Control: 10 Network Firewall firewalls should have subnet change protection enabled

Description

This control checks whether subnet change protection is enabled for an AWS Network Firewall firewall. The control fails if subnet change protection isn't enabled for the firewall.

AWS Network Firewall is a stateful, managed network firewall and intrusion detection service that you can use to inspect and filter traffic to, from, or between your Virtual Private Clouds (VPCs). If you enable subnet change protection for a Network Firewall firewall, you can protect the firewall against accidental changes to the firewall's subnet associations.

Remediation

For information about enabling subnet change protection for an existing Network Firewall firewall, see Updating a firewall in the AWS Network Firewall Developer Guide.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_networkfirewall_10

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_networkfirewall_10 --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when subnet_change_protection then 'ok'
    else 'alarm'
  end status,
  case
    when subnet_change_protection then title || ' subnet change protection enabled.'
    else title || ' subnet change protection disabled.'
  end reason
  
  , region, account_id
from
  aws_networkfirewall_firewall;

Control: 10 Network Firewall firewalls should have subnet change protection enabled

Description

Remediation

Usage

SQL

Tags