Network Firewall Logging Should Be Enabled

Using Console

To remediate the issue of Network Firewall Logging not being enabled for AWS EC2 instances, you can follow these steps using the AWS Management Console:

Sign in to the AWS Management Console: Go to the AWS Management Console (https://aws.amazon.com/console/) and sign in using your credentials.
Navigate to the VPC Dashboard: Click on the “Services” dropdown in the top left corner of the console and select “VPC” under the Networking & Content Delivery section.
Select the VPC: In the VPC Dashboard, select the Virtual Private Cloud (VPC) where your EC2 instances are located.
Select the Network ACLs: In the VPC Dashboard, locate the “Network ACLs” option in the left-hand menu and click on it.
Identify the Network ACL: Identify the Network Access Control List (NACL) associated with the subnet where your EC2 instances are located. Note down the NACL ID for future reference.
Edit the Network ACL: Click on the NACL ID to open the details of the Network ACL.
Add a Logging Configuration: In the Network ACL details, locate the “Network ACL entries” section and click on the “Edit” button.
Enable Logging: In the Network ACL entries configuration, find the outbound and inbound rules that you want to enable logging for. Click on each rule and check the box for “Log” to enable logging for that rule.
Save the Changes: After enabling logging for the necessary rules, click on the “Save” button to apply the changes to the Network ACL.
Verify the Configuration: Once the changes are saved, verify that the Network Firewall Logging is enabled for the selected rules by checking the “Log” column in the Network ACL entries.

By following these steps, you can successfully enable Network Firewall Logging for the Network ACL associated with your AWS EC2 instances, helping you monitor and analyze the network traffic effectively.

Using CLI

To remediate the misconfiguration of network firewall logging not being enabled for AWS EC2 instances using AWS CLI, follow these steps:

Enable VPC Flow Logs: VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC. Run the following AWS CLI command to enable VPC Flow Logs for your VPC:

aws ec2 create-flow-logs --resource-type VPC --resource-ids <your-vpc-id> --traffic-type ALL --log-group-name <your-log-group-name> --deliver-logs-permission-arn <your-iam-role-arn>

Replace <your-vpc-id> with the ID of your VPC, <your-log-group-name> with the name of the CloudWatch Logs group where the flow logs will be stored, and <your-iam-role-arn> with the ARN of the IAM role that has permission to publish logs to CloudWatch Logs.

Enable Security Group Logging: Security Group Logs provide detailed information about the traffic allowed or denied by security groups associated with your EC2 instances. Run the following AWS CLI command to enable security group logging:

aws ec2 create-flow-logs --resource-type NetworkInterface --resource-ids <your-network-interface-id> --traffic-type ALL --log-group-name <your-log-group-name> --deliver-logs-permission-arn <your-iam-role-arn>

Replace <your-network-interface-id> with the ID of the network interface associated with your EC2 instance.

Verify Configuration: Once you have enabled VPC Flow Logs and Security Group Logs, verify that the logs are being generated and stored in the specified CloudWatch Logs group. You can do this by checking the CloudWatch Logs console or by using the AWS CLI to query the logs.

By following these steps, you can successfully remediate the misconfiguration of network firewall logging not being enabled for AWS EC2 instances using AWS CLI.

Using Python

To remediate the network firewall logging misconfiguration for AWS EC2 using Python, you can follow these steps:

Import the necessary libraries:

import boto3

Initialize the AWS EC2 client:

ec2 = boto3.client('ec2')

Enable VPC Flow Logs for the desired VPC:

response = ec2.create_flow_logs(
    DeliverLogsPermissionArn='arn:aws:iam::123456789012:role/flow-logs-role',
    ResourceIds=['vpc-12345678'],
    ResourceType='VPC',
    TrafficType='ALL',
    LogDestinationType='cloud-watch-logs',
    LogDestination='arn:aws:logs:us-east-1:123456789012:log-group:flow-logs',
)

Replace the DeliverLogsPermissionArn, ResourceIds, and LogDestination with your specific values.

Verify that the VPC Flow Logs have been enabled successfully:

response = ec2.describe_flow_logs()
for flow_log in response['FlowLogs']:
    print(flow_log)

By following these steps, you can use Python to enable network firewall logging for AWS EC2 instances.

Using Terraform

# Existing Network Firewall
resource "aws_networkfirewall_firewall" "this" {
  name                = "NETWORK_FIREWALL_NAME"            # replace with your firewall name
  firewall_policy_arn = "FIREWALL_POLICY_ARN"              # replace with your policy ARN
  vpc_id              = "VPC_ID"                           # replace with your VPC ID

  subnet_mapping {
    subnet_id = "SUBNET_ID_1"                              # replace with subnet IDs
  }

  subnet_mapping {
    subnet_id = "SUBNET_ID_2"
  }
}

# CloudWatch Logs group for Network Firewall logs (must exist or be created)
resource "aws_cloudwatch_log_group" "network_firewall_logs" {
  name              = "NETWORK_FIREWALL_LOG_GROUP_NAME"    # replace with your log group name
  retention_in_days = 90
}

# Enable both FLOW and ALERT logging to CloudWatch Logs
resource "aws_networkfirewall_firewall_logging_configuration" "this" {
  firewall_arn = aws_networkfirewall_firewall.this.arn

  logging_configuration {
    log_destination_config {
      log_destination_type = "CloudWatchLogs"
      log_type             = "FLOW"

      log_destination = {
        logGroup = aws_cloudwatch_log_group.network_firewall_logs.name
      }
    }

    log_destination_config {
      log_destination_type = "CloudWatchLogs"
      log_type             = "ALERT"

      log_destination = {
        logGroup = aws_cloudwatch_log_group.network_firewall_logs.name
      }
    }
  }
}

This aws_networkfirewall_firewall_logging_configuration resource performs the same operation as the verified CLI (it overwrites the existing logging configuration and enables both FLOW and ALERT logs to the specified CloudWatch Logs group). Ensure the log group exists and that the Network Firewall service has permissions to write to it via an appropriate resource policy.This change does not force replacement of the firewall; it updates its logging configuration in place. After adding this, terraform plan should show one new resource to add: aws_networkfirewall_firewall_logging_configuration.this (and possibly the aws_cloudwatch_log_group if it’s new), with no replacement of the existing aws_networkfirewall_firewall.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Network Firewall Logging Should Be Enabled

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​