AWS network-firewall high security documentation change
Summary
Expanded documentation for troubleshooting VPC endpoint associations, added new error scenarios (KMS key deletion scheduled, inactive account, certificate validation errors), and updated references to include VPC endpoint associations
Security assessment
Added documentation about KMS key deletion leading to firewall failure (security impact: traffic drops), inactive account causing traffic drops, and TLS certificate validation errors. These highlight security-critical misconfigurations that could disable firewall protections or weaken TLS inspection.
Diff
diff --git a/network-firewall/latest/developerguide/firewall-troubleshooting-endpoint-failures.md b/network-firewall/latest/developerguide/firewall-troubleshooting-endpoint-failures.md index f9b1713c2..f1b91f354 100644 --- a//network-firewall/latest/developerguide/firewall-troubleshooting-endpoint-failures.md +++ b//network-firewall/latest/developerguide/firewall-troubleshooting-endpoint-failures.md @@ -7 +7 @@ -If Network Firewall can't create or delete a firewall endpoint in the subnet because of an error, the service displays a _status message_ describing how to resolve the issues. Use the status message in the console, API, or CLI to troubleshoot the issues causing the endpoint failure. Depending on the issue, it can take as many as 15 minutes for Network Firewall to display the status message. +If Network Firewall can't create or delete a firewall endpoint in a subnet because of an error, the service displays a _status message_ describing how to resolve the issue. Use the status message in the console, API, or CLI to troubleshoot the issues causing the endpoint failure. Depending on the issue, it can take as many as 15 minutes for Network Firewall to display the status message. @@ -12 +12 @@ Console -**To view the status message** +**To view the status message for an endpoint defined as a firewall subnet** @@ -18 +18,12 @@ Console - 3. In the **Firewall details** tab, in the **Firewall endpoints** section, hover over the **firewall endpoint status** to view the status message. + 3. In the **Firewall details** tab, in the **Firewall endpoints** section, hover over the **Firewall endpoint status** to view the status message. + + + + +**To view the status message for an endpoint defined as a VPC endpoint association** + + 1. Sign in to the AWS Management Console and open the Amazon VPC console at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/). + + 2. In the navigation pane, under **Network Firewall** , choose **VPC endpoint associations**. + + 3. In the **VPC endpoint associations** page, hover over the status that you're interested in to view the status message. @@ -26 +37,3 @@ API -The [DescribeFirewall](https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeFirewall.html) response includes `StatusMessage`. +For an endpoint defined as a firewall subnet, the [DescribeFirewall](https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeFirewall.html) response includes status messages for the endpoints. + +For an endpoint defined as a VPC endpoint association, the [DescribeVpcEndpointAssociation](https://docs.aws.amazon.com/network-firewall/latest/APIReference/API_DescribeVpcEndpointAssociation.html) response includes a status message for the endpoint. @@ -31 +44,3 @@ CLI -The [describe-firewall](https://docs.aws.amazon.com/cli/latest/reference/network-firewall/describe-firewall.html) response includes `StatusMessage`. +For an endpoint defined as a firewall subnet, the [describe-firewall](https://docs.aws.amazon.com/cli/latest/reference/network-firewall/describe-firewall.html) response includes status messages for the endpoints. + +For an endpoint defined as a VPC endpoint association, the [describe-vpc-endpoint-association](https://docs.aws.amazon.com/cli/latest/reference/network-firewall/describe-vpc-endpoint-association.html) response includes a status message for the endpoint. @@ -33 +48 @@ The [describe-firewall](https://docs.aws.amazon.com/cli/latest/reference/network -The following table lists the possible causes of the error or failure as indicated in the Network Firewall console or the `StatusMessage` parameter in the API or CLI. Errors indicate an error that you can take actions to fix. Failures indicate a non-recoverable failed state. For errors, after you apply any of the remedial steps, Network Firewall automatically attempts to complete creation or deletion of the firewall. +The following table lists the possible causes of the error or failure as indicated in the Network Firewall console or the `StatusMessage` parameter in the API or CLI. Errors indicate an error that you can take actions to fix. Failures indicate a non-recoverable failed state. For errors, after you apply any of the remedial steps, Network Firewall automatically attempts to complete creation or deletion of the firewall or VPC endpoint association. @@ -37,2 +52,5 @@ Firewall endpoint status | Reason for error or failure | Cause | Solution -Error | AWS Key Management Service encryption key misconfigured | The specified AWS KMS encryption key either doesn't exist in the Region, or you aren't allowed to access it. | Either update the encryption configuration with a new key or delete the firewall. For information about using encryption keys with Network Firewall, see [Encryption at rest with AWS Key Management Service](./kms-encryption-at-rest.html). -Error | Endpoint tag removed | Network Firewall can't access the endpoint because the `AWSNetworkFirewallManaged:true` tag was removed from the VPC endpoint. Network Firewall automatically adds this tag to the endpoint when the service creates the firewall. | Add the `AWSNetworkFirewallManaged:true` tag back to the firewall endpoint, and try your request again. For information about using tags, see [Tagging AWS Network Firewall resources](./tagging.html). +Error | AWS Key Management Service encryption key misconfigured | The specified AWS KMS encryption key either doesn't exist in the Region, or you aren't allowed to access it. This can be the result of someone deleting the key or revoking your access to it. The firewall associated with this key is now in a failed state, and traffic directed to the firewall is being dropped. | Either update the encryption configuration with a new key or delete the firewall. For information about using encryption keys with Network Firewall, see [Encryption at rest with AWS Key Management Service](./kms-encryption-at-rest.html). +Error | AWS Key Management Service encryption key deletion scheduled | The firewall contains an AWS KMS encryption key that's scheduled for deletion. When the key is deleted, the firewall will enter a failed state and drop all traffic directed to it. | To prevent the firewall from entering a failed state, either update the firewall's encryption configuration with a valid key, cancel deletion and re-enable the key, or delete the firewall. For information about using encryption keys with Network Firewall, see [Encryption at rest with AWS Key Management Service](./kms-encryption-at-rest.html). +Error | Generic fail closed | The associated firewall is in a failed state, and traffic directed to the firewall is being dropped. | Delete the firewall. For information, see [Deleting a firewall in AWS Network Firewall](./deleting-firewall.html). +Error | Inactive account fail closed | The associated firewall's account is in inactive state. This causes the firewall to enter a failed state and drop all traffic that's directed to it. | Contact AWS support and reopen the account, then delete the firewall, and then close the account again. For information about deleting a firewall, see see [Deleting a firewall in AWS Network Firewall](./deleting-firewall.html). +Error | Endpoint tag removed | Network Firewall can't access the firewall endpoint because the `AWSNetworkFirewallManaged:true` tag was removed from VPC endpoint. Network Firewall automatically adds this tag to the endpoint when the service creates the firewall. | Add the `AWSNetworkFirewallManaged:true` tag back to the firewall endpoint, and try your request again. For information about using tags, see [Tagging AWS Network Firewall resources](./tagging.html). @@ -40,0 +59,2 @@ Error | Invalid root certificate | The firewall's TLS inspection configuration +Error | Invalid chain certificate | The firewall's TLS inspection configuration contains a certificate with an invalid chain, which doesn't support certificate body. For more information, see [Using SSL/TLS certificates with TLS inspection configurations in AWS Network Firewall](./tls-inspection-certificate-requirements.html). | Replace the certificate with a valid certificate. +Error | Invalid certificate authority (CA) certificate | The firewall's TLS inspection configuration contains a certificate that isn't usable as a CA certificate. For more information, see [Using SSL/TLS certificates with TLS inspection configurations in AWS Network Firewall](./tls-inspection-certificate-requirements.html). | Replace the certificate with a CA certificate. @@ -42,2 +62,2 @@ Error | IP limit exceeded | You've reached the quota of IPv4 or IPv6 CIDR block -Error | Subnet deleted | The specified subnet has been deleted. Your firewall must refer to an existing subnet. | Enter an existing subnet and try again. -Error | Subnet invalid IP address type | Network Firewall can't create a VPC endpoint containing the specified subnet because the subnet is associated with an IPv6 CIDR block that was removed from the firewall. | Do one of the following actions: +Error | Subnet deleted | The specified subnet has been deleted. Your firewalls and VPC endpoint associations must refer to existing subnets. | Enter an existing subnet and try again. +Error | Subnet invalid IP address type | Network Firewall can't create an endpoint using the specified subnet because the subnet is associated with an IPv6 CIDR block that was removed. | Do one of the following actions: @@ -45,3 +65,3 @@ Error | Subnet invalid IP address type | Network Firewall can't create a VPC en - * Add a new IPv6 CIDR block back to the subnet - * Delete the firewall - * Associate a different subnet to the firewall + * Use an existing IPv6 CIDR block + * Delete the firewall or VPC endpoint association + * Use a different subnet for the firewall or VPC endpoint association @@ -50,3 +70,3 @@ Error | Subnet invalid IP address type | Network Firewall can't create a VPC en -Failed | VPC deleted | The firewall is associated with a VPC that's been deleted. | Delete this firewall, and then create a new firewall using an existing VPC. For information about how to delete a firewall, see [Deleting a firewall in AWS Network Firewall](./firewall-deleting.html). -Error | VPCE limit exceeded | You've reached the quota of VPC endpoints you can have per VPC. For information about the VPC endpoint limits, see [Amazon VPC quotas](https://docs.aws.amazon.com/vpc/latest/userguide/amazon-vpc-limits.html) in the _Amazon VPC User Guide_. | Either delete the VPC endpoint, or delete the firewall and then create the endpoint using another VPC. For information about creating or deleting endpoints, see [Work with VPCs](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-vpcs.html) in the _Amazon VPC User Guide_. -Error | VPCE reference exists | You can't delete the firewall because the specified firewall endpoint is associated to a VPC route table. | Remove the firewall endpoint from your route table and try again. For information about route tables, see [Configure route tables ](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html) in the _Amazon VPC User Guide_. +Failed | VPC deleted | The firewall or VPC endpoint association use a VPC that's been deleted. | Delete the VPC endpoint associations or firewall that are using the VPC. Then as needed, create a new firewall and VPC endpoint associations using an existing VPC. For information, see [Managing a firewall and firewall endpoints in AWS Network Firewall](./firewall-managing.html). +Error | VPCE limit exceeded | You've reached the quota of VPC endpoints that you can have per VPC. For information about the limits, see [AWS PrivateLink quotas](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-limits-endpoints.html) in the _AWS PrivateLink Guide_. | Either delete the VPC endpoint association, or delete the firewall and then create the endpoint or VPC endpoint association using another VPC. For information about creating or deleting endpoints, see [Work with VPCs](https://docs.aws.amazon.com/vpc/latest/userguide/working-with-vpcs.html) in the _Amazon VPC User Guide_. +Error | VPCE reference exists | You can't delete the firewall or VPC endpoint association because the specified firewall endpoint is associated to a VPC route table. | Remove the firewall endpoint from your route table and try again. For information about route tables, see [Configure route tables ](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Route_Tables.html) in the _Amazon VPC User Guide_.