Medium
NetworkFirewall
Regional
Network Firewall firewalls should have subnet change protection enabled
NIST 800-53
Description
This control checks whether subnet change protection is enabled for an AWS Network Firewall firewall. The control fails if subnet change protection isn't enabled for the firewall.
Remediation
Enable subnet change protection to prevent accidental modifications to firewall subnet associations.
Steps
- Open the AWS Network Firewall console.
- Select your firewall and choose 'Edit'.
- Enable 'Subnet change protection'.
- Save changes and verify the firewall shows subnet change protection enabled.
Compliance
NIST 800-53