Control: 2 Network Firewall logging should be enabled
Description
This control checks whether logging is enabled for an AWS Network Firewall firewall. The control fails if logging isn't enabled for at least one log type or if the logging destination doesn't exist.
Logging helps you maintain the reliability, availability, and performance of your firewalls. In Network Firewall, logging gives you detailed information about network traffic, including the time that the stateful engine received a packet flow, detailed information about the packet flow, and any stateful rule action taken against the packet flow.
Remediation
To enable logging for a firewall, see Updating a firewall's logging configuration in the AWS Network Firewall Developer Guide.
Usage
Run the control in your terminal:
powerpipe control run aws_compliance.control.foundational_security_networkfirewall_2Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run aws_compliance.control.foundational_security_networkfirewall_2 --shareSQL
This control uses a named query:
networkfirewall_firewall_logging_enabled