AWS securityhub documentation change
Summary
Added a new control [NetworkFirewall.10] for subnet change protection in Network Firewall firewalls and updated AWS Config rule references to remove backticks
Security assessment
The change adds documentation about a new security feature (subnet change protection) but does not indicate it's addressing a specific security vulnerability or incident. The removal of backticks from AWS Config rule references is a formatting change.
Diff
diff --git a/securityhub/latest/userguide/networkfirewall-controls.md index 193a2b00d..c9a9afd99 100644 --- a/securityhub/latest/userguide/networkfirewall-controls.md +++ b/securityhub/latest/userguide/networkfirewall-controls.md @@ -5 +5 @@ -[NetworkFirewall.1] Network Firewall firewalls should be deployed across multiple Availability Zones[NetworkFirewall.2] Network Firewall logging should be enabled[NetworkFirewall.3] Network Firewall policies should have at least one rule group associated[NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets[NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets[NetworkFirewall.6] Stateless Network Firewall rule group should not be empty[NetworkFirewall.7] Network Firewall firewalls should be tagged[NetworkFirewall.8] Network Firewall firewall policies should be tagged[NetworkFirewall.9] Network Firewall firewalls should have deletion protection enabled +[NetworkFirewall.1] Network Firewall firewalls should be deployed across multiple Availability Zones[NetworkFirewall.2] Network Firewall logging should be enabled[NetworkFirewall.3] Network Firewall policies should have at least one rule group associated[NetworkFirewall.4] The default stateless action for Network Firewall policies should be drop or forward for full packets[NetworkFirewall.5] The default stateless action for Network Firewall policies should be drop or forward for fragmented packets[NetworkFirewall.6] Stateless Network Firewall rule group should not be empty[NetworkFirewall.7] Network Firewall firewalls should be tagged[NetworkFirewall.8] Network Firewall firewall policies should be tagged[NetworkFirewall.9] Network Firewall firewalls should have deletion protection enabled[NetworkFirewall.10] Network Firewall firewalls should have subnet change protection enabled @@ -23 +23 @@ These controls may not be available in all AWS Regions. For more information, se -**AWS Config rule:** [`netfw-multi-az-enabled`](https://docs.aws.amazon.com/config/latest/developerguide/netfw-multi-az-enabled.html) +**AWS Config rule:** [netfw-multi-az-enabled](https://docs.aws.amazon.com/config/latest/developerguide/netfw-multi-az-enabled.html) @@ -64 +64 @@ AWS global infrastructure includes multiple AWS Regions. AZs are physically sepa -**AWS Config rule:** [`netfw-logging-enabled`](https://docs.aws.amazon.com/config/latest/developerguide/netfw-logging-enabled.html) +**AWS Config rule:** [netfw-logging-enabled](https://docs.aws.amazon.com/config/latest/developerguide/netfw-logging-enabled.html) @@ -88 +88 @@ To enable logging for a firewall, see [Updating a firewall's logging configurati -**AWS Config rule:** [`netfw-policy-rule-group-associated`](https://docs.aws.amazon.com/config/latest/developerguide/netfw-policy-rule-group-associated.html) +**AWS Config rule:** [netfw-policy-rule-group-associated](https://docs.aws.amazon.com/config/latest/developerguide/netfw-policy-rule-group-associated.html) @@ -112 +112 @@ To add a rule group to a Network Firewall policy, see [Updating a firewall polic -**AWS Config rule:** [`netfw-policy-default-action-full-packets`](https://docs.aws.amazon.com/config/latest/developerguide/netfw-policy-default-action-full-packets.html) +**AWS Config rule:** [netfw-policy-default-action-full-packets](https://docs.aws.amazon.com/config/latest/developerguide/netfw-policy-default-action-full-packets.html) @@ -141 +141 @@ To change your firewall policy, see [Updating a firewall policy](https://docs.aw -**AWS Config rule:** [`netfw-policy-default-action-fragment-packets`](https://docs.aws.amazon.com/config/latest/developerguide/netfw-policy-default-action-fragment-packets.html) +**AWS Config rule:** [netfw-policy-default-action-fragment-packets](https://docs.aws.amazon.com/config/latest/developerguide/netfw-policy-default-action-fragment-packets.html) @@ -170 +170 @@ To change your firewall policy, see [Updating a firewall policy](https://docs.aw -**AWS Config rule:** [`netfw-stateless-rule-group-not-empty`](https://docs.aws.amazon.com/config/latest/developerguide/netfw-stateless-rule-group-not-empty.html) +**AWS Config rule:** [netfw-stateless-rule-group-not-empty](https://docs.aws.amazon.com/config/latest/developerguide/netfw-stateless-rule-group-not-empty.html) @@ -254 +254 @@ To add tags to an Network Firewall policy, see [Tagging AWS Network Firewall res -**AWS Config rule:** [`netfw-deletion-protection-enabled`](https://docs.aws.amazon.com/config/latest/developerguide/netfw-deletion-protection-enabled.html) +**AWS Config rule:** [netfw-deletion-protection-enabled](https://docs.aws.amazon.com/config/latest/developerguide/netfw-deletion-protection-enabled.html) @@ -267,0 +268,24 @@ To enable delete protection on an existing Network Firewall firewall, see [ Upda +## [NetworkFirewall.10] Network Firewall firewalls should have subnet change protection enabled + +**Related requirements:** NIST.800-53.r5 CA-9(1), NIST.800-53.r5 CM-2, NIST.800-53.r5 CM-2(2), NIST.800-53.r5 CM-3, NIST.800-53.r5 SC-5(2) + +**Category:** Protect > Network Security + +**Severity:** Medium + +**Resource type:** `AWS::NetworkFirewall::Firewall` + +**AWS Config rule:** [netfw-subnet-change-protection-enabled](https://docs.aws.amazon.com/config/latest/developerguide/netfw-subnet-change-protection-enabled.html) + +**Schedule type:** Change triggered + +**Parameters:** None + +This control checks whether subnet change protection is enabled for an AWS Network Firewall firewall. The control fails if subnet change protection isn't enabled for the firewall. + +AWS Network Firewall is a stateful, managed network firewall and intrusion detection service that you can use to inspect and filter traffic to, from, or between your Virtual Private Clouds (VPCs). If you enable subnet change protection for a Network Firewall firewall, you can protect the firewall against accidental changes to the firewall's subnet associations. + +### Remediation + +For information about enabling subnet change protection for an existing Network Firewall firewall, see [Updating a firewall](https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-updating.html) in the _AWS Network Firewall Developer Guide_. +