Back to Checks
aws

Network Firewall has logging enabled

networkfirewall_logging_enabled
Service: networkfirewallSeverity: high
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsNetworkFirewallFirewall

AWS Network Firewall has stateful engine logging configured with at least one log type (FLOW, ALERT, or TLS) and an active log destination

Prowler logoProwlerprowler-provider-aws

Risk

Absent Network Firewall logs reduce visibility and forensics. Malicious flows, C2 traffic, and data exfiltration can go undetected, impacting:

  • Confidentiality (leakage)
  • Integrity (unauthorized traffic allowed)
  • Availability (DDoS patterns unnoticed)

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks networkfirewall_logging_enabled

Recommendation

Enable comprehensive firewall logging and send FLOW, ALERT, and when applicable TLS events to a centralized, tamper-resistant destination. Apply least privilege to writers/readers, enforce encryption and retention, and integrate alerts with monitoring for defense in depth.

Remediation

CLI

aws network-firewall update-logging-configuration --firewall-arn <FIREWALL_ARN> --logging-configuration 'LogDestinationConfigs=[{LogType=FLOW,LogDestinationType=CLOUDWATCH_LOGS,LogDestination={LogGroup=<LOG_GROUP_NAME>}}]'

Terraform

resource "aws_networkfirewall_logging_configuration" "<example_resource_name>" {
  firewall_arn = "<example_resource_id>"  # CRITICAL: Targets the firewall to enable logging

  logging_configuration {
    log_destination_config {
      log_type             = "FLOW"              # CRITICAL: Enables at least one log type
      log_destination_type = "CloudWatchLogs"   # CRITICAL: Selects a valid destination type
      log_destination = {
        logGroup = "<example_log_group_name>"   # CRITICAL: Existing CloudWatch Logs group to receive logs
      }
    }
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::NetworkFirewall::LoggingConfiguration
    Properties:
      FirewallArn: <example_resource_id>  # CRITICAL: Targets the firewall to enable logging
      LoggingConfiguration:
        LogDestinationConfigs:
          - LogType: FLOW                  # CRITICAL: Enables at least one log type
            LogDestinationType: CloudWatchLogs  # CRITICAL: Selects a valid destination type
            LogDestination:
              logGroup: <example_log_group_name>  # CRITICAL: Existing CloudWatch Logs group to receive logs

Other

1Open the AWS console and go to VPC > Network Firewall > Firewalls
2Select your firewall and open the Firewall details tab
3In the Logging section, click Edit
4Enable at least one Log type (e.g., Flow)
5Choose Destination type: CloudWatch Logs and select an existing log group
6Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.networkfirewall.networkfirewall_client import (
    networkfirewall_client,
)


class networkfirewall_logging_enabled(Check):
    def execute(self):
        findings = []
        for firewall in networkfirewall_client.network_firewalls.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=firewall)
            report.status = "FAIL"
            report.status_extended = (
                f"Network Firewall {firewall.name} does not have logging enabled."
            )

            for configuration in firewall.logging_configuration:
                if configuration.log_type or configuration.log_destination:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Network Firewall {firewall.name} has logging enabled."
                    )
                    break

            findings.append(report)

        return findings

References