HeatShield offers two distinct advantages over Amazon Lightsail's very simple firewall options: the ability to restrict source addresses and SSH brute force protection.
HeatShield allows you to customize the IP addresses that can have access to the services running on your server, such as MySQL for example.
HeatShield blocks IP addresses that have attempted brute force SSH login attacks on any of your servers by dynamically updating your servers' firewalls.
You can also view the IP addresses that are blocked from accessing your server and whitelist any that should not be blocked.
When you open a firewall port through HeatShield, you also need to open that port in Lightsail. Once the port is opened in Lightsail, you can use HeatShield to limit the source addresses that have access to that port.