AWS Firewall Manager
A security management service that centrally applies and manages WAF, Shield Advanced, Security Group, and Network Firewall rules across multiple accounts and resources under Organizations
Overview
AWS Firewall Manager works with AWS Organizations to centrally manage firewall rules across multiple AWS accounts. It defines WAF rules, Shield Advanced protections, VPC security groups, Network Firewall policies, and Route 53 Resolver DNS Firewall rules as security policies, automatically applying them to designated OUs and accounts. When new accounts or resources are added, policies are automatically applied, ensuring consistent security.
Security Policy Types and Scope of Application
Each Firewall Manager security policy is specific to one policy type, and you choose the type based on the resource type being protected. WAF policies bulk-apply WAF rule groups to CloudFront distributions, ALBs, API Gateway, and AppSync. Use them to enforce common WAF rules (SQL injection protection, rate limiting) across all ALBs in all accounts. Shield Advanced policies apply DDoS protection to EC2, ELB, CloudFront, Global Accelerator, and Route 53. Security group policies manage VPC security groups, with the ability to detect and auto-remediate rules that do not comply with the policy. Network Firewall policies auto-deploy Network Firewall to VPCs and apply stateful traffic inspection rules. DNS Firewall policies apply DNS filtering rules to Route 53 Resolver, blocking DNS queries to malicious domains. Each policy's scope can be specified at the Organizations OU level, account level, or resource tag level, with exclusion rules also configurable.
Centralized WAF Rule Management and Auto-Remediation
One typical use of Firewall Manager is centralized WAF rule management. When the security team defines a WAF policy in Firewall Manager, Web ACLs are automatically created and associated with target resources in target accounts. Policies specify "first rule groups" and "last rule groups," and each account's administrators can add account-specific rules in between. This enforces an organization-wide security baseline (OWASP Top 10 protection, bot mitigation, rate limiting) while leaving room for per-account customization. With auto-remediation enabled, non-compliant resources (such as ALBs without WAF associations) are automatically remediated. When new ALBs are created, Firewall Manager detects them and automatically associates WAF. The compliance dashboard provides an at-a-glance view of policy compliance status across all accounts.
Prerequisites and Cost Structure
The main preparation steps before first using Firewall Manager are as follows, and some policy types and Regions require additional steps. First, AWS Organizations must be enabled with all features activated. Second, a Firewall Manager default administrator account must be created from the organization's management account. Third, AWS Config must be enabled in target accounts (required for Firewall Manager to evaluate resource compliance). Pricing consists of a monthly fee per protection policy per Region, plus charges for resources that Firewall Manager creates (WAF Web ACLs, Network Firewall endpoints, etc.) and for AWS Config rules; see the official AWS pricing page for rates (as of October 2026).
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS WAF official page
- AWS Network Firewall official page
- AWS Organizations official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.