AWS Firewall Manager
Central control plane that pushes firewall and DDoS protections across every account in your organization.
Verified against AWS documentation · 2026-09-09
Key facts
- 01Not a firewall itself — it deploys and enforces WAF, Shield Advanced, Network Firewall, DNS Firewall, security groups and NACLs
- 02Prerequisites: AWS Organizations with all features, a designated Firewall Manager admin account, AWS Config on in every account
- 03Policies auto-apply to new accounts and new resources in scope — scope by account, OU, resource type, or tag
- 04Policies are per-Region (CloudFront uses Global); audit mode reports violations, remediation mode fixes them automatically
Exam triggers
Phrases and scenarios that point here.
- "Centrally", "across all accounts", "organization-wide" + firewall or DDoS → Firewall Manager
- Protection must apply automatically to accounts and resources created in the future
- Find and fix security groups left open to 0.0.0.0/0 across the whole org
- Turn on Shield Advanced for every account in the organization in one action
Not this service
- Writing rules for one app in one account → AWS WAF, Shield, or Network Firewall directly
- Org-wide compliance across all resource types, not just firewalls → AWS Config + Security Hub
Use cases
- 01A security team with 40 accounts wants every internet-facing ALB behind the same managed rule baseline — without asking 40 app teams to do it
- 02New accounts get spun up weekly by different teams; the WAF and DNS Firewall policies land the moment an account joins the OU
- 03Auditing every security group for SSH open to the internet in report-only mode first, then flipping the same policy to auto-remediate
- 04Rolling Shield Advanced across all production accounts ahead of a launch, instead of subscribing resources one at a time
- 05Letting app teams add their own WAF rules in the middle of a web ACL while the security team's rules stay pinned first and last
How it's charged
- 01Billed per protection policy, per Region, per month — the fee is flat no matter how many accounts the policy covers
- 02You still pay full price for whatever it deploys: WAF web ACLs and rules, Network Firewall endpoints, Shield Advanced, DNS Firewall rule groups
- 03AWS Config charges apply on top, because Firewall Manager creates Config rules to detect non-compliant resources
- 04Shield Advanced customers get Firewall Manager protection policies at no additional charge — Config charges still apply
- 05Cost scales with policies × Regions, not with traffic, so five Regions means five times the policy fee
