AWS Firewall Manager

What it is

AWS Firewall Manager simplifies administration of security protections across multiple accounts and resources in AWS Organizations. You set up a protection once as a policy, and Firewall Manager applies it automatically to the accounts and resources in scope, including new accounts and resources as they are added.

Firewall Manager manages:

AWS WAF rules.
AWS Shield Advanced protections.
VPC Security groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entry and Network ACLA stateless firewall for a subnet, with numbered allow and deny rules checked in order. Because it is stateless, return traffic needs its own rule, usually for a range of ephemeral ports.Glossary entry.
AWS Network Firewall.
Route 53 Resolver DNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entry Firewall.
Some third-party firewalls from AWS Marketplace.

Choose Firewall Manager when a question asks how to enforce the same WAF rules, Shield Advanced protection, or security groups in every account, or to make sure newly created resources are protected automatically.

Prerequisites

An organization in AWS Organizations, with all features enabled.
A Firewall Manager administrator account, which manages all Firewall Manager policies for the organization.
AWS Config turned on in the accounts and AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry in scope, because Firewall Manager uses it to discover resources and check compliance.

Policies

AWS WAF policy: apply rule groups to every CloudFront distribution, ALB, or API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry Gateway stage in scope, with rules that account owners can't remove.
Shield Advanced policy: subscribe resources, such as all CloudFront distributions, to Shield Advanced protection automatically.
Security group policies: apply common security groups, audit and clean up overly permissive rules, and find unused groups.
Network ACL policies: manage network ACLs across accounts.
Network Firewall policy: deploy firewalls and rule groups across VPCs.
DNS Firewall policy: apply DNS Firewall rule groups to VPCs.
Scope: choose accounts and OU (Organizational unit)A group of AWS accounts inside an organization in AWS Organizations. OUs can contain other OUs, and policies attached to an OU, such as SCPs, apply to every account in it.Glossary entry, resource types, and tags to include or exclude. Firewall Manager can auto-remediate noncompliant resources, or just report them.

Security, resilience, performance, and cost

Security: consistent baseline protections everywhere, with central visibility of compliance.
Cost: Firewall Manager charges per policy per Region. You also pay for the services it manages (WAF, Shield Advanced, Network Firewall) and for AWS Config.

Firewall Manager or another option?

If the requirement is	Choose
Same WAF rules across all accounts, including new ones	AWS Firewall Manager
Shield Advanced on every new CloudFront distribution automatically	Firewall Manager Shield Advanced policy
Audit overly permissive security groups across accounts	Firewall Manager security group policy
Protect one web app	AWS WAF directly
Guardrails on what IAM PrincipalA person or workload that can make requests to AWS, such as an IAM user, a role session, the root user, a federated user, or an AWS service. Resource-based policies name the principals they allow.Glossary entry can do	Service control policies

Reverse mindmap: when the question points here

Is it AWS Firewall Manager?

Yes, when the question says
- Enforce WAF rules in all accounts leads to Firewall Manager WAF policy
- New resources protected automatically leads to Firewall Manager policy scope
- Shield Advanced across the organization leads to Firewall Manager Shield policy
- Clean up permissive security groups everywhere leads to Security group policy
- Deploy Network Firewall to many VPCs leads to Network Firewall policy
Prerequisites
- Needed first leads to Organizations, an administrator account, AWS Config
No, when the question says
- A single web ACL for one app leads to WAF

Key takeaways

Firewall Manager centrally manages WAF, Shield Advanced, security groups, network ACLs, Network Firewall, and DNS Firewall across an organization.
Policies apply automatically to new accounts and resources in scope, and can auto-remediate.
It needs AWS Organizations, a Firewall Manager administrator account, and AWS Config.