Network Firewall firewalls should be deployed across multiple Availability Zones

How to fix it

• Affects another check: Subnet change protection, which NetworkFirewall.10 asks for, has to be off to add the subnet, so turn it back on afterwards or that check fails.
• Interrupts service: Changing the Availability Zones of a transit gateway-attached firewall can briefly disrupt its traffic, so plan it for a quiet period.

In the console

VPC → Network Firewall → Firewalls → the firewall → Firewall details → Associated policy and VPC

Firewall subnets

Add a dedicated subnet in a second Availability Zone, one subnet per zone

Availability Zones

At least two, for a transit gateway-attached firewall

Route tables

Route each new zone's traffic through that zone's firewall endpoint

With the AWS CLI

aws network-firewall associate-subnets --firewall-arn <firewall-arn> --subnet-mappings SubnetId=<subnet-id-in-second-zone> --region <region>

With Terraform

resource "aws_networkfirewall_firewall" "this" {
  name                = var.firewall_name
  firewall_policy_arn = var.firewall_policy_arn
  vpc_id              = var.vpc_id

  subnet_mapping {
    subnet_id = var.firewall_subnet_id_zone_a
  }

  subnet_mapping {
    subnet_id = var.firewall_subnet_id_zone_b
  }
}