Description

Ensure that every VPC in use has an AWS Network Firewall associated with it. AWS Network Firewall is a managed, stateful firewall that inspects and filters traffic entering, leaving and moving within a VPC using stateless and stateful rules. A VPC is considered in use when it contains at least one network interface; VPCs with no network interfaces are not evaluated.

Rationale

Without a network firewall, VPC traffic is controlled only by security groups and network ACLs, with no deep packet inspection or central policy enforcement. This makes it easier for malware or attackers to exfiltrate data, reach command-and-control servers and move laterally between workloads unnoticed. Deploying AWS Network Firewall with a default-deny posture, least-privilege rules, restricted egress and logging adds a layer of defense and visibility.

Impact

  • Adds deep traffic inspection and central filtering for the VPC

  • Network Firewall is charged per firewall endpoint hour and per GB of traffic processed

  • Traffic is inspected only after the VPC route tables are changed to send it through the firewall endpoints; incorrect routes or rules can block legitimate traffic

  • A firewall is required inside each VPC; a centralized inspection design in a separate VPC does not meet this requirement for the other VPCs

Default Value

No AWS Network Firewall is deployed in a VPC by default.

Pre-Requisites

  • IAM permissions: ec2:DescribeVpcs, ec2:DescribeNetworkInterfaces, ec2:DescribeSubnets, network-firewall:ListFirewalls, network-firewall:DescribeFirewall, network-firewall:CreateFirewallPolicy, network-firewall:CreateFirewall, network-firewall:DeleteFirewall, plus ec2:CreateRoute and ec2:ReplaceRoute for routing changes

  • A dedicated firewall subnet in each Availability Zone to protect, not used by other workloads

  • A firewall policy and rule groups that match the traffic the workloads need

  • A network design and maintenance window for the route table changes

Remediation

Test Plan

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon VPC console and select Firewalls under Network Firewall.

  3. Note the VPC of each firewall.

  4. Select Your VPCs and compare the list of VPCs with the noted VPCs.

  5. Repeat for each region in use.

  6. If a VPC that contains network interfaces has no firewall, follow the implementation steps.

CLI:

List the VPCs in a region:

aws ec2 describe-vpcs --region <REGION> --query "Vpcs[].[VpcId,IsDefault,CidrBlock]" --output table

Check whether a VPC is in use (has network interfaces):

aws ec2 describe-network-interfaces --region <REGION> --filters Name=vpc-id,Values=<VPC_ID> --query "NetworkInterfaces[].NetworkInterfaceId"

List the firewalls deployed in a VPC:

aws network-firewall list-firewalls --vpc-ids <VPC_ID> --region <REGION> --query "Firewalls[].[FirewallName,FirewallArn]" --output table

A VPC fails if it has at least one network interface and no Network Firewall is deployed in it.

Implementation Steps

Console:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon VPC console and select Firewalls under Network Firewall.

  3. Choose Create firewall and enter a name.

  4. Select the VPC and, for each Availability Zone to protect, the dedicated firewall subnet.

  5. Select an existing firewall policy, or create a new one with the required rule groups.

  6. Choose Create firewall and wait until the firewall status is Ready.

  7. Update the VPC route tables (for example, the internet gateway and workload subnet route tables) to send traffic through the firewall endpoints.

  8. Repeat for each VPC in use in each region in use.

CLI:

Save the following minimal firewall policy as firewall-policy.json (it forwards all traffic to stateful inspection; add stateful rule groups for your traffic):

{"StatelessDefaultActions":["aws:forward_to_sfe"],"StatelessFragmentDefaultActions":["aws:forward_to_sfe"]}

Create the firewall policy:

aws network-firewall create-firewall-policy --firewall-policy-name <FIREWALL_POLICY_NAME> --firewall-policy file://firewall-policy.json --region <REGION>

Create the firewall in the VPC, with one subnet mapping for each Availability Zone to protect:

aws network-firewall create-firewall --firewall-name <FIREWALL_NAME> --firewall-policy-arn <FIREWALL_POLICY_ARN> --vpc-id <VPC_ID> --subnet-mappings SubnetId=<FIREWALL_SUBNET_ID_1> SubnetId=<FIREWALL_SUBNET_ID_2> --region <REGION>

Get the firewall endpoint IDs to use as route targets:

aws network-firewall describe-firewall --firewall-name <FIREWALL_NAME> --region <REGION> --query "FirewallStatus.SyncStates"

Backout Plan

Before making changes, save the current route tables of the VPC:

aws ec2 describe-route-tables --region <REGION> --filters Name=vpc-id,Values=<VPC_ID> > route-tables-backup.json

To roll back:

  1. Sign in to the AWS Management Console at https://console.aws.amazon.com.

  2. Open the Amazon VPC console and restore the original routes in each changed route table from the saved backup.

  3. Select Firewalls under Network Firewall and select the firewall.

  4. If delete protection is enabled, turn it off.

  5. Choose Delete and confirm.

CLI:

aws network-firewall delete-firewall --firewall-name <FIREWALL_NAME> --region <REGION>

Note: restore the original routes before deleting the firewall, otherwise traffic routed to the firewall endpoints is dropped. Rolling back removes traffic inspection from the VPC.

Reference