Control: 3 Network Firewall policies should have at least one rule group associated

Description

This control checks whether a Network Firewall policy has any stateful or stateless rule groups associated. The control fails if stateless or stateful rule groups are not assigned.

A firewall policy defines how your firewall monitors and handles traffic in Amazon Virtual Private Cloud (Amazon VPC). Configuration of stateless and stateful rule groups helps to filter packets and traffic flows, and defines default traffic handling

Remediation

To update firewall policy and add a rule group through console:

Sign in to the AWS Management Console and open the Amazon VPC console at https://console.aws.amazon.com/vpc/.
In the navigation pane, under Network Firewall, choose Firewall policies.
In the Firewall policies page, select the name of the firewall policy you want to update.
In the firewall policy's page, you can change the rule groups.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_networkfirewall_3

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_networkfirewall_3 --share

SQL

This control uses a named query:

select
  arn as resource,
  case
    when (firewall_policy ->> 'StatefulRuleGroupReferences' is null or jsonb_array_length(firewall_policy -> 'StatefulRuleGroupReferences') = 0)
      and (firewall_policy ->> 'StatelessRuleGroupReferences' is null or jsonb_array_length(firewall_policy -> 'StatelessRuleGroupReferences') = 0) then 'alarm'
    else 'ok'
  end as status,
  case
    when (firewall_policy ->> 'StatefulRuleGroupReferences' is null or jsonb_array_length(firewall_policy -> 'StatefulRuleGroupReferences') = 0)
      and (firewall_policy ->> 'StatelessRuleGroupReferences' is null or jsonb_array_length(firewall_policy -> 'StatelessRuleGroupReferences') = 0) then title || ' has no associated rule groups.'
    else title || ' has associated rule groups.'
  end as reason
  
  , region, account_id
from
  aws_networkfirewall_firewall_policy;

Control: 3 Network Firewall policies should have at least one rule group associated

Description

Remediation

Usage

SQL

Tags