Network Firewall firewalls should have subnet change protection enabled

How to fix it

In the console

VPC → Network Firewall → Firewalls → the firewall → Firewall details → Change protections

Subnet change protection

Enabled

With the AWS CLI

aws network-firewall update-subnet-change-protection --firewall-arn <firewall-arn> --subnet-change-protection --region <region>

With Terraform

resource "aws_networkfirewall_firewall" "this" {
  name                     = var.firewall_name
  firewall_policy_arn      = var.firewall_policy_arn
  vpc_id                   = var.vpc_id
  subnet_change_protection = true

  subnet_mapping {
    subnet_id = var.firewall_subnet_id
  }
}