Explain how Stream Exception Policy works in a ANFW policy

The Stream Exception Policy in an AWS Network Firewall (ANFW) policy determines how the firewall handles traffic when an established network connection is disrupted midstream. This disruption occurs after traffic has been allowed and established, not during the initial rule evaluation.

To clarify, "midstream" refers to an active, ongoing connection that has already been established and is flowing. The Stream Exception Policy comes into play when there's a network disruption to this established connection. This disruption can be due to issues in external networks or within the firewall itself.

The policy offers three options for handling such disruptions:

1. Drop: This is the default behavior. The firewall fails closed and drops all subsequent traffic going to the firewall after the disruption.

2. Continue: The firewall continues to apply rules to the subsequent traffic without the context from before the disruption. This can affect rules that depend on session context. For example, a stateful rule to drop HTTP traffic might not match because the firewall lacks the initial session context defining the protocol as HTTP.

3. Reject: Similar to Drop, but the firewall also sends a TCP reject packet back to the client. This allows the client to immediately establish a new session, which the firewall can then apply rules to with proper context.

This setting is indeed about recovery behavior after a network disruption to an established connection. It's not about determining how to break or drop traffic during the initial evaluation. The policy aims to manage how the firewall responds when an active, allowed connection experiences a break, helping to maintain security while potentially minimizing disruption to legitimate traffic flows.
Sources
Stream exception policy options in your AWS Network Firewall firewall policy - AWS Network Firewall
StatefulEngineOptions - AWS Firewall Manager
How AWS Network Firewall session state replication maximizes high availability for your application traffic | AWS Security Blog