AWS Firewall Manager · Organization-wide security policies · Compliance
AWS Firewall Manager is a management service that centrally deploys AWS WAF, Shield Advanced, security group, network ACL, Network Firewall, and DNS Firewall policies across the accounts and resources in AWS Organizations. New accounts and resources are protected automatically as soon as they fall within a policy's scope.
Root · management account → FMS default administrator: security account
The same policy produces different results depending on scope and whether auto remediation is on. Violations are also sent to Security Hub CSPM as findings.
Policy types (WAF · Shield · SG · NACL · NFW · DNS FW · 2 third-party)
Max administrator accounts per organization (including the default admin)
Scope conditions (accounts · OUs, resource type, tags)
Enforcement modes (auto remediation · report only)
Why Firewall Manager
Managing web ACLs, security groups, and firewall rules separately in each account leads to gaps and exceptions. With Firewall Manager, the security team defines the baseline as policies, and application teams add their own rules on top.
A policy created in the administrator account deploys the same protection to every account and resource in scope. When you change the policy, the change propagates too.
When an account joins the organization or a matching resource is created, Firewall Manager evaluates it and applies the policy right away.
A per-policy compliance dashboard shows noncompliant accounts and resources and the reasons. You can also start in report-only mode without auto remediation.
Prerequisites
Firewall Manager is an organization-level service. Complete the steps below in order before you can create policies in the console.
Managed accounts must belong to one organization, and all features must be enabled, not just consolidated billing.
The management account onboards the organization to Firewall Manager and designates the default administrator. The default administrator has full scope and also manages third-party firewall policies. A dedicated security account is typical.
Turn on AWS Config in every member account and Region that has resources to protect. Firewall Manager uses Config to detect resource changes and evaluate compliance.
Network Firewall and DNS Firewall policies require AWS RAM resource sharing with your organization, and third-party firewall policies require an AWS Marketplace subscription and integration setup. Regions that are disabled by default must be enabled separately.
Administrators
Besides the default administrator, the management account can create additional administrator accounts (up to 10 per organization). Give each administrator a full or restricted administrative scope; a restricted scope combines the conditions below.
Specifies the accounts or OUs the administrator can apply policies to. Use it to let each business unit's security team manage only its own OU.
OU = ProdAccount IDsRestricts the Regions the administrator can work in. A good fit when operations teams are split by geography.
us-east-2ap-northeast-2Split responsibilities so the network team handles only Network Firewall and security group policies, and the web security team handles only AWS WAF policies.
Security groupAWS WAFNetwork FirewallOnly the organization's management account can create, modify, or remove administrator accounts. Following least privilege, grant only the scope that is actually needed.
Policy types
Each Firewall Manager policy covers a single type. To enforce multiple protections, create a policy per type; you can also have several policies of the same type. Policies are Regional, and policies that target CloudFront are created as global.
L7 · Web
Associates a Firewall Manager–managed web ACL with resources in scope. The policy's first rule groups are pinned at the start and its last rule groups at the end, and account owners add their own rules in between. With the retrofit option, policy rules are added to web ACLs that are already associated.
CloudFrontALBAPI Gateway RESTfirst · last rule groupsDDoS
Applies Shield Advanced protection to the specified resource types across the organization. It subscribes in-scope accounts to Shield Advanced, including accounts that join later. L7 automatic mitigation settings are managed by the policy as well.
CloudFrontALB · CLBElastic IPVPC · Security group
Common replicates a baseline security group and associates it with resources in scope. Content audit checks whether security group rules meet allow and deny criteria. Usage audit finds and cleans up unused or redundant security groups.
EC2 instanceENIALB · CLBSecurity groupVPC · Subnet
Enforces first and last rules on subnet network ACLs. Firewall Manager assigns the rule numbers, and the account's existing rules stay in between. You choose separately for first and last rules whether to force remediation when they conflict with existing rules.
SubnetFirstEntriesLastEntriesL3–L7 · VPC
Creates AWS Network Firewall firewalls in VPCs in scope and deploys the policy's rule groups. Choose a deployment model: distributed, centralized, or import existing firewalls. Auto remediation is always on for this type.
DistributedCentralizedImport existingDNS
Associates DNS Firewall rule groups with the organization's VPCs to block queries for malicious domains. First rule groups (priority 1–100) are evaluated before rule groups the account associates itself (101–9900), and last rule groups (9901–10000) are evaluated after them.
VPCDomain listRAM sharingThird-party
Deploys partner firewalls subscribed through AWS Marketplace into VPCs. Palo Alto Networks Cloud NGFW policies apply Cloud NGFW and rulestacks, and Fortigate CNF policies apply Fortigate Cloud Native Firewall as a Service protection. Managed by the default administrator account.
Palo Alto Cloud NGFWFortigate CNFAWS MarketplaceFeatures
Policy scope
Apply to the whole organization, only to specified accounts and OUs, or to everything except specified accounts and OUs. Choose resource types, then include or exclude resources by whether they have all of the tags (AND) or any of them (OR). You can also group resources directly with a resource set.
Remediation
Choose whether to fix noncompliant resources automatically or just report them without changes. Options also let you remove protection from resources that leave scope and clean up resources Firewall Manager created.
Compliance
Each policy shows how many accounts are in scope and how many are compliant, and you can drill down from noncompliant account → resource → violation reason. Get real-time notifications of new violations through an Amazon SNS channel.
Security Hub
Sends noncompliant resources and detected attacks to Security Hub CSPM as findings. The integration is enabled automatically when you use Firewall Manager, so you can prioritize them alongside results from other security services.
Managed lists
Define the ports and protocols to allow or deny in security group policies as managed lists and reuse them. Use AWS-provided lists together with your own.
Logging
When you enable logging in an AWS WAF policy, web ACL logs from every account in scope are collected into Amazon Data Firehose or S3 in a single account. Sensitive fields are redacted by the policy.
Recent updates: AWS WAF L7 Anti-DDoS managed rule group can be added to policies (June 2025), Firewall Manager API calls through AWS PrivateLink interface endpoints (July 2025), and launches in the Asia Pacific (Taipei) Region (September 2025) and Asia Pacific (New Zealand) Region (March 2026). With retrofit existing web ACLs in AWS WAF policies, you can keep the web ACLs application teams created and just add the policy rules.
Policy comparison
Auto remediation behavior differs by type. For policies that delete or change resources, such as security group audit policies, check the impact in report-only mode first.
| Policy type | Enforces | Auto remediation behavior |
|---|---|---|
| AWS WAF | First and last rule groups, default action, and logging settings of the web ACL | Creates a managed web ACL and associates it with resources in scope. With retrofit, adds rules to the existing web ACL |
| Shield Advanced | Shield Advanced protection per resource, L7 automatic mitigation | Subscribes in-scope accounts and adds resource protection |
| Security group · Common | Association of the baseline (primary) security group | Replicates the baseline security group into accounts and associates it with resources. Optionally disassociates other security groups |
| Security group · Content audit | Whether security group rules meet allow and deny criteria | Removes rules that violate the criteria |
| Security group · Usage audit | Unused and redundant security groups | Deletes unused groups and replaces redundant groups with one |
| Network ACL | First and last rules of subnet NACLs | Applies rules to the managed NACL. On conflict with existing rules, remediates or marks noncompliant based on the force remediation setting |
| Network Firewall | Firewall presence in the VPC, plus firewall policy and rule groups | Always automatic. Creates firewalls and endpoints and shares rule groups. Routing is monitored only, reporting violations |
| DNS Firewall | DNS Firewall rule group associations on the VPC | Shares first and last rule groups through RAM and associates them with VPCs |
| Third-party firewall | Palo Alto Cloud NGFW · Fortigate CNF protection | Deploys partner firewall endpoints and policies (such as rulestacks) into VPCs |
Network Firewall via FMS
A Network Firewall policy's firewall management type determines where firewalls are created. Create the rule groups in the administrator account in advance and deploy them to member accounts through AWS RAM organization sharing.
Creates a firewall in each VPC of in-scope accounts, with endpoints in a firewall subnet per AZ. Routing is set to Monitor mode, which only reports violations, or Off.
Creates a single firewall in one inspection VPC in a specified account. Suits designs that aggregate spoke VPC traffic through Transit Gateway for inspection; you configure routing yourself.
Brings firewalls you already run under a single policy and adds organization baseline rules to standardize them.
Rule evaluation order: the policy selects strict order or action order for stateful rules. The Firewall Manager API documents that StatefulEngineOptions.RuleOrder defaults to DEFAULT_ACTION_ORDER when omitted, so set it explicitly if you want strict order, the Network Firewall console default.
Reference architecture
The management account designates the security account as the Firewall Manager administrator. The administrator creates policies and deploys them per OU; when AWS Config in each member account detects a change, Firewall Manager re-evaluates compliance. Violations are collected in the dashboard and Security Hub CSPM.
On narrow screens, swipe the diagram sideways.
Getting started
Enable all features in Organizations, and designate the security account as the default administrator from the management account.
Enable Config in every account and Region with resources to protect. Enable RAM sharing with your organization if needed.
Choose the policy type and Region (Global for CloudFront), then fill in the contents such as rule groups or the baseline security group.
Set the scope by account · OU, resource type, and tags, and review violations with auto remediation turned off.
After confirming the impact, turn on auto remediation and keep tracking violations with Security Hub CSPM and SNS.
Pricing
Each Firewall Manager policy incurs a monthly charge per Region, plus charges for the AWS Config rules the policy creates and for the underlying services that provide the actual protection. There are no minimum fees or upfront commitments.
| Component | Billed by | Notes |
|---|---|---|
| Protection policy | Monthly fee per policy per Region | Applies to WAF, security group, Network Firewall, DNS Firewall, and third-party policies. Prices vary by Region |
| AWS Config | Configuration items recorded · rule evaluations | Config rules Firewall Manager creates in each account are billed at AWS Config rates |
| AWS WAF | Web ACLs · rules · requests | Web ACLs and rules the policy creates are billed at AWS WAF rates |
| Network Firewall | Endpoint hours · GB processed | Distributed deployments create endpoints in each VPC and AZ, so a wider scope means higher cost |
| DNS Firewall · third-party | Underlying service charges | DNS Firewall rule groups at Route 53 Resolver rates; Palo Alto and Fortinet firewalls at AWS Marketplace rates |
| Shield Advanced customers | Included in subscription | Policy fees for Shield Advanced and AWS WAF policies, plus web ACLs and rules the policies create, are included at no extra cost. AWS Config charges are separate |
Prices and inclusions are subject to change. See the AWS Firewall Manager pricing page for the latest details.
Next step
Bring your OU structure, account count, resource types to protect, and the scope you want to delegate to application teams, and we'll review the policy type layout and a plan to move from report only to auto remediation together. Related services: AWS WAF · Network Firewall · Shield · Route 53 · VPC