A Config rule that checks if an AWS Network Firewall policy is configured with a user defined default stateless action for full packets. This rule is NON_COMPLIANT if default stateless action for full packets does not match with user defined default stateless action.

This config rule supports the following parameters:

  • statelessDefaultActions
    • Required: Yes
    • Type: CSV
    • Description:Comma-separated list of values. You can select a max of two. Valid values include 'aws:pass', 'aws:drop', and 'aws:forward_to_sfe'.

CloudFormation Template