🧠 AWS Network Firewall Policy Stateless Default Action is not Drop or Forward - prod.logic.yaml🟢

• Contextual name: 🧠 prod.logic.yaml🟢
• ID: /ce/ca/aws/network-firewall/policy-default-stateless-action/prod.logic.yaml
• Tags:
  • 🟢 Logic test success
  • 🟢 Logic with extracts
  • 🟢 Logic with test data

Uses

• 📗 AWS NetworkFirewall Firewall Policy
• 🔌 AWS NetworkFirewall Firewall Policy - object.extracts.yaml
• 🧪 test-data.json

Test Results 🟢

Generated at: 2026-01-17T12:02:55.272052525Z Open

Result	Id	Condition Index	Condition Text	Runtime Error
🟢	test1	✔️ 99	✔️ isDisappeared(CA10A2__disappearanceTime__c)	✔️ null
🟢	test2	✔️ 101	✔️ CA10A2__firewallPolicyStatus__c.delegatedTo(CA10A2__firewallPolicyStatus__c).isEmpty()	✔️ null
🟢	test3	✔️ 199	✔️ extract('CA10A2__firewallPolicyStatus__c') != 'ACTIVE'	✔️ null
🟢	test4	✔️ 299	✔️ extract('CA10A2__statelessDefaultActions__c').contains('aws:pass')	✔️ null
🟢	test5	✔️ 299	✔️ extract('CA10A2__statelessDefaultActions__c').contains('aws:pass')	✔️ null
🟢	test6	✔️ 499	✔️ extract('CA10A2__statelessDefaultActions__c').asSetOfText('\n').containsAny(setOfText(['aws:drop', 'aws:forward_to_sfe'])) && extract('CA10A2__statelessFragmentDefaultActions__c').asSetOfText('\n').containsAny(setOfText(['aws:drop', 'aws:forward_to_sfe']))	✔️ null
🟢	test7	✔️ 499	✔️ extract('CA10A2__statelessDefaultActions__c').asSetOfText('\n').containsAny(setOfText(['aws:drop', 'aws:forward_to_sfe'])) && extract('CA10A2__statelessFragmentDefaultActions__c').asSetOfText('\n').containsAny(setOfText(['aws:drop', 'aws:forward_to_sfe']))	✔️ null

Generation Bundle

	File	MD5
Open	/ce/ca/aws/network-firewall/policy-default-stateless-action/policy.yaml	46123524041C690D9397EA834C36E2EB
Open	/ce/ca/aws/network-firewall/policy-default-stateless-action/prod.logic.yaml	B58CDFF33BFC370BE23DDA0AEDD606E6
Open	/ce/ca/aws/network-firewall/policy-default-stateless-action/test-data.json	5E8902B39EA2CD2BBACEF32ED359A252
Open	/types/CA10A2__CaAwsNetworkFirewallFirewallPolicy__c/object.extracts.yaml	7D78149FCF8A2F3ABE66E6CFC4C9C395

Available Commands

repo-manager policies generate FULL /ce/ca/aws/network-firewall/policy-default-stateless-action/prod.logic.yaml
repo-manager policies generate DEBUG /ce/ca/aws/network-firewall/policy-default-stateless-action/prod.logic.yaml
repo-manager policies generate CAPTURE_TEST_DATA /ce/ca/aws/network-firewall/policy-default-stateless-action/prod.logic.yaml
repo-manager policies generate TESTS /ce/ca/aws/network-firewall/policy-default-stateless-action/prod.logic.yaml
# Execute tests
repo-manager policies test /ce/ca/aws/network-firewall/policy-default-stateless-action/prod.logic.yaml

Content

Open File

---
inputType: "CA10A2__CaAwsNetworkFirewallFirewallPolicy__c"
importExtracts:
  - file: "/types/CA10A2__CaAwsNetworkFirewallFirewallPolicy__c/object.extracts.yaml"
testData:
  - file: "test-data.json"
conditions:
  - status: "INAPPLICABLE"
    currentStateMessage: "The Network Firewall Policy is not active."
    check:
      NOT_EQUAL:
        left:
          EXTRACT: "CA10A2__firewallPolicyStatus__c"
        right:
          TEXT: "ACTIVE"
  - status: "INCOMPLIANT"
    currentStateMessage: "The stateless default action is not set to Pass for full packets."
    remediationMessage: "Change the stateless default action to 'aws:drop' or\
      \ 'aws:forward_to_sfe' to ensure unintended traffic is not allowed."
    check:
      CONTAINS:
        arg:
          EXTRACT: "CA10A2__statelessDefaultActions__c"
        search:
          TEXT: "aws:pass"
  - status: "INCOMPLIANT"
    currentStateMessage: "The stateless default action is not set to Pass for fragmented packets."
    remediationMessage: "Change the stateless default action to 'aws:drop' or\
      \ 'aws:forward_to_sfe' to ensure unintended traffic is not allowed."
    check:
      CONTAINS:
        arg:
          EXTRACT: "CA10A2__statelessFragmentDefaultActions__c"
        search:
          TEXT: "aws:pass"
  - status: "COMPLIANT"
    currentStateMessage: "The stateless default action is set to Drop or Forward."
    check:
      AND:
        args:
          - CONTAINS_ANY:
              arg:
                SET_FROM:
                  separator: "\n"
                  arg:
                    EXTRACT: "CA10A2__statelessDefaultActions__c"
              search:
                SET:
                  itemType: "TEXT"
                  items:
                    - "aws:drop"
                    - "aws:forward_to_sfe"
          - CONTAINS_ANY:
              arg:
                SET_FROM:
                  separator: "\n"
                  arg:
                    EXTRACT: "CA10A2__statelessFragmentDefaultActions__c"
              search:
                SET:
                  itemType: "TEXT"
                  items:
                    - "aws:drop"
                    - "aws:forward_to_sfe"
otherwise:
  status: "UNDETERMINED"
  currentStateMessage: "Unexpected values in the fields."