AWS Firewall Manager is a security management service which allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organizations. As new applications are created, Firewall Manager makes it easy to bring new applications and resources into compliance by enforcing a common set of security rules. Now you have a single service to build firewall rules, create security policies, and enforce them in a consistent, hierarchical manner across your entire infrastructure, from a central administrator account.

Using AWS Firewall Manager, you can easily roll out AWS WAF rules for your Application Load Balancers, API Gateways, and Amazon CloudFront distributions. You can create AWS Shield Advanced protections for your Application Load Balancers, ELB Classic Load Balancers, Elastic IP Addresses and CloudFront distributions. You can also configure new Amazon Virtual Private Cloud (VPC) security groups and audit any existing VPC security groups for your Amazon EC2, Application Load Balancer (ALB) and ENI resource types. You can deploy AWS Network Firewalls across accounts and VPCs in your organization. Finally, with AWS Firewall Manager, you can also associate your VPCs with Amazon Route 53 Resolvers DNS Firewall rules.

Benefits

Firewall Manager provides these benefits:

Helps to protect resources across accounts
Helps to protect all resources of a particular type, such as all Amazon CloudFront distributions
Helps to protect all resources with specific tags
Automatically adds protection to resources that are added to your account
Allows you to subscribe all member accounts in an AWS Organizations organization to AWS Shield Advanced, and automatically subscribes new in-scope accounts that join the organization
Allows you to apply security group rules to all member accounts or specific subsets of accounts in an AWS Organizations organization, and automatically applies the rules to new in-scope accounts that join the organization
Lets you use your own rules, or purchase managed rules from AWS Marketplace

Firewall Manager is particularly useful when you want to protect your entire organization rather than a small number of specific accounts and resources, or if you frequently add new resources that you want to protect. Firewall Manager also provides centralized monitoring of DDoS attacks across your organization.

AWS Firewall Manager handles five types of protection policies - AWS WAF, AWS Shield Advanced, Amazon VPC security groups, AWS Network Firewall, and Amazon Route 53 Resolver DNS Firewall. AWS Firewall Manager protection policies are priced with a monthly fee per region (prorated hourly).

For AWS Network Firewall protection policies, AWS Firewall Manager has these main pricing components:

AWS Firewall Manager protection policy - Monthly fee per Region.
AWS Network Firewall endpoints - Those created by Firewall Manager will be charged based on current pricing. For more details, see AWS Network Firewall pricing.
AWS Config Rules - Those rules created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing. For more details, see AWS Config pricing.

You only pay for what you use, as you use it; there are no minimum fees and no upfront commitments

For AWS WAF protection policies, AWS Firewall Manager has these main pricing components:

AWS Firewall Manager protection policy - Monthly fee per Region.
AWS WAF WebACLs or Rules - Those created by Firewall Manager will be charged based on current pricing. For more details, see AWS WAF pricing.
AWS Config Rules - Those rules created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing. For more details, see AWS Config pricing.

If you are an AWS Shield Advanced customer:

For AWS Shield Advanced customers, AWS Firewall Manager protection policy is included at no additional charge. Shield Advanced customers will be charged for the AWS Config rules created to monitor any changes in resource configurations. For more details, check the AWS Shield pricing and AWS Config pricing.

AWS Shield protection policies can be created using AWS Firewall Manager only for Shield Advanced users. The price is included in the AWS Shield Advanced subscription at no additional cost. In addition, the pricing components are as follows:

• AWS Shield Advanced Data Transfer Out Usage Fees: For more details, see AWS Shield pricing

• AWS Config Rules - Those rules created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing. For more details, see AWS Config pricing

For Amazon VPC security group protection policies, AWS Firewall Manager has these main pricing components:

• AWS Firewall Manager protection policy - Monthly fee per Region.

• AWS Config Rules - Those rules created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing. For more details, see AWS Config pricing.

You only pay for what you use, as you use it; there are no minimum fees and no upfront commitments.

For Amazon Route 53 Resolver DNS Firewall protection policies, AWS Firewall Manager has these main pricing components:

AWS Firewall Manager protection policy - Monthly fee per Region.
Route 53 Resolver DNS Firewall charges- Rule groups created by Firewall Manager will be charged based on current pricing. For more details, see Route 53 Resolver DNS Firewall pricing.
AWS Config Rules - Those rules created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing. For more details, see AWS Config pricing.

You only pay for what you use, as you use it; there are no minimum fees and no upfront commitments.

AWS Firewall Manager pricing for customers

AWS Network Firewall protection policy

All public regions

$100.00 per policy per Region
AWS Config rules created by Firewall Manager - See AWS Config pricing
AWS Network Firewall endpoints created by Firewall Manager - See AWS Network Firewall pricing.

AWS WAF protection policy

All public regions

$100.00 per policy per Region

Global (Amazon CloudFront locations)

$100.00 per policy per Region

AWS Shield Advanced protection policy

All public regions

Included for Shield Advanced customers. No charge per policy per Region

Global (Amazon CloudFront locations)

Included for Shield Advanced customers. No charge per policy per Region

AWS WAF WebACLs or Rules created by Firewall Manager - Included. No additional charge.
AWS Config rules created by Firewall Manager - See AWS Config pricing
AWS Shield Advanced - See AWS Shield pricing

Amazon VPC security group protection policy

All public regions

$100 per policy per Region
AWS Config rules created by Firewall Manager - See AWS Config pricing

Amazon Route 53 Resolver DNS Firewall protection policy

All public regions

$100 per policy per Region
AWS Config rules created by Firewall Manager - See AWS Config pricing
Route 53 Resolver DNS Firewall rule groups created by Firewall Manager – See Route 53 Resolver DNS Firewall pricing.

AWS Firewall Manager prerequisites

This topic shows you how to get ready to administer AWS Firewall Manager. You use one Firewall Manager administrator account to manage all Firewall Manager security policies for your organization in AWS Organizations. Except where noted, perform the prerequisite steps using the account that you will use as the Firewall Manager administrator.

Before you use Firewall Manager for the first time, perform the following steps in sequence.

Topics

After you follow these steps, you can configure Firewall Manager to begin protecting your resources. For more information, see Getting started with AWS Firewall Manager AWS WAF policies.

Step 1: Join and configure AWS Organizations

To use Firewall Manager, your account must be a member of the organization in the AWS Organizations service where you want to use your Firewall Manager policies.

Note

For information about Organizations, see AWS Organizations User Guide.

To establish the required AWS Organizations membership and configuration

Choose an account to use as the Firewall Manager administrator for the organization in Organizations.
If your chosen account isn't already a member of the organization, have it join. Follow the guidance at Inviting an AWS account to join your organization.
AWS Organizations has two available feature sets: consolidated billing features and all features. To use Firewall Manager, your organization must be enabled for all features. If your organization is configured only for consolidated billing, follow the guidance at Enabling All Features in Your Organization.

Step 2: Set the AWS Firewall Manager administrator account

This procedure uses the account and organization that you chose and configured in the preceding step.

When you set the Firewall Manager administrator account, Firewall Manager automatically sets it as the AWS Organizations Delegated Administrator for Firewall Manager. This allows Firewall Manager to access information about the organizational units (OUs). You can use OUs to specify the scope of your Firewall Manager policies. For more information about setting policy scope, see the guidance for the individual policy types under Creating an AWS Firewall Manager policy. For more information about Organizations and management accounts, see Managing the AWS Accounts in Your Organization.

To set the Firewall Manager administrator account

Sign in to the AWS Management Console using an existing AWS Organizations management account. You can sign in using the account's root user (not recommended) or another IAM user or IAM role within the account that has equivalent permissions.
Open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2

Choose Get started.

Type the ID of the account that you've chosen to use as the Firewall Manager administrator.

Note

This account is given permission to create and manage Firewall Manager policies across all accounts within your organization.

Choose Set administrator.

Step 3: Enable AWS Config

To use Firewall Manager, you must enable AWS Config.

Note

You incur charges for your AWS Config settings, according to AWS Config pricing. For more information, see Getting Started with AWS Config.

To enable AWS Config for Firewall Manager

Enable AWS Config for each of your AWS Organizations member accounts, including the Firewall Manager administrator account. For more information, see Getting Started with AWS Config.
Enable AWS Config for each AWS Region that contains the resources that you want to protect. You can enable AWS Config manually, or you can use the AWS CloudFormation template "Enable AWS Config" at AWS CloudFormation StackSets Sample Templates.
If you don't want to enable AWS Config for all resources, then you must enable the following according to the type of Firewall Manager policies that you use:

WAF policy – Enable Config for the resource types CloudFront Distribution, Application Load Balancer (choose ElasticLoadBalancingV2 from the list), API Gateway, WAF WebACL, WAF Regional WebACL, and WAFv2 WebACL. To enable AWS Config to protect a CloudFront distribution, you must be in the US East (N. Virginia) Region. Other Regions don't have CloudFront as an option.
Shield policy – Enable Config for the resource types Shield Protection, ShieldRegional Protection, Application Load Balancer, EC2 EIP, WAF WebACL, WAF Regional WebACL, and WAFv2 WebACL.
Security group policy – Enable Config for the resource types EC2 SecurityGroup, EC2 Instance, and EC2 NetworkInterface.
Network Firewall policy – Enable Config for the resource types NetworkFirewall FirewallPolicy, NetworkFirewall RuleGroup, EC2 VPC, EC2 InternetGateway, EC2 RouteTable, and EC2 Subnet.
DNS Firewall policy – Enable Config for the resource types DNSFirewall RuleGroup and EC2 VPC.

Step 4: For Network Firewall and DNS Firewall policies, enable resource sharing

To manage Firewall Manager Network Firewall and DNS Firewall policies, you must enable sharing with AWS Organizations in AWS Resource Access Manager. This allows Firewall Manager to deploy protections across your accounts when you create these policy types.

To enable sharing with AWS Organizations in AWS Resource Access Manager

Follow the guidance at Enable Sharing with AWS Organizations in the AWS Resource Access Manager User Guide.

If you run into problems with resource sharing, see the guidance at Resource sharing for Network Firewall and DNS Firewall policies.

Step 5: To use AWS Firewall Manager in Regions that are disabled by default

To use Firewall Manager in a Region that's disabled by default, you must enable the Region for both the management account of your AWS organization and the Firewall Manager administrator account.

For information about Regions that are disabled by default and how to enable them, see Managing AWS Regions in the AWS General Reference.

To enable a disabled Region

For both the Organizations management account and the Firewall Manager administrator account, follow the guidance at Enabling a Region in the AWS General Reference.

Managing the AWS Firewall Manager administrator

You use your Firewall Manager administrator account to manage your Firewall Manager policies. When you set the Firewall Manager administrator account, Firewall Manager automatically sets it as the AWS Organizations Delegated Administrator for Firewall Manager. This allows Firewall Manager to access information about the organizational units (OUs) that you use to specify the scope of your Firewall Manager policies. For more information about Organizations and management accounts, see Managing the AWS Accounts in Your Organization.

To begin using Firewall Manager, you set up your Firewall Manager administrator account and perform other required steps. To do this, follow the guidance under AWS Firewall Manager prerequisites.

This topic provides information and guidance for managing your existing administrator account.

Required settings for the Firewall Manager administrator

The Firewall Manager administrator account must have the following settings:

It must be a member of the organization in AWS Organizations where you want to apply your Firewall Manager policies.
It must be designated as the Firewall Manager administrator by the Organizations management account for the organization.

Blog of Kavishka

Thursday, May 12, 2022