Ensure Network firewall have policy change protection enabled

Risk Level: High
Cloud Entity: AWS Network-Firewall
CloudGuard Rule ID: D9.TF.AWS.NET.64
Covered by Spectral: No
Category: Networking & Content Delivery

GSL LOGIC

aws_networkfirewall_firewall should have firewall_policy_change_protection=true

REMEDIATION

In order to set Networks firewall PolicyChangeProtection to TRUE, use to following CLI command:
aws network-firewall update-firewall-policy-change-protection --firewall-arn <FW arn> --firewall-policy-change-protection
The flag --firewall-policy-change-protection will set the policy change protection to TRUE.

From TF

resource "aws_networkfirewall_firewall" "example" {
	- firewall_policy_change_protection = false
	+ firewall_policy_change_protection = true
}

For more information: https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_UpdateFirewallPolicyChangeProtection.html
CLI: https://awscli.amazonaws.com/v2/documentation/api/latest/reference/network-firewall/update-firewall-policy-change-protection.html

AWS Network-Firewall

AWS Network Firewall is a managed service that makes it easy to deploy essential network protections for all of your Amazon Virtual Private Clouds (VPCs).AWS Network Firewall���s flexible rules engine lets you define firewall rules that give you fine-grained control over network traffic, such as blocking outbound Server Message Block (SMB) requests to prevent the spread of malicious act

Compliance Frameworks

• Terraform AWS CIS Foundations