AWS Firewall Manager
AWS Firewall Manager is a security management service that configures and maintains protections across many accounts and resources from one place. Policies are defined once and applied automatically — including to accounts and resources that are created afterwards.
It is a managed service; there is nothing to install on an EC2 instance.
Policy types it manages
Section titled “Policy types it manages”- AWS WAF web ACLs for CloudFront distributions, Application Load Balancers, API Gateway REST APIs and the other supported protected resources
- AWS Shield Advanced subscriptions and protections for Application Load Balancers, Elastic IP addresses, CloudFront distributions and other protectable resources
- Amazon VPC security groups — auditing existing groups against a reference, or applying a common group
- Amazon VPC network ACLs
- AWS Network Firewall
- Amazon Route 53 Resolver DNS Firewall
- Third-party rule groups purchased from the AWS Marketplace
Scope is expressed by account, by resource type — every CloudFront distribution, say — or by resource tag, so a policy keeps applying as the estate changes.
Prerequisites
Section titled “Prerequisites”- The organisation must be in AWS Organizations with all features enabled.
- A Firewall Manager administrator account must be designated by the management account.
- AWS Config must be enabled in the accounts and Regions in scope, because Firewall Manager uses it to evaluate compliance.
Reporting
Section titled “Reporting”Firewall Manager reports per-policy compliance for each in-scope account and resource, and delivers findings and insights to AWS Security Hub CSPM, so drift shows up alongside the rest of the security findings. It also provides centralised visibility of DDoS attacks across the organisation.
Charges for Firewall Manager itself are separate from the charges incurred by the underlying services it configures — AWS WAF, Shield Advanced, AWS Config and the rest.
For more information, see AWS Firewall Manager in the AWS documentation.