The default stateless action for Network Firewall policies should be drop or forward for fragmented packets

How to fix it

• Can break clients: Unmatched UDP fragments stop passing on every firewall using this policy: Drop blocks them, and Forward to stateful rule groups lets the stateful rules decide.
• Affects another check: Use the same actions for all packets also sets the action for full packets, which NetworkFirewall.4 checks.

In the console

VPC → Network Firewall → Firewall policies → the policy → Stateless default actions

Stateless default actions

Forward to stateful rule groups or Drop for fragmented packets, or for all packets; Pass fails

With the AWS CLI

• Overwrites existing settings: update-firewall-policy replaces the whole policy document, so start from describe-firewall-policy, which also returns the update token, and change only the default actions.

aws network-firewall update-firewall-policy --firewall-policy-arn <policy-arn> --update-token <update-token> --firewall-policy file://firewall-policy.json --region <region>

With Terraform

resource "aws_networkfirewall_firewall_policy" "this" {
  name = var.policy_name

  firewall_policy {
    stateless_default_actions          = ["aws:forward_to_sfe"]
    stateless_fragment_default_actions = ["aws:forward_to_sfe"]
  }
}