Network Firewall has deletion protection enabled

Check ID: networkfirewall_deletion_protection
Provider: AWS
Service: networkfirewall
Severity: MEDIUM
Categories: resilience
Resource type: AwsNetworkFirewallFirewall

What this check verifies

AWS Network Firewall firewalls have deletion protection enabled (DeleteProtection=true).

Risk

Without deletion protection, a firewall can be removed accidentally or by a compromised identity, letting traffic bypass inspection and logging. This threatens confidentiality and integrity via unfiltered access, and harms availability through routing disruption and loss of perimeter controls.

Recommendation

Enable deletion protection on every firewall (DeleteProtection=true). Enforce least privilege to prevent delete actions, require change approval for firewall modifications, and implement guardrails with policy-as-code. Apply defense in depth so alternate controls contain traffic if a firewall is altered.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws network-firewall update-firewall-delete-protection —firewall-name <FIREWALL_NAME> —delete-protection

# Terraform: enable deletion protection on a Network Firewall
resource "aws_networkfirewall_firewall" "<example_resource_name>" {
  name                = "<example_resource_name>"
  firewall_policy_arn = "<example_resource_id>"
  vpc_id              = "<example_resource_id>"

  subnet_mapping {
    subnet_id = "<example_resource_id>"
  }

  delete_protection = true  # Critical: prevents deletion to pass the check
}

# CloudFormation: enable deletion protection on a Network Firewall
Resources:
  <example_resource_name>:
    Type: AWS::NetworkFirewall::Firewall
    Properties:
      FirewallName: <example_resource_name>  # Required: unique name for the firewall
      FirewallPolicyArn: <example_resource_id>
      VpcId: <example_resource_id>
      SubnetMappings:
        - SubnetId: <example_resource_id>
      DeleteProtection: true  # Critical: enables deletion protection to pass the check

References

https://docs.aws.amazon.com/securityhub/latest/userguide/networkfirewall-controls.html#networkfirewall-9

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = networkfirewall_deletion_protection. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Neptune cluster is not using public subnets VPC has Network Firewall enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires