Skip to main content

🛡️ AWS Network Firewall Policy Stateless Default Action is not Drop or Forward🟢

  • Contextual name: 🛡️ Policy Stateless Default Action is not Drop or Forward🟢
  • ID: /ce/ca/aws/network-firewall/policy-default-stateless-action
  • Tags:
  • Policy Type: COMPLIANCE_POLICY
  • Policy Categories: RELIABILITY

Logic​

Similar Policies​

Description​

Open File

Description​

This policy identifies AWS Network Firewall Policies where the default action for stateless traffic, packets that do not match any configured stateless rules, is set to Pass.

Rationale​

In AWS Network Firewall, stateless rules are evaluated before stateful rules. When a packet does not match any stateless rule, the firewall applies the configured Stateless Default Action:

  • aws:drop: Blocks the traffic.
  • aws:forward_to_sfe: Forwards the traffic to the stateful engine for deeper inspection, such as signature-based detection and domain filtering.
  • aws:pass: Allows the traffic to reach its destination without additional inspection.

Configuring the stateless default action as Pass introduces a security gap by allowing unmatched traffic to bypass both stateless controls and the stateful inspection engine. This may result in insufficient enforcement of network security policies.

Impact​

Malicious or unauthorized traffic may enter the network if stateless rules do not explicitly account for all unwanted traffic patterns.

... see more

Remediation​

Open File

Remediation​

Update the Stateless Default Action​

To prevent stateless traffic from bypassing inspection, update the AWS Network Firewall policy to use a secure stateless default action, such as forwarding unmatched traffic to the stateful engine.

From Command Line​

When updating a firewall policy, you must provide the current UpdateToken to avoid conflicting changes.

First, retrieve the current update token:

aws network-firewall describe-firewall-policy \
    --firewall-policy-arn {{firewall-policy-arn}} \
    --query UpdateToken \
    --output text

Next, update the firewall policy to set secure stateless default actions:

aws network-firewall update-firewall-policy \
    --update-token {{update-token}} \
    --firewall-policy-arn {{firewall-policy-arn}} \
    --firewall-policy '{
        "StatelessDefaultActions": ["aws:forward_to_sfe"],
        "StatelessFragmentDefaultActions": ["aws:forward_to_sfe"]
    }'

Alternatively, you may use aws:drop to block unmatched stateless traffic, depending on your security requirements.

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets1no data
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets1no data
💼 Cloudaware Framework → 💼 System Configuration61no data
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)3137no data
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)36no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)337no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks43no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration736no data