# Ensure VPC has Network Firewall enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292245287554-ensure-vpc-has-network-firewall-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that every VPC in use has an AWS Network Firewall associated with it. AWS Network Firewall is a managed, stateful firewall that inspects and filters traffic entering, leaving and moving within a VPC using stateless and stateful rules. A VPC is considered in use when it contains at least one network interface; VPCs with no network interfaces are not evaluated.

**Rationale**

Without a network firewall, VPC traffic is controlled only by security groups and network ACLs, with no deep packet inspection or central policy enforcement. This makes it easier for malware or attackers to exfiltrate data, reach command-and-control servers and move laterally between workloads unnoticed. Deploying AWS Network Firewall with a default-deny posture, least-privilege rules, restricted egress and logging adds a layer of defense and visibility.

**Impact**

-   Adds deep traffic inspection and central filtering for the VPC
    
-   Network Firewall is charged per firewall endpoint hour and per GB of traffic processed
    
-   Traffic is inspected only after the VPC route tables are changed to send it through the firewall endpoints; incorrect routes or rules can block legitimate traffic
    
-   A firewall is required inside each VPC; a centralized inspection design in a separate VPC does not meet this requirement for the other VPCs
    

**Default Value**

No AWS Network Firewall is deployed in a VPC by default.

**Pre-Requisites**

-   IAM permissions: ec2:DescribeVpcs, ec2:DescribeNetworkInterfaces, ec2:DescribeSubnets, network-firewall:ListFirewalls, network-firewall:DescribeFirewall, network-firewall:CreateFirewallPolicy, network-firewall:CreateFirewall, network-firewall:DeleteFirewall, plus ec2:CreateRoute and ec2:ReplaceRoute for routing changes
    
-   A dedicated firewall subnet in each Availability Zone to protect, not used by other workloads
    
-   A firewall policy and rule groups that match the traffic the workloads need
    
-   A network design and maintenance window for the route table changes
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon VPC console and select **Firewalls** under **Network Firewall**.
    
3.  Note the VPC of each firewall.
    
4.  Select **Your VPCs** and compare the list of VPCs with the noted VPCs.
    
5.  Repeat for each region in use.
    
6.  If a VPC that contains network interfaces has no firewall, follow the implementation steps.
    

**CLI:**

List the VPCs in a region:

aws ec2 describe-vpcs --region <REGION> --query "Vpcs\[\].\[VpcId,IsDefault,CidrBlock\]" --output table

Check whether a VPC is in use (has network interfaces):

aws ec2 describe-network-interfaces --region <REGION> --filters Name=vpc-id,Values=<VPC\_ID> --query "NetworkInterfaces\[\].NetworkInterfaceId"

List the firewalls deployed in a VPC:

aws network-firewall list-firewalls --vpc-ids <VPC\_ID> --region <REGION> --query "Firewalls\[\].\[FirewallName,FirewallArn\]" --output table

A VPC fails if it has at least one network interface and no Network Firewall is deployed in it.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon VPC console and select **Firewalls** under **Network Firewall**.
    
3.  Choose **Create firewall** and enter a name.
    
4.  Select the VPC and, for each Availability Zone to protect, the dedicated firewall subnet.
    
5.  Select an existing firewall policy, or create a new one with the required rule groups.
    
6.  Choose **Create firewall** and wait until the firewall status is **Ready**.
    
7.  Update the VPC route tables (for example, the internet gateway and workload subnet route tables) to send traffic through the firewall endpoints.
    
8.  Repeat for each VPC in use in each region in use.
    

**CLI:**

Save the following minimal firewall policy as firewall-policy.json (it forwards all traffic to stateful inspection; add stateful rule groups for your traffic):

{"StatelessDefaultActions":\["aws:forward\_to\_sfe"\],"StatelessFragmentDefaultActions":\["aws:forward\_to\_sfe"\]}

Create the firewall policy:

aws network-firewall create-firewall-policy --firewall-policy-name <FIREWALL\_POLICY\_NAME> --firewall-policy file://firewall-policy.json --region <REGION>

Create the firewall in the VPC, with one subnet mapping for each Availability Zone to protect:

aws network-firewall create-firewall --firewall-name <FIREWALL\_NAME> --firewall-policy-arn <FIREWALL\_POLICY\_ARN> --vpc-id <VPC\_ID> --subnet-mappings SubnetId=<FIREWALL\_SUBNET\_ID\_1> SubnetId=<FIREWALL\_SUBNET\_ID\_2> --region <REGION>

Get the firewall endpoint IDs to use as route targets:

aws network-firewall describe-firewall --firewall-name <FIREWALL\_NAME> --region <REGION> --query "FirewallStatus.SyncStates"

**Backout Plan**

Before making changes, save the current route tables of the VPC:

aws ec2 describe-route-tables --region <REGION> --filters Name=vpc-id,Values=<VPC\_ID> > route-tables-backup.json

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon VPC console and restore the original routes in each changed route table from the saved backup.
    
3.  Select **Firewalls** under **Network Firewall** and select the firewall.
    
4.  If delete protection is enabled, turn it off.
    
5.  Choose **Delete** and confirm.
    

**CLI:**

aws network-firewall delete-firewall --firewall-name <FIREWALL\_NAME> --region <REGION>

Note: restore the original routes before deleting the firewall, otherwise traffic routed to the firewall endpoints is dropped. Rolling back removes traffic inspection from the VPC.

**Reference**

-   [https://docs.aws.amazon.com/network-firewall/latest/developerguide/vpc-config.html](https://docs.aws.amazon.com/network-firewall/latest/developerguide/vpc-config.html)
    
-   [https://docs.aws.amazon.com/network-firewall/latest/developerguide/setting-up.html](https://docs.aws.amazon.com/network-firewall/latest/developerguide/setting-up.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/network-firewall/create-firewall.html](https://docs.aws.amazon.com/cli/latest/reference/network-firewall/create-firewall.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.