Back to Checks
aws

Network Firewall has deletion protection enabled

networkfirewall_deletion_protection
Service: networkfirewallSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:AwsNetworkFirewallFirewall

AWS Network Firewall firewalls have deletion protection enabled (DeleteProtection=true).

Prowler logoProwlerprowler-provider-aws

Risk

Without deletion protection, a firewall can be removed accidentally or by a compromised identity, letting traffic bypass inspection and logging.

This threatens confidentiality and integrity via unfiltered access, and harms availability through routing disruption and loss of perimeter controls.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks networkfirewall_deletion_protection

Recommendation

Enable deletion protection on every firewall (DeleteProtection=true). Enforce least privilege to prevent delete actions, require change approval for firewall modifications, and implement guardrails with policy-as-code. Apply defense in depth so alternate controls contain traffic if a firewall is altered.

Remediation

CLI

aws network-firewall update-firewall-delete-protection --firewall-name <FIREWALL_NAME> --delete-protection

Terraform

# Terraform: enable deletion protection on a Network Firewall
resource "aws_networkfirewall_firewall" "<example_resource_name>" {
  name                = "<example_resource_name>"
  firewall_policy_arn = "<example_resource_id>"
  vpc_id              = "<example_resource_id>"

  subnet_mapping {
    subnet_id = "<example_resource_id>"
  }

  delete_protection = true  # Critical: prevents deletion to pass the check
}

NativeIaC

# CloudFormation: enable deletion protection on a Network Firewall
Resources:
  <example_resource_name>:
    Type: AWS::NetworkFirewall::Firewall
    Properties:
      FirewallName: <example_resource_name>  # Required: unique name for the firewall
      FirewallPolicyArn: <example_resource_id>
      VpcId: <example_resource_id>
      SubnetMappings:
        - SubnetId: <example_resource_id>
      DeleteProtection: true  # Critical: enables deletion protection to pass the check

Other

1Open the AWS console and go to VPC > Network Firewall > Firewalls
2Select the target firewall
3On Firewall details, choose Edit (or Change protections)
4Enable Deletion protection
5Save changes

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.networkfirewall.networkfirewall_client import (
    networkfirewall_client,
)


class networkfirewall_deletion_protection(Check):
    def execute(self):
        findings = []
        for firewall in networkfirewall_client.network_firewalls.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=firewall)
            report.status = "FAIL"
            report.status_extended = f"Network Firewall {firewall.name} does not have deletion protection enabled."
            if firewall.deletion_protection:
                report.status = "PASS"
                report.status_extended = (
                    f"Network Firewall {firewall.name} has deletion protection enabled."
                )

            findings.append(report)

        return findings

References