# Ensure VPC Has Network Firewall Enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1788890043210117-ensure-vpc-has-network-firewall-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Cloud](https://support.icompaas.com/support/solutions/c_1788889426924716) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1788889470630116)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Virtual Private Cloud (VPC) network traffic is inspected by AWS Network Firewall, providing stateful, rule-based inspection and filtering of traffic entering, leaving, or moving between subnets within the VPC.

**Rationale**

Security groups and network ACLs provide basic, stateless or connection-level traffic filtering, but they do not offer deep packet inspection, intrusion detection/prevention signatures, domain-based filtering, or centralized, auditable rule management across a fleet of VPCs. AWS Network Firewall provides a managed, stateful firewall with support for suricata-compatible rules, enabling more sophisticated traffic inspection and centralized policy enforcement, which is often required for regulated workloads or organizations wanting defense-in-depth beyond security groups alone.

**Impact**

-   Provides stateful, rule-based traffic inspection and filtering beyond what security groups and NACLs offer
    
-   Enables centralized, auditable firewall policy management across VPCs
    
-   Introduces additional cost (per endpoint-hour and per GB processed) and requires careful routing configuration to insert the firewall correctly in the traffic path
    

**Default Value**

AWS Network Firewall is not deployed by default in any VPC; it must be explicitly created, associated with subnets, and integrated into the VPC's route tables.

**Pre-Requisites**

-   A dedicated firewall subnet in the VPC, separate from workload subnets
    
-   IAM permissions to create and manage Network Firewall resources (network-firewall:CreateFirewall, network-firewall:CreateFirewallPolicy, ec2:CreateRoute)
    
-   A documented rule set (domain lists, 5-tuple rules, or Suricata-compatible rules) reflecting the organization's traffic filtering requirements
    

**Test Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon VPC > Network Firewall > Firewalls.
    
3.  Verify that a firewall exists and is associated with the VPC in scope.
    
4.  Review the firewall's associated Firewall policy and confirm it contains the expected stateful and/or stateless rule groups.
    
5.  Review the VPC's route tables to confirm traffic is actually being routed through the firewall endpoint(s) as intended (for example, internet-bound traffic from workload subnets routes via the firewall subnet).
    
6.  If no Network Firewall is deployed, or traffic is not actually routed through it, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to Amazon VPC > Network Firewall > Firewall policies and create a policy, defining stateless and/or stateful rule groups reflecting the required traffic filtering rules.
    
3.  Navigate to Firewalls and select Create firewall, associating it with the target VPC, a dedicated firewall subnet in each Availability Zone in use, and the policy created above.
    
4.  Update the route tables for the workload subnets so that relevant traffic (for example, 0.0.0.0/0 for internet-bound traffic) routes to the firewall endpoint, and update the firewall subnet's route table to forward traffic onward to the internet gateway or NAT gateway as appropriate.
    
5.  Verify traffic flows correctly through the firewall and that expected rule group actions (pass, drop, alert) are being applied by reviewing Network Firewall logging (if configured to a destination such as CloudWatch Logs or S3).
    

**Backout Plan**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Navigate to the affected VPC's route tables and remove the routes directing traffic through the Network Firewall endpoint, restoring the previous direct routing.
    
3.  Navigate to Amazon VPC > Network Firewall > Firewalls and delete the firewall resource if it is no longer needed.
    

**Reference**

-   [https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html](https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.