Network Firewall firewall is deployed across multiple Availability Zones

networkfirewall_multi_az

Service: networkfirewallSeverity: high

OfficialBuilt-inVerified

Categories:resilience

Resource Type:AwsNetworkFirewallFirewall

AWS Network Firewall firewalls are assessed for multi-AZ deployment, expecting subnet mappings in more than one Availability Zone.

A configuration with only one subnet mapping indicates a single-AZ firewall.

Prowler prowler-provider-aws

Risk

Single-AZ firewalls are a single point of failure. An AZ outage can drop or blackhole traffic, degrading availability, or prompt route changes that bypass inspection, exposing confidentiality and integrity to unfiltered access, data exfiltration, and lateral movement.

Run this check with Prowler

Run in Prowler Cloud

Run

prowler aws --checks networkfirewall_multi_az

Recommendation

Deploy firewalls across >=2 AZs with a dedicated subnet in each used AZ. Maintain per-AZ, symmetric routing to the local endpoint to preserve stateful inspection. Apply defense in depth and automate drift controls and AZ failover tests to sustain resilience.

Remediation

CLI

aws network-firewall associate-subnets --firewall-arn <FIREWALL_ARN> --subnet-mappings SubnetId=<SUBNET_ID_IN_DIFFERENT_AZ>

Terraform

# Terraform: Add a second subnet_mapping to deploy the firewall across multiple AZs
resource "aws_networkfirewall_firewall" "<example_resource_name>" {
  name                = "<example_resource_name>"
  firewall_policy_arn = "<example_firewall_policy_arn>"
  vpc_id              = "<example_vpc_id>"

  subnet_mapping {
    subnet_id = "<subnet-id-1>"
  }

  subnet_mapping {
    subnet_id = "<subnet-id-2>"  # CRITICAL: second subnet in a different AZ for multi-AZ
  }
}

NativeIaC

# CloudFormation: Ensure the firewall spans multiple AZs by adding a second subnet mapping
Resources:
  <example_resource_name>:
    Type: AWS::NetworkFirewall::Firewall
    Properties:
      FirewallName: <example_resource_name>
      FirewallPolicyArn: <example_firewall_policy_arn>
      VpcId: <example_vpc_id>
      SubnetMappings:
        - SubnetId: <subnet-id-1>
        - SubnetId: <subnet-id-2>  # CRITICAL: second subnet in a different AZ to achieve multi-AZ

Other

1Open the AWS Console and go to VPC > Network Firewall > Firewalls

2Select your firewall and open the Firewall details tab

3In Associated policy and VPC, click Edit

4Click Add new subnet, choose an additional Availability Zone and its subnet in the same VPC

5Ensure at least two AZs are selected, then click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.networkfirewall.networkfirewall_client import (
    networkfirewall_client,
)


class networkfirewall_multi_az(Check):
    def execute(self):
        findings = []
        for firewall in networkfirewall_client.network_firewalls.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=firewall)
            report.status = "FAIL"
            report.status_extended = (
                f"Network Firewall {firewall.name} is not deployed across multiple AZ."
            )

            if len(firewall.subnet_mappings) > 1:
                report.status = "PASS"
                report.status_extended = (
                    f"Network Firewall {firewall.name} is deployed across multiple AZ."
                )

            findings.append(report)

        return findings