Firewall Manager
AWS Firewall Manager applies one security policy to matching resources across every account in an organization, and keeps applying it as new resources appear. The platform uses it to put a baseline web application firewall in front of every load balancer in the plat-* accounts.
What it does
Firewall Manager is an orchestration layer, not a firewall. An administrator account defines a policy: a resource type to match, a set of accounts to include, and a security service configuration such as an AWS WAF web ACL, a Shield Advanced protection or a set of security-group rules. Firewall Manager then creates the underlying resources in each target account and attaches them. With auto-remediation on, a load balancer created next month by a team that never heard of WAF gets the web ACL within minutes. The service requires a delegated administrator account and trusted access in AWS Organizations.
How BuiltForProd uses it
Two prerequisites are set by modules/organizations in core-root: fms.amazonaws.com is enabled as a trusted service, and core-security is registered as the Firewall Manager administrator (aws_fms_admin_account).
The aws-fms-waf unit (module modules/firewall-manager, listed by the core/security/us-west-2 stack file) then creates one policy, acme-alb-waf-baseline:
- Resource type
AWS::ElasticLoadBalancingV2::LoadBalancer, so it targets application load balancers. - Include map: the four
plat-*account ids read from the Organizations outputs. remediation_enabled = true: non-compliant load balancers are attached automatically.- A WAFv2 configuration with four AWS managed rule groups and a default action of allow (see WAF for the rule groups).
- Sampled requests on, so blocked requests can be inspected.
Firewall Manager creates and owns the web ACLs inside each target account; the platform does not define a standalone web ACL anywhere. That is the point: the web application blueprint's AWS Load Balancer Controller creates an internet-facing ALB for the API from a Kubernetes Ingress, and the WAF arrives without the application team adding anything. The overrideCustomerWebACLAssociation setting is off, so a team that deliberately associates its own web ACL is not overridden.
Scope is limited on purpose. The policy targets load balancers only; the design decisions note that CloudFront distributions are not yet in the Firewall Manager policy scope. Shield Advanced, which Firewall Manager can also orchestrate, is managed by its own unit and is off by default.
Terms you will see
| Term | Meaning |
|---|---|
| Policy | The Firewall Manager rule: what to match, where, and what to apply. |
| Administrator account | The account that defines policies; core-security. |
| Include map | The set of accounts or OUs a policy applies to. |
| Auto-remediation | Automatic attachment of the security configuration to non-compliant resources. |
| Web ACL | The AWS WAF access control list that Firewall Manager creates in each account. |
| Managed rule group | A rule set maintained by AWS, referenced by name in the policy. |
| Compliance status | Per-account view of which matched resources have the policy applied. |
Where to read more
- AWS Baseline overview for the perimeter controls as a set.
- WAF for what the attached web ACL inspects.
- Elastic Load Balancing for the load balancers the policy targets.