Check ID: networkfirewall_policy_default_action_fragmented_packets
Provider: AWS
Service: networkfirewall
Severity: HIGH
Categories: trust-boundaries
Resource type: AwsNetworkFirewallFirewall

​
What this check verifies

Network Firewall policies are assessed for the StatelessFragmentDefaultActions setting to confirm fragmented UDP packets use aws:drop or aws:forward_to_sfe.

​
Risk

Using aws:pass for fragmented UDP lets uninspected traffic traverse the firewall. Attackers can evade filters via fragmentation, enabling data exfiltration (confidentiality), payload smuggling and lateral movement (integrity), and fragment floods that strain services (availability).

​
Recommendation

Set StatelessFragmentDefaultActions to aws:drop or aws:forward_to_sfe so fragments are blocked or sent for stateful inspection. Apply least privilege on traffic flows, use defense in depth with rule groups, and monitor logs for anomalous fragmentation.

​
Remediation

resource "aws_networkfirewall_firewall_policy" "<example_resource_name>" {
  name = "<example_resource_name>"

  firewall_policy {
    stateless_default_actions          = ["aws:drop"]
    stateless_fragment_default_actions = ["aws:drop"]  # Critical: drop fragmented UDP packets by default to pass the check
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = networkfirewall_policy_default_action_fragmented_packets. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks