diff --git a/aws/internal/service/networkfirewall/waiter/waiter.go b/aws/internal/service/networkfirewall/waiter/waiter.go
index 716e8d9abeb..9cc70453e70 100644
--- a/aws/internal/service/networkfirewall/waiter/waiter.go
+++ b/aws/internal/service/networkfirewall/waiter/waiter.go
@@ -40,7 +40,10 @@ func FirewallUpdated(ctx context.Context, conn *networkfirewall.NetworkFirewall,
 		Target:  []string{networkfirewall.FirewallStatusValueReady},
 		Refresh: FirewallUpdatedStatus(ctx, conn, arn),
 		Timeout: FirewallTimeout,
-		Delay:   30 * time.Second,
+		// Delay added to account for Associate/DisassociateSubnet calls that return
+		// a READY status immediately after the method is called instead of immediately
+		// returning PROVISIONING
+		Delay: 30 * time.Second,
 	}
 
 	outputRaw, err := stateConf.WaitForState()
diff --git a/aws/resource_aws_networkfirewall_firewall.go b/aws/resource_aws_networkfirewall_firewall.go
index fa724f846e1..b5820d4ab1d 100644
--- a/aws/resource_aws_networkfirewall_firewall.go
+++ b/aws/resource_aws_networkfirewall_firewall.go
@@ -10,6 +10,7 @@ import (
 	"github.com/aws/aws-sdk-go/service/networkfirewall"
 	"github.com/hashicorp/aws-sdk-go-base/tfawserr"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/diag"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/customdiff"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/terraform-providers/terraform-provider-aws/aws/internal/hashcode"
 	"github.com/terraform-providers/terraform-provider-aws/aws/internal/keyvaluetags"
@@ -27,6 +28,12 @@ func resourceAwsNetworkFirewallFirewall() *schema.Resource {
 			StateContext: schema.ImportStatePassthroughContext,
 		},
 
+		CustomizeDiff: customdiff.Sequence(
+			customdiff.ComputedIf("firewall_status", func(ctx context.Context, diff *schema.ResourceDiff, meta interface{}) bool {
+				return diff.HasChange("subnet_mapping")
+			}),
+		),
+
 		Schema: map[string]*schema.Schema{
 			"arn": {
 				Type:     schema.TypeString,
@@ -56,7 +63,7 @@ func resourceAwsNetworkFirewallFirewall() *schema.Resource {
 				Elem: &schema.Resource{
 					Schema: map[string]*schema.Schema{
 						"sync_states": {
-							Type:     schema.TypeList,
+							Type:     schema.TypeSet,
 							Computed: true,
 							Elem: &schema.Resource{
 								Schema: map[string]*schema.Schema{
diff --git a/website/docs/r/networkfirewall_firewall.html.markdown b/website/docs/r/networkfirewall_firewall.html.markdown
index 9e8e7c7ec39..ca93fdabb73 100644
--- a/website/docs/r/networkfirewall_firewall.html.markdown
+++ b/website/docs/r/networkfirewall_firewall.html.markdown
@@ -65,7 +65,7 @@ In addition to all arguments above, the following attributes are exported:
 * `arn` - The Amazon Resource Name (ARN) that identifies the firewall.
 
 * `firewall_status` - Nested list of information about the current status of the firewall.
-    * `sync_states` - List of subnets configured for use by the firewall.
+    * `sync_states` - Set of subnets configured for use by the firewall.
         * `attachment` - Nested list describing the attachment status of the firewall's association with a single VPC subnet.
             * `endpoint_id` - The identifier of the firewall endpoint that AWS Network Firewall has instantiated in the subnet. You use this to identify the firewall endpoint in the VPC route tables, when you redirect the VPC traffic through the endpoint.
             * `subnet_id` - The unique identifier of the subnet that you've specified to be used for a firewall endpoint.