Centralized Security Rules with AWS Firewall Manager - Rolling Out WAF and Security Groups Across Your Organization
This article explains how to centrally manage WAF rules, Security Groups, and Network Firewall policies across Organizations and maintain an organization-wide security baseline through automatic application to new accounts.
Firewall Manager Overview
AWS Firewall Manager is a security management service that centrally manages firewall rules across Organizations. You can apply WAF rules, Shield Advanced protection, Security Group rules, Network Firewall policies, and Route 53 Resolver DNS Firewall rules to the entire organization at once. When new accounts or resources are added, predefined security policies are applied automatically, so the security baseline is reliably maintained. When you manage WAF rules and Security Groups manually in individual accounts, configuration gaps and inconsistencies tend to occur, but Firewall Manager solves this problem at the organization level.
Designing Security Policies
Firewall Manager security policies are created for each policy type (WAF, Shield, Security Group, Network Firewall, and DNS Firewall). In a WAF policy, you define a combination of managed rule groups (AWS Managed Rules and Marketplace rules) and custom rules, and apply them automatically to CloudFront, ALB, and API Gateway. In a Security Group policy, you define the inbound/outbound rules to allow, and an option is also provided to automatically remediate Security Groups that violate the policy (removing noncompliant rules). In a Network Firewall policy, you define traffic filtering rules for VPCs, and Network Firewall endpoints are automatically deployed to new VPCs. The scope of a policy can be controlled by OU, tag, and account ID, and you can limit application to specific environments (production only, or specific Regions only).
Compliance and Automatic Remediation
You monitor the policy compliance status of each account/resource in real time on the Firewall Manager compliance dashboard. Noncompliant resources can be handled either by automatic remediation (enforcing the rules defined in the policy) or by notification only (alerting administrators). Through integration with Security Hub, you manage Firewall Manager findings together with the findings of other security services. Through coordination with Config rules, you can also include the application status of Firewall Manager policies in compliance reports.
Firewall Manager Pricing
Firewall Manager costs about $100 per policy per month (as of August 2026). Because a single policy can be applied to the entire organization (hundreds of accounts), the more accounts you have, the lower the cost per account becomes. Charges for each service applied by a policy, such as WAF, Shield Advanced, and Network Firewall, are incurred separately. The charge for Firewall Manager itself is fixed, but you need to be aware that the usage-based charges of each service increase with the number of rules you apply and the volume of traffic.
Prerequisites and Steps for Enabling
To use Firewall Manager, you need to put several prerequisites in place. First, you set up an organization in Organizations and designate an administrator account to which Firewall Manager administration is delegated. Because many policy types depend on AWS Config, you enable Config in the target accounts. Consolidating security operations in a dedicated account makes separation of permissions and auditing easier. By creating policies after preparing this foundation, you can reach a state where predefined protection is applied automatically even when new accounts are added to the organization. It is important to settle this design early in the adoption.
Centralized Management of DDoS Protection
Firewall Manager can also apply DDoS protection with Shield Advanced across the organization. You specify the resources that should be protected (CloudFront, ALB, Global Accelerator, Elastic IP, and so on) by conditions, and protection is automatically extended to newly created resources as well. Even if individual teams forget protection settings, the organization's policy can cover them, so you can prevent public endpoints that should be protected from being missed. Being able to grasp important public services centrally and maintain a consistent level of protection is a major advantage for DDoS countermeasures in large-scale environments.
Rolling Out Rule Updates Safely
Policies applied across the entire organization have a wide scope of impact, so you roll them out carefully. When introducing a new rule, it is safe not to enable automatic remediation right away, but to first observe the impact in a mode that only detects violations and sends notifications. You narrow the scope by OU or tag, confirm the behavior in a limited environment, and then expand to the whole organization. You verify step by step whether legitimate traffic is blocked by mistake and whether the rules are consistent with existing Security Groups. Precisely because the settings take effect over a wide range, following a procedure of trying small and confirming leads to preventing incidents.
Division of Roles in Defense in Depth
Each feature managed by Firewall Manager works at a different layer of defense. WAF rejects malicious requests at the application layer, Security Groups control instance-level traffic, Network Firewall filters VPC traffic, and DNS Firewall prevents name resolution to malicious domains. By layering these, you can build defense in depth in which a threat that slips through one layer is stopped at another. Firewall Manager is a mechanism for applying these consistently across the entire organization, and designing with an understanding of each layer's role is the key to a robust security posture.
Summary
AWS Firewall Manager is a service that centrally manages WAF / Security Group / Network Firewall policies across Organizations and maintains the security baseline through automatic application to new accounts/resources. With the compliance dashboard and automatic remediation features, it continuously monitors and improves the security posture of the entire organization.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS Firewall Manager official page
- AWS WAF official page
- AWS Organizations official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.