Does AWS Network Firewall Detect Base64 Encoded Payloads?

I can't speak to the specifics of that, but I'm interested in your workflow. I've previously worked on a project involving S3 presigned URLs for uploads and using a staging bucket. We relied on something called GuardDuty for checking for malicious content. Are you using API Gateway along with some compute resources like EC2, ECS, or Lambda?

Yes, I believe Suricata can decode base64 data. However, while Suricata with managed rules can do quite a bit, it may not be as efficient for detecting malware in uploaded files as a dedicated malware scanner. Consider implementing a workflow where uploads are scanned, possibly utilizing S3 or a custom solution.