Ensure Network firewall delete protection enabled

Risk Level: High
Cloud Entity: AWS Network-Firewall
CloudGuard Rule ID: D9.AWS.NET.62
Covered by Spectral: Yes
Category: Networking & Content Delivery

GSL LOGIC

NetworkFirewall should have deleteProtection=true

REMEDIATION

From Portal

1. Sign in to the AWS console
2. In the console, select the specific region
3. Navigate to the 'AWS Network Firewall' service.
4. In the left pane under 'Network Firewall' click on Firewall.
5. Select desired firewall and click on 'Firewall details'.
6. Go to 'change protection' and click on 'Edit'.
7. Choose 'enable' for Delete protection option and click 'save'.

From TF

resource "aws_networkfirewall_firewall" "example" {
	- delete_protection  = false
	+ delete_protection = true
}

From Command Line
In order to set Networks firewall delete protection to TRUE, use to following CLI command:

aws network-firewall update-firewall-delete-protection --region REGION_NAME --firewall-name FIREWALL_NAME --delete-protection

Note: The flag --delete-protection will set the deletion protection to TRUE. The firewall deletion process through the console disables this protection, Therefore it is not shown in the console. Through the API, you must explicitly disable delete protection before you can delete the firewall.

References

1. https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-settings.html
2. CLI: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/network-firewall/update-firewall-delete-protection.html

AWS Network-Firewall

AWS Network Firewall is a managed service that makes it easy to deploy essential network protections for all of your Amazon Virtual Private Clouds (VPCs).AWS Network Firewall���s flexible rules engine lets you define firewall rules that give you fine-grained control over network traffic, such as blocking outbound Server Message Block (SMB) requests to prevent the spread of malicious act

Compliance Frameworks

• AWS CIS Controls V 8
• AWS CloudGuard Best Practices
• AWS CloudGuard SOC2 based on AICPA TSC 2017
• AWS HITRUST
• AWS HITRUST v11.0.0
• AWS ISO27001:2022
• AWS ITSG-33
• AWS MITRE ATT&CK Framework v10
• AWS MITRE ATT&CK Framework v11.3
• AWS NIST 800-53 Rev 5
• CloudGuard AWS All Rules Ruleset