Ensure Network firewall resides in a dedicated subnet

Risk Level: Medium
Cloud Entity: AWS Network-Firewall
CloudGuard Rule ID: D9.AWS.NET.65
Covered by Spectral: Yes
Category: Networking & Content Delivery

GSL LOGIC

NetworkFirewall should have subnetMappings contain-all [getResource('Subnet', subnetId) contain [cidr numberOfHosts() <=15]]

REMEDIATION

From Command Line
To set Networks firewall in a new subnet, you should create a small subnet in the availability zone where you want the network firewall.

1. Afterwards, you need to temporary disable subnet change protection with the following CLI command:

aws network-firewall update-subnet-change-protection --firewall-arn FW_ARN --no-subnet-change-protection

Note: The flag --no-subnet-change-protection will set the subnet change protection to FALSE.

2. Use below command to associate the network firewall with the new subnet:

aws network-firewall associate-subnets --firewall-arn FW_ARN --subnet-mappings SubnetId=SUBNET_ID

3. Use below command to disassociate the previous subnet from the network firewall:

aws network-firewall disassociate-subnets --firewall-arn FW_ARN --subnet-ids SUBNET_ID

Note: Dont forget to enable subnet change protection when you finish:

aws network-firewall update-subnet-change-protection --firewall-arn FW_ARN --subnet-change-protection

References

1. https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-vpc.html
2. https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall/
3. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/network-firewall/update-subnet-change-protection.html
4. https://awscli.amazonaws.com/v2/documentation/api/latest/reference/network-firewall/associate-subnets.html

AWS Network-Firewall

AWS Network Firewall is a managed service that makes it easy to deploy essential network protections for all of your Amazon Virtual Private Clouds (VPCs). AWS Network Firewall's flexible rules engine lets you define firewall rules that give you fine-grained control over network traffic, such as blocking outbound Server Message Block (SMB) requests to prevent the spread of malicious act

Compliance Frameworks

• AWS CIS Controls V 8
• AWS CSA CCM v.4.0.1
• AWS CloudGuard Best Practices
• AWS CloudGuard SOC2 based on AICPA TSC 2017
• AWS HITRUST v11.0.0
• AWS ISO27001:2022
• AWS MITRE ATT&CK Framework v10
• AWS MITRE ATT&CK Framework v11.3
• AWS NIST 800-53 Rev 5
• CloudGuard AWS All Rules Ruleset