Back to Checks
aws

Network Firewall policy has at least one rule group associated

networkfirewall_policy_rule_group_associated
Service: networkfirewallSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:AwsNetworkFirewallFirewall

Network Firewall policies have one or more stateful or stateless rule groups associated to define packet inspection and handling.

Policies with no rule groups are identified.

Prowler logoProwlerprowler-provider-aws

Risk

Without rule groups, traffic isn't meaningfully inspected, allowing unauthorized flows across VPC boundaries.

Impacts:

  • Confidentiality: data exfiltration
  • Integrity: unauthorized changes via exposed services
  • Availability: C2, scanning, or DoS traffic passes; enables lateral movement

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks networkfirewall_policy_rule_group_associated

Recommendation

Associate appropriate stateful and stateless rule groups with every policy.

  • Enforce a deny-by-default posture (least privilege)
  • Use vetted managed rule groups as a baseline, then tailor to workloads
  • Review and test regularly; version rules, monitor logs, and require change control

Remediation

Terraform

# Attach at least one rule group to a Network Firewall policy
resource "aws_networkfirewall_firewall_policy" "<example_resource_name>" {
  name = "<example_resource_name>"

  firewall_policy {
    stateless_default_actions          = ["aws:forward_to_sfe"]
    stateless_fragment_default_actions = ["aws:forward_to_sfe"]

    # Critical: Associate at least one rule group with the policy to pass the check
    stateful_rule_group_reference {
      resource_arn = "<example_resource_arn>"  # Critical line: references an existing rule group ARN
    }
  }
}

NativeIaC

# CloudFormation: Attach at least one rule group to a Network Firewall policy
Resources:
  FirewallPolicy:
    Type: AWS::NetworkFirewall::FirewallPolicy
    Properties:
      FirewallPolicyName: <example_resource_name>
      FirewallPolicy:
        StatelessDefaultActions:
          - aws:forward_to_sfe
        StatelessFragmentDefaultActions:
          - aws:forward_to_sfe
        # Critical: Associate at least one rule group with the policy to pass the check
        StatefulRuleGroupReferences:
          - ResourceArn: <example_resource_arn>  # Critical line: references an existing rule group ARN

Other

1Open the AWS Console and go to VPC > Network Firewall > Firewall policies
2Select the target firewall policy
3In Stateful rule groups (or Stateless rule groups), choose Add rule groups (or Add managed stateful/stateless rule groups)
4Select at least one existing rule group and choose Add to policy
5Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.networkfirewall.networkfirewall_client import (
    networkfirewall_client,
)


class networkfirewall_policy_rule_group_associated(Check):
    def execute(self):
        findings = []
        for firewall in networkfirewall_client.network_firewalls.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=firewall)
            report.status = "PASS"
            report.status_extended = f"Network Firewall {firewall.name} policy has at least one rule group associated."

            if not firewall.stateful_rule_groups and not firewall.stateless_rule_groups:
                report.status = "FAIL"
                report.status_extended = f"Network Firewall {firewall.name} policy does not have rule groups associated."

            findings.append(report)

        return findings

References