Description

This control verifies whether the default stateless action for fragmented packets in a Network Firewall policy is set to aws:drop or aws:forward_to_sfe. The control fails if the default stateless action is aws:pass.

A firewall policy determines how traffic is monitored and managed within an Amazon VPC. It includes stateless and stateful rule groups to filter packets and regulate traffic flow. Setting the default action to aws:pass could allow unintended traffic.

Remediation

For guidance on configuring firewall logging, refer to the Updating a firewall policy in AWS Network Firewall section of the AWS Network Firewall Developer Guide.