All checks
Medium
The default stateless action for Network Firewall policies should be drop or forward for full packets
Confirms that the default stateless action for full packets in Network Firewall policies is drop or forward, not pass.
- service
- NetworkFirewall
- severity
- Medium
- scope
- evaluated in every region
How to fix it
Set the default stateless action for full packets to 'aws:drop' or 'aws:forward_to_sfe'.
- Navigate to the VPC console
- Select the Network Firewall policy
- Modify the 'Default stateless actions' for full packets
- Set to 'aws:drop' or 'aws:forward_to_sfe'
- Apply the changes
See which of your accounts this check is failing on.
Book a demo