Control: 10 Network Firewall firewalls should have subnet change protection enabled
Description
This control checks whether subnet change protection is enabled for an AWS Network Firewall firewall. The control fails if subnet change protection isn't enabled for the firewall.
AWS Network Firewall is a stateful, managed network firewall and intrusion detection service that you can use to inspect and filter traffic to, from, or between your Virtual Private Clouds (VPCs). If you enable subnet change protection for a Network Firewall firewall, you can protect the firewall against accidental changes to the firewall's subnet associations.
Remediation
For information about enabling subnet change protection for an existing Network Firewall firewall, see Updating a firewall in the AWS Network Firewall Developer Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_networkfirewall_10Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_networkfirewall_10 --shareSQL
This control uses a named query:
select arn as resource, case when subnet_change_protection then 'ok' else 'alarm' end status, case when subnet_change_protection then title || ' subnet change protection enabled.' else title || ' subnet change protection disabled.' end reason , region, account_idfrom aws_networkfirewall_firewall;