Back to Checks
linode

Linode Cloud Firewall is assigned to devices

networking_firewall_assigned_to_devices
Service: networkingSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposed
Resource Type:NotDefined

Linode Cloud Firewalls are checked to verify each one is attached to at least one device, such as a Linode instance or NodeBalancer. A firewall only filters traffic for the resources it is assigned to, so an unassigned firewall enforces no protection at all.

Prowler logoProwlerprowler-provider-linode

Risk

An unassigned firewall provides no protection to running workloads, leaving their network exposure governed only by default behavior. This commonly signals a misconfigured control where operators assume traffic is filtered when it is not, raising the risk of unauthorized network access to unprotected instances.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler linode --checks networking_firewall_assigned_to_devices

Recommendation

Attach each firewall to applicable Linode devices, such as Linodes or NodeBalancers, to enforce intended network controls.

Remediation

Other

1Log in to the Linode Cloud Manager
2Navigate to Firewalls
3Select the associated firewall
4Click on either the Linodes or Nodebalancers tab and add those devices to the firewall

Check Code

from prowler.lib.check.models import Check, CheckReportLinode
from prowler.lib.logger import logger
from prowler.providers.linode.services.networking.networking_client import (
    networking_client,
)


class networking_firewall_assigned_to_devices(Check):
    """Check if Linode Cloud Firewalls are assigned to at least one device."""

    def execute(self) -> list[CheckReportLinode]:
        """Execute the networking_firewall_assigned_to_devices check.

        Iterates over all Cloud Firewalls and checks whether each one is
        assigned to at least one device.

        Returns:
            list[CheckReportLinode]: A list of findings for each firewall.
        """
        findings = []

        for fw in networking_client.firewalls:
            # When the device count could not be determined (the devices fetch
            # failed) skip the firewall instead of reporting a false FAIL.
            if fw.attached_devices_count is None:
                logger.warning(
                    f"firewall - Skipping firewall '{fw.label}' ({fw.id}): "
                    "device assignment could not be determined."
                )
                continue

            report = CheckReportLinode(
                metadata=self.metadata(),
                resource=fw,
                resource_name=fw.label,
                resource_id=str(fw.id),
                region="global",
            )
            report.resource_tags = fw.tags

            if fw.attached_devices_count > 0:
                report.status = "PASS"
                report.status_extended = f"Firewall '{fw.label}' is assigned to {fw.attached_devices_count} device(s)."
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Firewall '{fw.label}' is not assigned to any device."
                )

            findings.append(report)

        return findings

References