Check ID: networkfirewall_policy_rule_group_associated
Provider: AWS
Service: networkfirewall
Severity: HIGH
Categories: trust-boundaries
Resource type: AwsNetworkFirewallFirewall

​
What this check verifies

Network Firewall policies have one or more stateful or stateless rule groups associated to define packet inspection and handling. Policies with no rule groups are identified.

​
Risk

Without rule groups, traffic isn’t meaningfully inspected, allowing unauthorized flows across VPC boundaries. Impacts:
  • Confidentiality: data exfiltration
  • Integrity: unauthorized changes via exposed services
  • Availability: C2, scanning, or DoS traffic passes; enables lateral movement

​
Recommendation

Associate appropriate stateful and stateless rule groups with every policy.
  • Enforce a deny-by-default posture (least privilege)
  • Use vetted managed rule groups as a baseline, then tailor to workloads
  • Review and test regularly; version rules, monitor logs, and require change control

​
Remediation

# Attach at least one rule group to a Network Firewall policy
resource "aws_networkfirewall_firewall_policy" "<example_resource_name>" {
  name = "<example_resource_name>"

  firewall_policy {
    stateless_default_actions          = ["aws:forward_to_sfe"]
    stateless_fragment_default_actions = ["aws:forward_to_sfe"]

    # Critical: Associate at least one rule group with the policy to pass the check
    stateful_rule_group_reference {
      resource_arn = "<example_resource_arn>"  # Critical line: references an existing rule group ARN
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = networkfirewall_policy_rule_group_associated. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks