Network Firewall has logging enabled

Check ID: networkfirewall_logging_enabled
Provider: AWS
Service: networkfirewall
Severity: HIGH
Categories: logging
Resource type: AwsNetworkFirewallFirewall

What this check verifies

AWS Network Firewall has stateful engine logging configured with at least one log type (FLOW, ALERT, or TLS) and an active log destination

Risk

Absent Network Firewall logs reduce visibility and forensics. Malicious flows, C2 traffic, and data exfiltration can go undetected, impacting:

Confidentiality (leakage)
Integrity (unauthorized traffic allowed)
Availability (DDoS patterns unnoticed)

Recommendation

Enable comprehensive firewall logging and send FLOW, ALERT, and when applicable TLS events to a centralized, tamper-resistant destination. Apply least privilege to writers/readers, enforce encryption and retention, and integrate alerts with monitoring for defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws network-firewall update-logging-configuration --firewall-arn <FIREWALL_ARN> --logging-configuration 'LogDestinationConfigs=[{LogType=FLOW,LogDestinationType=CLOUDWATCH_LOGS,LogDestination={LogGroup=<LOG_GROUP_NAME>}}]'

resource "aws_networkfirewall_logging_configuration" "<example_resource_name>" {
  firewall_arn = "<example_resource_id>"  # CRITICAL: Targets the firewall to enable logging

  logging_configuration {
    log_destination_config {
      log_type             = "FLOW"              # CRITICAL: Enables at least one log type
      log_destination_type = "CloudWatchLogs"   # CRITICAL: Selects a valid destination type
      log_destination = {
        logGroup = "<example_log_group_name>"   # CRITICAL: Existing CloudWatch Logs group to receive logs
      }
    }
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::NetworkFirewall::LoggingConfiguration
    Properties:
      FirewallArn: <example_resource_id>  # CRITICAL: Targets the firewall to enable logging
      LoggingConfiguration:
        LogDestinationConfigs:
          - LogType: FLOW                  # CRITICAL: Enables at least one log type
            LogDestinationType: CloudWatchLogs  # CRITICAL: Selects a valid destination type
            LogDestination:
              logGroup: <example_log_group_name>  # CRITICAL: Existing CloudWatch Logs group to receive logs

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = networkfirewall_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

VPC has Network Firewall enabled Network Firewall firewall is deployed across multiple AZs

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires