Stateless network firewall rule group should not be empty

How to fix it

• Can break clients: A new rule acts at once on every firewall policy that uses this rule group, so traffic it drops or passes changes on all of their firewalls.

In the console

VPC → Network Firewall → Network Firewall rule groups → the rule group

Rules

At least one stateless rule with match criteria and an action, or delete the group if no policy uses it

With the AWS CLI

• Overwrites existing settings: update-rule-group replaces the group's rules, so start from describe-rule-group, which also returns the update token, and add the rule to its RuleGroup.

aws network-firewall update-rule-group --rule-group-arn <rule-group-arn> --update-token <update-token> --rule-group file://rule-group.json --region <region>

With Terraform

resource "aws_networkfirewall_rule_group" "this" {
  name     = var.rule_group_name
  type     = "STATELESS"
  capacity = var.rule_group_capacity

  rule_group {
    rules_source {
      stateless_rules_and_custom_actions {
        stateless_rule {
          priority = 1

          rule_definition {
            actions = ["aws:forward_to_sfe"]

            match_attributes {
              source {
                address_definition = var.source_cidr
              }

              destination {
                address_definition = var.destination_cidr
              }
            }
          }
        }
      }
    }
  }
}