Network Firewall Policy Default Action Should Be Set For Full Packets

Using Console

To remediate the network firewall policy default action for full packets in AWS EC2 using the AWS console, follow these steps:

Login to the AWS Management Console: Go to https://aws.amazon.com/ and sign in to your AWS account.
Navigate to the VPC Dashboard: In the AWS Management Console, go to the VPC dashboard by selecting “Services” from the top menu and then clicking on “VPC” under the Networking & Content Delivery section.
Select the VPC: From the VPC dashboard, select the VPC where the EC2 instance with the misconfigured network firewall policy is located.
Navigate to the Network ACLs: In the VPC dashboard, click on “Network ACLs” in the left-hand menu to view the list of network access control lists associated with the selected VPC.
Identify the Network ACL: Identify the network ACL associated with the subnet where the misconfigured EC2 instance resides. Click on the relevant network ACL to view its details.
Edit the Network ACL: In the network ACL details page, identify the inbound and outbound rules that need to be modified to set the default action for full packets.
Update the Default Action: Locate the default action rule in the inbound and outbound rules sections of the network ACL. Edit the default action rule to allow full packets by specifying the appropriate protocol (e.g., TCP, UDP, ICMP) and port range.
Save the Changes: Once you have updated the default action rule to allow full packets, save the changes to apply the new configuration to the network ACL.
Verify the Configuration: Verify that the default action for full packets has been successfully set in the network ACL associated with the subnet where the EC2 instance is located.

By following these steps, you can remediate the network firewall policy default action for full packets in AWS EC2 using the AWS Management Console.

Using CLI

To remediate the misconfiguration of the network firewall policy default action in AWS EC2 using AWS CLI, follow these steps:

Identify the Security Group: First, identify the security group associated with the EC2 instance that needs to be remediated. You can do this by either checking the EC2 instance details in the AWS Management Console or by using the following AWS CLI command:
aws ec2 describe-instances --instance-ids YOUR_INSTANCE_ID --query "Reservations[].Instances[].SecurityGroups[].GroupId" --output text

Update the Security Group: Once you have identified the security group, you can update the network firewall policy default action to “deny” for all inbound and outbound traffic using the following AWS CLI command:

aws ec2 update-security-group-rule-descriptions-ingress --group-id YOUR_SECURITY_GROUP_ID --ip-permissions '[{"IpProtocol": "-1", "PrefixListIds": [], "IpRanges": [], "UserIdGroupPairs": [], "Ipv6Ranges": [], "FromPort": -1, "ToPort": -1, "Description": "Deny all inbound traffic"}]'

aws ec2 update-security-group-rule-descriptions-egress --group-id YOUR_SECURITY_GROUP_ID --ip-permissions '[{"IpProtocol": "-1", "PrefixListIds": [], "IpRanges": [], "UserIdGroupPairs": [], "Ipv6Ranges": [], "FromPort": -1, "ToPort": -1, "Description": "Deny all outbound traffic"}]'

Verify the Changes: You can verify that the default action for full packets is now set to “deny” for both inbound and outbound traffic by checking the security group rules in the AWS Management Console or by using the following AWS CLI command:
aws ec2 describe-security-groups --group-ids YOUR_SECURITY_GROUP_ID

By following these steps, you can remediate the misconfiguration of the network firewall policy default action in AWS EC2 using AWS CLI.

Using Python

To remediate the network firewall policy default action setting for AWS EC2 using Python, you can use the AWS SDK for Python (Boto3) to update the Network ACL associated with the VPC. Here are the step-by-step instructions to remediate this misconfiguration:Step 1: Install Boto3 Ensure that you have Boto3 installed. You can install it using pip:

pip install boto3

Step 2: Write Python script Create a Python script with the following code to update the Network ACL default action for full packets:

import boto3

# Initialize the EC2 client
ec2_client = boto3.client('ec2')

# Specify the VPC ID
vpc_id = 'YOUR_VPC_ID'

# Specify the Network ACL ID
network_acl_id = 'YOUR_NETWORK_ACL_ID'

# Update the Network ACL entry to set the default action for full packets
response = ec2_client.create_network_acl_entry(
    CidrBlock='0.0.0.0/0',
    Egress=False,
    NetworkAclId=network_acl_id,
    Protocol='-1',
    RuleAction='allow',
    RuleNumber=100
)

print("Network ACL default action updated successfully.")

Replace YOUR_VPC_ID and YOUR_NETWORK_ACL_ID with the actual VPC ID and Network ACL ID where the misconfiguration exists.Step 3: Run the Python script Save the Python script and run it using the Python interpreter. This script will update the Network ACL entry to set the default action for full packets.

python remediate_network_acl.py

After running this script, the default action for full packets in the Network ACL should be set, remediating the misconfiguration.

Using Terraform

resource "aws_networkfirewall_firewall_policy" "THIS_FIREWALL_POLICY" {
  name        = "FIREWALL_POLICY_NAME"          # replace with your policy name
  description = "DESCRIPTION_OF_POLICY"         # optional

  firewall_policy {
    # Ensure the default stateless action for full packets matches
    # the user-defined default stateless action (and fragments) by
    # using the same action set in both attributes.

    # Replace USER_DEFINED_ACTION with your actual stateless action
    # (e.g. "aws:drop", "aws:forward_to_sfe", or a custom action name).
    stateless_default_actions          = ["USER_DEFINED_ACTION"]
    stateless_fragment_default_actions = ["USER_DEFINED_ACTION"]

    # other required fields for your policy
    stateful_rule_group_reference {
      resource_arn = "STATEFUL_RULE_GROUP_ARN"  # replace with your stateful rule group ARN
    }

    # optional: if you have stateless rule groups
    # stateless_rule_group_reference {
    #   resource_arn = "STATELESS_RULE_GROUP_ARN"
    #   priority     = 1
    # }

    # optional: if USER_DEFINED_ACTION is a custom action, define it here
    # custom_action {
    #   action_name = "USER_DEFINED_ACTION"
    #
    #   action_definition {
    #     publish_metric_action {
    #       dimension {
    #         value = "DIMENSION_VALUE"
    #       }
    #     }
    #   }
    # }
  }

  tags = {
    Name = "FIREWALL_POLICY_TAG_NAME"           # replace as needed
  }
}

This change is an in-place update of the firewall policy; it does not normally force replacement of the policy resource itself, but will update the live behavior of the firewall once applied.To verify, terraform plan should show only updates to stateless_default_actions and stateless_fragment_default_actions on aws_networkfirewall_firewall_policy.THIS_FIREWALL_POLICY, with both lists set identically to ["USER_DEFINED_ACTION"].

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Network Firewall Policy Default Action Should Be Set For Full Packets

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: