Control: 9 Network Firewall firewalls should have deletion protection enabled
Description
This control checks whether an AWS Network Firewall firewall has deletion protection enabled. The control fails if deletion protection isn't enabled for a firewall.
AWS Network Firewall is a stateful, managed network firewall and intrusion detection service that enables you to inspect and filter traffic to, from, or between your Virtual Private Clouds (VPCs). The deletion protection setting protects against accidental deletion of the firewall.
Remediation
To enable delete protection on an existing Network Firewall firewall, see Updating a firewall in the AWS Network Firewall Developer Guide. For Change protections, select Enable. You can also enable deletion protection by invoking the UpdateFirewallDeleteProtection API and setting the DeleteProtection field to true.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_networkfirewall_9Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_networkfirewall_9 --shareSQL
This control uses a named query:
networkfirewall_firewall_deletion_protection_enabled