Check ID: networkfirewall_policy_default_action_full_packets
Provider: AWS
Service: networkfirewall
Severity: HIGH
Categories: trust-boundaries
Resource type: AwsNetworkFirewallFirewall

​
What this check verifies

AWS Network Firewall policies define a stateless default action for full packets. This evaluates whether unmatched packets are handled by aws:drop or aws:forward_to_sfe, meaning they are either discarded or sent to the stateful engine rather than allowed to pass.

​
Risk

Using Pass as the default allows unmatched full packets to bypass stateless filtering and stateful inspection, enabling reconnaissance, malware delivery, and covert data exfiltration. This undermines confidentiality and integrity, and can threaten availability through unfiltered attacks.

​
Recommendation

Enforce a deny-by-default posture: set the stateless default for full packets to aws:drop or aws:forward_to_sfe. Use explicit allow rules, layer stateful inspection, and maintain logging and reviews to support defense in depth and least privilege.

​
Remediation

# Terraform: set default stateless action for full packets to Drop
resource "aws_networkfirewall_firewall_policy" "<example_resource_name>" {
  name = "<example_resource_name>"

  firewall_policy {
    stateless_default_actions          = ["aws:drop"]  # CRITICAL: full packets default to Drop (fixes the check)
    stateless_fragment_default_actions = ["aws:drop"]  # Required for a valid policy
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = networkfirewall_policy_default_action_full_packets. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks