🛡️ AWS Network Firewall Policy is not associated with a rule group🟢

• Contextual name: 🛡️ Policy is not associated with a rule group🟢
• ID: /ce/ca/aws/network-firewall/policy-rule-group-association
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: RELIABILITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 AWS NetworkFirewall Firewall Policy
  • 🔌 AWS NetworkFirewall Firewall Policy - object.extracts.yaml
  • 🧪 test-data.json

Similar Policies

• AWS Security Hub: [NetworkFirewall.3] Network Firewall policies should have at least one rule group associated

Description

Open File

Description

This policy identifies AWS Network Firewall Policies that are not associated with at least one stateless or stateful rule group.

Rationale

An AWS Network Firewall policy serves as a container for stateless and stateful rule groups. While the policy defines default actions, such as how traffic is handled when no rules match, the actual inspection, filtering, and enforcement logic is implemented within the rule groups themselves. A firewall policy without any associated rule groups provides minimal security value and may indicate an incomplete or misconfigured firewall setup, potentially allowing network traffic to pass without proper inspection or control.

Audit

This policy flags an AWS NetworkFirewall Firewall Policy as INCOMPLIANT if it is not associated with at least one AWS Network Firewall Rule Group.

Firewall Policies that are not in ACTIVE Firewall Policy Status are marked as INAPPLICABLE.

Remediation

Open File

Remediation

Associate the Network Firewall Policy with a Rule Group

To ensure effective traffic inspection and enforcement, associate the AWS Network Firewall policy with at least one stateless or stateful rule group.

From Command Line

When updating a firewall policy, you must supply the current UpdateToken to avoid conflicting updates.

First, retrieve the current update token:

aws network-firewall describe-firewall-policy \
    --firewall-policy-arn {{policy-arn}} \
    --query UpdateToken \
    --output text

Associate a Stateless Rule Group

aws network-firewall update-firewall-policy \
    --update-token {{update-token}} \
    --firewall-policy-arn {{firewall-policy-arn}} \
    --firewall-policy '{
        "StatelessRuleGroupReferences": [
            {
                "ResourceArn": "{{stateless-rule-group-arn}}",
                "Priority": 100
            }
        ]
    }'

Associate a Stateful Rule Group

aws network-firewall update-firewall-policy \
    --update-token {{update-token}} \

... [see more](remediation.md)

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 AWS Foundational Security Best Practices v1.0.0 → 💼 [NetworkFirewall.3] Network Firewall policies should have at least one rule group associated			1		no data
💼 Cloudaware Framework → 💼 System Configuration			61		no data
💼 FedRAMP High Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)	3	1	37		no data
💼 FedRAMP Low Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)			36		no data
💼 FedRAMP Moderate Security Controls → 💼 CM-2 Baseline Configuration (L)(M)(H)	3		37		no data
💼 NIST SP 800-53 Revision 5 → 💼 CA-9(1) Internal System Connections _ Compliance Checks			43		no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-2 Baseline Configuration	7		36		no data