{"id":317,"date":"2026-04-13T15:22:17","date_gmt":"2026-04-13T15:22:17","guid":{"rendered":"https:\/\/www.devopsschool.com\/tutorials\/aws-firewall-manager-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance\/"},"modified":"2026-04-13T15:22:17","modified_gmt":"2026-04-13T15:22:17","slug":"aws-firewall-manager-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/tutorials\/aws-firewall-manager-tutorial-architecture-pricing-use-cases-and-hands-on-guide-for-security-identity-and-compliance\/","title":{"rendered":"AWS Firewall Manager Tutorial: Architecture, Pricing, Use Cases, and Hands-On Guide for Security, identity, and compliance"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Category<\/h2>\n\n\n\n<p>Security, identity, and compliance<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">1. Introduction<\/h2>\n\n\n\n<p>AWS Firewall Manager is an AWS Security, identity, and compliance service that helps you centrally configure, enforce, and monitor firewall protections across multiple AWS accounts and resources.<\/p>\n\n\n\n<p>In simple terms: <strong>instead of configuring AWS WAF, AWS Shield Advanced, AWS Network Firewall, security group rules, and DNS Firewall protections account-by-account<\/strong>, AWS Firewall Manager lets a security or platform team define policies once and apply them consistently across an AWS Organization.<\/p>\n\n\n\n<p>Technically, AWS Firewall Manager is a <strong>central policy orchestration and compliance layer<\/strong>. It integrates with <strong>AWS Organizations<\/strong> (to target accounts and OUs), typically relies on <strong>AWS Config<\/strong> (to discover and evaluate resources for compliance), and then <strong>deploys and\/or audits<\/strong> protections implemented by other services (for example, AWS WAF web ACL associations, AWS Network Firewall deployments, or security group rule baselines). It provides a single place to see coverage and compliance drift across accounts and Regions.<\/p>\n\n\n\n<p>The problem it solves is common in real environments: <strong>security controls drift<\/strong> as teams create new resources, spin up new accounts, and deploy to multiple Regions. Manual setup is inconsistent, slow, and difficult to audit. AWS Firewall Manager helps you scale governance and reduce the risk of unprotected internet-facing workloads.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">2. What is AWS Firewall Manager?<\/h2>\n\n\n\n<p><strong>Official purpose (what it\u2019s for)<\/strong><br\/>\nAWS Firewall Manager is designed to help you <strong>centrally manage firewall rules and protections<\/strong> across accounts and resources in an AWS Organization. It\u2019s aimed at organizations that need consistent baseline protections, ongoing compliance visibility, and automated remediation.<\/p>\n\n\n\n<p><strong>Core capabilities (what it does)<\/strong>\n&#8211; Define centralized <strong>Firewall Manager policies<\/strong> for supported protection types.\n&#8211; Scope policies to:\n  &#8211; Organizational Units (OUs)\n  &#8211; Specific accounts\n  &#8211; Resource tags (where supported)\n&#8211; Continuously <strong>audit compliance<\/strong> and report drift.\n&#8211; Optionally perform <strong>automatic remediation<\/strong>, deploying\/associating protections for newly created or noncompliant resources.<\/p>\n\n\n\n<p><strong>Major components<\/strong>\n&#8211; <strong>AWS Firewall Manager administrator account<\/strong>: the account where policies are created and managed (often a delegated administrator in AWS Organizations).\n&#8211; <strong>Policies<\/strong>: the central objects that define what protection to apply, where to apply it, and whether to remediate.\n&#8211; <strong>Policy scope<\/strong>: target accounts\/OUs and (in some cases) resource tags.\n&#8211; <strong>Compliance reporting<\/strong>: visibility into which resources\/accounts are compliant or noncompliant.\n&#8211; <strong>Integrations<\/strong>: policy types that configure\/enforce protections in underlying services (such as AWS WAF, AWS Network Firewall, and others supported by Firewall Manager).<\/p>\n\n\n\n<p><strong>Service type<\/strong>\n&#8211; A <strong>governance \/ security management<\/strong> service (control-plane orchestration).\n&#8211; It <strong>does not inspect packets itself<\/strong>; instead it manages and enforces protections provided by other AWS security services.<\/p>\n\n\n\n<p><strong>Scope model (regional\/global\/account-scoped)<\/strong>\n&#8211; AWS Firewall Manager is <strong>organization-scoped<\/strong> and designed for <strong>multi-account<\/strong> environments.\n&#8211; Policies are typically <strong>Region-specific<\/strong>, because many underlying protections are regional. Some resources (notably <strong>Amazon CloudFront<\/strong>) are global in nature, but AWS WAF for CloudFront uses a specific Region for configuration (commonly <strong>us-east-1<\/strong> for CloudFront scope). Always verify the Region\/scoping requirements for the specific policy type in official docs.<\/p>\n\n\n\n<p><strong>How it fits into the AWS ecosystem<\/strong>\nAWS Firewall Manager sits above:\n&#8211; <strong>AWS Organizations<\/strong> (account and OU targeting, delegated admin)\n&#8211; <strong>AWS Config<\/strong> (resource discovery and compliance evaluation for many policy types; verify exact prerequisites by policy type in official docs)\n&#8211; Underlying protection services, such as:\n  &#8211; <strong>AWS WAF<\/strong> (web ACL policies)\n  &#8211; <strong>AWS Shield Advanced<\/strong> (DDoS protection management; subscription required)\n  &#8211; <strong>AWS Network Firewall<\/strong> (VPC network firewall deployment and rule policy)\n  &#8211; <strong>Amazon VPC security groups<\/strong> (baseline and audit policies)\n  &#8211; <strong>Amazon Route 53 Resolver DNS Firewall<\/strong> (DNS filtering policy associations)<\/p>\n\n\n\n<p>Think of it as \u201c<strong>central policy + continuous compliance + (optional) auto-remediation<\/strong>\u201d for firewall-related controls across your organization.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3. Why use AWS Firewall Manager?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Business reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Lower risk of outages and breaches<\/strong> by ensuring internet-facing workloads aren\u2019t created without baseline protections.<\/li>\n<li><strong>Faster onboarding<\/strong> for new AWS accounts and teams: security guardrails apply automatically.<\/li>\n<li><strong>Audit readiness<\/strong>: centralized compliance views and consistent policies help with governance reporting.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Technical reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Consistency<\/strong> across Regions and accounts (less configuration drift).<\/li>\n<li><strong>Automation<\/strong> for attaching protections to newly created resources (for example, new application endpoints or new accounts).<\/li>\n<li><strong>Standardization<\/strong> of policy patterns (managed rule baselines, consistent allow\/deny posture).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operational reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Reduced operational overhead: fewer \u201cticket-to-security\u201d workflows for routine firewall configuration.<\/li>\n<li>Central visibility and troubleshooting: identify gaps at the org level.<\/li>\n<li>Works well with multi-account landing zone models (for example, shared services + workload accounts).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Security\/compliance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enforces organization-wide minimum controls (for example, baseline AWS WAF rules on public endpoints).<\/li>\n<li>Supports separation of duties: security team can manage policies centrally while application teams manage their workloads.<\/li>\n<li>Helps manage compliance for common frameworks when paired with logging and evidence (CloudTrail, AWS Config, security logs). (Always confirm your evidence requirements with your compliance team.)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Scalability\/performance reasons<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Designed for <strong>multi-account scale<\/strong> using AWS Organizations.<\/li>\n<li>Scales governance without requiring per-account manual setup.<\/li>\n<li>Performance impact depends on the underlying protection service (AWS WAF, AWS Network Firewall, etc.), not Firewall Manager itself.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should choose AWS Firewall Manager<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You have (or plan to have) <strong>multiple AWS accounts<\/strong> under AWS Organizations.<\/li>\n<li>You need <strong>consistent baseline firewall controls<\/strong> applied to many resources.<\/li>\n<li>You want <strong>continuous compliance monitoring<\/strong> and optional auto-remediation.<\/li>\n<li>You operate a platform\/security team responsible for centralized guardrails.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">When teams should not choose it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>You have a single AWS account and no near-term need for an AWS Organization (Firewall Manager is primarily for org-wide control).<\/li>\n<li>You need deep packet inspection features not covered by AWS\u2019s supported services (you might need a third-party firewall appliance or a different architecture).<\/li>\n<li>You need bespoke per-application WAF tuning only (you can still use Firewall Manager, but you may prefer direct AWS WAF management per app if central governance isn\u2019t required).<\/li>\n<li>You are not prepared to run prerequisites like AWS Organizations and (often) AWS Config in a governed way.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">4. Where is AWS Firewall Manager used?<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Industries<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>SaaS and software companies (multi-tenant platforms)<\/li>\n<li>Financial services (strict governance and auditing)<\/li>\n<li>Healthcare and life sciences (compliance and data protection programs)<\/li>\n<li>E-commerce (web application protection at scale)<\/li>\n<li>Media\/streaming (CloudFront-based delivery needing consistent edge protections)<\/li>\n<li>Government and regulated sectors<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Team types<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Center of Excellence (CCoE)<\/li>\n<li>Platform engineering and SRE<\/li>\n<li>Security engineering \/ SecOps<\/li>\n<li>Network engineering teams (especially when using AWS Network Firewall)<\/li>\n<li>DevOps teams operating many environments<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Workloads<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Public web apps behind ALBs and CloudFront<\/li>\n<li>APIs via API Gateway (where AWS WAF is used)<\/li>\n<li>Microservices platforms (EKS\/ECS) exposed via ingress\/ALB<\/li>\n<li>Multi-VPC architectures needing consistent network firewall or DNS filtering<\/li>\n<li>Enterprise landing zones with many accounts and Regions<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Architectures<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Multi-account landing zones (shared services, log archive, security tooling, workload OUs)<\/li>\n<li>Multi-Region deployments<\/li>\n<li>Edge + origin architectures (CloudFront + ALB\/API)<\/li>\n<li>Hub-and-spoke networking with centralized egress and inspection<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Production vs dev\/test usage<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Production<\/strong>: highest value\u2014consistent protections, compliance, and automated remediation.<\/li>\n<li><strong>Dev\/test<\/strong>: helpful to ensure pre-prod environments match production guardrails; many teams run audit-only at first to reduce disruption, then enable remediation.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5. Top Use Cases and Scenarios<\/h2>\n\n\n\n<p>Below are realistic, common scenarios for AWS Firewall Manager. Each includes the problem, fit, and a short example.<\/p>\n\n\n\n<p>1) <strong>Baseline AWS WAF on all public applications<\/strong>\n&#8211; <strong>Problem:<\/strong> Teams deploy internet-facing endpoints without WAF, leading to inconsistent protection.\n&#8211; <strong>Why it fits:<\/strong> Firewall Manager can automatically associate a standard web ACL to targeted resources.\n&#8211; <strong>Example:<\/strong> Every new ALB in the \u201cProd\u201d OU tagged <code>Exposure=Public<\/code> automatically gets a web ACL with AWS managed rules.<\/p>\n\n\n\n<p>2) <strong>Centralized AWS WAF rule standardization (managed rule groups + custom rules)<\/strong>\n&#8211; <strong>Problem:<\/strong> Different apps use different rule sets; security has no consistent baseline.\n&#8211; <strong>Why it fits:<\/strong> A single policy can define a baseline rule configuration.\n&#8211; <strong>Example:<\/strong> Security mandates a minimum set of managed rules and a bot user-agent block rule for all CloudFront distributions.<\/p>\n\n\n\n<p>3) <strong>DDoS protection governance with AWS Shield Advanced (where subscribed)<\/strong>\n&#8211; <strong>Problem:<\/strong> Large organizations struggle to ensure Shield Advanced coverage is applied where required.\n&#8211; <strong>Why it fits:<\/strong> Firewall Manager can help enforce Shield Advanced protections consistently (requires Shield Advanced subscription).\n&#8211; <strong>Example:<\/strong> All internet-facing ALBs in the \u201cCritical\u201d OU must be protected by Shield Advanced, with centralized visibility into coverage.<\/p>\n\n\n\n<p>4) <strong>Security group baseline enforcement across accounts<\/strong>\n&#8211; <strong>Problem:<\/strong> Teams open risky inbound ports (for example, <code>0.0.0.0\/0<\/code> to SSH\/RDP) and forget to close them.\n&#8211; <strong>Why it fits:<\/strong> Firewall Manager can audit and help enforce security group rule baselines at scale (policy type dependent; verify exact behavior in official docs).\n&#8211; <strong>Example:<\/strong> Any security group allowing <code>0.0.0.0\/0:22<\/code> is flagged noncompliant; remediation removes the rule or applies a baseline managed security group depending on the policy.<\/p>\n\n\n\n<p>5) <strong>Detect and report unused security groups<\/strong>\n&#8211; <strong>Problem:<\/strong> Unused security groups accumulate, creating operational confusion and audit noise.\n&#8211; <strong>Why it fits:<\/strong> Firewall Manager can perform security group usage auditing (supported policy type; verify prerequisites).\n&#8211; <strong>Example:<\/strong> Monthly report identifies unused security groups across all workload accounts for cleanup.<\/p>\n\n\n\n<p>6) <strong>Central deployment of AWS Network Firewall across many VPCs<\/strong>\n&#8211; <strong>Problem:<\/strong> Network firewall deployments are inconsistent; new VPCs bypass inspection.\n&#8211; <strong>Why it fits:<\/strong> Firewall Manager can orchestrate AWS Network Firewall policies across multiple accounts\/VPCs.\n&#8211; <strong>Example:<\/strong> All VPCs in the \u201cProd\u201d OU must have Network Firewall deployed with a standard firewall policy and rule groups.<\/p>\n\n\n\n<p>7) <strong>Organization-wide DNS filtering using Route 53 Resolver DNS Firewall<\/strong>\n&#8211; <strong>Problem:<\/strong> Workloads can resolve malicious domains or exfiltrate data via DNS.\n&#8211; <strong>Why it fits:<\/strong> Firewall Manager can manage DNS Firewall rule group associations at scale.\n&#8211; <strong>Example:<\/strong> A DNS Firewall policy blocks known malware domains across all VPCs, with exceptions only in a \u201cResearch\u201d OU.<\/p>\n\n\n\n<p>8) <strong>Tag-driven enforcement for internet exposure<\/strong>\n&#8211; <strong>Problem:<\/strong> Not all resources need the same level of controls; you need targeted enforcement.\n&#8211; <strong>Why it fits:<\/strong> Policies can often be scoped by tags (where supported).\n&#8211; <strong>Example:<\/strong> Only resources tagged <code>DataSensitivity=High<\/code> get the strictest WAF configuration.<\/p>\n\n\n\n<p>9) <strong>Rapid integration after acquisition (new AWS accounts)<\/strong>\n&#8211; <strong>Problem:<\/strong> Newly acquired business units have different standards and incomplete protections.\n&#8211; <strong>Why it fits:<\/strong> Bring accounts into your Organization and apply baseline policies quickly.\n&#8211; <strong>Example:<\/strong> Within a week of account migration, baseline WAF and security group policies are enforced and audited centrally.<\/p>\n\n\n\n<p>10) <strong>Continuous compliance reporting for leadership and auditors<\/strong>\n&#8211; <strong>Problem:<\/strong> Security needs measurable coverage across accounts and Regions.\n&#8211; <strong>Why it fits:<\/strong> Firewall Manager consolidates compliance results.\n&#8211; <strong>Example:<\/strong> A quarterly security review uses Firewall Manager compliance dashboards to show baseline WAF coverage on all production endpoints.<\/p>\n\n\n\n<p>11) <strong>Separation of duties: central security, autonomous app teams<\/strong>\n&#8211; <strong>Problem:<\/strong> App teams move fast; security needs guardrails without blocking.\n&#8211; <strong>Why it fits:<\/strong> Security sets policies; app teams deploy resources normally.\n&#8211; <strong>Example:<\/strong> App teams can deploy new ALBs; Firewall Manager automatically applies baseline protections.<\/p>\n\n\n\n<p>12) <strong>Multi-Region governance<\/strong>\n&#8211; <strong>Problem:<\/strong> Teams protect us-east-1 but forget eu-west-1.\n&#8211; <strong>Why it fits:<\/strong> Policies can be created and applied across Regions (Region-by-Region setup).\n&#8211; <strong>Example:<\/strong> The same WAF baseline is applied to all Regions where workloads run, with consistent reporting.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">6. Core Features<\/h2>\n\n\n\n<p>Below are the most important AWS Firewall Manager features, with practical implications and caveats. Always confirm the latest supported policy types and behaviors in the official docs because integrations evolve.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">6.1 Centralized policy management across AWS Organizations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets you define firewall-related policies once in an administrator account and apply them across OUs\/accounts.<\/li>\n<li><strong>Why it matters:<\/strong> Reduces configuration drift and manual work.<\/li>\n<li><strong>Practical benefit:<\/strong> Standardizes protections across dozens or hundreds of accounts.<\/li>\n<li><strong>Caveats:<\/strong> Requires AWS Organizations (typically with \u201cAll features\u201d enabled). The management model (management account vs delegated administrator) affects operations.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.2 Multiple policy types (depends on underlying services)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Supports policies that manage protections implemented by services like AWS WAF, AWS Shield Advanced, AWS Network Firewall, security groups, and Route 53 Resolver DNS Firewall.<\/li>\n<li><strong>Why it matters:<\/strong> One control plane for multiple layers (L3\/L4 network, L7 web, DNS).<\/li>\n<li><strong>Practical benefit:<\/strong> Centralize governance without forcing a single control type.<\/li>\n<li><strong>Caveats:<\/strong> Each policy type has its own prerequisites, Regions, limits, and behavior. Verify policy type availability and details in official docs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.3 Automated remediation (optional)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Can automatically apply required protections to in-scope resources (for example, associate a web ACL).<\/li>\n<li><strong>Why it matters:<\/strong> Prevents \u201ctime gaps\u201d where resources are created and remain unprotected.<\/li>\n<li><strong>Practical benefit:<\/strong> Makes guardrails continuous, not ticket-driven.<\/li>\n<li><strong>Caveats:<\/strong> Remediation can disrupt applications if rules are too strict. Many teams start in audit-only mode, tune, then enable remediation.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.4 Continuous compliance auditing and reporting<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Evaluates whether in-scope resources match the policy requirements and reports compliance.<\/li>\n<li><strong>Why it matters:<\/strong> Security is not \u201cset-and-forget\u201d; drift happens.<\/li>\n<li><strong>Practical benefit:<\/strong> Central dashboard for compliance status by policy\/account\/resource.<\/li>\n<li><strong>Caveats:<\/strong> Compliance evaluation frequency and timing depend on underlying services and prerequisites (often AWS Config). Expect some propagation delay.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.5 OU\/account scoping and exclusions<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Targets policies to OUs or accounts; supports excluding specific accounts where needed.<\/li>\n<li><strong>Why it matters:<\/strong> Different environments (dev vs prod) often require different baselines.<\/li>\n<li><strong>Practical benefit:<\/strong> Apply stricter controls to production OUs; lighter controls to dev OUs.<\/li>\n<li><strong>Caveats:<\/strong> Complex org structures require clear governance to avoid accidental scope creep.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.6 Tag-based resource targeting (where supported)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Applies protections to resources that match tags (depending on policy type).<\/li>\n<li><strong>Why it matters:<\/strong> Enables self-service: teams tag resources to opt into baseline protections.<\/li>\n<li><strong>Practical benefit:<\/strong> Avoid over-enforcing controls on internal-only resources.<\/li>\n<li><strong>Caveats:<\/strong> Tagging must be governed; inconsistent tags can lead to gaps. Use tag policies, IaC, and CI checks.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.7 Delegated administrator support<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Lets you designate a non-management account as the Firewall Manager administrator.<\/li>\n<li><strong>Why it matters:<\/strong> Supports separation of duties and reduces risk in the management account.<\/li>\n<li><strong>Practical benefit:<\/strong> Security tooling runs in a dedicated security account.<\/li>\n<li><strong>Caveats:<\/strong> You must configure delegated admin in AWS Organizations correctly.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.8 Multi-Region support (implemented per Region)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Allows you to create policies in Regions where you operate resources (and for CloudFront\/WAF global scope as applicable).<\/li>\n<li><strong>Why it matters:<\/strong> Real environments are multi-Region.<\/li>\n<li><strong>Practical benefit:<\/strong> Consistent control coverage across Regions.<\/li>\n<li><strong>Caveats:<\/strong> You may need to repeat certain configurations per Region and ensure prerequisites (like AWS Config) are enabled in each Region.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">6.9 Integration with logging and audit trails (indirect)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>What it does:<\/strong> Firewall Manager activities are recorded via AWS audit mechanisms (for example, AWS CloudTrail for API calls). Underlying services provide detailed logs (AWS WAF logs, Network Firewall logs, DNS Firewall logs).<\/li>\n<li><strong>Why it matters:<\/strong> Governance without logs is hard to prove and hard to troubleshoot.<\/li>\n<li><strong>Practical benefit:<\/strong> Centralized evidence for security operations and compliance.<\/li>\n<li><strong>Caveats:<\/strong> Log storage and ingestion costs can be significant; design logging intentionally.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">7. Architecture and How It Works<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">7.1 High-level architecture<\/h3>\n\n\n\n<p>AWS Firewall Manager acts as a centralized control plane:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>You define a <strong>Firewall Manager policy<\/strong> in the Firewall Manager administrator account.<\/li>\n<li>Firewall Manager uses <strong>AWS Organizations<\/strong> to identify <strong>in-scope accounts<\/strong> (OUs\/accounts\/exclusions).<\/li>\n<li>It discovers and evaluates <strong>in-scope resources<\/strong> (often using <strong>AWS Config<\/strong> and service integrations; verify exact prerequisites per policy type).<\/li>\n<li>It <strong>audits compliance<\/strong> and optionally <strong>remediates<\/strong> by calling underlying service APIs to attach or configure protections (for example, associating an AWS WAF web ACL).<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">7.2 Request\/data\/control flow<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Control plane flow (policy):<\/strong> Admin defines policy \u2192 Firewall Manager distributes policy intent \u2192 evaluates compliance \u2192 remediates (if enabled).<\/li>\n<li><strong>Data plane flow (traffic):<\/strong> End-user traffic flows through resources (CloudFront\/ALB\/API Gateway\/VPC). Firewall Manager is not inline; the underlying service is inline (AWS WAF at L7, Network Firewall at L3\/L4, DNS Firewall at DNS layer).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7.3 Integrations with related services<\/h3>\n\n\n\n<p>Common integrations include:\n&#8211; <strong>AWS Organizations:<\/strong> required for multi-account policy scoping.\n&#8211; <strong>AWS Config:<\/strong> commonly required to inventory and evaluate protected resources.\n&#8211; <strong>AWS WAF:<\/strong> web ACL creation\/association; rule configuration.\n&#8211; <strong>AWS Shield Advanced:<\/strong> DDoS protection (subscription required).\n&#8211; <strong>AWS Network Firewall:<\/strong> centralized firewall policy\/rule group deployment for VPCs.\n&#8211; <strong>Amazon VPC security groups:<\/strong> audit\/baseline policies.\n&#8211; <strong>Amazon Route 53 Resolver DNS Firewall:<\/strong> DNS filtering policies.\n&#8211; <strong>AWS CloudTrail:<\/strong> auditing policy changes and API activity.\n&#8211; <strong>Amazon CloudWatch \/ EventBridge:<\/strong> operational visibility and events (service behavior varies; verify in official docs).<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">7.4 Dependency services<\/h3>\n\n\n\n<p>At minimum in most real deployments:\n&#8211; AWS Organizations\n&#8211; IAM (permissions and service-linked roles)\n&#8211; AWS Config (in applicable Regions\/accounts)<\/p>\n\n\n\n<p>Depending on what you manage:\n&#8211; AWS WAF, Shield Advanced, Network Firewall, Route 53 Resolver DNS Firewall<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">7.5 Security\/authentication model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Uses IAM permissions in the administrator account to create and manage policies.<\/li>\n<li>Uses <strong>service-linked roles<\/strong> (created automatically by AWS) and cross-account mechanisms coordinated via Organizations for applying protections.<\/li>\n<li>Best practice is a <strong>delegated admin<\/strong> in a dedicated security account.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7.6 Networking model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firewall Manager does not sit in your VPC path.<\/li>\n<li>Network-level enforcement is handled by AWS Network Firewall and VPC routing.<\/li>\n<li>Web enforcement is handled by AWS WAF associated to resources.<\/li>\n<li>DNS enforcement is handled by Route 53 Resolver DNS Firewall rule groups associated with VPCs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7.7 Monitoring\/logging\/governance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use CloudTrail to track administrative changes.<\/li>\n<li>Use compliance dashboards in Firewall Manager for coverage.<\/li>\n<li>Use underlying service logs for incident response:<\/li>\n<li>AWS WAF logs (to Firehose \u2192 S3\/OpenSearch, etc.)<\/li>\n<li>Network Firewall logs (to CloudWatch Logs \/ S3 via Firehose, depending on configuration)<\/li>\n<li>DNS Firewall query logs (per Route 53 Resolver capabilities)<\/li>\n<li>Tagging governance: enforce required tags so tag-scoped policies don\u2019t miss resources.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">7.8 Simple architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart LR\n  A[Security Admin Account&lt;br\/&gt;AWS Firewall Manager] --&gt; B[AWS Organizations&lt;br\/&gt;OUs &amp; Accounts]\n  A --&gt; C[Policies&lt;br\/&gt;WAF \/ SG \/ Network Firewall \/ DNS Firewall]\n  C --&gt; D[Member Accounts&lt;br\/&gt;Workloads]\n  D --&gt; E[Protected Resources&lt;br\/&gt;CloudFront \/ ALB \/ VPC \/ SG \/ Resolver]\n  E --&gt; F[Underlying Enforcement&lt;br\/&gt;AWS WAF \/ Network Firewall \/ DNS Firewall]\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">7.9 Production-style architecture diagram (Mermaid)<\/h3>\n\n\n\n<pre><code class=\"language-mermaid\">flowchart TB\n  subgraph Org[AWS Organization]\n    subgraph Sec[Security OU]\n      FMS[Firewall Manager Admin Account]\n      LOG[Log Archive \/ SIEM Account]\n    end\n\n    subgraph Shared[Shared Services OU]\n      NET[Network Account&lt;br\/&gt;Transit Gateway \/ Central Egress]\n      DNS[DNS Account&lt;br\/&gt;Resolver endpoints (optional)]\n    end\n\n    subgraph Work[Workload OUs]\n      A1[Prod App Account A]\n      A2[Prod App Account B]\n      D1[Dev Account]\n    end\n  end\n\n  FMS --&gt;|Policy distribution| Org\n  FMS --&gt;|WAF policy| A1\n  FMS --&gt;|WAF policy| A2\n  FMS --&gt;|SG audit policy| Work\n  FMS --&gt;|Network Firewall policy| NET\n  FMS --&gt;|DNS Firewall policy| Work\n\n  A1 --&gt; CF1[CloudFront\/ALB\/API resources]\n  A2 --&gt; CF2[CloudFront\/ALB\/API resources]\n  NET --&gt; NFW[AWS Network Firewall]\n  Work --&gt; R53[Route 53 Resolver DNS Firewall]\n\n  CF1 --&gt; WAF1[AWS WAF web ACL]\n  CF2 --&gt; WAF2[AWS WAF web ACL]\n\n  WAF1 --&gt;|logs| LOG\n  NFW --&gt;|logs| LOG\n  R53 --&gt;|DNS logs| LOG\n  FMS --&gt;|API activity| CT[CloudTrail]\n  CT --&gt; LOG\n<\/code><\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">8. Prerequisites<\/h2>\n\n\n\n<p>Before you start (especially for the hands-on lab), make sure you have the following.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Account\/organization requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS Organizations<\/strong> set up.<\/li>\n<li>Typically <strong>All features enabled<\/strong> in Organizations (required for many delegated admin\/security services).<\/li>\n<li>At least <strong>two accounts<\/strong> recommended for a meaningful lab:<\/li>\n<li>A security\/tooling account (Firewall Manager administrator)<\/li>\n<li>A workload\/member account (where resources will be protected)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Permissions \/ IAM roles<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>In the AWS Organizations management account:<\/li>\n<li>Permission to manage Organizations, enable service access, and register a delegated administrator.<\/li>\n<li>In the Firewall Manager administrator account:<\/li>\n<li>Permission to create Firewall Manager policies and manage integrated services (WAF, etc.).<\/li>\n<li>Ensure you can create service-linked roles (common requirement across AWS security services).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Billing requirements<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A valid payment method attached to accounts.<\/li>\n<li>Awareness of costs for:<\/li>\n<li>AWS Config (often required)<\/li>\n<li>AWS WAF (web ACLs and requests)<\/li>\n<li>CloudFront (if used)<\/li>\n<li>S3 (storage)<\/li>\n<li>AWS Shield Advanced is a paid subscription; do not enable it for a low-cost lab unless you explicitly intend to.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">CLI\/SDK\/tools needed<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Console access is sufficient for this tutorial.<\/li>\n<li>Optional:<\/li>\n<li>AWS CLI v2 for validation and automation: https:\/\/docs.aws.amazon.com\/cli\/latest\/userguide\/getting-started-install.html<\/li>\n<li><code>curl<\/code> for testing HTTP behavior.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Region availability<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Firewall Manager is used across Regions depending on policy type.<\/li>\n<li>For <strong>CloudFront + AWS WAF (CloudFront scope)<\/strong>, configuration is commonly done in <strong>us-east-1<\/strong>. Verify the exact requirement in AWS WAF and Firewall Manager docs for CloudFront-scoped web ACLs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Quotas\/limits<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Service quotas exist for Firewall Manager and the underlying services (WAF, Network Firewall, etc.).<\/li>\n<li>Check:<\/li>\n<li>AWS Firewall Manager quotas in the <strong>Service Quotas<\/strong> console<\/li>\n<li>Underlying service quotas (AWS WAF capacity, rule limits, etc.)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Prerequisite services<\/h3>\n\n\n\n<p>Depending on what you manage:\n&#8211; <strong>AWS Config<\/strong> enabled in target accounts\/Regions (commonly required). Confirm in official docs for each policy type.\n&#8211; <strong>AWS WAF<\/strong> (for WAF policies)\n&#8211; <strong>CloudFront\/ALB\/API Gateway<\/strong> etc. (resources to protect)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">9. Pricing \/ Cost<\/h2>\n\n\n\n<p>AWS Firewall Manager cost is a combination of:\n1) <strong>Firewall Manager pricing<\/strong> itself (policy-based management layer), and<br\/>\n2) <strong>Underlying service costs<\/strong> (AWS WAF, AWS Config, CloudFront, Network Firewall, DNS Firewall, Shield Advanced, logging pipelines).<\/p>\n\n\n\n<p>Because AWS pricing is Region-dependent and changes over time, use official sources:\n&#8211; AWS Firewall Manager pricing page: https:\/\/aws.amazon.com\/firewall-manager\/pricing\/\n&#8211; AWS Pricing Calculator: https:\/\/calculator.aws\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">9.1 Pricing dimensions (how you are billed)<\/h3>\n\n\n\n<p>Common billing dimensions to evaluate (verify exact details on the pricing page):\n&#8211; Firewall Manager charges typically relate to <strong>policies<\/strong> and\/or <strong>scope<\/strong> (for example, by policy count, by Region, and\/or by accounts\/resources protected). <strong>Verify the current model<\/strong> in the official pricing page because this is the part that changes most often.\n&#8211; Underlying services bill independently:\n  &#8211; <strong>AWS WAF:<\/strong> web ACLs, rule groups, requests processed, and optional logging pipelines.\n  &#8211; <strong>AWS Config:<\/strong> configuration items recorded, rules\/evaluations, and delivery\/storage.\n  &#8211; <strong>CloudFront:<\/strong> data transfer and requests.\n  &#8211; <strong>AWS Network Firewall:<\/strong> endpoint hours, traffic processed, and logging.\n  &#8211; <strong>Route 53 Resolver DNS Firewall:<\/strong> query processing and rule group usage (pricing varies; verify).\n  &#8211; <strong>AWS Shield Advanced:<\/strong> subscription fee (significant) plus data transfer\/usage implications.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">9.2 Free tier<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>AWS Firewall Manager itself may not have a meaningful free tier for real usage; <strong>verify<\/strong> on the pricing page.<\/li>\n<li>Some underlying services have limited free tiers (for example, CloudFront has a free tier for a period for some accounts; AWS WAF generally does not have a broad free tier). Always validate current free tier eligibility.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9.3 Primary cost drivers<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Number of Firewall Manager policies (and how many Regions\/accounts each policy covers).<\/li>\n<li>AWS Config enabled across many accounts\/Regions (inventory scale increases cost).<\/li>\n<li>AWS WAF request volume (public endpoints with high traffic can be expensive).<\/li>\n<li>Logging volume (WAF logs, firewall logs, DNS logs) and retention.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9.4 Hidden\/indirect costs to plan for<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Log pipelines<\/strong>: Kinesis Data Firehose, S3 storage, OpenSearch, SIEM ingestion.<\/li>\n<li><strong>Data transfer<\/strong>: CloudFront and cross-Region log centralization can add costs.<\/li>\n<li><strong>Operational time<\/strong>: tuning WAF rules and managing exceptions (not a direct AWS bill, but real cost).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9.5 Network\/data transfer implications<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firewall Manager control plane traffic is not your data plane.<\/li>\n<li>Costs mostly come from:<\/li>\n<li>CloudFront and origin traffic<\/li>\n<li>WAF inspection at the edge\/region (charged per request)<\/li>\n<li>Network Firewall traffic processing (charged per GB or similar metric; verify)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9.6 How to optimize cost<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start with <strong>audit-only<\/strong>, then enable remediation after tuning.<\/li>\n<li>Consolidate policies: fewer, well-designed policies are cheaper and easier to manage than many narrow ones.<\/li>\n<li>Scope carefully using OUs and tags; avoid applying heavy inspections to all dev\/test resources.<\/li>\n<li>Use AWS WAF managed rule groups thoughtfully\u2014avoid enabling everything everywhere.<\/li>\n<li>Set clear log retention and sampling strategies appropriate to compliance needs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">9.7 Example low-cost starter estimate (conceptual)<\/h3>\n\n\n\n<p>A low-cost starter lab usually includes:\n&#8211; 1\u20132 accounts\n&#8211; AWS Config enabled in a single Region\n&#8211; 1 CloudFront distribution + 1 S3 bucket\n&#8211; 1 Firewall Manager policy that deploys\/associates a simple WAF web ACL\n&#8211; Very low request volume<\/p>\n\n\n\n<p>You should expect small but non-zero costs from AWS Config, AWS WAF, CloudFront, and S3. Use the AWS Pricing Calculator and keep the lab runtime short.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">9.8 Example production cost considerations<\/h3>\n\n\n\n<p>In production, costs scale with:\n&#8211; Number of OUs\/accounts\/Regions\n&#8211; Number of protected endpoints (ALBs, APIs, CloudFront distributions)\n&#8211; Request volume (WAF) and traffic volume (Network Firewall)\n&#8211; Logging retention and analysis tools<\/p>\n\n\n\n<p>Production cost management usually involves:\n&#8211; Periodic reviews of policy scope\n&#8211; WAF rule tuning and false-positive reduction\n&#8211; Log pipeline optimization<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">10. Step-by-Step Hands-On Tutorial<\/h2>\n\n\n\n<p>This lab builds a small but realistic setup: a CloudFront distribution serving a static page from S3, with AWS Firewall Manager automatically associating an AWS WAF web ACL that blocks a specific User-Agent.<\/p>\n\n\n\n<p>This demonstrates the core value: <strong>central policy \u2192 automatic enforcement \u2192 measurable outcome<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Objective<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Set up AWS Firewall Manager with a delegated administrator.<\/li>\n<li>Create a Firewall Manager <strong>AWS WAF policy<\/strong> for <strong>CloudFront distributions<\/strong> that match a specific tag.<\/li>\n<li>Deploy a CloudFront distribution in a member account and verify that:<\/li>\n<li>The AWS WAF web ACL is automatically associated<\/li>\n<li>Requests with <code>User-Agent: BadBot<\/code> are blocked (HTTP 403)<\/li>\n<li>Normal requests succeed (HTTP 200)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Lab Overview<\/h3>\n\n\n\n<p>You will create:\n&#8211; An AWS Organization (if you don\u2019t already have one)\n&#8211; A delegated Firewall Manager administrator account (security account)\n&#8211; AWS Config enabled (commonly required for Firewall Manager; confirm in official docs if your policy type requires it)\n&#8211; In a member account:\n  &#8211; An S3 bucket with a simple <code>index.html<\/code>\n  &#8211; A CloudFront distribution tagged <code>FMSProtected=true<\/code>\n&#8211; In the Firewall Manager admin account:\n  &#8211; A Firewall Manager policy that creates and associates an AWS WAF web ACL to tagged CloudFront distributions<\/p>\n\n\n\n<p><strong>Estimated time:<\/strong> 60\u2013120 minutes (CloudFront provisioning and policy propagation can take time)<br\/>\n<strong>Estimated cost:<\/strong> low, but not free (AWS Config, CloudFront, AWS WAF, S3)<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Create (or confirm) an AWS Organization with two accounts<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> You need an AWS Organization and at least one member account to see Firewall Manager in action.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Sign in to the <strong>AWS Organizations management account<\/strong>.<\/li>\n<li>Go to <strong>AWS Organizations<\/strong>.<\/li>\n<li>If you don\u2019t already have an Organization, create one.<\/li>\n<li>Create a <strong>member account<\/strong> (workload account) if needed:\n   &#8211; Example name: <code>workload-lab<\/code>\n   &#8211; Use an email you control<\/li>\n<li>Create (or choose) a <strong>security\/tooling account<\/strong> to act as the Firewall Manager delegated admin:\n   &#8211; Example name: <code>security-lab<\/code><\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; You have:\n  &#8211; A management account\n  &#8211; A security account\n  &#8211; A workload account\n&#8211; All are part of the same AWS Organization.<\/p>\n\n\n\n<p><strong>Notes<\/strong>\n&#8211; Account creation can take several minutes.\n&#8211; If you already have accounts, you can reuse them.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Register the Firewall Manager delegated administrator<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Use a dedicated security account to manage Firewall Manager policies.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the <strong>Organizations management account<\/strong>, open <strong>AWS Organizations<\/strong>.<\/li>\n<li>Go to <strong>Services<\/strong> (or <strong>Delegated administrator<\/strong> section; UI changes over time).<\/li>\n<li>Enable trusted access for <strong>AWS Firewall Manager<\/strong> (if prompted).<\/li>\n<li>Register your <strong>security account<\/strong> as the <strong>delegated administrator<\/strong> for AWS Firewall Manager.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; Your security account is now the delegated administrator for Firewall Manager.\n&#8211; You can manage policies from the security account without using the management account for day-to-day operations.<\/p>\n\n\n\n<p><strong>Common error<\/strong>\n&#8211; If registration fails, confirm your Organization has <strong>All features enabled<\/strong> and that you have permission to manage delegated administrators.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Enable AWS Config (commonly required) in the admin and member accounts<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Ensure resource discovery and compliance evaluation works as expected.<\/p>\n\n\n\n<blockquote>\n<p>AWS Firewall Manager prerequisites often include AWS Config in each account\/Region where you apply policies. Requirements vary by policy type. <strong>Verify in official docs<\/strong> for your chosen policy type.<\/p>\n<\/blockquote>\n\n\n\n<p>For this lab, enable AWS Config in:\n&#8211; The <strong>security (admin)<\/strong> account\n&#8211; The <strong>workload (member)<\/strong> account<br\/>\nAnd at minimum in <strong>us-east-1<\/strong> (and any other Region you plan to use).<\/p>\n\n\n\n<p><strong>In each account:<\/strong>\n1. Switch to the account (security first, then workload).\n2. Go to <strong>AWS Config<\/strong>.\n3. Use the simplest setup available (often \u201c1-click setup\u201d or \u201cGet started\u201d):\n   &#8211; Record resources (you can record all supported resources for simplicity in a lab).\n   &#8211; Choose\/create an S3 bucket for AWS Config delivery (the wizard can create it).\n   &#8211; Enable the configuration recorder.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; AWS Config shows \u201cRecording: On\u201d.\n&#8211; A delivery channel is configured.<\/p>\n\n\n\n<p><strong>Cost note<\/strong>\n&#8211; AWS Config charges based on configuration items and evaluations. Disable it during cleanup if you don\u2019t need it.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: In the workload account, create the S3 origin with a simple page<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Host a simple site to serve behind CloudFront.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the <strong>workload account<\/strong>, go to <strong>Amazon S3<\/strong>.<\/li>\n<li>Create a bucket (globally unique name), for example:\n   &#8211; <code>fms-lab-site-&lt;unique-suffix&gt;<\/code><\/li>\n<li>Keep <strong>Block Public Access<\/strong> enabled (recommended).<\/li>\n<li>Upload a simple <code>index.html<\/code> file.<\/li>\n<\/ol>\n\n\n\n<p>Sample <code>index.html<\/code>:<\/p>\n\n\n\n<pre><code class=\"language-html\">&lt;!doctype html&gt;\n&lt;html&gt;\n  &lt;head&gt;&lt;meta charset=\"utf-8\"&gt;&lt;title&gt;FMS Lab&lt;\/title&gt;&lt;\/head&gt;\n  &lt;body&gt;\n    &lt;h1&gt;AWS Firewall Manager Lab&lt;\/h1&gt;\n    &lt;p&gt;If you can read this, CloudFront can reach the S3 origin.&lt;\/p&gt;\n  &lt;\/body&gt;\n&lt;\/html&gt;\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; The S3 bucket contains <code>index.html<\/code>.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 5: In the workload account, create a CloudFront distribution (tagged for policy targeting)<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Create a CloudFront distribution that Firewall Manager can protect.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In the <strong>workload account<\/strong>, go to <strong>Amazon CloudFront<\/strong>.<\/li>\n<li>Create a new distribution.<\/li>\n<li>For <strong>Origin<\/strong>, select your S3 bucket.<\/li>\n<li>Use <strong>Origin Access Control (OAC)<\/strong> if the console offers it (recommended):\n   &#8211; Create a new OAC.\n   &#8211; Let CloudFront update the S3 bucket policy (the console typically provides a button to copy\/apply the policy).<\/li>\n<li>Set <strong>Default root object<\/strong> to <code>index.html<\/code>.<\/li>\n<li>Add a tag to the distribution:\n   &#8211; Key: <code>FMSProtected<\/code>\n   &#8211; Value: <code>true<\/code><\/li>\n<li>Create the distribution.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; CloudFront distribution status becomes <strong>Deployed<\/strong> (this can take time).\n&#8211; You have a CloudFront domain name like <code>d123example.cloudfront.net<\/code>.\n&#8211; Your distribution is tagged <code>FMSProtected=true<\/code>.<\/p>\n\n\n\n<p><strong>Verification<\/strong>\nOnce deployed, open in a browser:\n&#8211; <code>https:\/\/&lt;cloudfront-domain&gt;\/<\/code><br\/>\nYou should see the \u201cAWS Firewall Manager Lab\u201d page.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 6: In the security account, enable AWS Firewall Manager and create a WAF policy<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Define a centralized policy that automatically associates a WAF web ACL with tagged CloudFront distributions.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Switch to the <strong>security (delegated admin)<\/strong> account.<\/li>\n<li>Go to <strong>AWS Firewall Manager<\/strong> console.<\/li>\n<li>If prompted, complete initial setup steps (service-linked role creation, etc.).<\/li>\n<\/ol>\n\n\n\n<p>Now create a policy:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>In AWS Firewall Manager, choose <strong>Security policies<\/strong> (or <strong>Policies<\/strong>) \u2192 <strong>Create policy<\/strong>.<\/li>\n<li>Choose the policy type for <strong>AWS WAF<\/strong> (WAFv2).<br\/>\n   &#8211; If you see options for <strong>CloudFront distributions<\/strong>, select that resource type.\n   &#8211; Because CloudFront\/WAF scope is special, you may need to create this policy in the correct Region (commonly <strong>us-east-1<\/strong>). <strong>Follow the console guidance<\/strong>.<\/li>\n<li>Choose to <strong>Create and apply a new web ACL<\/strong> (wording may vary).<\/li>\n<li>Configure the web ACL rules:\n   &#8211; Add a simple rule to block a known User-Agent:<ul>\n<li>Name: <code>BlockBadBotUA<\/code><\/li>\n<li>Condition: match <code>User-Agent<\/code> header contains <code>BadBot<\/code> (exact match vs contains depends on WAF UI; choose a simple match)<\/li>\n<li>Action: <strong>Block<\/strong><\/li>\n<li>Default action: <strong>Allow<\/strong><\/li>\n<\/ul>\n<\/li>\n<li>Policy scope:\n   &#8211; Apply to the OU\/account that contains your workload account.\n   &#8211; Use <strong>resource tags<\/strong> targeting:<ul>\n<li>Include only resources with tag <code>FMSProtected=true<\/code> (if this option is available for the chosen resource type).<\/li>\n<\/ul>\n<\/li>\n<li>Remediation:\n   &#8211; Enable <strong>automatic remediation<\/strong> so the web ACL is associated automatically.<\/li>\n<li>Create the policy.<\/li>\n<\/ol>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; The policy is created and shows as enabled.\n&#8211; Firewall Manager begins evaluating your organization for in-scope resources.<\/p>\n\n\n\n<p><strong>Important caveat<\/strong>\n&#8211; Policy propagation is not instantaneous. It can take minutes (sometimes longer) for compliance to update and for associations to appear.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 7: Wait for policy application and verify WAF association<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Confirm that Firewall Manager associated the web ACL with your CloudFront distribution.<\/p>\n\n\n\n<p><strong>In the security account (Firewall Manager):<\/strong>\n1. Open the policy.\n2. Check <strong>Compliance status<\/strong> and protected resources.\n3. Confirm your CloudFront distribution is in scope and becomes compliant.<\/p>\n\n\n\n<p><strong>In the workload account (AWS WAF):<\/strong>\n1. Go to <strong>AWS WAF<\/strong> console.\n2. Ensure you are viewing the correct scope for CloudFront (the UI typically indicates CloudFront scope and uses a specific Region like us-east-1).\n3. Find the web ACL created by Firewall Manager.\n4. Confirm the web ACL is associated with your CloudFront distribution.<\/p>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; The CloudFront distribution shows an associated WAF web ACL.\n&#8211; Firewall Manager compliance indicates the resource is protected (or compliant).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Step 8: Test blocking behavior (validation via curl)<\/h3>\n\n\n\n<p><strong>Goal:<\/strong> Confirm requests are blocked when User-Agent matches your rule.<\/p>\n\n\n\n<p>Replace <code>&lt;CLOUDFRONT_DOMAIN&gt;<\/code> with your distribution domain (for example, <code>d123example.cloudfront.net<\/code>).<\/p>\n\n\n\n<p>Test normal request:<\/p>\n\n\n\n<pre><code class=\"language-bash\">curl -I \"https:\/\/&lt;CLOUDFRONT_DOMAIN&gt;\/\"\n<\/code><\/pre>\n\n\n\n<p>You should see a successful response such as:\n&#8211; <code>HTTP\/2 200<\/code> (or <code>HTTP\/1.1 200<\/code> depending on headers\/caching)<\/p>\n\n\n\n<p>Now test the blocked User-Agent:<\/p>\n\n\n\n<pre><code class=\"language-bash\">curl -I -H \"User-Agent: BadBot\" \"https:\/\/&lt;CLOUDFRONT_DOMAIN&gt;\/\"\n<\/code><\/pre>\n\n\n\n<p><strong>Expected outcome<\/strong>\n&#8211; The second request should return <strong>HTTP 403<\/strong> (for a WAF block).\n&#8211; Response headers often include WAF-related headers (not always; depends on configuration).<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Validation<\/h3>\n\n\n\n<p>Use this checklist:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>[ ] Firewall Manager policy exists and is enabled in the security account  <\/li>\n<li>[ ] Workload CloudFront distribution is tagged <code>FMSProtected=true<\/code> <\/li>\n<li>[ ] Firewall Manager compliance view shows the distribution in scope  <\/li>\n<li>[ ] AWS WAF shows a web ACL associated with the CloudFront distribution  <\/li>\n<li>[ ] <code>curl<\/code> with normal User-Agent returns 200  <\/li>\n<li>[ ] <code>curl<\/code> with <code>User-Agent: BadBot<\/code> returns 403  <\/li>\n<\/ul>\n\n\n\n<p>If all are true, you have a working end-to-end Firewall Manager enforcement loop.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Troubleshooting<\/h3>\n\n\n\n<p>Common issues and fixes:<\/p>\n\n\n\n<p>1) <strong>Policy shows no resources in scope<\/strong>\n&#8211; Confirm the CloudFront distribution has the exact tag key\/value used in the policy.\n&#8211; Confirm the policy scope includes the correct OU\/account.\n&#8211; Confirm you created the policy in the correct Region\/scope for CloudFront\/WAF (often us-east-1 for CloudFront scope).<\/p>\n\n\n\n<p>2) <strong>CloudFront distribution isn\u2019t associated with the web ACL<\/strong>\n&#8211; Wait longer\u2014CloudFront + WAF associations can take time to propagate.\n&#8211; Ensure remediation is enabled in the Firewall Manager policy.\n&#8211; Confirm AWS Config prerequisites (if required) are enabled in the target account\/Region.<\/p>\n\n\n\n<p>3) <strong>403 isn\u2019t returned for BadBot<\/strong>\n&#8211; Confirm the WAF rule is correct (header match, contains vs equals, case sensitivity).\n&#8211; Check if CloudFront caching is interfering (less likely for a header-based rule, but still possible).\n&#8211; Confirm you\u2019re testing the correct domain and path.<\/p>\n\n\n\n<p>4) <strong>You can\u2019t enable Firewall Manager in the security account<\/strong>\n&#8211; Confirm the account is registered as delegated administrator in AWS Organizations.\n&#8211; Confirm trusted access for Firewall Manager is enabled.<\/p>\n\n\n\n<p>5) <strong>S3 access denied via CloudFront<\/strong>\n&#8211; If using OAC, confirm the S3 bucket policy was applied correctly.\n&#8211; Confirm the object exists (<code>index.html<\/code>) and is in the right key.<\/p>\n\n\n\n<hr class=\"wp-block-separator\" \/>\n\n\n\n<h3 class=\"wp-block-heading\">Cleanup<\/h3>\n\n\n\n<p>To avoid ongoing charges, clean up in reverse order.<\/p>\n\n\n\n<p>1) <strong>Delete the Firewall Manager policy<\/strong>\n&#8211; In the security account, delete the policy.\n&#8211; Wait for it to stop enforcing\/remediating.<\/p>\n\n\n\n<p>2) <strong>Delete the AWS WAF web ACL (if it wasn\u2019t deleted automatically)<\/strong>\n&#8211; Ensure it is disassociated first.\n&#8211; Then delete the web ACL.<\/p>\n\n\n\n<p>3) <strong>Delete CloudFront distribution<\/strong>\n&#8211; Disable the distribution first.\n&#8211; Wait for status to deploy the disabled state.\n&#8211; Then delete it. (CloudFront deletion can take time.)<\/p>\n\n\n\n<p>4) <strong>Delete S3 bucket<\/strong>\n&#8211; Delete objects (<code>index.html<\/code>) and then delete the bucket.<\/p>\n\n\n\n<p>5) <strong>Disable AWS Config (optional but recommended for a lab)<\/strong>\n&#8211; In each account, stop the configuration recorder and delete delivery channel\/config settings if you no longer need them.\n&#8211; Remove or keep the S3 buckets used for AWS Config delivery as appropriate.<\/p>\n\n\n\n<p>6) <strong>(Optional) Remove delegated administrator registration<\/strong>\n&#8211; In the Organizations management account, remove delegated admin for Firewall Manager if this was only for a temporary lab.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">11. Best Practices<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Architecture best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Use a <strong>multi-account landing zone<\/strong> (security\/tooling account, log archive account, workload accounts).<\/li>\n<li>Prefer a <strong>delegated administrator<\/strong> account for Firewall Manager rather than running everything from the management account.<\/li>\n<li>Separate policies by environment and risk level (for example, prod vs dev) using OUs.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">IAM\/security best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Apply least privilege:<\/li>\n<li>Limit who can create\/modify Firewall Manager policies.<\/li>\n<li>Use IAM roles with clear separation between policy authors and workload operators.<\/li>\n<li>Require MFA and strong access controls for the security admin account.<\/li>\n<li>Monitor Firewall Manager API activity with CloudTrail and alert on policy changes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Cost best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start with <strong>audit-only<\/strong> mode to avoid unexpected remediation impacts and to reduce operational churn.<\/li>\n<li>Scope policies carefully using OUs and tags to avoid protecting everything everywhere.<\/li>\n<li>Keep AWS Config footprint minimal but sufficient:<\/li>\n<li>Enable only required Regions.<\/li>\n<li>Avoid recording unnecessary resource types when feasible (balance with compliance needs).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Performance best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Remember: performance impact comes from underlying services.<\/li>\n<li>AWS WAF: add rules thoughtfully; test false positives; use managed rules appropriately.<\/li>\n<li>Network Firewall: plan routing and scaling for throughput.<\/li>\n<li>Use staged rollouts:<\/li>\n<li>Apply to a pilot OU first, then expand.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Reliability best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Treat policies as code:<\/li>\n<li>Use Infrastructure as Code where supported (CloudFormation\/Terraform) for repeatability.<\/li>\n<li>Version changes and use change control.<\/li>\n<li>Use exception mechanisms deliberately:<\/li>\n<li>If an app requires an exception, document it and ensure it\u2019s scoped.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Operations best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Define ownership:<\/li>\n<li>Security owns baseline policies.<\/li>\n<li>App teams own application-specific exceptions\/tuning (within guardrails).<\/li>\n<li>Set up recurring reviews:<\/li>\n<li>Monthly: compliance gaps, unused security groups, policy drift.<\/li>\n<li>Quarterly: policy design, cost, incident learnings.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Governance\/tagging\/naming best practices<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Create a standard tag schema used for policy targeting, for example:<\/li>\n<li><code>Environment=prod|dev<\/code><\/li>\n<li><code>Exposure=public|internal<\/code><\/li>\n<li><code>DataSensitivity=low|medium|high<\/code><\/li>\n<li>Enforce tags through IaC, CI checks, and (where appropriate) Organizations tag policies.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">12. Security Considerations<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Identity and access model<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firewall Manager is controlled via IAM in the administrator account.<\/li>\n<li>Use AWS Organizations delegated admin to keep security tooling separate.<\/li>\n<li>Restrict permissions to:<\/li>\n<li>Create\/update\/delete policies<\/li>\n<li>Change policy scope<\/li>\n<li>Enable remediation<\/li>\n<li>Use break-glass access patterns for emergency changes.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Encryption<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firewall Manager is a control-plane service; encryption concerns typically relate to:<\/li>\n<li>AWS Config delivery buckets (S3 encryption)<\/li>\n<li>WAF logs and firewall logs stored in S3\/OpenSearch<\/li>\n<li>Use SSE-S3 or SSE-KMS for log buckets, and KMS key policies that enforce least privilege.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Network exposure<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firewall Manager doesn\u2019t introduce data-plane exposure.<\/li>\n<li>The risk is misconfiguration of underlying protections:<\/li>\n<li>Over-blocking (availability risk)<\/li>\n<li>Under-blocking (security risk)<\/li>\n<li>Always validate in lower environments before enabling remediation in production.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secrets handling<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firewall Manager itself doesn\u2019t require application secrets.<\/li>\n<li>Your logging and automation pipelines might (for example, SIEM integration). Use AWS Secrets Manager or Parameter Store for any secrets in automation scripts.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Audit\/logging<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enable CloudTrail organization trails to capture Firewall Manager and related API calls across accounts.<\/li>\n<li>Centralize logs in a log archive account.<\/li>\n<li>Keep evidence for:<\/li>\n<li>Policy creation\/changes<\/li>\n<li>Compliance status<\/li>\n<li>WAF\/firewall\/DNS events (for incident response)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Compliance considerations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Firewall Manager helps demonstrate consistent policy enforcement and monitoring, but <strong>compliance requires more than firewall controls<\/strong>:<\/li>\n<li>Identity governance, data protection, vulnerability management, incident response, etc.<\/li>\n<li>Align policies with your control frameworks (PCI DSS, SOC 2, ISO 27001, HIPAA) and document exceptions.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Common security mistakes<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Applying strict remediation policies without testing (causes outages).<\/li>\n<li>Relying on tag-based scope without enforcing tag correctness (creates gaps).<\/li>\n<li>Not enabling organization-wide CloudTrail (no audit trail).<\/li>\n<li>Not planning logging cost and retention (bill shock and\/or missing evidence).<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Secure deployment recommendations<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Start in audit-only mode and baseline compliance.<\/li>\n<li>Introduce remediation gradually:<\/li>\n<li>Pilot OU \u2192 expand to prod<\/li>\n<li>Require change approvals for policies that affect production.<\/li>\n<li>Use runbooks for incident response (how to temporarily relax a policy without losing governance).<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">13. Limitations and Gotchas<\/h2>\n\n\n\n<p>Always verify current limits and behavior in official documentation, but these are common real-world gotchas:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS Organizations is required<\/strong>: Firewall Manager is designed for organizations, not standalone accounts.<\/li>\n<li><strong>Propagation delays<\/strong>: policy evaluation and remediation are not instantaneous.<\/li>\n<li><strong>AWS Config dependency<\/strong>: many scenarios depend on AWS Config being enabled in each target account\/Region (and it costs money).<\/li>\n<li><strong>CloudFront\/WAF scoping<\/strong>: CloudFront is global; AWS WAF for CloudFront uses a specific configuration scope\/Region. This confuses many first-time users.<\/li>\n<li><strong>Risk of outages with remediation<\/strong>: remediation can break apps if rules are too strict or if exceptions aren\u2019t planned.<\/li>\n<li><strong>Complex OU scoping<\/strong>: nested OUs and exclusions can lead to unexpected coverage if not carefully designed.<\/li>\n<li><strong>Logging cost and volume<\/strong>: WAF and firewall logs can be extremely high volume at scale.<\/li>\n<li><strong>Service quotas<\/strong>: WAF rule limits, web ACL capacities, Network Firewall limits, and Firewall Manager policy limits can block expansions.<\/li>\n<li><strong>Policy overlap<\/strong>: multiple policies impacting the same underlying resource can create confusing outcomes (depends on service behavior; design to avoid ambiguity).<\/li>\n<li><strong>Multi-Region management overhead<\/strong>: you may need to replicate policies per Region, depending on policy type and resource distribution.<\/li>\n<li><strong>Shield Advanced<\/strong>: requires a paid subscription; don\u2019t accidentally enable it in a lab environment.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">14. Comparison with Alternatives<\/h2>\n\n\n\n<p>AWS Firewall Manager is not a firewall itself\u2014it is a centralized manager for multiple firewall\/protection services. Alternatives depend on what you\u2019re trying to solve.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Key alternatives (AWS-native)<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS WAF (directly)<\/strong>: manage web ACLs per application\/resource without org-wide governance.<\/li>\n<li><strong>AWS Network Firewall (directly)<\/strong>: deploy network firewalls per VPC without centralized org policy enforcement.<\/li>\n<li><strong>AWS Organizations SCPs<\/strong>: prevent actions (like creating certain resources), but SCPs don\u2019t configure WAF or firewalls; they restrict API actions.<\/li>\n<li><strong>AWS Control Tower guardrails<\/strong>: governance baseline for landing zones; not a replacement for firewall policy orchestration.<\/li>\n<li><strong>Security Hub<\/strong>: central security findings aggregation; not a firewall policy deployment service.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Alternatives in other clouds<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Azure Firewall Manager<\/strong>: centralized management for Azure Firewall in hub-and-spoke networks.<\/li>\n<li><strong>Google Cloud Firewall Policies \/ Cloud Armor (for WAF)<\/strong>: policy management and WAF equivalents in Google Cloud.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Open-source \/ self-managed alternatives<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Self-managed WAF (ModSecurity) behind NGINX\/Envoy<\/li>\n<li>Third-party firewall appliances in VPCs<\/li>\n<li>Central policy systems via custom automation (Lambda + Organizations + IaC)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Comparison table<\/h3>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Option<\/th>\n<th>Best For<\/th>\n<th>Strengths<\/th>\n<th>Weaknesses<\/th>\n<th>When to Choose<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><strong>AWS Firewall Manager<\/strong><\/td>\n<td>Multi-account AWS organizations needing centralized firewall governance<\/td>\n<td>Central policies, OU scope, compliance visibility, optional remediation<\/td>\n<td>Requires Organizations; prerequisites like AWS Config; propagation delays<\/td>\n<td>When you need org-wide standardization and reporting<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS WAF (direct)<\/strong><\/td>\n<td>Single app\/team managing its own web protection<\/td>\n<td>App-level control, immediate tuning, direct ownership<\/td>\n<td>Hard to standardize across many accounts; drift risk<\/td>\n<td>When central governance isn\u2019t required or for app-specific tuning<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Network Firewall (direct)<\/strong><\/td>\n<td>Network teams deploying inspection in specific VPCs<\/td>\n<td>Strong VPC-level control, explicit routing<\/td>\n<td>Doesn\u2019t solve org-wide consistency by itself<\/td>\n<td>When you have a few VPCs or a centralized network team workflow<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Organizations SCPs<\/strong><\/td>\n<td>Preventing risky API actions<\/td>\n<td>Strong guardrails, denies are enforceable<\/td>\n<td>Not a firewall; doesn\u2019t inspect traffic<\/td>\n<td>When you need to prevent creation\/changes rather than enforce WAF\/firewall configs<\/td>\n<\/tr>\n<tr>\n<td><strong>AWS Control Tower<\/strong><\/td>\n<td>Landing zone governance and account vending<\/td>\n<td>Standardized account setup, guardrails<\/td>\n<td>Not a firewall policy manager<\/td>\n<td>Use alongside Firewall Manager for a governed multi-account foundation<\/td>\n<\/tr>\n<tr>\n<td><strong>Azure Firewall Manager<\/strong><\/td>\n<td>Azure hub-and-spoke centralized firewall governance<\/td>\n<td>Centralized firewall policy management in Azure<\/td>\n<td>Not applicable to AWS<\/td>\n<td>Choose if your workloads are primarily on Azure<\/td>\n<\/tr>\n<tr>\n<td><strong>GCP Cloud Armor + Firewall Policies<\/strong><\/td>\n<td>GCP WAF and firewall governance<\/td>\n<td>Cloud-native controls on GCP<\/td>\n<td>Not applicable to AWS<\/td>\n<td>Choose if your workloads are primarily on GCP<\/td>\n<\/tr>\n<tr>\n<td><strong>Self-managed WAF \/ appliances<\/strong><\/td>\n<td>Highly customized traffic inspection needs<\/td>\n<td>Full control, niche features<\/td>\n<td>Ops burden, scaling complexity<\/td>\n<td>When you must meet specialized requirements not covered by managed services<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">15. Real-World Example<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Enterprise example: multi-business-unit governance<\/h3>\n\n\n\n<p><strong>Problem<\/strong>\nA large enterprise runs 200+ AWS accounts across multiple business units. Some teams deploy CloudFront distributions and ALBs without consistent web protections. Audit teams need evidence that public endpoints have baseline controls.<\/p>\n\n\n\n<p><strong>Proposed architecture<\/strong>\n&#8211; AWS Organizations with OUs for <code>Prod<\/code>, <code>NonProd<\/code>, <code>SharedServices<\/code>, <code>Security<\/code>.\n&#8211; A dedicated <strong>Security tooling account<\/strong> as the <strong>Firewall Manager delegated administrator<\/strong>.\n&#8211; Firewall Manager policies:\n  &#8211; AWS WAF baseline policy for internet-facing resources in <code>Prod<\/code> OU\n  &#8211; DNS Firewall policy for all VPCs in <code>Prod<\/code> and <code>SharedServices<\/code>\n  &#8211; Security group audit policy to detect risky inbound rules\n&#8211; Central logging:\n  &#8211; CloudTrail organization trail \u2192 centralized S3\n  &#8211; WAF logs \u2192 Firehose \u2192 S3\/OpenSearch (as required)\n&#8211; Rollout:\n  &#8211; Audit-only for 2\u20134 weeks, tune exceptions\n  &#8211; Enable remediation in phases by OU<\/p>\n\n\n\n<p><strong>Why AWS Firewall Manager was chosen<\/strong>\n&#8211; Needed OU-based governance and multi-account enforcement.\n&#8211; Security wanted centralized policy control with measurable compliance reporting.\n&#8211; Reduced per-team manual work and improved audit consistency.<\/p>\n\n\n\n<p><strong>Expected outcomes<\/strong>\n&#8211; Standard baseline protections applied consistently.\n&#8211; Faster detection of unprotected endpoints.\n&#8211; Reduced audit findings related to inconsistent firewall coverage.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Startup\/small-team example: fast growth, many environments<\/h3>\n\n\n\n<p><strong>Problem<\/strong>\nA startup moves from one AWS account to a multi-account setup (prod\/dev\/staging) and begins deploying multiple services behind CloudFront and ALBs. Security is lean and can\u2019t manually review each new endpoint.<\/p>\n\n\n\n<p><strong>Proposed architecture<\/strong>\n&#8211; AWS Organizations with two OUs: <code>Prod<\/code> and <code>NonProd<\/code>.\n&#8211; Security account as delegated admin for Firewall Manager.\n&#8211; A single WAF policy:\n  &#8211; Applies to <code>Prod<\/code> OU only\n  &#8211; Tag-based scope: <code>Exposure=Public<\/code>\n  &#8211; Automatic remediation enabled after testing\n&#8211; Basic logging:\n  &#8211; CloudTrail enabled\n  &#8211; WAF logging enabled only for prod endpoints<\/p>\n\n\n\n<p><strong>Why AWS Firewall Manager was chosen<\/strong>\n&#8211; Small team needed automation and consistency without heavy processes.\n&#8211; Tag-based scope enabled developer self-service while maintaining baseline controls.<\/p>\n\n\n\n<p><strong>Expected outcomes<\/strong>\n&#8211; New public endpoints automatically protected.\n&#8211; Security can focus on tuning and incident response instead of manual setup.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">16. FAQ<\/h2>\n\n\n\n<p>1) <strong>Is AWS Firewall Manager a firewall that inspects traffic?<\/strong><br\/>\nNo. AWS Firewall Manager is a management service that orchestrates and enforces policies using underlying services (AWS WAF, AWS Network Firewall, DNS Firewall, security groups, etc.).<\/p>\n\n\n\n<p>2) <strong>Do I need AWS Organizations to use AWS Firewall Manager?<\/strong><br\/>\nYes, Firewall Manager is designed for multi-account governance via AWS Organizations.<\/p>\n\n\n\n<p>3) <strong>Can I use a delegated administrator account instead of the management account?<\/strong><br\/>\nYes. Best practice is to use a dedicated security account as the delegated administrator.<\/p>\n\n\n\n<p>4) <strong>Does AWS Firewall Manager require AWS Config?<\/strong><br\/>\nMany Firewall Manager use cases require AWS Config for discovery\/compliance evaluation. Requirements can vary by policy type\u2014verify in official docs.<\/p>\n\n\n\n<p>5) <strong>How long does it take for a policy to apply?<\/strong><br\/>\nIt can take minutes or longer, depending on the policy type, the number of accounts\/resources, and propagation timing.<\/p>\n\n\n\n<p>6) <strong>Can AWS Firewall Manager automatically attach AWS WAF to new resources?<\/strong><br\/>\nYes, if you enable remediation and the policy type supports automatic association for that resource type.<\/p>\n\n\n\n<p>7) <strong>Can I apply different policies to prod and dev?<\/strong><br\/>\nYes. Use OU scoping (Prod OU vs Dev OU) and\/or tag scoping.<\/p>\n\n\n\n<p>8) <strong>What\u2019s the safest way to roll out policies?<\/strong><br\/>\nStart with audit-only mode, review noncompliance and false positives, then enable remediation gradually.<\/p>\n\n\n\n<p>9) <strong>How do I prove compliance to auditors?<\/strong><br\/>\nUse Firewall Manager compliance reports plus CloudTrail logs showing policy configuration, and underlying service logs (WAF\/firewall\/DNS logs) as evidence.<\/p>\n\n\n\n<p>10) <strong>Does Firewall Manager replace Security Hub?<\/strong><br\/>\nNo. Security Hub aggregates and correlates security findings. Firewall Manager enforces firewall-related policies.<\/p>\n\n\n\n<p>11) <strong>Does Firewall Manager replace AWS WAF?<\/strong><br\/>\nNo. AWS WAF performs L7 inspection and enforcement. Firewall Manager manages WAF configurations across accounts centrally.<\/p>\n\n\n\n<p>12) <strong>Can Firewall Manager manage CloudFront protections?<\/strong><br\/>\nYes, for AWS WAF protections on CloudFront distributions (scope\/Region specifics apply; verify in docs).<\/p>\n\n\n\n<p>13) <strong>What happens if an application needs an exception to the baseline rules?<\/strong><br\/>\nDesign an exception process. Common patterns include separate OUs, tag-based exclusions, or separate policies for specific workloads (capabilities depend on policy type).<\/p>\n\n\n\n<p>14) <strong>What are the biggest operational risks?<\/strong><br\/>\nOverly strict remediation causing outages, inconsistent tagging causing gaps, and high log volume causing cost spikes.<\/p>\n\n\n\n<p>15) <strong>How does Firewall Manager help with multi-Region environments?<\/strong><br\/>\nIt provides a consistent policy approach across Regions, but you still must manage prerequisites and ensure policies exist where needed.<\/p>\n\n\n\n<p>16) <strong>Can I manage third-party firewalls with Firewall Manager?<\/strong><br\/>\nFirewall Manager\u2019s primary integrations are with AWS services. Some third-party integrations may exist depending on AWS Marketplace\/partner offerings and current features\u2014<strong>verify in official docs<\/strong> for up-to-date support.<\/p>\n\n\n\n<p>17) <strong>Is Firewall Manager suitable for single-account setups?<\/strong><br\/>\nIt\u2019s usually overkill for single-account environments. Direct service configuration (AWS WAF\/Network Firewall) is typically simpler.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">17. Top Online Resources to Learn AWS Firewall Manager<\/h2>\n\n\n\n<figure class=\"wp-block-table\"><table>\n<thead>\n<tr>\n<th>Resource Type<\/th>\n<th>Name<\/th>\n<th>Why It Is Useful<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Official product page<\/td>\n<td>AWS Firewall Manager<\/td>\n<td>High-level overview, supported policy types, positioning: https:\/\/aws.amazon.com\/firewall-manager\/<\/td>\n<\/tr>\n<tr>\n<td>Official documentation<\/td>\n<td>AWS Firewall Manager documentation (Developer Guide)<\/td>\n<td>Core concepts, prerequisites, policy types, workflows (navigate from here): https:\/\/docs.aws.amazon.com\/<\/td>\n<\/tr>\n<tr>\n<td>Official API reference<\/td>\n<td>AWS Firewall Manager API Reference<\/td>\n<td>For automation and integrations: https:\/\/docs.aws.amazon.com\/firewall-manager\/latest\/APIReference\/Welcome.html<\/td>\n<\/tr>\n<tr>\n<td>Official pricing<\/td>\n<td>AWS Firewall Manager Pricing<\/td>\n<td>Current pricing model and dimensions: https:\/\/aws.amazon.com\/firewall-manager\/pricing\/<\/td>\n<\/tr>\n<tr>\n<td>Pricing tool<\/td>\n<td>AWS Pricing Calculator<\/td>\n<td>Build estimates for WAF\/Config\/CloudFront\/Firewall Manager: https:\/\/calculator.aws\/<\/td>\n<\/tr>\n<tr>\n<td>Official WAF docs<\/td>\n<td>AWS WAF Developer Guide<\/td>\n<td>Firewall Manager WAF policies are tightly linked to WAF concepts: https:\/\/docs.aws.amazon.com\/waf\/latest\/developerguide\/what-is-aws-waf.html<\/td>\n<\/tr>\n<tr>\n<td>Official Organizations docs<\/td>\n<td>AWS Organizations User Guide<\/td>\n<td>Delegated admin and OU scoping fundamentals: https:\/\/docs.aws.amazon.com\/organizations\/latest\/userguide\/orgs_introduction.html<\/td>\n<\/tr>\n<tr>\n<td>Official Config docs<\/td>\n<td>AWS Config Developer Guide<\/td>\n<td>Prerequisite for many Firewall Manager setups: https:\/\/docs.aws.amazon.com\/config\/latest\/developerguide\/WhatIsConfig.html<\/td>\n<\/tr>\n<tr>\n<td>Official architecture<\/td>\n<td>AWS Architecture Center<\/td>\n<td>Reference architectures for multi-account governance and security: https:\/\/aws.amazon.com\/architecture\/<\/td>\n<\/tr>\n<tr>\n<td>Official videos<\/td>\n<td>AWS YouTube Channel<\/td>\n<td>Service talks and re:Invent sessions (search \u201cAWS Firewall Manager\u201d): https:\/\/www.youtube.com\/@amazonwebservices<\/td>\n<\/tr>\n<tr>\n<td>Samples (official\/trusted)<\/td>\n<td>AWS Samples on GitHub<\/td>\n<td>Look for automation patterns around WAF\/Organizations\/Config (verify repository trust): https:\/\/github.com\/aws-samples<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">18. Training and Certification Providers<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>DevOpsSchool.com<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> DevOps engineers, SREs, cloud engineers, platform teams\n   &#8211; <strong>Likely learning focus:<\/strong> DevOps practices, cloud operations, security basics, tooling ecosystems (verify current course catalog)\n   &#8211; <strong>Mode:<\/strong> Check website\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>ScmGalaxy.com<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> DevOps and SCM learners, engineers transitioning into CI\/CD and cloud tooling\n   &#8211; <strong>Likely learning focus:<\/strong> Source control, CI\/CD, DevOps tooling, foundational cloud\/dev practices (verify current offerings)\n   &#8211; <strong>Mode:<\/strong> Check website\n   &#8211; <strong>Website:<\/strong> https:\/\/www.scmgalaxy.com\/<\/p>\n<\/li>\n<li>\n<p><strong>CLoudOpsNow.in<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> Cloud operations teams, sysadmins moving to cloud, junior cloud engineers\n   &#8211; <strong>Likely learning focus:<\/strong> Cloud operations, operational readiness, monitoring, cost and governance (verify current curriculum)\n   &#8211; <strong>Mode:<\/strong> Check website\n   &#8211; <strong>Website:<\/strong> https:\/\/www.cloudopsnow.in\/<\/p>\n<\/li>\n<li>\n<p><strong>SreSchool.com<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> SREs, operations engineers, reliability-focused platform teams\n   &#8211; <strong>Likely learning focus:<\/strong> Reliability engineering, incident response, observability, production operations (verify current offerings)\n   &#8211; <strong>Mode:<\/strong> Check website\n   &#8211; <strong>Website:<\/strong> https:\/\/www.sreschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>AiOpsSchool.com<\/strong>\n   &#8211; <strong>Suitable audience:<\/strong> Operations teams exploring AIOps, automation, and analytics for operations\n   &#8211; <strong>Likely learning focus:<\/strong> AIOps concepts, automation patterns, monitoring\/alerting with analytics (verify current catalog)\n   &#8211; <strong>Mode:<\/strong> Check website\n   &#8211; <strong>Website:<\/strong> https:\/\/www.aiopsschool.com\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">19. Top Trainers<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>RajeshKumar.xyz<\/strong>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps\/cloud training content (verify specific coverage)\n   &#8211; <strong>Suitable audience:<\/strong> Engineers seeking practical DevOps\/cloud skills\n   &#8211; <strong>Website:<\/strong> https:\/\/rajeshkumar.xyz\/<\/p>\n<\/li>\n<li>\n<p><strong>devopstrainer.in<\/strong>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps tools and practices (verify current topics)\n   &#8211; <strong>Suitable audience:<\/strong> Beginners to intermediate DevOps learners\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopstrainer.in\/<\/p>\n<\/li>\n<li>\n<p><strong>devopsfreelancer.com<\/strong>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps consulting\/training resources (verify current services)\n   &#8211; <strong>Suitable audience:<\/strong> Teams or individuals looking for practical DevOps assistance\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsfreelancer.com\/<\/p>\n<\/li>\n<li>\n<p><strong>devopssupport.in<\/strong>\n   &#8211; <strong>Likely specialization:<\/strong> DevOps support and training resources (verify current scope)\n   &#8211; <strong>Suitable audience:<\/strong> Operations\/DevOps teams needing support-oriented guidance\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopssupport.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">20. Top Consulting Companies<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>\n<p><strong>cotocus.com<\/strong>\n   &#8211; <strong>Likely service area:<\/strong> Cloud\/DevOps consulting (verify current service lines)\n   &#8211; <strong>Where they may help:<\/strong> Multi-account setup, automation, governance patterns, operational readiness\n   &#8211; <strong>Consulting use case examples:<\/strong> Landing zone setup, CI\/CD implementation, infrastructure automation, governance tooling integration\n   &#8211; <strong>Website:<\/strong> https:\/\/cotocus.com\/<\/p>\n<\/li>\n<li>\n<p><strong>DevOpsSchool.com<\/strong>\n   &#8211; <strong>Likely service area:<\/strong> DevOps and cloud consulting\/training services (verify current offerings)\n   &#8211; <strong>Where they may help:<\/strong> Platform engineering practices, DevOps enablement, cloud governance learning programs\n   &#8211; <strong>Consulting use case examples:<\/strong> DevOps transformation workshops, toolchain implementations, cloud operations processes\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsschool.com\/<\/p>\n<\/li>\n<li>\n<p><strong>DEVOPSCONSULTING.IN<\/strong>\n   &#8211; <strong>Likely service area:<\/strong> DevOps consulting services (verify current coverage)\n   &#8211; <strong>Where they may help:<\/strong> DevOps process design, automation, operational enablement\n   &#8211; <strong>Consulting use case examples:<\/strong> CI\/CD pipeline standardization, infrastructure as code adoption, monitoring\/alerting setup\n   &#8211; <strong>Website:<\/strong> https:\/\/www.devopsconsulting.in\/<\/p>\n<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">21. Career and Learning Roadmap<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn before AWS Firewall Manager<\/h3>\n\n\n\n<p>To use AWS Firewall Manager effectively, learn:\n&#8211; AWS Organizations basics:\n  &#8211; OUs, accounts, delegated admin, service control policies (SCPs)\n&#8211; IAM fundamentals:\n  &#8211; Roles, policies, least privilege, CloudTrail\n&#8211; Core networking:\n  &#8211; VPCs, routing, security groups, NACLs\n&#8211; AWS Config basics:\n  &#8211; recorders, configuration items, delivery channels\n&#8211; Underlying enforcement services you plan to manage:\n  &#8211; AWS WAF concepts (web ACLs, rules, managed rule groups)\n  &#8211; AWS Network Firewall concepts (firewall policies, rule groups, endpoints)\n  &#8211; Route 53 Resolver DNS Firewall concepts (rule groups, domain lists)<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What to learn after AWS Firewall Manager<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Centralized logging pipelines:<\/li>\n<li>Kinesis Data Firehose, S3, OpenSearch, SIEM integrations<\/li>\n<li>Threat detection and response:<\/li>\n<li>Security Hub, GuardDuty, Detective<\/li>\n<li>Governance automation:<\/li>\n<li>Infrastructure as Code, CI policy checks, change management workflows<\/li>\n<li>Advanced WAF tuning:<\/li>\n<li>false positive reduction, rule ordering, rate limiting strategies (where applicable)<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Job roles that use it<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Cloud Security Engineer<\/li>\n<li>Security\/Platform Architect<\/li>\n<li>DevSecOps Engineer<\/li>\n<li>SRE \/ Platform Engineer (in governance-heavy environments)<\/li>\n<li>Cloud Operations \/ Governance Engineer<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Certification path (AWS)<\/h3>\n\n\n\n<p>AWS Firewall Manager appears in security governance contexts rather than as a standalone exam topic. A practical path is:\n&#8211; AWS Certified Cloud Practitioner (optional for beginners)\n&#8211; AWS Certified Solutions Architect \u2013 Associate\n&#8211; AWS Certified Security \u2013 Specialty (where available in your region; verify current AWS certification catalog)\n&#8211; AWS Certified Advanced Networking \u2013 Specialty (helpful when Network Firewall and routing governance are involved)<\/p>\n\n\n\n<p>Always verify current AWS certification availability: https:\/\/aws.amazon.com\/certification\/<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Project ideas for practice<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Build a multi-account lab and enforce:<\/li>\n<li>Baseline WAF on CloudFront and ALB resources by tag<\/li>\n<li>Security group audit policies for risky ports<\/li>\n<li>Create a staged rollout plan:<\/li>\n<li>Audit-only \u2192 pilot OU \u2192 production<\/li>\n<li>Design a logging architecture for WAF logs with cost controls:<\/li>\n<li>Firehose \u2192 S3 partitioning \u2192 lifecycle policies<\/li>\n<li>Write an IaC module for consistent tagging and resource creation so Firewall Manager scoping is reliable.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">22. Glossary<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>AWS Organizations:<\/strong> Service to centrally manage multiple AWS accounts.<\/li>\n<li><strong>Organizational Unit (OU):<\/strong> A logical grouping of accounts inside AWS Organizations.<\/li>\n<li><strong>Delegated administrator:<\/strong> An account designated to administer a supported AWS service for the organization.<\/li>\n<li><strong>AWS Firewall Manager policy:<\/strong> A central definition of what protections to apply, where, and whether to remediate.<\/li>\n<li><strong>Remediation:<\/strong> Automatically applying or correcting protections on noncompliant resources.<\/li>\n<li><strong>Compliance (Firewall Manager):<\/strong> Whether a resource matches the desired policy configuration.<\/li>\n<li><strong>AWS Config:<\/strong> Service that records resource configurations and evaluates compliance over time.<\/li>\n<li><strong>AWS WAF:<\/strong> Web Application Firewall for L7 protection; uses web ACLs and rules.<\/li>\n<li><strong>Web ACL:<\/strong> AWS WAF configuration object containing rules and actions (allow\/block\/count).<\/li>\n<li><strong>AWS Shield Advanced:<\/strong> Managed DDoS protection service (paid subscription).<\/li>\n<li><strong>AWS Network Firewall:<\/strong> Managed network firewall service for VPC traffic inspection.<\/li>\n<li><strong>Security group:<\/strong> Stateful virtual firewall for EC2\/VPC network interfaces.<\/li>\n<li><strong>Route 53 Resolver DNS Firewall:<\/strong> DNS filtering capability for VPC DNS queries.<\/li>\n<li><strong>CloudFront:<\/strong> AWS CDN service; often paired with WAF for edge protection.<\/li>\n<li><strong>CloudTrail:<\/strong> Logs AWS API calls for audit and investigation.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">23. Summary<\/h2>\n\n\n\n<p>AWS Firewall Manager (AWS) is a centralized <strong>Security, identity, and compliance<\/strong> service for managing firewall-related protections across an AWS Organization. It doesn\u2019t inspect traffic itself; it orchestrates and enforces policies using services like <strong>AWS WAF<\/strong>, <strong>AWS Network Firewall<\/strong>, <strong>security groups<\/strong>, <strong>Route 53 Resolver DNS Firewall<\/strong>, and (where subscribed) <strong>AWS Shield Advanced<\/strong>.<\/p>\n\n\n\n<p>It matters because multi-account environments scale faster than manual security configuration. Firewall Manager provides <strong>consistent policies<\/strong>, <strong>continuous compliance visibility<\/strong>, and <strong>optional auto-remediation<\/strong> to reduce gaps and drift.<\/p>\n\n\n\n<p>Cost and security success comes from designing scope carefully (OUs\/tags), rolling out in stages (audit \u2192 remediate), and planning for indirect costs such as AWS Config and logging pipelines. Use it when you need <strong>organization-wide governance<\/strong> of firewall protections; use direct service configuration when you don\u2019t.<\/p>\n\n\n\n<p>Next step: replicate the lab with a second workload type (for example, an ALB) and practice a staged rollout strategy\u2014pilot OU first, then production\u2014while building an operational runbook for exceptions and incident response.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security, identity, and compliance<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,39],"tags":[],"class_list":["post-317","post","type-post","status-publish","format-standard","hentry","category-aws","category-security-identity-and-compliance"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/317","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/comments?post=317"}],"version-history":[{"count":0,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/posts\/317\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/media?parent=317"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/categories?post=317"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/tutorials\/wp-json\/wp\/v2\/tags?post=317"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}