Skip to main content
emnode
Sign up
Compliance Medium severity

AWS Security Hub · NetworkFirewall

NetworkFirewall.1: Firewalls should span multiple AZs

Written and reviewed by Emnode · Last reviewed

What does AWS Security Hub NetworkFirewall.1 check?

NetworkFirewall.1 evaluates the AWS::NetworkFirewall::Firewall resource and fails when a firewall is deployed in only one Availability Zone. A firewall gets one inspection endpoint per associated subnet, and traffic in each AZ routes through that AZ's endpoint.

Why does NetworkFirewall.1 matter?

A Network Firewall is almost always inline, so traffic must pass through it to reach the workload. When the endpoint lives in a single AZ, an event in that one zone severs the inspection path. If your route tables hairpin every zone's traffic through that single endpoint, a one-zone failure can take down connectivity for workloads in zones that are otherwise perfectly healthy.

How do I fix NetworkFirewall.1?

  1. Associate the firewall with a dedicated subnet in each AZ where you run workloads.
  2. Update route tables so each AZ's traffic uses the firewall endpoint in that same AZ.
  3. Confirm endpoints reach the READY state in every zone before relying on the path.

Remediation script · bash

# Fix the highest-impact data stores first: enable Multi-AZ on production databases.
for db in $(aws rds describe-db-instances \
    --query 'DBInstances[?MultiAZ==`false` && DBClusterIdentifier==null].DBInstanceIdentifier' --output text); do
  aws rds modify-db-instance --db-instance-identifier "$db" \
    --multi-az --apply-immediately
  echo "$db: standby being provisioned in a second AZ"
done

# Span a stateless compute fleet across three AZs, then mirror the set on its load balancer.
aws autoscaling update-auto-scaling-group --auto-scaling-group-name web-tier-asg \
  --vpc-zone-identifier "subnet-0aaa1,subnet-0bbb2,subnet-0ccc3"
aws elbv2 set-subnets --load-balancer-arn "$ALB_ARN" \
  --subnets subnet-0aaa1 subnet-0bbb2 subnet-0ccc3

Full walkthrough (console steps, edge cases and verification) in the lesson Deploy across multiple Availability Zones.

Is NetworkFirewall.1 a false positive?

A single-AZ firewall can be deliberate when every workload behind it also lives in one AZ: a dev or test VPC, a proof of concept, or a cost-conscious environment where a second inspection endpoint (each one billed per hour) buys no resilience the workload actually needs. The control evaluates the firewall's subnet associations and fails on any firewall mapped to one AZ, regardless of where the protected workloads sit. If the single-zone footprint is a conscious choice, document that the workload is itself single-AZ, suppress the finding for that firewall, and keep the control enforced for production firewalls that must survive a zone failure rather than adding endpoints you won't route traffic through.

Full lesson Deploy across multiple Availability Zones Step-by-step remediation with CLI, code and persona-specific context.
AWS documentation for NetworkFirewall controls ↗ Check your own account for NetworkFirewall.1 →
Part of the learning path Tighten your databases

More NetworkFirewall controls