AWS Firewall Manager is a security management service which allows you to centrally configure and manage firewall rules across your accounts and applications in AWS Organizations. As new applications are created, Firewall Manager makes it easy to bring new applications and resources into compliance by enforcing a common set of security rules. Now you have a single service to build firewall rules, create security policies, and enforce them in a consistent, hierarchical manner across your entire infrastructure, from a central administrator account. Using AWS Firewall Manager, you can easily roll out AWS WAF rules for your Application Load Balancers, API Gateways, and Amazon CloudFront distributions. You can create AWS Shield Advanced protections for your Application Load Balancers, ELB Classic Load Balancers, Elastic IP Addresses and CloudFront distributions. You can also configure new Amazon Virtual Private Cloud (VPC) security groups and audit any existing VPC security groups for your Amazon EC2, Application Load Balancer (ALB) and ENI resource types. You can deploy AWS Network Firewalls across accounts and VPCs in your organization. Finally, with AWS Firewall Manager, you can also associate your VPCs with Amazon Route 53 Resolvers DNS Firewall rules.
Benefits
Firewall Manager provides these benefits:
- Helps to protect resources across accounts
- Helps to protect all resources of a particular type, such as all Amazon CloudFront distributions
- Helps to protect all resources with specific tags
- Automatically adds protection to resources that are added to your account
- Allows you to subscribe all member accounts in an AWS Organizations organization to AWS Shield Advanced, and automatically subscribes new in-scope accounts that join the organization
- Allows you to apply security group rules to all member accounts or specific subsets of accounts in an AWS Organizations organization, and automatically applies the rules to new in-scope accounts that join the organization
- Lets you use your own rules, or purchase managed rules from AWS Marketplace
Firewall Manager is particularly useful when you want to protect your entire organization rather than a small number of specific accounts and resources, or if you frequently add new resources that you want to protect. Firewall Manager also provides centralized monitoring of DDoS attacks across your organization.
AWS Firewall Manager handles five types of protection policies - AWS WAF, AWS Shield Advanced, Amazon VPC security groups, AWS Network Firewall, and Amazon Route 53 Resolver DNS Firewall. AWS Firewall Manager protection policies are priced with a monthly fee per region (prorated hourly).
For AWS Network Firewall protection policies, AWS Firewall Manager has these main pricing components:
- AWS Firewall Manager protection policy - Monthly fee per Region.
- AWS Network Firewall endpoints - Those created by Firewall Manager will be charged based on current pricing. For more details, see AWS Network Firewall pricing.
- AWS Config Rules - Those rules created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing. For more details, see AWS Config pricing.
You only pay for what you use, as you use it; there are no minimum fees and no upfront commitments
For AWS WAF protection policies, AWS Firewall Manager has these main pricing components:
- AWS Firewall Manager protection policy - Monthly fee per Region.
- AWS WAF WebACLs or Rules - Those created by Firewall Manager will be charged based on current pricing. For more details, see AWS WAF pricing.
- AWS Config Rules - Those rules created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing. For more details, see AWS Config pricing.
If you are an AWS Shield Advanced customer:
For AWS Shield Advanced customers, AWS Firewall Manager protection policy is included at no additional charge. Shield Advanced customers will be charged for the AWS Config rules created to monitor any changes in resource configurations. For more details, check the AWS Shield pricing and AWS Config pricing.
AWS Shield protection policies can be created using AWS Firewall Manager only for Shield Advanced users. The price is included in the AWS Shield Advanced subscription at no additional cost. In addition, the pricing components are as follows:
• AWS Shield Advanced Data Transfer Out Usage Fees: For more details, see AWS Shield pricing • AWS Config Rules - Those rules created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing. For more details, see AWS Config pricing
For Amazon VPC security group protection policies, AWS Firewall Manager has these main pricing components:
• AWS Firewall Manager protection policy - Monthly fee per Region.
• AWS Config Rules - Those rules created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing. For more details, see AWS Config pricing. You only pay for what you use, as you use it; there are no minimum fees and no upfront commitments.
For Amazon Route 53 Resolver DNS Firewall protection policies, AWS Firewall Manager has these main pricing components:
- AWS Firewall Manager protection policy - Monthly fee per Region.
- Route 53 Resolver DNS Firewall charges- Rule groups created by Firewall Manager will be charged based on current pricing. For more details, see Route 53 Resolver DNS Firewall pricing.
- AWS Config Rules - Those rules created by Firewall Manager to monitor changes in resource configurations are charged based on current pricing. For more details, see AWS Config pricing.
You only pay for what you use, as you use it; there are no minimum fees and no upfront commitments.
AWS Firewall Manager pricing for customers
AWS Network Firewall protection policy
All public regions
AWS WAF protection policy
All public regions
$100.00 per policy per Region
Global (Amazon CloudFront locations)
$100.00 per policy per Region
AWS Shield Advanced protection policy
All public regions
Included for Shield Advanced customers. No charge per policy per Region
Global (Amazon CloudFront locations)
Included for Shield Advanced customers. No charge per policy per Region
- AWS WAF WebACLs or Rules created by Firewall Manager - Included. No additional charge.
- AWS Config rules created by Firewall Manager - See AWS Config pricing
- AWS Shield Advanced - See AWS Shield pricing
Amazon VPC security group protection policy
All public regions
- $100 per policy per Region
- AWS Config rules created by Firewall Manager - See AWS Config pricing
Amazon Route 53 Resolver DNS Firewall protection policy
All public regions
AWS Firewall Manager prerequisites
This topic shows you how to get ready to administer AWS Firewall Manager. You use one Firewall Manager administrator account to manage all Firewall Manager security policies for your organization in AWS Organizations. Except where noted, perform the prerequisite steps using the account that you will use as the Firewall Manager administrator.
Before you use Firewall Manager for the first time, perform the following steps in sequence.
Topics
Step 1: Join and configure AWS Organizations
To use Firewall Manager, your account must be a member of the organization in the AWS Organizations service where you want to use your Firewall Manager policies.
Note
To establish the required AWS Organizations membership and configuration
- Choose an account to use as the Firewall Manager administrator for the organization in Organizations.
- If your chosen account isn't already a member of the organization, have it join. Follow the guidance at Inviting an AWS account to join your organization.
- AWS Organizations has two available feature sets: consolidated billing features and all features. To use Firewall Manager, your organization must be enabled for all features. If your organization is configured only for consolidated billing, follow the guidance at Enabling All Features in Your Organization.
Step 2: Set the AWS Firewall Manager administrator account
This procedure uses the account and organization that you chose and configured in the preceding step.
When you set the Firewall Manager administrator account, Firewall Manager automatically sets it as the AWS Organizations Delegated Administrator for Firewall Manager. This allows Firewall Manager to access information about the organizational units (OUs). You can use OUs to specify the scope of your Firewall Manager policies. For more information about setting policy scope, see the guidance for the individual policy types under Creating an AWS Firewall Manager policy. For more information about Organizations and management accounts, see Managing the AWS Accounts in Your Organization. To set the Firewall Manager administrator account
- Sign in to the AWS Management Console using an existing AWS Organizations management account. You can sign in using the account's root user (not recommended) or another IAM user or IAM role within the account that has equivalent permissions.
- Open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2
.
Choose Get started.
Type the ID of the account that you've chosen to use as the Firewall Manager administrator.
Note
This account is given permission to create and manage Firewall Manager policies across all accounts within your organization.
Choose Set administrator.
Step 3: Enable AWS Config
To use Firewall Manager, you must enable AWS Config.
Note
To enable AWS Config for Firewall Manager
- Enable AWS Config for each of your AWS Organizations member accounts, including the Firewall Manager administrator account. For more information, see Getting Started with AWS Config.
- Enable AWS Config for each AWS Region that contains the resources that you want to protect. You can enable AWS Config manually, or you can use the AWS CloudFormation template "Enable AWS Config" at AWS CloudFormation StackSets Sample Templates.
- If you don't want to enable AWS Config for all resources, then you must enable the following according to the type of Firewall Manager policies that you use:
- WAF policy – Enable Config for the resource types CloudFront Distribution, Application Load Balancer (choose ElasticLoadBalancingV2 from the list), API Gateway, WAF WebACL, WAF Regional WebACL, and WAFv2 WebACL. To enable AWS Config to protect a CloudFront distribution, you must be in the US East (N. Virginia) Region. Other Regions don't have CloudFront as an option.
- Shield policy – Enable Config for the resource types Shield Protection, ShieldRegional Protection, Application Load Balancer, EC2 EIP, WAF WebACL, WAF Regional WebACL, and WAFv2 WebACL.
- Security group policy – Enable Config for the resource types EC2 SecurityGroup, EC2 Instance, and EC2 NetworkInterface.
- Network Firewall policy – Enable Config for the resource types NetworkFirewall FirewallPolicy, NetworkFirewall RuleGroup, EC2 VPC, EC2 InternetGateway, EC2 RouteTable, and EC2 Subnet.
- DNS Firewall policy – Enable Config for the resource types DNSFirewall RuleGroup and EC2 VPC.
Step 4: For Network Firewall and DNS Firewall policies, enable resource sharing
To manage Firewall Manager Network Firewall and DNS Firewall policies, you must enable sharing with AWS Organizations in AWS Resource Access Manager. This allows Firewall Manager to deploy protections across your accounts when you create these policy types.
To enable sharing with AWS Organizations in AWS Resource Access Manager
Step 5: To use AWS Firewall Manager in Regions that are disabled by default
To use Firewall Manager in a Region that's disabled by default, you must enable the Region for both the management account of your AWS organization and the Firewall Manager administrator account.
For information about Regions that are disabled by default and how to enable them, see Managing AWS Regions in the AWS General Reference. To enable a disabled Region
- For both the Organizations management account and the Firewall Manager administrator account, follow the guidance at Enabling a Region in the AWS General Reference.
Managing the AWS Firewall Manager administrator
You use your Firewall Manager administrator account to manage your Firewall Manager policies. When you set the Firewall Manager administrator account, Firewall Manager automatically sets it as the AWS Organizations Delegated Administrator for Firewall Manager. This allows Firewall Manager to access information about the organizational units (OUs) that you use to specify the scope of your Firewall Manager policies. For more information about Organizations and management accounts, see Managing the AWS Accounts in Your Organization. To begin using Firewall Manager, you set up your Firewall Manager administrator account and perform other required steps. To do this, follow the guidance under AWS Firewall Manager prerequisites. This topic provides information and guidance for managing your existing administrator account.
Required settings for the Firewall Manager administrator
The Firewall Manager administrator account must have the following settings:
- It must be a member of the organization in AWS Organizations where you want to apply your Firewall Manager policies.
- It must be designated as the Firewall Manager administrator by the Organizations management account for the organization.
