The default stateless action for Network Firewall policies should be drop or forward for full packets¶

A firewall policy defines how your firewall monitors and handles traffic in AWS VPC. You configure stateless and stateful rule groups to filter packets and traffic flows. Defaulting to Pass can allow unintended traffic.

How to fix¶

Attribute firewall_policy[0].stateless_default_actions of aws_networkfirewall_firewall_policy must be non-empty.

Implementation options¶

Choose the option that matches how you manage Terraform. All options satisfy this control.

Option 1: Terraform AWS provider resources¶

If you manage resources directly, configure the relevant Terraform AWS provider resources to meet this control. See docs for the resources involved: aws_networkfirewall_firewall_policy.

resource "aws_networkfirewall_firewall_policy" "this" {
  firewall_policy {
    stateless_default_actions          = ["aws:drop"]
    stateless_fragment_default_actions = ["aws:drop"]
  }
  name = "pofix-example-policy"
}

Tool mappings¶

Use these identifiers to cross-reference this control across tools, reports, and evidence.

• Compliance.tf (CTF) Control: networkfirewall_firewall_policy_default_stateless_action_check_full_packets

• AWS Config Managed Rule: NETFW_POLICY_DEFAULT_ACTION_FULL_PACKETS

• Powerpipe Control: aws_compliance.control.networkfirewall_firewall_policy_default_stateless_action_check_full_packets