AWS Firewall Manager
Centralized firewall management
Centrally applies and monitors WAF, Shield Advanced, security group, Network Firewall and DNS Firewall rules for every account in AWS Organizations; new accounts/resources get policies applied automatically.
- Cost$$ Medium
- Difficulty●●●●●
- Costs money when idle?Yes
- Managed by AWS
- In examsSAA · SOA
Think of it asLike a head security office that sets common rules, and every newly opened branch automatically follows them.
When to use it
✓ Use it when
Many accounts need the same set of network security rules.
✗ Avoid it when
Only one account and a few rules → configure WAF / security groups directly.
Common uses
- Applying common WAF rules to every ALB in the organization
- Checking for security groups open to 0.0.0.0/0
- Deploying Network Firewall for new VPCs
What does it cost?
- Pricing model: Monthly fee per policy per Region, plus the costs of the underlying WAF/Config/Network Firewall.
⚠️ Cost traps
Requires AWS Config to be enabled in every account, which adds Config charges.
Related services
SAA-C03 study guide
Firewall Manager is covered in these study modules: