AWS Firewall Manager – Managing Firewall Rules!

Tanya Garg

26 May 2022

Protecting your AWS account and the objects within it from web-based assaults is crucial, just like protecting any other Web-based resource.

However, firewall rules may be established in an inconsistent manner across an organization’s AWS services, which is a challenge that some businesses face.

Thankfully, there is a tool that can assist you with this issue. The AWS Firewall Manager is a tool that makes managing firewalls easier for everyone in your company.

What is Firewall Manager?

Firewall Manager is a centralized security management service that allows you to set and administer firewall rules across all of your accounts and applications from a single location.

By imposing a uniform set of security rules on new apps, Firewall Manager makes it simple to bring them into compliance.

Your firewall rules will have to be configured once. They’ll be applicable to all of your accounts and resources by the service.

It includes a variety of protections –

AWS WAF
AWS Shield Advanced
Amazon VPC security groups
AWS Network Firewall
Amazon Route 53 Resolver DNS Firewall

AWS Firewall Manager Prerequisites

AWS Organizations

Your accounts must be AWS Organizations members with all active features.

AWS Firewall Manager Administrator Account

Firewall Manager must be linked to either your AWS organization’s management account or a member account with the necessary rights.

The Firewall Manager administrator account is the account you use to connect to the Firewall Manager.

Enable AWS Config

For each member account in your organization, enable AWS Config.

Features of Firewall Manager

There are many features of AWS Firewall Manager, some of them are here –

Your security administrator can use Firewall Manager to deploy firewall rules for AWS Network Firewall to manage traffic leaving and entering your network across accounts and Amazon VPCs.
Any modifications to the centrally established set of rules will be deployed to your accounts and VPCs automatically.
However, you can deploy protection policies in a hierarchical manner with AWS Firewall Manager.
The firewall manager connects with AWS Organizations, and it will automatically retrieve a list of accounts in your AWS organization so you may group resources across accounts.
This monitors security groups in real-time for extremely liberal policies and assists in improving firewall security.
AWS Firewall Manager is a visual dashboard that allows you to rapidly see which AWS resources are protected, detect non-compliant resources, and take action.
You can enforce regulations on existing or future AWS resources, ensuring that firewall rules will be followed across the organization.
You may group resources within AWS Firewall Manager by Account, Resource Type, and Tag.

Benefits of Firewall Manager

There are certain benefits of using AWS Firewall Manager –

It implements mandatory security policies you establish across existing and newly generated resources automatically. Therefore, As new resources will be created across accounts, the service discovers them.
AWS Firewall Manager integrates with AWS Organizations, allowing you to manage AWS WAF rules, AWS Shield Advanced protection, security groups, AWS Network Firewall rules, and Amazon Route 53 Resolver DNS Firewall rules for your Amazon VPCs across multiple accounts and resources from a single location.
You may create policies, organize rules, and apply them centrally across your whole infrastructure.
You can use your own rules or purchase managed rules from the AWS Marketplace.
However, It enables you to subscribe to AWS Shield Advanced for all AWS organization member accounts.

AWS Firewall Manager configures rules for Resources

Using AWS Firewall Manager, you can configure the below resources –

Roll out AWS WAF rules across Application Load Balancer API Gateways and Amazon CloudFront distributions.
AWS Shield Advanced protects Application Load Balancers, ELB Classic Load Balancers, Elastic IP Addresses, and CloudFront distributions.
For your Amazon EC2, Application Load Balancers (ALBs), and ENI resource types, you can create new Amazon Virtual Private Cloud (VPC) security groups and audit any existing security groups.
AWS Network Firewalls can be deployed across accounts and VPCs in your organization.
Finally, you may associate Amazon Route 53 Resolver DNS Firewall rules across VPCs in your organization.

How to Setup AWS Firewall Manager?

First of all, Complete the prerequisites listed above.
Then build a policy type for Amazon Route 53 Resolver DNS Firewall, AWS WAF, AWS Shield Advanced, VPC security group, AWS Network Firewall, or AWS Network Firewall.
Then, specify the set of rules based on the policy. For example, provide the rule groups (custom or managed) that you want to deploy across accounts in an AWS WAF policy. Similarly, when creating a VPC security group policy, specify the security group you want to be duplicated in each account’s resource. Then specify the rule groups (stateful and stateless) that you want to deploy across VPCs in your accounts in AWS Network Firewall. Specify the collection of rules (rule groups) you want to associate with your VPCs in the Amazon Route 53 Resolver DNS Firewall.
Fourth, define the policy’s scope by selecting the accounts, resource types, and, optionally, as well as resource tags that will be used to implement the policy.
Finally, you can go through the policy and generate it. Then the firewall Manager will apply the rules and protections to all resources across all accounts automatically. When Firewall Manager will be configured, it displays a compliance dashboard that reveals which accounts/resources are non-compliant and which are compliant.

How does it work?

You manage your Firewall Manager policies with your Firewall Manager administrator account.

Firewall Manager sets the Firewall Manager administrator account as the AWS Organizations Delegated Administrator for Firewall Manager when you create it.

This gives the Firewall Manager access to the organizational units (OUs) you use to define the scope of your Firewall Manager policies.

It generates findings for out-of-compliance resources and detects assaults, which it sends to AWS Security Hub.

Pricing

It manages AWS WAF, AWS Shield, Amazon VPC security groups, AWS Network Firewall, Amazon Route 53 Resolver DNS Firewall, as well as Palo Alto Cloud Next-generation firewalls, among others.

Therefore, Protection policies in AWS Firewall Manager will be on a monthly basis per region.

To know further about the pricing, please visit Pricing.

Conclusion

AWS Firewall Manager is a security management solution that primarily focuses on two tasks: enabling Web Application Firewall rules and managing and configuring them, as well as AWS Advanced Shield protection.

In conclusion, It’s easy to create rules in Firewall Manager and they have a big impact. It enables AWS users to apply different rules per account or organizational unit.

However, the Firewall Manager can continuously check compliance with its policies thanks to AWS Config, which saves administrative costs.