AWS Firewall Manager features

Using Firewall Manager, your security administrator can deploy firewall rules for AWS Network Firewall to control traffic leaving and entering your network across accounts and Amazon VPCs, from a single place. Any changes to the centrally configured set of rules are automatically deployed to your accounts and VPCs. This enables security administrators to consistently enforce centrally mandated firewall rules across an organization, even as new accounts and VPCs are created in your organization. At the same time, Firewall Manager also reports non-compliant issues including any VPCs and accounts that are missing Network Firewall protections.

You can automatically enforce policies on AWS resources that currently exist or are created in the future, thereby ensuring compliance with firewall rules across the organization. AWS Firewall Manager gives customers the ability to apply AWS WAF rules, as well as Managed Rules for AWS WAF, on Application Load Balancers, API Gateways and Amazon CloudFront accounts. You can apply AWS Shield Advanced protections on Application or Classic Load Balances, Elastic IP addresses or CloudFront distributions. Similarly, you can use AWS Firewall Manager to create a common primary security group across your EC2 instances in your VPC. With Firewall Manager you can automatically deploy Network Firewall endpoints and associated rules, for your VPCs. At the same time, Firewall Manager also lets you associate your VPCs with Route 53 Resolver DNS Firewall rules. You can choose to automatically enforce the rule on a newly created resource, or you can choose to be notified when the new resource is created.

Within AWS Firewall Manager, you are able to group resources by Account, by Resource Type, and by Tag. Your security team can create policies for all resources within a particular group or across accounts in the organization.

AWS Firewall Manager is integrated with AWS Organizations and will automatically fetch the list of accounts in your AWS organization to enable you to group resources across accounts. First, you build protection policies, which define a group of resources and associate the group with your policy. Then, you specify the scope of the policy to cover a specific set of AWS accounts, or all of your Organizations’ accounts. Firewall Manager will deploy the protections only on the resources in the accounts based on the scope of the policy.

AWS Firewall Manager allows you to apply protection policies in a hierarchical manner, so you can delegate the creation of application-specific rules while retaining the ability to enforce certain rules centrally. Centrally applied rules are constantly monitored for any accidental removal or mishandling, thereby ensuring they are applied consistently.

AWS Firewall Manager provides a visual dashboard where you can quickly view which AWS resources are protected, identify non-compliant resources, and take appropriate action. You can also get notified when there are changes to your configurations through SNS notification streams.

With AWS Firewall Manager, you can create policies to set guardrails that define what security groups are allowed/disallowed across your VPCs. AWS Firewall Manager continuously monitors security groups to detect overly permissive rules, and helps improve firewall posture. You can get notifications of accounts and resources that are non-compliant or allow AWS Firewall Manager to take action directly through auto-remediation.

AWS Firewall Manager allows you to centrally deploy and monitor AWS Marketplace subscribed third-party cloud firewalls across all virtual private clouds (VPCs) in your organization. The service is a single firewall management solution to deploy and manage both AWS native firewalls and AWS Marketplace subscribed third-party firewalls. You can automate cross-account deployment of firewalls, association of rules, and configuration of VPC routes, even as new accounts and VPCs are created in your organization.