AWS Firewall Manager
AWS Firewall Manager is a service of Amazon Web Services that centrally configures and manages security policies — such as Amazon VPC security groups and network ACLs, AWS WAF rules, AWS Shield Advanced protections, AWS Network Firewall, and Route 53 Resolver DNS (Domain Name System) Firewall — across multiple AWS accounts within an organization.
Key points
- Centrally configures and manages Amazon VPC security groups and network ACLs across multiple AWS accounts within an organization.
- Works with AWS Organizations to apply consistent security policies account-wide.
- Commonly used to roll out AWS WAF rules and AWS Shield protections consistently across accounts.
- Also supports centrally deploying third-party firewall policy types available through AWS Marketplace, such as Palo Alto Networks Cloud NGFW and Fortigate Cloud Native Firewall (CNF) as a Service, alongside the native AWS protection policy types.
- Manages and enforces policies for these services rather than creating the underlying protections itself.
- Does not perform threat detection itself — that’s Amazon GuardDuty; Firewall Manager only manages and enforces preventive security policies across accounts.
- Prerequisites (frequently tested): the account must belong to an AWS Organizations organization with all features enabled (consolidated billing-only mode is not sufficient); one account must be designated as the Firewall Manager administrator account for the organization; and AWS Config must be enabled — with continuous recording — in every member account and Region containing resources to protect, including the administrator account itself.
- Auto-remediation — Firewall Manager can automatically apply and remediate its policies (WAF rules, security group rules, Shield Advanced protections, Network Firewall, and Route 53 Resolver DNS Firewall) across in-scope accounts and resources, continuously bringing non-compliant resources back into compliance rather than just reporting on them.
- Policy scope — a policy defined once in the administrator account can target the whole organization or be scoped to specific accounts, organizational units, or resources selected by tag, so different parts of an organization can be held to different policies.