VPC has Network Firewall enabled

Check ID: networkfirewall_in_all_vpc
Provider: AWS
Service: networkfirewall
Severity: MEDIUM
Categories: trust-boundaries
Resource type: AwsEc2Vpc

What this check verifies

VPCs with an AWS Network Firewall associated to the same VPC to inspect and filter network traffic. Identifies VPCs that do not have a Network Firewall resource linked to them.

Risk

Without a Network Firewall, VPC traffic can bypass deep inspection and centralized policy enforcement, enabling data exfiltration, command-and-control, and lateral movement. Confidentiality is reduced by unmonitored flows; integrity and availability are threatened by malware and disruptive traffic.

Recommendation

Deploy AWS Network Firewall in each VPC or centralize inspection through a dedicated hub VPC. Adopt a default-deny posture with least-privilege rules, restrict egress to required destinations, segment workloads (defense in depth, zero trust), and enable logging to monitor and tune network policies.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws network-firewall create-firewall --firewall-name <example_resource_name> --firewall-policy-arn <example_resource_id> --vpc-id <example_resource_id> --subnet-mappings "SubnetId=<example_resource_id>"

# Create a Network Firewall in the VPC
resource "aws_networkfirewall_firewall" "<example_resource_name>" {
  name                = "<example_resource_name>"
  firewall_policy_arn = "<example_resource_id>"  # Critical: required policy
  vpc_id              = "<example_resource_id>"  # Critical: associates firewall to the VPC (fixes the check)

  subnet_mapping {                                # Critical: creates firewall endpoint in the VPC
    subnet_id = "<example_resource_id>"
  }
}

# CloudFormation: Create a Network Firewall in the VPC
Resources:
  <example_resource_name>:
    Type: AWS::NetworkFirewall::Firewall
    Properties:
      FirewallName: <example_resource_name>
      FirewallPolicyArn: <example_resource_id>  # Critical: required policy for the firewall
      VpcId: <example_resource_id>              # Critical: associates the firewall to the target VPC (fixes the check)
      SubnetMappings:                           # Critical: creates firewall endpoints in the VPC
        - SubnetId: <example_resource_id>

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = networkfirewall_in_all_vpc. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

Network Firewall has deletion protection enabled Network Firewall has logging enabled

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires