required by the DeleteVpcEndpointAssociation API reference.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.5. Clear deletion dependencies, then delete the firewall
Route cleanup is not the only deletion prerequisite. AWS’s firewall deletion guidance also requires disassociating dependent AWS resources and disabling the firewall’s logging configuration. If a VPC endpoint association is owned by another account, coordinate with that owner to remove it.
- Remove endpoint routes from every route table that uses them, including routes in associated VPCs.
- Disassociate dependent resources and remove VPC endpoint associations. Coordinate with the owner if another account controls an association.
- Disable the firewall’s logging configuration.
- If delete protection is enabled, turn it off using UpdateFirewallDeleteProtection.
- Delete the firewall through the AWS console or the DeleteFirewall API.
AWS states that firewall deletion cannot be reverted. Its console deletion process can take a few minutes, so treat the final delete as an irreversible change and ensure the route and dependency checks are complete first.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
