Back to Checks
aws

Network Firewall firewall policy default stateless action for full packets is drop or forward

networkfirewall_policy_default_action_full_packets
Service: networkfirewallSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:AwsNetworkFirewallFirewall

AWS Network Firewall policies define a stateless default action for full packets. This evaluates whether unmatched packets are handled by aws:drop or aws:forward_to_sfe, meaning they are either discarded or sent to the stateful engine rather than allowed to pass.

Prowler logoProwlerprowler-provider-aws

Risk

Using Pass as the default allows unmatched full packets to bypass stateless filtering and stateful inspection, enabling reconnaissance, malware delivery, and covert data exfiltration. This undermines confidentiality and integrity, and can threaten availability through unfiltered attacks.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks networkfirewall_policy_default_action_full_packets

Recommendation

Enforce a deny-by-default posture: set the stateless default for full packets to aws:drop or aws:forward_to_sfe. Use explicit allow rules, layer stateful inspection, and maintain logging and reviews to support defense in depth and least privilege.

Remediation

Terraform

# Terraform: set default stateless action for full packets to Drop
resource "aws_networkfirewall_firewall_policy" "<example_resource_name>" {
  name = "<example_resource_name>"

  firewall_policy {
    stateless_default_actions          = ["aws:drop"]  # CRITICAL: full packets default to Drop (fixes the check)
    stateless_fragment_default_actions = ["aws:drop"]  # Required for a valid policy
  }
}

NativeIaC

# CloudFormation: set default stateless action for full packets to Drop
Resources:
  <example_resource_name>:
    Type: AWS::NetworkFirewall::FirewallPolicy
    Properties:
      FirewallPolicyName: <example_resource_name>
      FirewallPolicy:
        StatelessDefaultActions:
          - aws:drop  # CRITICAL: full packets default to Drop (fixes the check)
        StatelessFragmentDefaultActions:
          - aws:drop  # Required for a valid policy

Other

1In the AWS console, open Amazon VPC
2Under Network Firewall, select Firewall policies
3Open the target firewall policy and choose Edit
4In Stateless default actions (full packets), select Drop (or Forward to stateful rule groups)
5Choose Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.networkfirewall.networkfirewall_client import (
    networkfirewall_client,
)


class networkfirewall_policy_default_action_full_packets(Check):
    def execute(self):
        findings = []
        for firewall in networkfirewall_client.network_firewalls.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=firewall)
            report.status = "FAIL"
            report.status_extended = f"Network Firewall {firewall.name} policy does not drop or forward full packets by default."

            if (
                "aws:drop" in firewall.default_stateless_actions
                or "aws:forward_to_sfe" in firewall.default_stateless_actions
            ):
                report.status = "PASS"
                report.status_extended = f"Network Firewall {firewall.name} policy does drop or forward full packets by default."

            findings.append(report)

        return findings

References