Network Firewall logging should be enabled

How to fix it

In the console

VPC → Network Firewall → Firewalls → the firewall → Firewall details → Logging

Log type

Alert, Flow or both; any one with a destination passes, and TLS logs only with TLS inspection

Log destination type

An S3 bucket, a CloudWatch log group or a Firehose stream; any one passes

With the AWS CLI

• Overwrites existing settings: The call sets the whole logging configuration and adds only one log type at a time, so add Flow in a second call that repeats the Alert entry.

aws network-firewall update-logging-configuration --firewall-arn <firewall-arn> --logging-configuration '{"LogDestinationConfigs":[{"LogType":"ALERT","LogDestinationType":"CloudWatchLogs","LogDestination":{"logGroup":"<log-group-name>"}}]}' --region <region>

With Terraform

resource "aws_networkfirewall_logging_configuration" "this" {
  firewall_arn = var.firewall_arn

  logging_configuration {
    log_destination_config {
      log_destination = {
        logGroup = var.log_group_name
      }
      log_destination_type = "CloudWatchLogs"
      log_type             = "ALERT"
    }
  }
}