Network Firewall policies should have at least one rule group associated

How to fix it

• Can break clients: The rule group applies at once on every firewall that uses this policy, so traffic its rules drop or reject stops on all of them.
• Affects another check: A stateless rule group with no rules passes this check but is flagged by NetworkFirewall.6, since it filters nothing.

In the console

VPC → Network Firewall → Firewall policies → the policy

Stateful rule groups

Add at least one rule group, or one under Stateless rule groups; either passes

With the AWS CLI

• Overwrites existing settings: update-firewall-policy replaces the whole policy document, so start from describe-firewall-policy, which also returns the update token, and add the reference to it.

aws network-firewall update-firewall-policy --firewall-policy-arn <policy-arn> --update-token <update-token> --firewall-policy file://firewall-policy.json --region <region>

With Terraform

resource "aws_networkfirewall_firewall_policy" "this" {
  name = var.policy_name

  firewall_policy {
    stateless_default_actions          = ["aws:forward_to_sfe"]
    stateless_fragment_default_actions = ["aws:forward_to_sfe"]

    stateful_rule_group_reference {
      resource_arn = var.stateful_rule_group_arn
    }
  }
}